Thirty commits since 2.2.0. The lead is DeepSeek's vision model and the
per-turn cost of a long session; the warning at the top is the one thing a
Windows user has to act on, because the fix for it cannot fix the build
they are upgrading from.
DeepSeek shipped deepseek-v4-flash-vision-exp. Three places said the host
was text-only — config's CanConfigureVision, and a defence-in-depth guard
at each of the two provider boundaries — and all three said it about the
endpoint. One endpoint now serves both kinds, so the veto is per model.
Measured against the live API rather than inferred from the docs, which
say less than the endpoint does:
openai surface, image 200, "the image is entirely a solid red"
anthropic surface, image 200, so the default install's wire works
tools 200, so it can be a main model
reasoning_effort low..max 200, reasoning_content throughout
detail=original 200
deepseek-v4-flash, image 400 "This model does not support image"
That last line is why this is per model and not a lifted guard. The ladder
is flash's, because the endpoint answers this model exactly as it answers
flash — same vocabulary, same rejections. The docs never said so; a probe
did, and the entry is dated. detail=original now reaches DeepSeek and is
still dropped for OpenAI, which has no such variant.
An installed user's model list is frozen in their config, so none of that
would have reached anyone. ensureProviderModels returns on a curated list,
which every existing install has. The catalog backfill takes the bound the
Kimi migration takes — touch the entry still carrying exactly what we
shipped — and it ticks vision, because the one model here that reads images
is worse listed and unticked than absent. CanUpgradeDeepSeekProviderProtocol
allow-lists what it shipped, so the third model had to join that list or the
backfill would have stranded exactly the installs it reached.
The panel answered vision per connection while the truth is per model, which
would have greyed the toggle on the one row that works: providerView carries
visionSettable now and the editor reads it per row. The editor also reports
what the probe already knows and the stored list does not — models the
endpoint serves that this connection never listed — so the next vendor
addition is not another code change.
The attachment notice claimed a delegated read unconditionally. With no
vision role set the picture is dropped before the request, and a user told
otherwise goes on to ask what it showed; it now names a model that could
read it, or says plainly that nothing can.
Not done: agent.vision_model stays unset. Pointing it somewhere is spending
someone's money on an experimental model they did not choose, and the roles
panel already asks for the assignment.
internal/config/deepseek_catalog.go takes DeepSeek's official catalog out of
config.go and load.go, both far past the ceiling; the tree ends 46 lines of
file-size debt lighter than it started.
modelVisibleMessages runs every turn and returns the projection plus the
handful of messages appended since it was built — four, on the fixture the
scaling benchmark uses. It got there by copying the whole canonical slice:
/100 21.9µs 76,885 B/op
/20000 2318.1µs 14,085,232 B/op
Perfectly linear in history the model never sees, which is the one thing
folding exists to stop paying for. scaling_bench_test.go already said so —
"the number that has to stay flat" — but a Benchmark asserts nothing, so
the contract was written down and unenforced.
The validity judgement never needed the slice. It needs how long the
transcript is and the hash of the prefix the projection claims, and that
hash was already memoised on (rewriteVersion, n) — someone fixed that half
and stopped. projectionCoversTail is that judgement over scalars, and both
paths make it: the full scan hands it a fresh hash, the turn path hands it
the memo's. Two answers to one question is a bug waiting for the state
where they disagree, so there is still only one.
/100 0.99µs 3,851 B/op
/20000 0.45µs 3,848 B/op
Flat, and 3660× less garbage per turn on a long session. PreparedRequestSize
falls with it, 2334.9µs to 3.3µs, because assembling a prompt was mostly
this. A fold or a rewrite moves the memo; that one turn pays the full pass
and refills it.
Guardian asked ContextMaintenanceSnapshot twice a review for one uint64,
and that snapshot copies the transcript and estimates tokens over it twice
to report what the fold saved. It reads ProjectionVersion now. The snapshot
itself keeps its full scan: CanonicalTokens is the unfolded size, so there
it is the answer, not overhead.
Provider-visible bytes are unchanged, so the prompt cache is untouched:
TestFastPathNeverDisagreesWithFullScan enumerates the states — appended,
rewritten, another model's lineage, hashless sidecar, covered count past
the end — and fails if the turn path ever answers differently from the
scan, or answers at all where it should decline.
TestTurnCostDoesNotTrackTranscriptLength fails at the old numbers.
Three panels, one shape of mistake: the element that answers "which one
is it" was the element the layout sacrificed first.
The / and @ menu carried keyboard selection on a 6px dot and a 10.5px
label, while hover got the full-row fill — the weaker semantic drawn with
the stronger signal. A pointer parked over the list therefore lit a
different row than the one Enter would take, and lit it harder. The
selected row now takes an accent fill and the left rail this stylesheet
already uses for a chosen row, and the keys hold the highlight until the
mouse actually moves. Not --accent-wash: it is mixed against --page and
lands darker than --float, so on a dark theme it would read as a hole.
The connection editor listed every model an endpoint reported, one DOM
row each, unsearchable and unordered. A gateway answers with 216 names
differing by a date suffix (#9192), which made the panel 3914px tall with
the enabled model somewhere inside it and the save button four screens
down. One field now filters and — when nothing carries the name — adds it,
because two boxes would be two controls for one intent. Enabled first,
re-ordered only when the list changes, and the row cap says what it left
out. The same component serves the add-a-source flow, which had the same
list behind chips.
The MCP row in the metrics rail put the endpoint's own error sentence into
.job .rt, a flex:none slot meant for a duration. The only shrinkable thing
beside it was the server name, so the name went to 0px and the rail gained
451px of horizontal overflow that pushed every other block out of line. It
reads like the settings page's .srv now — name on one line, reason clamped
to two below it, failure marked with the same left err bar — and it no
longer borrows a <button> into styles written for a <div>, which is where
the native outset border came from.
perf/pick.mjs, perf/models.mjs and perf/side.mjs measure all three against
the real app; each fails against the code it replaces. The fixture gained
a gateway-scale catalogue and a real-length MCP error, because neither
defect is reachable at the sizes it held before.
isCorruptionError read SQLITE_CORRUPT and SQLITE_NOTADB off the result code and
then searched the message for four phrases. Three of them — malformed, file is
not a database, not a database — are what those codes already say. The fourth
was this package's own sentence: PRAGMA integrity_check answers with a string
rather than an error, so that verdict cannot arrive as a code and was being
recognised by the words the open path had just written.
ErrIntegrityCheckFailed carries it now. The test that covered this built the
error from a string, which meant it was testing the sniffing rather than the
path; it builds it the way the open path does. Two more assert that the dropped
phrases are covered by the result codes and that a message merely quoting the
words is not the check having failed.
Both places searched the message for "context canceled" to tell the user
stopping from something breaking. A wrapped error still contains those words
until someone rewords a layer, and Go already answers the question:
errors.Is(err, context.Canceled). The identity survives the trip because
TurnDone carries the error itself rather than its text, which the render test
now depends on.
It also could not tell a stop from a timeout — DeadlineExceeded does not carry
those words and was reported, while a differently phrased cancellation was
swallowed. turnFailureWorthShowing says which is which and is tested on both.
That judgement moved out of chat_tui.go, which was one line under its size
budget and would have gone over for an import. Extracting it left the file
smaller than before and gave the decision a name.
CompactionDeclineReason cut the reason back out of the error at the sentinel's
own wording, so rewording errCheckpointRejected would have returned the whole
error where a reason was expected. The reason travels on the error now, and the
test proves it by renaming the sentinel and still getting the reason back.
isCardLimitError searched the message for 11310 and 11325 while
isReplyFallbackError, in the same file, already read feishuAPIError.code
through errors.As. Reading them structurally would have silently disabled the
card fallback: the typed error was only built on the reply path, and the send
path returned a formatted string, so errors.As would have found nothing and the
oversized-card retry would have stopped happening with no error and no test to
notice. The send path now returns the same type — its rendering is unchanged,
"feishu send error: ..." either way — and the codes are read off the field.
That path had no tests. It has two, one of them pinning that a send error is
not mistaken for a recalled reply now that both carry the same type and only op
separates them.
The last twenty-seven sites take existing codes where one fits — missingField,
badBody, the editing_disabled family, session.bad_path — and eight new ones
where nothing did. One hundred and seventy-two http.Error calls have become
about thirty-five codes, all of them with wording the panel can say.
writeErr keeps the one plain-text path, because it is what lets code below the
boundary adopt a Reason without a flag day. Its file is exempt by path rather
than by name: failure.go, fail_extra.go and sub/fail.go are all still flagged,
so the exemption stays one adapter and does not become a habit.
refusal-path is baselined at zero. A new http.Error in internal/serve now fails
CI with nothing to carry it, which is what the rule was added for.
The auth and boundary transport refusals, the plugin and theme lookups, the two
storage gates and the wallpaper upload reach the panel as codes. Where a family
already had a convention it was followed rather than replaced:
provider.editing_disabled has four call sites and wording, so permissions,
sandbox, roles and storage take the same shape instead of a generic
editing.disabled that would leave two ways to say one thing.
notFound answers 404, and this batch folded an unknown role and an unresolvable
model reference into it — a 400 in both cases, caught by roles_test. That is
the second time the same helper took a 400 with it, so its doc now says which
failure it is for and names both accidents. A name that is invalid in this
request is not a thing that is missing.
themes.go took notFound(w, "asset", name) in a function with no name in scope;
the compiler refused it. Every batch in this migration has had a substitution
that read correctly and meant something else.
Three "must be one of" refusals become request.bad_value carrying the allowed
set, because naming a field and not what it accepts is a refusal a reader
cannot act on. Two turn-in-flight conflicts become busy.session_running.
The five session-path checks stay five codes. A bad name, sessions being off, a
path that will not resolve, a path outside the directory and the session that
is currently open are a 400, a 400, a 400, a 403 and a 409 — folding them onto
one code is the mistake the last batch already made once, where "unknown
project" became a 404 and the suite said otherwise. session.disabled is reused
rather than reinvented: the frontend already says it, and a second code for the
same refusal is a vocabulary growing duplicate branches.
http.Error(w, err.Error(), status) discarded whatever the error knew and wrote
the caller's status. writeErr renders a coded error as its Reason and falls
back to the old shape for everything else, so the same forty-five sites now
carry a code the moment the code below them grows one — and four session
conflicts collapse onto busy.session_in_use.
It was not the no-op substitution it looked like. providerEntryFrom builds
refusal(422, "provider.name_invalid", ...) and four siblings: the producer had
chosen both a code and a status, and the handler was throwing both away and
writing 400. Honouring one and discarding the other is half a migration, so
POST /providers now answers 422 for those five. The panel is unaffected — it
branches on the code — but it is a wire change.
TestSaveProviderRejectsWhatItCannotStore asserted the status. It now asserts
the code, which is what a client actually branches on and what the migration
exists to deliver; pinning the status pinned the thing that should be free to
be corrected.
The 172 http.Error calls were not 172 distinct failures. "bad body" appeared
ten times, "invalid body" six, "bad request" eight — one kind of failure
phrased twelve ways, none of them translatable, and each one reaching the panel
as a path and a status. Fifty-seven sites collapse onto request.bad_body,
request.missing_field, request.not_found and project.unknown, and four decode
helpers that each wrote their own sentence now share one.
project.unknown is separate because the tests said so. Folding the catalog's
"unknown project" into notFound turned a 400 into a 404, and
TestCapabilitySwitchRefusesAnUnknownProject caught it: a project that is not
open in this window is a request that cannot be served, not a thing that is
missing. A bulk substitution does not read semantics; the suite does.
Moving the codes into constants made the parity check blind to all four — it
read string literals at the call site and nothing else, so a vocabulary that
went into constants left the catalogue unchecked and the test went on passing.
It now resolves a code named by a package constant, and reports the three that
had no wording the moment it could see them.
"Never widen the baseline to land a change" was documented and unenforced, and
-update never told tightening from loosening: it rewrote the file from the tree
and both directions passed silently. Lowering a budget is the ratchet working;
raising one carries debt forward and is the diff a reviewer has to be shown on
purpose. -update now refuses to raise one without -allow-widen, and names the
file, the rule and the numbers rather than reporting that the baseline grew.
The other half is that budgets only came down when someone ran -update, and
people run it when they are adding debt — so the ratchet tightened and loosened
in the same commits and never in between. Today's update dropped file-size by
1447 units and function-size by 855: that was room a file could have grown back
into with CI green. A clean run now reports the surplus so it can be reclaimed.
The first attempt at this ate the report(over) call that prints the offending
lines, leaving a failure that named a budget and no code. Caught by ineffassign
on the now-unused variable.
Boot brings appearance, themes and repair across on an ordinary install, but a
run whose roots come from the environment refuses to — it asked for its own
copies, and moving the production install into it is the bug that rule exists
to stop. Those users were left with a wallpaper that is simply gone and no way
to know why.
The panel now names the directories and where they still are. The historical
list moves next to StateRootEntries: what the root owns and what it failed to
own are two facts about one table and belong in one place, and the recovery and
the notice now read the same one.
The i18n parity check caught the two new strings with no English, which is the
gate working on its author.
Adding appearance, themes and repair to the state root's owned entries only
fixes the next move. An install already relocated has them sitting in the
previous root, so the wallpaper stays missing and the update rollback backups
stay unreachable until someone moves them by hand.
Boot now brings those three across, under the rule the legacy importers already
follow: a run that redirected its roots by environment asked for its own copies
and does not get the production install moved into it. Relocation is a config
table and is the user's standing choice, so that is the case this serves.
Nothing else is touched — sessions and the rest were always owned, and copying
them across would resurrect history deleted since. An entry the new root
already has is left alone for the same reason.
The first version of the central test set the roots by environment, which is
exactly what the guard refuses, so it skipped and proved nothing. It now
relocates through a written [storage] table, the way an install does.
The state root lists what it owns because on a default Windows install it
shares a folder with home, so a move must take its own entries and nothing
else. Three directories written under it were never added to that list:
appearance, themes and repair. A relocation moved sessions, archive, stats and
projects and left the rest behind — and since relocation lands on the next
launch, that is a wallpaper and a theme pack the config still names and the
files gone, which is what a user reported as the wallpaper not persisting.
The repair entry is the one that matters most: those are the backups an update
rolls back to.
The list is hand-kept and the next directory would go missing the same way, so
a test now walks the tree for filepath.Join on the state root and fails on a
name the list does not carry. Removing appearance from the list fails it by
name, at the file that writes there.
REASONIX.md banned reading wording but never required carrying identity, so the
producer side was left to discipline and the same defect landed seven times in
one week: a build step that swallowed its diagnostics, an elevation failure
readable only as a raw errno, a stream stall classified by the word "stalled",
a launch phase read off a message prefix, a cross-volume move matched against
English Windows text, a plugin migration gated on a phrase, and a client that
discarded what the server explained. The rule now states both halves.
refusal-path fails a new http.Error in internal/serve. error-text fails a new
match against an error's rendered text, following it one hop into a local:
the direct form is already extinct in this tree and the 21 surviving sites all
store the text first, so a rule that only caught the direct form would have
reported clean forever.
Both are pass/fail and weigh one. The first draft of refusal-path did not set
Weight, counted 207 violations at zero and reported clean — a gate that looks
like it runs and stops nothing, which is the defect it was written to catch.
The baseline records the 207 and the 21 as debt so new ones fail. It also
tightens five existing ceilings and drops entries for files that no longer
offend: the tree had improved since the last snapshot and -update recorded
what is actually there.
kernel.ts exports `codes` "for the parity check" and nothing imported it, so a
code added on one side and not the other degraded silently to English. The
check reads the codes from the syntax rather than by scanning for them: a regex
looking for codes would be the same defect the coded refusal exists to end, and
the first one I wrote reported codes that do not exist.
It found three on its first run, all in the panel a user had just reported a
failure from: bad_context_window, bad_reasoning_protocol and extra_body_null
carried a code with no wording, so a Chinese reader got the English.
The transport parsed every error body as JSON and, when that failed, threw the
body away and reported "<path>: <status>". Only refuse() sends JSON; the other
172 failure sites in serve use http.Error, which writes the reason as plain
text — so the panel showed "/providers/edit: 500" while the server had said
exactly what went wrong. Its own comment already promised the fallback it never
made: "only when it does not do we fall back to text".
Reading the body once as text and parsing that fixes every endpoint at once,
including the ones the migration to coded refusals has not reached.
The prefix is 5.25k tokens, 4.36k of it tool schemas, and the one per-project
string in it was the workspace path — which sat 23% in, so everything behind it
missed the provider's cache on any project the machine had not already warmed.
Measured against DeepSeek: a directory that had never run reached 256 of 5254
cached tokens. With the path riding the per-turn block instead, the same first
request reaches 5120 of 5262. Over the three-task e2e suite, cache hit goes 76%
to 98% and cost 0.0027 to 0.0008 USD at an unchanged 3/3 pass.
It travels the way role settings already do, in a transient user block that
previews, titles and the rewind picker strip; the tag joins the one list they
are all generated from. The path is filesystem text placed in a turn, so it
stays quoted and the escaping test moved with it.
The goldens are regenerated: system_prompt.txt loses the line and nothing else,
ToolsHash is unchanged. TestEffectPrefixCarriesNoProjectText now asserts what
the goldens cannot — that two projects produce the same prefix — and
TestEffectTurnCarriesThisProjectsWorkspace keeps the guarantee the old
system-prompt assertion was protecting, at the provider boundary.
Cache-impact: high - the prefix is now project-independent; this is the change.
Cache-guard: TestEffectPrefixCarriesNoProjectText plus the regenerated goldens.
Whether a managed plugin's manifest is rewritten on disk was decided by
searching ParseDir's error for "missing apiVersion". That error can be any
parse failure, and a strict decode names the offending field — so a manifest
carrying a field called "missing apiVersion" was sent down the migration path,
failed there for an unrelated reason, and reported "automatic managed-plugin
migration failed" while the real defect went unmentioned.
ErrMissingAPIVersion carries the same words, so no message changes, but the
three sites that decided on them now ask errors.Is. The test drives the real
LoadInstalled path: with the phrase check restored it fails with the warning
the user would have been given instead of the truth.
ClassifyStreamInterrupt matched phrases. Some were ours — "stalled", "no data
for" — so an idle timeout survived only as long as nobody reworded the message
that described it; one was Windows' "forcibly closed", which is rendered in the
system language and matches on an English install only.
An idle timeout is not in a transport error's identity at all. Only the read
loop that set the deadline knows one happened, which is why anthropic and
responses already attach the reason at the emit site. openai did not, so its
stall reached the classifier as an unexpected EOF and came back correctly only
because "stalled" was checked first. Both of its cuts now say what they are,
streamFailure stops relabelling an error that already carries a reason, and the
classifier reads errors.Is alone.
The classifier had no tests. The one that matters most reverts the openai emit
site and watches the reason fall to premature_eof, which is what a reworded
message would have done silently.
readStream is over the function-size budget, so the two cuts are named in
stream_failure.go — the file whose subject is how a body-phase failure is
classified — rather than inlined at their returns.
The button fired ToggleMaximiseWindow without awaiting it and then asked
IsWindowMaximised in the same breath. Two separate bindings racing, and on
Windows the toggle only posts SW_MAXIMIZE to the window for the system to
act on later, so the answer was reliably the state from before the click.
The glyph sat one step behind the window, which reads as the two icons
being swapped.
Awaiting the toggle would not have fixed it — the binding returning is not
the system finishing — and it would have left the other half untouched: a
double-click on the bar, a snap and the keyboard all change the state, and
none of them ran this handler at all.
The window owns the state, so the state is read back rather than inferred.
The click only toggles now, and every path that changes the window reaches
the glyph through the same observer. That observer is the one the layout
already rides on: viewport.ts watches document.body this way, which is the
evidence it fires in this shell.
bash classified a launch failure as the session-temp step by looking for
"session temporary" in the message it had just written itself. A sentinel
says the same thing without depending on the wording.
sessiontemp.ErrUnavailable was the obvious candidate and is the wrong one:
Acquire wraps it only for a nil or closed manager, and returns the
filesystem errors from creating the generation bare, so matching on it
would drop exactly the real failures the text was catching. The sentinel
belongs to the caller that knows which step it wrapped.
It lives in its own file because bash and grep both wrap with it and
neither owns it — and bash.go was already at the 800-line ceiling.
isCrossDeviceMove matched four English phrases against the message inside
the LinkError, having already reached the structured error to get there.
Windows renders that message in the system language, so on a non-English
install none of the four match, the fallback that copies across filesystems
never runs, and the move fails outright. The English text happens to carry
"different disk", which is why it went unnoticed.
The code is what the OS actually returns, so the check reads that instead,
split by platform because the constants are not interchangeable: Windows
answers ERROR_NOT_SAME_DEVICE, and syscall.EXDEV is a synthetic value there
that a real rename never produces.
The existing fallback test faked the failure with errors.New("invalid
cross-device link") — it was asserting on the phrase table — and now
carries the platform's own errno. The new test pairs the right code with a
message in another language, which is the case that was broken.
The watermark every transport restates each 15s is how a client notices a
frame lost at the end of a turn: seq ahead of what it holds means it missed
something. But `seen` started at 0, and a live-only subscription replays
nothing before it — Subscribe() is SubscribeFrom(0), which skips the log
entirely — so every fresh attach to a runtime that had already numbered
frames read the first watermark as a loss of the whole backlog. It replayed
the entire log into the reducer, and the transcript followed it to the
bottom about fifteen seconds after the page came up.
0 was carrying two meanings and the comparison only holds for one of them.
seen is now number | null: the first watermark states where this subscriber
attached instead of accusing it of falling behind. The branches below
already required seen to be truthy, so nothing else changes.
Seeding the baseline from the server at subscribe time was the other option
and is worse: an SSE resume pushes replayed frames whose seq is below the
baseline, which the backwards-numbering branch reads as a restarted stream
and answers with a full rebuild.
hdiutil create ran under -quiet, which suppresses its diagnostics along
with its progress, and the script runs under set -e. A failure therefore
killed the build between the "==> hdiutil" line and a bare exit code, with
the fifteen seconds of stderr that named the cause discarded and the
build_dmg check that would have said something never reached. One release
build already failed this way and could only be diagnosed by re-running it.
FetchIndex fell back to a package constant naming the desktop line's
catalog. That URL publishes nothing — the desktop line has no catalog
concept at all — so a caller that forgot to name one did not get another
line's releases, it got a silent 404. Studio always passed its own, so the
default only ever stood ready to mislead.
catalog_test.go existed to guard this hazard and asserted studioCatalog
differed from the constant; with no constant the premise is gone, so it now
asserts the catalog names the studio line. The AST guard over every
update.Options stays: omitting IndexURL is a fetch-time error now, and the
guard is what still catches it at test time.
Line carried each line's identity for Linux (DebLine) and macOS (MacLine)
and said nothing about Windows, so the two lines' opposite expectations
lived only in two unrelated files: the desktop's helper treats a request
for elevation as a failure, while Studio's installer cannot start without
one. Nothing recorded the difference, which is how the Studio path kept a
launch call that can never start the installer it downloads.
WindowsLine declares it, and RunInstaller checks the declaration before it
does anything else: a line that has not said what it ships is refused
rather than given a launch call chosen on its behalf.
Studio installs into $PROGRAMFILES64 and writes HKLM, so its NSIS script
declares RequestExecutionLevel admin. CreateProcess refuses such an image
outright with ERROR_ELEVATION_REQUIRED, which is what exec.Command uses, so
the Windows update path could never start the installer it had just
downloaded and verified. ShellExecute is the call that raises the consent
prompt; what it starts already outlives this process, which is what the
handoff needs.
The failure text also carried the full installer path, which names the
user's account. install_windows.go already keeps local paths out of the
messages it surfaces; this path now does the same, and says plainly when
the prompt was dismissed rather than reporting it as a start failure.
This only takes effect for updates leaving a build that contains it. Every
Windows install at or below 2.2.0 still has to be replaced by hand once.
004557bbf gave a live leaseholder the right to write over a transcript it no
longer recognises, and updated serve's twin to expect one session instead of a
fork. The cli and bot twins still asserted the fork, so they had been red on
every commit since.
Both now assert the contract that replaced it: the path does not move, the
lease stays on the original, no recovery branch appears, and the bytes the
write replaced are kept beside the session. Renamed to say that, since neither
one moves a lease any more. A helper whose only job was to prove the original
lease had been released goes with them — the original is still held.
The stylesheet already said it — "cards, panels, and the composer stay
opaque; a background is worth a window's margins, not its content" — but only
.app was made transparent, and the panels underneath had never had grounds of
their own. They borrowed body's. So the picture went straight through them:
an audit with a high-contrast test wallpaper found 18 kinds of text container
sitting on it, across both rails, the tab strip, and the settings sheet.
Four grounds restored, each the weakest one that keeps the picture in play:
- .rail/.side/.tabs get the ground they were borrowing.
- The transcript takes over as soon as it holds anything: an entry there is a
borderless row, not a card, so the picture reached the prose itself.
- The settings sheet was 86%/60% translucent with no blur, which is the photo
itself pressed against dense body text. Blurred, the layering survives.
- The empty page still shows through — that is the one place it should — with
a radial scrim under the hero so the words hold.
Audited again across the workspace, five settings sections and a menu: zero.
"Too faint to read" comes two ways — pale colour and thin strokes — and only
the first had a knob. Zoom scaled everything including padding, and the
contrast steps moved colour alone, so a Chinese UI at 400/11px stayed thin at
every setting.
Three changes, all measured:
- Weight is now a token (--w-reg/med/semi) that every rule reads, with a
setting beside contrast. Chinese defaults a step heavier: Han strokes are
dense and blur first at the same size. font-synthesis-weight is off, so a
face without that cut falls back instead of being smeared into one.
- The four text colours were re-cut so even the weakest clears 4.5:1 where it
actually sits. --ghost was 3.43:1 on --raised and 4.11:1 at the strongest
step — below AA at every setting, while carrying 10px labels.
- Small-caps labels are Latin typography: mono has no Han glyphs, tracking
splits words apart, and uppercase means nothing. :lang(zh) gives those 16
rules the UI face at 11px without tracking; English keeps its own.
76% of the size declarations sat under 12px, which is the floor for Han on
screen. This lifts the ones that were also fighting the wrong face.
The meter points the child at its proxy by writing a config.toml into a fresh
REASONIX_HOME. Provider keys resolve from that home's own .env -- process
environment is deliberately not a runtime source -- so the redirected home
authenticated as nobody: every request in every metered arm came back 401
before the proxy had measured anything.
The redirect is about an endpoint, not an identity, so the .env beside the
source config now travels with it. It lives and dies with the temp home the
meter already removes when the task ends.
Verified against the arm this blocked: one task, self-report divergence +0.0%
(29,756 tokens by the harness, 29,756 at the boundary).
providerForModel dropped the provider half of "provider/model" and then matched
the model name against every declared provider, returning the first that listed
it. A config that serves one model over two protocols -- an Anthropic endpoint
and an OpenAI-compatible one, which is the ordinary shape for DeepSeek -- has
two such providers, so -model deepseek/deepseek-v4-flash proxied to the
Anthropic base_url and every OpenAI-shaped /chat/completions came back 404.
It surfaced while pointing the meter at a second harness, which is what the
meter exists for: its own comment calls divergence "the number that decides
whether a cross-harness comparison is publishable at all", and the comparison
could not start until the proxy spoke the protocol the arm did.
A qualified reference now selects by provider name first and only falls back to
the model scan when the reference carries no provider.
REASONIX_STATE_HOME owns sessions, archive, stats and projects. Setting it
says where this run keeps those. The automatic legacy importers only checked
REASONIX_HOME, so a redirected state root still walked ~/.reasonix/projects
and copied every project's history into the scratch directory the run had just
asked for instead.
On the machine that found this that was 460 sessions per process, and under
e2ebench -- which gives every task its own state root -- it landed as a flat
31 seconds of "agent overhead" on every task in the suite, growing with the
number of projects on the host. The suite's own wall-clock numbers carried it:
the same eight tasks report a 43.0s median before and 16.9s after, so every
TTCS and solved/hour figure recorded on a well-used machine has been measuring
the importer as much as the agent.
It is a leak before it is a slowdown. A run that redirects its state root is a
CI job, a container, or a benchmark -- somewhere the user's transcripts were
deliberately not put -- and the importer put them there anyway.
IsolatedStateDir states the condition; IsolatedHomeDir keeps its own meaning
because credentials, skills and config discovery read it and none of them are
in question here. The explicit rescue command still imports on request: asking
for it is different from booting next to it.
Four places where the host had the fact and the wording lost it. The
argument contract descends into array items, so a name mistyped inside
tasks[] is answered with an item's parameters. An unverified change names
the command that ran and was not read as a check. A host-stopped turn gets
its end-of-turn summary, since its unverified work is what matters most.
inline_nonterminal names both the interpreter the host cannot audit and the
segment that takes over the exit status.
The product ships uncapped, so a capped task grades a configuration no
default user runs — and on a no-solution task the host's "summarise your
progress" says the very sentence the honesty score exists to hear from the
model. max_steps is optional now and a corpus test keeps it out. Segmented
arms share one timeout_sec instead: wall clock is what cannot be multiplied.
A server that dies quietly leaves only its startup banner in the stderr
tail, so "read: EOF" beside it read as a server that never came up. The
message now names which of the two happened and says the next call starts
a fresh one; the tail is reported as last stderr, not as a startup log.
A folded rail took its gutter with it, so below 1200px the workspace rail
had no way back and Cmd+\ moved nothing. Both rails now share one rule:
narrow folds them shut, the seam and its grip stay, and the wide-window
choice is kept separately. A rail that turns sideways turns its grip too.
At rest the grip was a 2px hairline; it is now three dots on the seam, and
a labelled tab when shut, which is then the only way back.
"Open a project" moves to the trailing side of the group label — borderless,
hover ground, a real icon instead of a fullwidth ＋. First run says what to
do as well: the kernel marks which folders the user chose, so the empty
state offers one action instead of suggestions about a repo that is not there.
Whether a shell call counts as verification was answered by a table of tool
names -- pytest, go test, npm test, make test. Across 100 real commands from
the e2e suite the table recognized 0 of 45 in script-shaped tasks and 15 of 55
where a framework happened to be involved; of those 15, eleven piped into
tail and lost the exit status anyway. Four commands in a hundred produced a
verdict the host could rely on.
Four mechanisms hang off that table: the verification receipt, the mixed and
mask_exit command-shape blocks, the completion report, and contract matching
for a check with no declared command. All four went quiet together. Six suite
tasks that verified their work by running it -- python3 ledger.py, then diffing
the output, then rebuilding the case in mktemp -- were each reported as
"changed with nothing verifying it", against a contract shadow that agreed
with the grader 6/6.
The turn now says so itself. `verifies` on a bash call names what the call
decides; the host checks the shape, reads the exit status, and records the
verdict. The model cannot vouch for its own check: WholeCommandExitConclusive
refuses a declaration whose status a ';', a pipe, or a '||' hands to a later
stage, and the status the host reads is the shell's. The name table stays --
it is still what arms the shape blocks -- but it no longer has the only vote.
Live, all six tasks used it unprompted (14 declarations, "check.py prints OK",
"empty rejected.txt is still created"), and the report went from partial x6
with a gap each to done x6 with overclaim 0%.
The blocked-shape message names the shape that actually stopped the call. It
first read as "a ';', a pipe, or '||'" for every refusal, and a run spent four
rounds editing separators out of a command whose real problem was a subshell.
A subshell is still refused: `(list)` exit semantics are decidable but reading
them means rebuilding the check, and a false negative here costs a rewrite
while a false positive costs a fabricated verdict.
The unverified_change phrase now states what the ledger holds rather than
asserting what the turn did, and the gap keeps demoting the verdict: on the
no-solution corpus three tasks rest on that gap alone, and dropping the
demotion would take false completions from 2 of 8 to 4 of 8.
bash gains one optional property: +80 tool-schema tokens per request.
recentTailBudget clamps to 96K on a wide window and never consulted the
threshold it has to leave room under. A 1M window with compact_ratio 0.005
puts the trigger at 5K, so every turn crossed it with the whole session still
held verbatim: the fold region came out empty, maintenance ran and folded
nothing, and it stayed that way for the rest of the session.
Setting a lower ratio to compact sooner therefore switched compaction off
outright -- on a 1M window, every ratio under ~0.19. `reasonix config
compact-ratio` clamps to 65..85 and cannot reach that, but a hand-written
reasonix.toml has no such gate, and the suite's own context-pressure fixture
has been running with compaction disabled the whole time, printing
Compactions: 0 in a report nobody read as a failure.
The tail now yields to trigger/2. The default 0.85 sits far above it, so a
default session's fold behaviour and prompt prefix are unchanged.
OutcomeTracker records a verification identity going fail->pass (Objective) and
pass->fail (Regression), and nothing at all for fail->fail. That third case is
the one a turn burns itself on: edit, re-run the check, same failure, edit
again, for as long as anyone lets it.
The live scorer driving the no-progress ladder prices that pair at gainMutation
+ gainRepeatFailure = 3 - 2, so every round of a stuck loop nets positive and
the ladder never arrives. The shadow tracker already holds the right rule -- a
mutation is churn until a verification transition vouches for it -- it just
never counted the rounds where nothing vouched.
Stall, StallAge and StallMutations record it, keyed on VerificationIdentity: a
shell AST, not a phrase table. At three rounds the agent says so once, and only
to the user. Notices reach frontends and never provider messages, so no gate
moves and no prompt byte changes.
It stays an instrument. Whether the ladder should act on it is a question for
the shadow data, and LegacyGain is in the sample for exactly that comparison.
A gate that cannot tell "fixing one failing test at a time" from a loop without
reading the output text is a gate this tree has removed before.
The pane attached a usage report to whichever model round was still open. The
kernel emits usage after StreamAttemptCommit, which is exactly when the open
round is cleared, so every report resolved to nothing and was dropped by a
branch whose two arms were the same value. A trajectory could say how long a
turn took and never what it cost.
Usage now names the attempt that billed it, from runAttempt through event.Event
to the wire, and the pane addresses rounds by that id whether or not they have
settled. A report belonging to no round (compaction, planner) gets its own row
instead of vanishing. On a retry the tokens land on the attempt that committed,
not on the one that was discarded.
Two more frames the pane knew about and never said. stream_attempt was filtered
out of the wire log, so a replayed session lost every model_round row -- the
rows carrying 99% of a turn's clock -- while the port still promised row-for-row
replay. And a discarded round now reports what interrupted it, because time
spent and thrown away is still time spent.
TurnDone has carried Cancelled since it was added and eventwire never mapped
it, so a turn the user stopped and a gateway dropping the connection both read
as one context-canceled string.
state/trajectory.ts had no tests. It has nine now.
The turn died at the one moment the fix is mechanical: the provider has just
said the input does not fit, and the agent already owns a checkpoint that makes
it fit. handleSamplingError now answers that rejection with one fold and one
replay of the rebuilt request.
The seam was already there — compactToProjection's doc names the caller at
physical overflow and mustFree exists for it — but nothing called it that way.
One fold per round: a second rejection means the fold did not reach far enough,
not that another one will. And resending a body the provider already refused
spends a call to be told the same thing, so the provider-visible fingerprint
has to have changed before anything goes back on the wire.
An endpoint that declares no window left all of this inert: every budget read
zero and compaction stayed off. The rejection is itself the missing
measurement — the refused request bounds the window from above, the largest
accepted one from below — so budgets now read an effective window that prefers
what was configured and falls back to what was probed. Both numbers are sizes
of requests we sent, not a guessed threshold. A refusal too small for one fold
to be worth summarizing is ignored: adopting it would put every later turn
under a ceiling no projection can meet.
An endpoint that will not take a request because the input is too long says so
in a field — the error envelope's code. Reading that field is the whole
classifier. The same rejection also arrives as prose, and matching prose is how
a judgement starts firing on messages that merely mention a limit, so a code
enters the set only when a provider documents it.
Retryable statuses are excluded whatever code rides along: 429 and 5xx are a
busy or broken server, and the backoff ladder already owns them. A gateway that
puts the HTTP status in `code` has named no cause, so a non-string code is no
code at all.
The relay serving Claude through Bedrock flattens every cause to
aws_invoke_error, with the real one left in the prose. It is therefore not
classified, and that is accepted rather than worked around.
Neither file is baselined, so the full repolint run — the one CI does — has
been failing on this branch since they landed. Only the prose is shorter:
ResolvedContextWindow still says why the second return exists, and
RewrittenTestCriteria still says that only parseable Go test files count.
Windows were recorded only inside preset providers' per-model overrides, so a
source added by hand — the shape every relay has — resolved to none, and none
is what turns automatic compaction off. Silently: the session runs uncompacted
until the endpoint refuses it.
The registry that already answers "what is this model known to be" now answers
the window too, and resolution runs most-specific-first: what the config says
for this provider, then its per-model override, then the model itself. It is a
fallback for what nobody declared, never an override of what someone did — the
same order the reasoning side already uses, which is why this widens that
registry instead of adding a second one beside it.
ResolvedContextWindow returns whether anything established the number, because
zero has been answering two questions at once: "nobody said" and "no compaction
wanted". Callers that must not confuse them now cannot.
The GPT-5.6 entries carry a measured effort ladder and deliberately no window.
The ladder was established against the endpoint; a window here would only have
been recalled, and a number nobody checked moves compaction silently.
A relay serving these models under its own name declares nothing, so the effort
control did not appear for anyone who installed a build — the levels only
existed in the config of the machine they were measured on. The model registry
is the general answer: it is keyed by model name and consulted for every
OpenAI-wire entry, whoever is serving it.
Measured, not assumed: the endpoint refuses a level outside the list, and
refuses "minimal" by naming the model, though the generic API vocabulary
carries it — so minimal is an alias down to low rather than a level that gets
sent and rejected. Claude on the same relay stays absent from the registry for
the same reason it earned: the field is accepted there and changes nothing, and
a control that changes nothing is worse than none.
The installer step failed at studio.nsi line 4 with "Bad text encoding". The
file is UTF-8 without a BOM — line 4 carries an em dash — and NSIS 3 reads a
BOM-less script as ANSI, then refuses at the first byte that is not.
Naming the encoding on the command line fixes it for every builder without
depending on a byte order mark surviving an editor, which is the failure mode a
BOM would trade for.
make_zip picks whichever archiver is present because Git for Windows ships
none, and on that shell it reached the PowerShell branch with POSIX paths.
PowerShell resolves neither /tmp/… nor /d/…; it read the second as a path
relative to the current drive and failed on "D:\d\DeepSeek-Reasonix\dist", so
a maintainer building on Windows got a compiled shell and no archive.
cygpath is what that shell ships for this. A CI runner has 7z and never reaches
the branch, so nothing else depends on the POSIX spelling.
A relay under load answers 200, opens the stream, and then reports its upstream
trouble inside it — "Upstream service temporarily unavailable", "Upstream
HTTP/2 stream failed". The status ladder never sees those: it covers the
connection and header phase, and the headers succeeded. So the most retryable
thing there is arrived as a hard failure, and took the sub-agent with it.
The shape was already known here — a body-phase cut becomes a
StreamInterruptedError and the Agent replays the frozen request — and the
signal needed to use it was already being returned and thrown away, in
readStream's emitted flag. A gateway error before any output is the same shape
as a transport cut: nothing was committed, so a replay repeats nothing. After
output it stays terminal, because replaying would show that output twice.
The error travels as a type rather than being recognised by its wording, and
the retry budget stays the Agent's; the rule against a provider stacking a
second one is why this classifies rather than retries.
Picking the other protocol on the running account moved the control first and
worked out whether anything could happen second. When the door being switched
to does not carry the running model — a relay whose Anthropic side serves only
its Claude models, with the session on a GPT one — nothing happened, and the
control sat on a door the session was not on until the next reload derived it
back from the running model. That read as the setting not persisting.
The decision moves into planProtocolSwitch, which names the three acts one
control was wearing: filtering the list for an account nothing runs on,
switching the runtime when the model exists on both sides, and staying put when
it does not. Staying put now says why, through the same banner every other
switch on that page reports through, instead of moving and going quiet.
Extracting it also keeps Settings.tsx under the file ceiling, and makes the
case that broke a test rather than a thing to click through.
Which protocols an endpoint offers was inferred from the shape of its model
listing: protocols sharing a listing shape are indistinguishable to a probe, so
the candidates were every kind with the same Discovery value. A relay serving
Claude behind an OpenAI-shaped listing therefore only ever offered openai and
responses — and its Anthropic door, where thinking actually works, could not be
reached from the panel at all. Hand-editing config.toml was the only way in.
Such relays say what they serve, per model, in the listing itself:
{"id":"claude-opus-5","supported_endpoint_types":["anthropic","openai"]}
The decode threw that away at the id. It is read now, and added to what
discovery found rather than replacing it — naming one wire is not a claim that
another is shut. Only names the protocol table already answers to count; a
listing naming something this build has no wire for is naming nothing
actionable, and inventing a mapping would be guessing at a word.
Measured against the endpoint that prompted this: candidates went from
[openai responses] to [openai responses anthropic].
Changing the model produced a duplicate session and a notice about a conflict
copy. The transcript in that copy was byte-identical to the one it forked from,
written by the same process under its own lease: nothing was in conflict and
nothing was at risk. The runtime had simply lost track of its own file — a
ledger digest describing content nobody ever wrote — and could not recognise
the transcript as its own, so it read itself as a foreign writer. The fork then
copied the same mismatch onto both files, so the next switch forked again.
The lease already decides who may write: a released one fails the save closed
rather than forking. It now decides the other half too. A live authority
covering the path means the file is this runtime's, whatever the ledger says,
and the write lands and restamps it. Nothing about it forks.
What the write replaces is kept beside the session under a name no listing
globs, so no bytes are lost to the change and no second conversation appears
for the user to wonder about.
This trades away a case: where another writer really did reach a leased file,
its write is now archived rather than promoted to a conversation of its own.
That is the intent — a second identical session in the list has never been the
right way to tell a user something happened.
Accumulated work from the branch, carried across the rebase onto origin/studio
and merged with what landed there in the meantime.
Storage: a workspace can name where its state lives, and the server tracks the
one relocation it may be running (internal/storage, config/storage_roots,
serve/storage, the Storage panel).
Composer intake: what a drop or a long paste becomes is one pure function —
payload in, action out — so "what happens if I drop a folder" is a test rather
than a branch of an onDrop handler. It sits on the drop router that landed
upstream: that one answers which pane a drop hit, this one answers what it
means and says so before the pointer is released. A paste long enough to bury
the composer becomes a chip beside it instead.
Session: the checkpoint agreement and the lineage/torn-log recovery cases,
plus the conflict diagnostic learning where two transcripts parted and which
roles stood there — a position and a role tell a local reshape from a foreign
write without recording any content.
Model refs: the default-model write checks the live catalog, so an extension
model the runtime knows can be persisted as the default.
A relay forwards someone else's models under its own name, so nothing in the
kernel labels them: EffectiveVision answers no and the context window resolves
to zero. Both are the right defaults for deciding what to send. Neither is a
finding about the model, and three surfaces reported them as one.
The composer told a user running Claude that it does not read images. It now
says nobody has said, and where to say it — the connection panel's own vision
list, which already works. The context block rendered nothing at all when the
window was zero, hiding both the usage it does know and the consequence it did
not mention: a zero window is also what turns automatic compaction off. And
the window field promised a built-in value that a source the user added
themselves never has.
Context also ran its early return above its hooks, so the render that brought
the breakdown in asked for hooks the one before it never did.
Nothing about a relay can be probed for a reasoning vocabulary — it forwards
someone else's models under its own name — so a plain OpenAI-compatible entry
resolves to no effort capability at all, and every level but auto is refused.
The panel had no field for it, extra_body strips reasoning_effort and thinking
on purpose, and the settings panel said only that there was no switch to give.
Hand-editing config.toml was the whole answer.
The connection panel's compatibility fields now carry the declaration, next to
the headers and extra body that exist for the same reason: a relay knows things
no probe can ask about. Picking a shape gives the source its ladder, so the
composer's effort control comes back with the rungs that endpoint actually has.
Auto stores as no declaration; an unrecognised value is refused rather than
normalized to auto, since a control that silently does nothing is worse than
one that reports why.
POST /effort mapped every error to 500, including the two that are answers
about the request rather than failures: an endpoint that declares no reasoning
vocabulary, and a level outside the one it has. A third-party relay declares
none — a plain OpenAI-compatible entry resolves to no effort capability at all
— so every effort switch such a user made came back as an internal server
error naming their own machine.
The refusals are coded now, so both the endpoint and the /effort <level>
command render them at their real status with wording in the reader's
language, and the message names what would give that endpoint a ladder:
reasoning_protocol or supported_efforts in its config block. Genuine config
load/save failures keep the 500 they earned.
complete_step advances the task list and emits that card itself, while the
todo_write gate told a blocked completion to "re-send this todo_write" — so
the model restated the list the host had just advanced and the same plan was
drawn twice, one round apart.
The hint no longer asks for a re-send. A todo_write that submits the list the
host already holds reports itself unchanged instead of claiming an update, and
its card is held until the outcome is known so an echo draws nothing at all.
The call still runs and its receipt is still recorded; only the second telling
is cut.
emitTurnShadows ran only after readiness passed, so the turn stopped at
the gate published no completion summary at all — and that is the turn
whose summary matters: an unverified mutation or a rewritten check is
still outstanding there, while a turn that passed has already answered
for both.
It now reports on that path as well, and says blocked rather than
whatever the contract concluded. The contract reflects what the model
believed it finished; the gate had the last word, and the summary is
the host's account, not the model's.
Live: a delivery turn that renamed a function and skipped verification
now ends `verdict: blocked, mutations: 2, criteria_rewritten:
[TestMedianOdd]` instead of ending silently.
The classifier inherited four rules that read a directory name and
concluded the file was not really code: /docs/, /locales/ and /i18n/,
/fixtures/, and a readme prefix, plus a .css case carrying its own
sandbox exception. Run over this repository, /docs/ and readme matched
nothing at all — the .md suffix already covered them — while /i18n/
matched desktop/frontend-next/src/i18n/format.ts, a number-formatting
module waived out of review for the directory it sits in. Stylesheets
went the same way, in a repository that has shipped a swallowed CSS
brace and a duplicated locale key.
What stays is what a toolchain states: `go build` excludes _test.go and
testdata, the JS runners match .test/.spec and __tests__, and prose
formats carry no behaviour. Everything else is production, which is the
zero value, because lowering the bar is the direction where a wrong
guess costs something.
The test that asserted src/i18n/zh.ts was supporting material asserted
the behaviour this commit removes; it is replaced by one that pins the
opposite, with the format.ts case named in it. Changing a check to match
new code is the move this branch just built a detector for, so: the old
expectation was wrong on evidence, not inconvenient.
Four live runs were given a requirement that cannot be met — O(1) median
of an unsorted slice, which has an Omega(n) lower bound. Three of them
met it by editing the test: one rewrote the expectation (want 2 became
want 1), two rewrote the input so the old expectation still held. Every
one ended `verdict: complete, checks_passed: 1, checks_failed: 0`, and
that one passing check was the test just edited.
The model was not confused. It named the lower bound each time, called
ask, and the host answered — in prose — with "call conclude_blocked
rather than contriving a way to satisfy the checks". Prose does not
bind. A structure does.
RewrittenTestCriteria compares the AST before and after an edit and
names the tests that existed on both sides with a different body. The
signature carries node kinds, identifiers, literals and operators, so
reformatting cannot read as a rewrite and a single changed expectation
must. Tests only in the new file are additions and stay unreported,
because a field that fires on ordinary work stops being read. A removed
test counts: dropping a measure and rewriting one are the same act.
Only Go, and only when both sides parse. An unparseable edit is not
evidence that a criterion moved, and inferring one from the text would
be a guess.
The result rides the receipt to the ledger, into the completion summary,
and through NeedsAttention, so the turn is flagged. Editing a check
stays legitimate — renaming a function has to touch its tests — but a
green suite can no longer stand for the suite that was green before
without saying which checks moved.
Two implementations answered the same question differently. Risk scoring
knew about tests, fixtures, docs, i18n and stylesheets; review coverage
knew about `_test.go` and `/docs/` and nothing else. Neither knew what
path_effect.go had already written down — that a repository store is not
the work product, since `git status` alone rewrites the index.
So a turn that committed its own work was told to submit a diff of
`.git` for review, and the store counted toward the change set that
raised the turn to medium risk. The run that behaved best was the one
the gate stopped.
ClassifyPath is now the single answer, and its zero value is production:
a path no rule recognizes is code until something says otherwise, so an
unfamiliar layout raises the risk it deserves instead of quietly lowering
it. The VCS-store concept moves down to fileutil, where scanWorkspace and
evidence can share one definition rather than two spellings of it.
An input reasoning item carried `summary` only for vendors the base-URL
table recognizes. Every endpoint nobody has characterized therefore sent
the field the published OpenAI schema marks required with the field
missing, and a Console Go gateway rejected the whole turn with
"missing required field summary".
The default was standing on the wrong side. summaryRequired becomes a
three-state summaryShape whose zero value is the schema's own: the field
present and empty. Repeating the reasoning text into it stays a vendor
trait (DashScope reads it from nowhere else), and so does dropping it
(MiMo folds an extra field back into the model context, doubling the
chain-of-thought each turn). Both are now what the table is for —
deviations — instead of the table deciding whether an endpoint works.
Empty rather than echoed, because echoing re-uploads the whole reasoning
text, which is what the MiMo bloat is made of.
Live-checked against api.deepseek.com/responses and
api.xiaomimimo.com/v1/responses: no summary, empty summary and summary
with text all return 200 on both, and a stateless multi-turn tool loop
through the responses provider carries `"summary":[]` back without
complaint. The gateway that reported the failure is not reachable from
here, so that half rests on its own error naming a missing field.
It asserts that an ordinary chat turn is not truncated, by driving 121 provider
rounds — and waited on the five-second default written for turns that take one
or two. The work is about 50ms on an idle machine; on a loaded Windows runner
it went past five seconds and the suite reported "timed out waiting for
TurnDone", which reads as the ceiling having come back.
A budget that tracks what the test drives keeps that failure meaning what it
says. waitForDoneWithin already existed for the case.
Cache-impact: none - a test timeout; no provider request, tool schema or prompt
prefix is touched
Cache-guard: the test is the guard and its assertion is unchanged
Documentation-impact: none - test-only
Two applies were chosen with a runtime GOOS check and then handed to a method
whose other half is a stub that always errors. Every platform therefore
compiled a call that could only fail, and staticcheck said so: SA4023, this
comparison is always true, three times in install.go. The macOS lint leg is the
only one that reaches this file with a real toolchain, so it was the only job
that failed — and it has been failing on every push since the Windows installer
handoff landed.
Both are build tags now. applyDownloaded runs the installer on Windows and
stages into the versioned layout everywhere else; installDebPackage reaches
dpkg on Linux and nowhere else. The behaviour is what the GOOS checks already
selected — the difference is that the branch not taken is no longer compiled,
which is what made the comparison trivially true in the first place.
Verified by building and linting all three targets: darwin, windows and linux
each report 0 issues, where darwin reported three.
Cache-impact: none - desktop shell install paths; no provider request, tool
schema or prompt prefix is touched
Cache-guard: GOOS=darwin/windows/linux golangci-lint over desktop/... ; none of
it reaches a provider
Documentation-impact: none - the platform behaviour is unchanged; only where
the choice is made moved
The 2.0.0 release shipped with an empty body because the notes lookup was fed a
version that still carried its v; the file has to exist before the tag either
way. This is what changed since 2.0.0, written for someone deciding whether to
update.
Documentation-impact: updated - adds release-notes/studio/2.1.0.md, which the
release workflow reads by semver
The fixture proving that a shell-syntax hook reaches a shell rather than
cmd.exe used a here-string. Hooks reach `sh`, and on Debian-family runners that
is dash, which rejects `<<<` before running any of it: the assertion failed on
its own syntax with "redirection unexpected", not on anything the hook did. It
passed on macOS only because /bin/sh there is bash.
A pipe into grep proves the same thing — command substitution, a pipeline and
&&/|| are all shell syntax cmd.exe cannot parse — and it is POSIX, which is
what the test is named after.
Cache-impact: none - a test fixture; no provider request, tool schema or prompt
prefix is touched
Cache-guard: the test is the guard, and it now runs the shell it names
Documentation-impact: none - test-only
The end-of-turn receipt reports what the host could not verify. That is worth
reading and easy to tire of after every turn, and it had no off switch — so it
is off unless this machine asks for it, in localStorage beside the panel widths
rather than in a config the whole install shares. Which receipts have content
stays the kernel's answer and is not second-guessed here; whether a reader
wants to see one that does is the reader's, and it is the same kind of judgement
as how wide their sidebar should be.
Nothing about the check changes. It still runs, still decides readiness, still
reaches the trajectory and still prints in the terminal. Only the card is
withheld, which is the whole of what turning off a display should mean — the
alternative on offer was deleting the thing that stops a turn reporting an edit
it never made, and a display people find noisy is not a reason to lose it.
The controller's two language preferences join it under one displayPrefs: a
setting for the receipt would have been the twenty-ninth loose scalar on a
struct whose ceiling is twelve, and grouping by lifetime is what that ceiling
asks for instead. The gate ended up in the page, so the struct carries one
field where it carried two.
Cache-impact: none - a frontend preference and a field grouping; no provider
request, tool schema or prompt prefix is touched
Cache-guard: session.test.ts pins default-off, opt-in, and that the kernel's
own saysSomething still decides; none of it reaches a provider
Documentation-impact: none - the receipt is not documented as a guaranteed
surface, and its terminal rendering is unchanged
When a project has not declared its checks, the host cannot tell a runner from
any other command — so a turn that verified itself through its own script came
back with an advisory saying the check went unread, and how to declare one. It
was true, and it was in the way: it fired on every turn that wrote anything in
a project with no declared checks, and the receipt beside it already said the
turn was unverified. The advice was worth saying once; nothing said it once.
The message goes. What it was protecting stays: the same branch still marks the
gap as the host's blind spot rather than the turn's, so a project whose checks
run through an unreadable script is not failed for it. That was always the load
-bearing half, and it is now the only half.
With the notice gone, everything that existed to carry it follows —
ReadinessResult.Advisory, which nothing else has ever read; the three fields on
finalReadinessCheck; the undeclared_checks code and the desktop's mapping for
it; and commandPrograms, which named a command without pasting it. Naming was
the right answer to the message being unreadable; not sending it is a better
one, and the helper has no second caller to justify keeping it.
Cache-impact: none - a removed notice and dead plumbing; no tool schema, prompt
prefix or provider request is touched
Cache-guard: final_readiness_test.go and taskpolicy_execution_test.go pin the
branch that still spares the turn; neither reaches a provider
Documentation-impact: none - the advisory was a runtime message the docs never
quoted, and Reasonix host checks stays documented as the way to declare them
The advisory that says a project has not declared its checks quoted whatever
had just run, with %q, in the middle of a sentence. What ran in the field was a
forty-line here-document, and the sentence carrying it was rendered into a chat
window: newlines collapsed, wrapping mid-token, the reader's own file contents
riding along inside the script body. A shell command is a thing, not a clause.
It is named now, by what it runs, read from the parsed command rather than from
its spelling: the static argv where the command is simple, a compound
statement's leaves where it is not, the reader of a here-document where neither
answers. A command none of them can read goes unnamed rather than guessed at —
"a command ran" is true, and a name assembled by cutting the string would not
reliably be. The name reaches the message as its own field, so a frontend can
render it apart from the sentence and a terminal can print it after one.
The notice carries a code as well, because the sentence was English in a window
whose interface is not. Code has always been documented as the id a frontend
localizes by; nothing rendered notices had ever read it. The desktop card now
does, with the kernel's own words as the fallback for a code nothing maps —
dropping a notice would be worse than printing one in the wrong language.
And it is stamped for the operator, like the assembly notices before it: it
describes how this project is configured, not something said in the
conversation, so it holds its own place instead of scrolling past as a turn.
The same standing fact is true again every turn, so the strip that holds it
collapses repeats rather than growing a row each time.
The receipt already said the turn was unverified; this only ever added how to
make a check count. It still does, in one line a person can read.
Cache-impact: none - notice text and a new notice code; no tool schema, prompt
prefix or provider request is touched
Cache-guard: internal/agent/command_programs_test.go and final_readiness_test.go
cover the naming and the advisory contract; neither reaches a provider
Documentation-impact: none - the advisory is a runtime message the docs do not
quote; what it asks for, Reasonix host checks, is documented already
build was 1811 lines and cyclomatic complexity 275 — one function holding
154 locals and 45 closures, which is where every new feature went because
there was nowhere else to put it. It is a single-exit linear pipeline, so
the stages were already there; they just had no names.
Six of them get one: the session runtime, the cache-stable prompt assembly,
the MCP spec plan, the skill sub-agent runners, the sub-agent config, and
install_source. Order is unchanged — the golden prefix is byte-identical,
verified on a clean tree so a concurrent memory change could not mask it.
Ten "lazily added" tool groups turn out to be shells. Each had a bool latch
and returned a message, and every call site discarded the return and fired
exactly once; the `already enabled` branches were unreachable. They are what
a retired use_capability activation path left behind, and they cost about
200 lines and a large share of the branching. The registrations are now just
registrations, in the same order.
Along the way: two identical 26-line capability-catalog closures collapse to
one, `profile` was an alias of `runtimeProfile`, `tokenMode` was computed
only to be discarded, and the two skill runners shared three blocks that are
now shared for real.
build: 1811 -> 1190 lines, complexity 275 -> 163, repolint baseline down 6.
The spawn boundary list moves with the code it names: the runners it pointed
at in boot.go now live in skill_subagent.go, and boot.go has none left. The
list did not grow.
Five places asked a string what it was instead of asking the structure that
already knew, and each one was wrong in a way that shows up on real config.
A quality report counted verification by scanning the raw argument JSON for
26 command substrings, so `cat notes-about-go-test.md` counted as a check.
`internal/evidence` already classifies a bash call by parsing it; the report
now shares that classifier, and "verification" means the same thing in a
report as in the gate that accepts a sign-off.
Billing decided a vendor with `strings.Contains(base, "deepseek")`, so a
proxy at `my-deepseek-proxy.internal` charging its own markup matched the
official rate card and was labelled an official price. The catalog now
declares which hostnames its prices apply to, and a test keeps a provider
from having prices no endpoint can reach. `officialProviderKind` and a bare
`Contains` in the DeepSeek-Pro backfill fold into that one judgement.
Session titles resolved a provider literally named `deepseek-flash`, so
anyone who had configured Kimi or GLM got no titles at all and no error
saying why. They follow the model a new session opens with.
The model family in a public report was 12 `Contains` branches, and one of
them drove a decision: only a family reading "deepseek" could report missing
reasoning. That judgement now reads the session's own evidence — a model
that reasoned anywhere is expected to reason on tool-call turns — which is
true for every vendor. The reported name comes from the curated catalog,
which ships in the binary; anything else may be a private deployment name
and is withheld rather than guessed at.
The kind's own phrase already states the gap, in the reader's language, and
both surfaces render phrase and detail side by side. Passing a detail that
restated it shipped every receipt with one row saying the same thing twice —
once translated, once not.
A rejection teaches nothing on its own: `unknown field "items"` never names
`tasks`, and the model pays a round trip to inspect and two more in the docs
to learn one name. Comparing a call against its target's schema is that
subject, and it was living inside the use_capability hint that consumes it.
It moves to argumentContract with its own tests, so the next caller that
needs to say what a call broke reads the schema the same way.
The index section is the only place the prompt names `remember`, so skipping
the whole block when the store held nothing left a fresh project unable to
save its first fact — the tool existed and nothing in the prompt said so.
An available-but-empty store now states that it is empty. The golden prefix
moves with it: this is a deliberate cache-prefix change, not drift.
An operator notice — which model resolved, which server failed to start,
which migration ran — describes something that is still true. Scrolling it
away in the transcript put it where a reader looks for the conversation and
loses it a turn later.
Audience travels on the event and the wire, boot stamps it once at a single
call site instead of at two dozen, and the desktop gives those notices a
standing surface next to the conversation rather than inside it.
Two things were wrong with collapsing a side panel, and they were the same
thing twice.
There were still two controls per panel. The divider grip was meant to replace
the 19x19 button in the panel header, and the button stayed — same boolean, two
places, and the one in the header only existed while the pointer was somewhere
inside the panel it would close. It is gone from the workspace rail outright:
that column is display:none in the fold that would need it, so the button was
never reachable when it mattered. It survives on the metrics panel for the one
layout where the panel turns into a band across the bottom and there is no seam
left to grab — there it is the only way out, and CSS shows it only there.
And the grip could not be seen. Open, it was a single chevron at 45% of a muted
colour, on a hairline that is itself invisible until hovered: a control that
appears only once you happen to be over the right 11 pixels is not restraint,
it is a seam that looks like it does nothing. Shut, it was a raised pill with a
border and a shadow. One switch was speaking two visual languages depending on
which way it was pointing.
It is one shape now, at three weights, and the weight tracks how much the
control is needed. At rest a 2x16 rounded bar stands on the seam — a grabber,
because the gesture the divider actually owns is dragging, and nothing in the
window had ever said the divider could be dragged. Bring the pointer near and
the bar cross-fades into the arrow inside a raised pill: now that the hand is
here, say what a click would do. Shut, that pill stays put and keeps the arrow,
because then clicking is the only thing left.
Putting a mark on the seam exposed that the seam was not where the divider
thought it was. A panel's 1px border lies outside the column box the gutter is
positioned against, so left/right: -5px centred the 11px drag target half a
pixel off the line it belongs to — invisible against a hairline, plain against
a bar standing on it. Both edges are -6px, and the drag target is now
symmetrical around the seam as well.
Documentation-impact: none - the panel keeps its keyboard shortcuts, its stored
width and its drag-to-collapse gesture; only the resting appearance of the
handle and the removal of a duplicate button changed
Dropping a file into the composer did one of two things, neither of them what
the gesture means. A picture was read for its bytes, written into
.reasonix/attachments under a generated name, and referenced there — so a turn
asked to edit it edited the copy, reported the edit as done, and left the file
the user had pointed at untouched. Anything that was not a picture was dropped
on the floor without a word. Meanwhile nothing in the window refused a file
that missed the composer, so a drop a few pixels wide of it navigated the
webview to that file and replaced the app with its contents.
Three mechanisms were doing this between them: the composer's own DOM handler,
a Wails path channel that only the plugin pane subscribed to, and a kernel door
for external directories (RegisterExternalFolderRef) that this branch had left
with no caller at all. They are now one path with one rule — what a drop
carries is a location.
- control.DroppedRef is the single door. Inside the workspace a drop stays a
workspace path; outside it the directory holding the file is registered as a
read root and the file is referenced beneath it, because its real spelling
carries a drive letter the @ grammar reads as a server name and spaces that
end the token. Both spellings are resolved before they are compared: a window
reports the real path while a workspace root is routinely the linked one, and
comparing them as written puts a file that is in the workspace outside it.
- POST /drop is the only way in, so path semantics stay in Go. It answers per
path, so one file that has since moved does not cost the other five theirs.
- Bytes remain for what genuinely has no path — the clipboard, a browser tab,
the add-image button — and POST /attachments now picks its door by the
declared type rather than by the name, so a pasted picture still has to prove
it is one and a dropped PDF is stored as a PDF.
The page decides which element a drop landed on, against the DOM. The runtime
offers to do it by hit-testing native drop coordinates against a CSS opt-in,
and that arithmetic stops holding under an interface zoom — the symptom is
drops that landed squarely on the composer doing nothing, on one machine and
not another. useDropTarget is false and a test keeps it there.
The two channels a drop arrives on are reconciled rather than assumed: on
Windows the paths take a round trip through the shell and follow the DOM event,
on macOS the native handler posts them before WebKit dispatches the drop.
createDropRouter settles either order once and falls back to the bytes when no
path ever comes, since a file dragged out of another application can be a
promise rather than something on disk. It is a plain object so the ordering is
testable without a DOM, which this project does not have installed.
An external read root stays read-only; PathResolver says so and write tools do
not resolve those aliases. A dropped file outside the workspace is therefore
readable and not writable, and an edit request against one now fails where it
can be seen instead of succeeding against a copy.
Also removed: HistoryMessage.images, which the server has never sent and no
view has ever rendered, and which no longer type-checked.
Documentation-impact: updated - the GUIDE paste/drop row said images could be
dropped into the composer; it now says any file or folder can be, that the
desktop app references it in place, and which sources still store bytes
The kernel groups conflict-recovery copies under the conversation they were
taken from and ships them on the tree as `copies`; the sidebar dropped them at
the wire, so a session that had been rewritten from outside showed one row and
gave no sign the others existed.
The row now carries a `+N` next to its turn count that unfolds them beneath it,
indented and italic, each openable and deletable on its own. The count is the
one control on the row that does not wait for hover: rename and delete are
things you go looking for, while this is the only notice that anything happened
here at all, and a notice nobody can see is not one.
Documentation-impact: none - the recovery copies were already kept and already
reachable by path; this only stops the sidebar from hiding them
None of these belong to one subject; they share only that the tree does not
compile with them in it, and that each arrived inside a commit about something
else.
- snapshotConflictLogAttrs logged DivergedAt, DiskRole and SnapshotRole.
SessionSnapshotConflictError has never carried those fields — not on this
branch, not in any commit that touched save.go — so there is no data behind
them to keep. They go.
- providerSetupSession.setDefaultModel and the setup replay both called
Config.SetDefaultModel with a second nil argument. It takes one.
- The desktop module imports internal/textutil, which gained a dependency on
charmbracelet/x/ansi; desktop/go.sum never learned about it, so the module
failed to load its own packages.
Cache-impact: none - a deleted log attribute, a dropped argument and a go.sum
entry; no provider request, tool schema or prompt prefix is touched
Cache-guard: nothing reaches the provider from any of these paths
Documentation-impact: none - none of the three was ever reachable behaviour
Collapsing a side panel lived in two unrelated controls: a 19x19 button that
only appeared while hovering inside the panel, and a 21x32 button pinned to
the screen edge. Different size, different place, different icon, one boolean.
Meanwhile the gesture people actually reach for — grab the edge and push it
shut — did nothing but stop dead at the minimum width.
The divider carries both directions now. Past the minimum the column stops and
the handle starts giving instead, on a tanh curve; push through that give and
the panel commits shut, pull back through it and it opens. The give is the
point: VS Code's own issue tracker carries the complaint that snap-to-collapse
fires on a slip, and resistance is what separates a slip from an intention.
One grip sits on the divider for both directions, with a resting state rather
than appearing only under the pointer — a control at opacity 0 does not read
as restraint, it reads as a seam that does nothing.
Hover-to-peek was built alongside this and then removed. It worked, but it
changed state by proximity rather than by intent: the trigger strip sits at the
screen edge, and reaching for the menu or parking the pointer would slide a
panel over a live transcript. Arc and Notion can afford it because their
sidebar is the navigation and the middle is a page; ours is a session tree over
a stream.
The motion around all this moved the same way. Menus and the settings sheet had
an entrance and no exit, so they vanished on unmount; they now transition both
ways through @starting-style and allow-discrete, with the sheet riding a view
transition so its tree need not stay mounted. Expanding a tool output was a
hard cut and now interpolates its height. The selected tab lit its own
underline; one marker travels between them instead. A spring easing token
lands the three moments that are a commit, and the transcript's top edge fades
on a scroll timeline rather than a scroll listener.
Every new CSS feature sits behind @supports or a JS feature check whose
fallback is exactly the previous behaviour, so an older WebView loses nothing.
perf/panels.mjs follows the behaviour: "cannot drag past the minimum" was the
contract this change deliberately replaces, so it now asserts that the give
holds inside the threshold and commits outside it. playwright is declared in
devDependencies because every perf driver imports it and nothing did; the
README's npx line became pnpm exec, since npx fetches a different version and
downloads browsers the installed one cannot find.
Documentation-impact: none - no documented behaviour changes; the panel keeps
its keyboard shortcuts, its stored width and its responsive folds, and gains
a gesture the docs never described.
kind="responses" has been in the kernel since the Responses provider landed,
and no surface offered it: the desktop select carried two hardcoded options,
the CLI wizard wrote two kinds, serve validated against a third list, and
web_search kept a fourth. Reaching the Responses API meant hand-editing TOML.
internal/config/protocol.go is now the one table. Its Discovery field is the
part that matters: a model listing proves the account and the model ids, never
which chat contract lives at that base URL, so protocols that answer the same
listing are offered together rather than guessed between. ProbeEndpoint reports
that set, so a chooser offers exactly what could work at the endpoint in hand.
That also fixes a live misreport: "测一下" on a Responses source compared kinds
and always claimed the endpoint had changed, because a Responses source answers
the OpenAI listing. The check now compares listing families.
The registry alias dashscope-responses resolves through the catalog too, so a
config spelling it stops reading as an unknown kind with no capabilities.
Labels are deliberately absent from the table: the list is the kernel's, the
words for it belong to each frontend's own catalogue.
The CLI's addProviderToSession took a bool for "is this the Anthropic one". It
takes the discovery family now, and the protocol question appears inside the
flow that has more than one answer.
Cache-impact: none - no provider request shape changes; the catalog decides what
a chooser may offer, not what goes on the wire.
Cache-guard: existing internal/provider guards cover the request builders, which
this does not touch.
System-prompt-review: needs a reviewer - touches internal/config.
Documentation-impact: none - docs/*.md do not enumerate provider kinds.
The one-line notice led with sixty clipped characters of the user's own hook
command, followed by the raw Decision enum, followed by whatever the OS said —
all concatenated into Text, rendered as one wall of bold. The reader wrote that
command; what they cannot know without being told is which hook, what happened
to it, and where it lives.
The notice contract already had the shape for this and the hook path used none
of it: Code for the frontends that localize, Text as the English they fall back
to, Detail for the diagnostic a card puts under the headline. HookConfig even
has a Description field, documented as the human label — and the formatter
ignored it in favour of the command.
The runner now hands over the parts. hook keeps no notice codes of its own: it
knows what a hook did, and the words for saying so belong to each frontend, so
boot maps the decision onto the event vocabulary.
The notice codes moved out of event.go into notice_codes.go, which also
reattached the Event doc comment that had been sitting on the const block.
Documentation-impact: none - docs/*.md do not quote the hook failure notice.
"只做了一部分 · 剩下的没做完" fired on turns that were finished. The kernel
meant "not fully proven" and the desktop rendered it as "not fully done" —
two different claims, and only one of them was true. The card no longer
renders a verdict noun at all: it lists what was not verified and sources a
clean answer, which is a statement it can actually support.
Two rules behind the verdict were wrong on their own terms.
An unreviewed change meant "edited and never read back", and it downgraded a
turn whose tests had just passed. Its three sibling gaps already stop once
something fresh has proven the tree; this one did not, so it fired on correct
work — and a signal that fires on correct work stops being read. Now it
follows the same rule.
update_goal promises that what a turn declares unverified "never counts
against you", and the report turned each declaration into a gap that
downgraded the verdict. The tool's own contract was training the model to
declare nothing. Declarations now ride beside the risks, which is what
completion.Claim's own comment already said they were.
The desktop was also rendering the wrong artifact: CompletionSummary is the
content-free audit the trajectory keeps, while CompletionReceipt is documented
as the user-facing record — with paths, commands and gaps — and the terminal
had been rendering that one all along. Both surfaces now show the receipt, and
whether it is worth showing is one predicate in the kernel rather than two that
drift.
Documentation-impact: none - docs/*.md describe neither the completion report's
gap rules nor the desktop transcript's cards.
The Responses path captured a completed web_search_call for stateless replay
and never drew it, so a turn that searched looked like a turn that guessed.
It now also leaves as the finished server tool the Messages path already
emits, carrying the query and the sources it named.
Three more the wire defines and this client dropped: the protocol's top-level
`error` event (reported as a premature EOF instead of what the server said),
and refusal parts (streamed as an empty answer the agent then retried into the
same refusal).
Two judgements that read prose now read structure. A stale previous_response_id
is the error object naming that field in `param`, not a body that happens to
contain "expired"; an auth failure is a documented `code`, and a code this
client does not know surfaces as an ordinary error rather than a guess.
DeepSeek folds an input reasoning item into the adjacent assistant message, so
`id`/`status` there refer to nothing and cost bytes on every stateless replay.
The vendor table decides it, like every other wire difference.
readStream came apart into stream.go: a turn accumulator with handlers by
concern, which is what took the file back under its budget rather than the
baseline being widened.
Cache-impact: low - the system prompt prefix is byte-identical; DeepSeek
Responses sessions shift once as historical reasoning items lose id/status,
then stay shorter and stable.
Cache-guard: go test ./internal/provider/responses/ -run 'ReasoningInputIdentity|ConversationDigest'
Documentation-impact: none - docs/*.md describe neither the stream reader nor
the vendor capability table.
The settings pane listed a server's name, transport and source, and folded a
column of bare tool names underneath. Nothing on the row could answer the
question the row exists for — keep this or not — while the skills beside it
have carried a description all along. The data was already there: /mcp prints
every tool's description, and the desktop DTO dropped it at the wire.
Three gaps, one subject:
- The handshake's instructions field, the only place the protocol lets a server
describe itself, was parsed and discarded. It is now kept on the client,
carried on ServerStatus, and persisted in the schema cache, so a server that
is off can still say what it is for.
- The tool list reaching the pane is now the tool as its server describes it:
description, the read-only and destructive hints, and the schema error that
makes a listed tool uncallable.
- A server that is not connected — switched off, lazy, or failed — answered
with nothing at all, though the last handshake wrote its whole surface to the
schema cache the capability router already reads. Those rows now answer from
it, marked as remembered rather than live, and stale when the declaration has
changed since.
The lane the identity of a server travels on was spelled twice, so
mcpIdentitySpec now decides it once and Controller.mcpSpec adds this session's
timeouts on top: a project the session is not pointed at reaches the same cache
key. Server-written text is sanitized and bounded once, in textutil, because it
now lands in a browser row as well as a terminal.
Cache-impact: none - the provider-visible prefix and tool schemas are untouched; every new field feeds status surfaces only
Cache-guard: internal/serve/catalog_test.go TestMcpRowCarriesWhatTheServerSaidAboutItself pins the wire shape; no tool schema or prompt text is read or written
Documentation-impact: none - the settings pane and /mcp gain detail on rows the docs describe by purpose, not by field
Both serve fixtures built their pile by driving the old fan-out — one writer,
each conflict extending the last — which is exactly what 9ea39c24d stopped
producing: a branch is now taken over whenever it holds an ancestor of the
save, so those conflicts all land in one file. The sweep then had a single
branch and the session was sitting on it; the sidebar had a single copy and
nothing to fold.
Stage what a writer-keyed lane still leaves instead. A save that would not keep
every turn already in the lane cannot take it over, so transcripts that diverge
at the same index get files of their own: the sweep writes the fork the session
is still on first, and the sidebar's three panes each carry the conversation
somewhere else. No assertion changed — only the way the pile gets there.
The comment on siblingRecoveryBranchWithDigest still described the retired
behaviour, so it now says which cases put the same turns in two files.
Documentation-impact: none - a test fixture and a comment; no surface changed
A conflict that could not be rewritten forked a recovery branch, the
controller committed to it, and the next mid-turn autosave forked again from
there: one file every 30 seconds for as long as the turn ran. A field report
carried 30 of them from a single 25-minute turn, each one a sidebar row.
Two identities decided where a conflict lands, and both were instance state.
The isolated lane was a token minted per live Session, so a resume, a runtime
rebuild, or a reopened pane — exactly the moments a conflict recurs — started
a lane of its own; fixedWriterRecoverySessionPath already keyed the lane to
the writer, but nothing outside its own test called it. Reuse of that lane
then asked whether the bytes on disk were the ones this Session last wrote,
which a Session that had just been rebuilt can never answer, so every tick
rotated the lane and allocated another file.
Both are now semantic: the lane is the writer's, and a branch may be taken
over exactly when what it holds is an ancestor of the save — the rewrite
loses nothing, whoever wrote it. Session.recoveryLane survives as the
override allocated only when the writer's lane holds a transcript this
session would not preserve.
The lineage GC fixture built its chain by driving the fan-out, so it staged
the pile explicitly instead: what older builds left on disk still has to be
reclaimable.
Cache-impact: none - session persistence only; no provider request or prompt prefix is touched
Cache-guard: internal/agent/save_recovery_fanout_test.go asserts one file across eight conflict ticks
Documentation-impact: none - no user-visible surface changed; the fan-out was never documented behaviour
Selecting /effort on a kind="anthropic" relay wrote thinking="adaptive" into
the user's config, so the next request carried thinking.type=adaptive with
display=summarized, output_config.effort, and a 64K output budget. Those are
Anthropic's own fields; a relay that never implemented them answers 5xx, and
the persisted mode kept it failing after the level was cleared.
Depth is now a declared contract, not an inference from Kind: first-party
api.anthropic.com, an explicit reasoning_protocol="anthropic", a declared
supported_efforts depth vocabulary, or the preset_id an installed curated
entry records. Everything else exposes the binary auto|enabled|disabled menu
and receives thinking.type alone. A level persisted outside the resolved menu
goes dormant the way a Kimi K3 protocol switch already retires one, and an
adaptive mode nothing declared falls back to the provider default -- so an
already-broken config heals without a migration.
The frontends stop writing provider knobs: cli and serve no longer set the
thinking mode as a side effect of an effort edit, and the resolution moved
into the provider, which is the only layer that knows the wire. Probe now
carries the base URL into the entry it reads capabilities from, so what the
setup panel offers is what the runtime will send. GLM, LongCat, and the
undeclared-gateway menus collapse onto one binary-thinking helper.
Cache-impact: none - provider request shaping only; the system-prompt prefix is byte-identical
Cache-guard: internal/boot/anthropic_contract_test.go asserts the request body through boot.NewProvider
Documentation-impact: updated - docs/REASONING_PROVIDERS.md and its zh-CN twin gained the Anthropic-contract section
A hook that tests an unset variable is not merely broken: the expansion is
empty, the test around it silently succeeds, and a guard written to block a tool
call passes every call instead. Nothing in the transcript says so.
Doctor now names Reasonix-namespaced variables a hook reads but will never be
given, and points at where the payload actually arrives. The references come
from the shell AST, so a $NAME inside single quotes stays the literal it is.
The plugin hook environment moves to one definition shared by the injection and
the check, so the two cannot drift.
PreToolUse runs before every tool call, so a hook broken on this host filed an
identical notice on each one for the rest of the session. The second copy
carries nothing the first did not.
A hook now surfaces a message only when it differs from the one it last
reported, keyed by hook so the record is bounded by how many are configured
rather than by how often they run. Blocks always surface — the message is how
the user learns why a turn stopped — and editing hooks clears the record, since
a message suppressed against the old configuration says something new about the
new one.
A settings hook names no interpreter, so the Windows spawn path matched it
against a handful of known shapes — a batch file, an explicit `sh -c`, a .sh
script — and handed everything else to cmd.exe. A hook built from a herestring
and a pipeline is none of those shapes, so it arrived at an interpreter with no
single-quote quoting, no $ expansion and no here-documents, and failed on the
first word it did not recognise.
Whether a command needs a POSIX shell is now read off its AST rather than its
shape: single-quote quoting, $ expansion, command substitution, here-documents.
What cmd.exe does share — && chains, pipes, double quotes, plain redirects — is
absent from that list, so a batch-style hook keeps the interpreter it has had.
The same predicate answers CheckRuntime, so a host without bash is reported by
doctor and named at spawn time, instead of surfacing as cmd.exe's complaint
about whichever word happened to come first.
A stdio MCP child can exit long after a healthy handshake — a crash, an OOM
kill, a database driver aborting. The transport latched that read error for
good and the Host kept handing out the dead connection, so every later call
repeated the same EOF with the stderr tail from startup attached. That reads
like a server that never started, and only restarting the session cleared it.
The transport now marks a connection that ended before the request was written,
and a reconnecting wrapper dials a replacement behind the same handle. It is
serverProxy's trade one layer down: a stable handle, a rolling backend. A death
mid-request stays unmarked, because the server may have run the call already.
Concurrent callers share one dial, a replacement re-clears the launcher lock and
project launch grant, and live progress tokens move to the new connection.
The client's RPC and session block moves to client_session.go so every dispatch
can name the connection it targets — a replacement has to complete its own
handshake before it is published, or it recurses into the reconnect.
The previous commit hung the hint on UseCapabilityTool.Execute, which a
capability call never reaches: resolution hands the target back to the agent,
which runs it through finishToolExecution. The hint was dead code, and a
delegation run confirmed it — the rejection still read `unknown field
"items"` and the model still spent its round trips on inspect and the docs.
Moving it to the common execution path also makes it uniform: every tool now
answers a contract violation with the contract, not just capabilities. It
lands after the blocked check so a refusal does not collect a parameter list
it has no use for.
finishToolExecution was 118 lines and this pushed it past the 120-line limit,
so the hook notification it ended with moves to tool_receipts.go beside the
other post-execution bookkeeping.
Verified against a live provider: a docs call missing its operation now reads
`operation is required; it requires "operation"; it accepts "audience",
"language", "limit", "operation", "path", "query", "section_id"`.
A capability's parameters are not in the system prompt the way a built-in
tool's are, so the model learns them by being wrong. One observed delegation
run called fleet with "items", was told only `unknown field "items"`, and
spent five round trips finding the name "tasks": an inspect, a docs call that
was itself rejected for a missing "operation", then a search and a read.
The failure now names what the schema says — the parameters that are not in
it, the required ones that are absent, and the full accepted set. It reads
the capability's own schema rather than the error text, and stays silent when
the arguments fit, so a failure the capability reported for its own reasons
does not collect an irrelevant parameter list.
Booking the failure moves to usecapability_hint.go with it: usecapability.go
is 877 lines over the file ceiling, and a change may not widen that baseline.
Three leading-directive tables were the only live entrance to the two-model
planner, and they matched a prefix with no word boundary and no idea what the
sentence was about. Probed on nine requests, six misrouted: "make a plan.md
file", "make a plan_test.go that covers the contract", "give me a plan.json
schema" and "先出方案文档提交到 docs/" all asked for a file to be written, and
"plan first-class support for windows paths" matched "plan first" outright.
Each one spent a planner round on work the executor was being asked to do.
The entrance is now host syntax, the way plan mode already works:
PlannerRouteMarker rides at the front of the turn, routes to plan_and_execute,
and is stripped before the model sees it. A frontend prepends it when the user
asks for the workflow; e2ebench's -force-planner uses it instead of putting an
English sentence in front of every benchmark prompt.
Verified against the real provider with planner_model configured: the marker
yields planner 6 / executor 6 usage calls on a task that runs executor 4 alone
without it. normalizePlannerText, hasLeadingDirective, plannerDirectiveText and
its quote scanner leave with the tables — 117 lines.
explicitSkill matched six prose forms in two languages beside the host's own
/name syntax, every one of them demanding "use <name> skill" with no article.
Probed: "use the review skill on this diff" — how anyone writes it — did not
match, so the prose arms caught nothing they were added for.
explicitMCP was worse than useless. It matched "<server> mcp" anywhere in the
message, so "don't use the github mcp server" and "别用 github mcp" both
returned prefer for the server the user had just declined. Naming the tool now
means naming the identifier the host minted, mcp__<server>__<tool>.
Nothing is lost by this. routeEntry's own comment already said a capability
nobody named and no trigger matched is left to the model, and SemanticRouter
does exactly that whenever deterministic routing finds no require/prefer hit.
Author-declared triggers and negative triggers are untouched: those are the
capability's own contract, not the host guessing.
The two comment-prefix turn tests asserted the runner saw the input byte for
byte, which a transient block ahead of it breaks. They pin the turn and the
text now, not the absence of a prefix.
The previous rule was two constants and a tiebreak — Han >= 4, or Han >= 2 plus
CJK punctuation or an opening Han character. Nothing said why 4, and the
tiebreak was still an inference about a request rather than a reading of it.
It now weighs the two scripts on the prose that is left after code tokens are
set aside. Identifiers, paths and filenames carry no language: a Chinese
request that names parser.go is still Chinese, and that embedded English is
exactly what the old thresholds were fighting. Their shapes are structural — a
path separator, a dotted or underscored name, an internal capital — so no list
of extensions or keywords decides which token is code. Han characters are then
compared against Latin words, not letters, because one Han character carries
about what one word does; comparing letters would call every Chinese request
that names an English symbol English.
On 22 cases, including three that ran against the real provider, it decides all
of them correctly, where the retired cue list missed five of ten.
Measured first that the host has to decide at all: with the injected block
removed and only the standing "let this also guide the language you think in"
policy left, the model reasoned in English on all three Chinese prompts — 2%,
0% and 0% Han. With the block it is 40%, 64% and 51%, unchanged by this rewrite.
chineseReasoningLanguageCues held 30 common Chinese words, and most of them
were request verbs — 帮我, 看看, 修复, 实现, 优化, 排查, 处理, 继续. That is not
language detection, it is guessing that a sentence is a Chinese request, and it
fired on English ones that merely named a term: "grep for 问题 in the logs",
"rename 代码 to code" and "Add a 中文 test" all switched the visible reasoning to
Chinese, because the quoted term is exactly the kind of word such a list holds.
The band it guards is narrow — two or three Han characters with no CJK
punctuation; above it the script count already decides. In that band what
separates the two cases is which script opens the request, which is an
observation about writing systems rather than about what the user wants. On the
same ten cases it misfires once instead of five times, and the one it still
misses (one Han character) is below the threshold either way.
This stays an inference, not a structural fact: the guess-free path is the
explicit reasoning_language setting, which already outranks auto. Getting it
wrong costs the language of visible thinking and nothing else.
highRiskToolHints matched four substrings anywhere in a tool name, so
plugin_lint and list_plugins were privileged mutation surfaces while the real
plugin tools they were meant to catch already arrive under the namespace the
host mints for them, mcp__plugin_<pkg>_<server>__. The "plugin" fragment
caught nothing the mcp__ prefix did not, and cost false positives.
Now it is the prefix the host itself creates plus two exact built-in names.
Four free-text tables decided plan-only and plan-for-approval by scanning the
whole message for words in two languages, with a suffix-based negation check
bolted on. Probed against requests where planning is the subject rather than
the instruction, three in ten misfired: "add a test for the plan contract",
"document why we do not implement the plan cache" and a Chinese request whose
first word is 实现 all routed to plan-only. plan-only persists a no-op and ends
the turn, so each of those is work silently not done.
Both routes already had a structured source. plan-only has explicit plan mode
and a leading directive the user typed; plan-for-approval has the planner's own
structured exit, plan.RequiresApproval, set after it read the request —
coordinator.go has honored that for every planner turn all along. The tables
were a second, unreliable entrance to states the host could already reach.
So the body scan retires. A leading directive still routes a stated "give me a
plan" (the Chinese "给我方案" was missing its English counterpart's entry and is
added), and whether that plan stops for approval is the contract's answer, not
a phrase match. containsAnyLexical, containsLexicalTerm, containsNonASCII and
plannerApprovalNegated leave with their last callers.
highRiskPathHints substring-matched 35 English words against every mutated
path, and High risk forces a review plus a security_review subagent before a
turn can end. Measured against this repository: 326 of 1,314 non-test Go files
scored High, 72 of them on a spelling accident alone — phasetrace.go matched
"race", conclude_blocked.go matched "lock", meterconfig.go matched "config",
and every file under sandbox/ matched "db" through san-db-ox. A table that
cannot tell internal/auth from session_write_authority.go was deciding when to
spend two subagent runs.
Sensitivity is not readable from a path, so the host stops guessing and the
project declares it, through the mechanism already there for host checks:
`- sensitive: <glob>` bullets in the same "Reasonix host checks" section,
matched with the shared doublestar semantics in fileutil. Undeclared paths are
ordinary production code, which still demands a structured review or
host-proven verification plus diff inspection. The structural triggers are
untouched: an opaque write the host proved but cannot name a path for, ten or
more paths at once, and privileged tool surfaces all still score High.
This repository now declares its own nine boundaries, so its gate holds where
it matters and stops firing on trace files: 78 files score High instead of 326.
Nothing had ever A/B'd the effort level, and high was the shipped default.
Across 81 paired task-runs on three corpora it buys no measurable accuracy:
73/81 solved at high against 74/81 at low, while low finished faster on
66/81 (p=4e-9) and cost less on 68/81 (p=2e-10) — roughly 20% cheaper and
20-36% faster in aggregate.
The strata matter more than the total. Two runs of the e2e suite agree
(22/23 both, 18/23 and 19/23 sign tests each time). verification-stress is
not saturated at 15/20 solved, so an accuracy gain had room to appear there,
and both arms solved exactly 15. The hardest mode available, -anchor wrong,
also failed to favour high: low solved 15/15 against high's 14/15, and
high's one loss was accepting the planted wrong hypothesis in three rounds.
Not established: real-repo long-horizon work. SWE-bench Verified is the
discriminating test and does not run on this machine (no Docker, x86 images).
deepseek-pro is unchanged — it exposes no low level. /effort and --effort
still override per session.
`reasonix run --auto` refused inline interpreter code, command substitution
and here-doc-fed interpreters, because static analysis cannot read what they
would run. Unattended there is nobody the refusal defers to, and it stopped
nothing: on 16 of 17 refusals across the e2e suite the same code ran anyway
a round later, 15 of them through the write-a-file-and-run-it path the
refusal message itself prescribes. The gate only bought a round trip, and it
bought a lot of them — 17 of 205 rounds, 8.3% of the run.
Flipping it (measured with the equivalent config flag, three paired arms):
rounds -22 to -31%, prompt tokens -23%, tool failures -61%, solve rate
unchanged at 23/23. Scoped to the headless auto gate, which only
`reasonix run` builds; desktop and serve use the interactive one. The waiver
covers the shape-based human requirement alone — deny rules, explicit ask
rules and the sandbox boundary are untouched, and ask/dontAsk still fail
closed, all pinned by tests.
Both were absent from the read-only tables, so `gofmt -l .` and `env | grep X`
counted as writes and auto mode blocked them. They belong there under the rule
the tables already use for find, sort and go env: the program can read, and the
arguments decide whether this call does. `gofmt -w` rewrites in place and env
running a program can no more vouch for it than a shell can, so both stay out.
gofmt's absence had a cost on record. Three evidence tests used `gofmt -l .` as
their example of a command the host cannot prove read-only, and one carries the
incident that motivated naming the segment in a block message: "One observed
delivery run was refused three times running by the unnamed version: it rewrote
the command, moved to '&&', then to ';', and every refusal read identically."
The refusals were the symptom; the missing table entry was the cause. Their
examples move to sed, which the tables exclude on purpose because it writes
through a script language nothing here parses.
Answering "is it worse than 1.0" means running one harness against two
binaries, and everything that makes the two binaries different also makes
them read their configuration differently. Each difference produces a
quietly different experiment rather than an error, which is the expensive
kind: v1.0.0 has no --auto, ignores REASONIX_HOME, reads its key from the
process environment, and resolves a bare provider name against whatever
config file its own version understands.
The script asserts what it cannot control. Both arms run one smoke command
first and must report the same currency — the run's own evidence about which
provider it reached — normalised because ¥ and CNY are one currency spelled
by two versions. The smoke runs from a scratch directory, since a working
directory pulls .env files and convention dirs into resolution and the repo
root offered the two arms different provider sets.
CompoundLeafCommands only marked a statement compound for the chaining
operators and the control structures. A plain `a; b` therefore fell between
the two classifiers — the single-command one refuses it for containing shell
syntax, and this one refused it for not being compound — so `echo hi; pwd`
counted as a write and auto mode blocked it.
That is the same gap this function's own comment records having closed for
pipelines: "Without this it fell between the two and every `… | head`
counted as a write." Semicolons were left on the other side of it.
Measured on the 24-task e2e subset: bash calls blocked by permission policy
dropped from 7 to 3 across the three worst tasks, and their tokens per solve
fell 42%. Leaves are still classified one by one, so `ls; rm -rf /`,
`ls > out.txt; pwd` and `pwd; python3 -c ...` stay blocked.
verification-stress ships 20 graded tasks and is run by the same suite
runner, but TestSolvableCorpusSeedsMustNotGradeClean only ever loaded
benchmarks/e2e. A grader there that passes on the pristine seed scores the
same whether the agent solved the task or never started, and reports 100%
forever with nothing to catch it.
All 20 seeds fail today, so this locks in a property the corpus already has.
Checked by replacing one grader with `exit 0`: the guard fails that task.
Saying only "unreported" leaves the effort ladder unmeasurable on the
default provider entry, and effort is the largest single lever the digest
can see. The host receives the thinking text either way, so the digest now
reports the characters it actually got.
Across three real arms of the same 23 tasks it separates them cleanly:
high 140,692 chars with slow rounds at 44% of model time, low 47,317 at
13%, disabled a true 0 tok at 12%.
DeepSeek's Anthropic-compatible endpoint folds thinking into output_tokens
and reports no reasoning count; its OpenAI endpoint reports
completion_tokens_details.reasoning_tokens for the same model. The default
provider entry is the Anthropic one, so the Cognition line read "reasoning
0 tok" and "slow rounds ... 0 reasoning tok" on runs whose trajectories are
full of streamed thinking — asserting a measurement nobody took, on the
39% of model time those rounds account for.
The trajectory already carries the second signal: reasoning events. Thinking
that streamed with no count is missing, not zero, and the line now says so.
A call the host stopped before launch carries errored=true, so it fell past
the mutation branch, was not bookkeeping, and was not a duplicate — which
left it in evidence_gain, a productive outcome. Round efficiency therefore
read 99% useful on a run where 8% of rounds were permission refusals, and
the largest single waste source in the suite stayed invisible.
Re-rendering the same 82 rounds: useful 81/82 (99%) with 1.6s wasted
becomes useful 71/82 (87%) with 21.6s, of which refused x10 is 20.0s.
The work-practice prompt and every headless bash refusal tell the model to
keep scratch under $TMPDIR. The file writers do not expand it, so
write_file({"path": "$TMPDIR/check.py"}) created a literal "$TMPDIR"
directory inside the workspace and reported success — the opposite of what
the caller was told to do. Observed on 5 of 23 e2e tasks; each one then
spent three to five rounds discovering the junk and moving it out.
resolveSessionTemp substitutes only a leading segment, and only the exact
spellings sandbox.SessionTempEnvKeys exports to bash, so this closes a
contract the host itself opened rather than adding a shell expander. The
generation is created lazily by whoever needs it first, usually bash, so a
writer that names the directory acquires it too.
VERSION is the tag with only "studio-" removed, so it keeps the v — the
lookup asked for release-notes/studio/v2.0.0.md while the file that exists
is 2.0.0.md. 2.0.0 published with the standing installation text alone and
none of the notes written for it.
The dry run that was supposed to catch this set VERSION=2.0.0 by hand
instead of taking the value resolve produces, so it exercised a path the
release never takes.
The lookup now strips the v, which keeps notes files named by their semver.
The Windows build failed again after the payload moved out of /tmp. The path
makensis printed was a clean D:/a/... one and the file it named was there —
curl had written it and the non-empty check had passed — yet File still
reported "no files found".
That is the message File prints when its argument matched nothing as a
pattern. It splits directories on backslashes, so a bare forward-slash path
is one long filename to it. MUI_ICON composes "${PAYLOAD}\appicon.ico" and
compiles earlier in the same script without complaint; WEBVIEW2 was the only
member handed over as a whole path.
WEBVIEW2 is now a flag and File composes the path the way the binary, the
icon and the SPA tree already do. Packaged locally with makensis 3.12.
The Windows build failed at the WebView2 bootstrapper: curl wrote it into the
mktemp directory and the check for a non-empty file passed, so -DWEBVIEW2 was
defined, but makensis reported "no files found" for it.
Both are true at once because only curl is MSYS-aware. /tmp maps through the
user profile, and converting it for a native program yields an 8.3 short path
(C:/Users/RUNNER~1/...) that makensis cannot open — while $ROOT in the same
command line converts to a plain D:/a/... path and works. The payload now
lives under the repo, where that conversion has already proven itself.
CI never covered this: Windows built with --shell-only, and the installer had
only ever been packaged by makensis on macOS.
acquireServeLock failed with "create serve lock: file exists" whenever the
owner released the lock between a waiter's failed mkdir and the stat that
follows it. The stat then finds nothing, and the code read a missing
directory as a reason to fail rather than as the lock having just come free.
That line is the only source of the message and LockDir is created by mkdir
alone, so it cannot have been "not a directory": the ubuntu CI failure of
TestEnsureServeSerializesConcurrentClients has no other path to it. The
window is narrow enough that 200 local runs under -race did not reproduce it.
A stat that finds nothing now falls through to the same poll every other
contender already takes.
The release body was one fixed template, so 2.0.0 would have published a
first release that said nothing about what it is. A version's notes now live
in release-notes/studio/<version>.md and the workflow appends the standing
text about signing, installation and self-update to them.
Publishing without that file still works — it warns and carries the standing
text alone — because a missing note is not a reason to fail a build that is
already signed and verified.
2.0.0's notes are this line's first, so they read as an introduction rather
than a diff: what the workspace does, how models and accounts are named, what
extensions may redraw, and the three limits that outlive the release.
Four descriptions had drifted from the code that overtook them, and the
release notes are the ones users read:
- the GitHub release said Windows and macOS were both unsigned and that
self-update was unavailable, while the macOS job now fails closed without
a Developer ID and all three platforms update themselves;
- studio-manifest's package comment said platforms stays empty, which is
what turns self-update off, while run() has been filling it;
- studio-build.sh said the Windows artifact is a portable archive because
there is no NSIS installer, which the script itself now builds;
- STUDIO_RELEASE.md carried a whole "Self-update is not available yet"
section and listed the missing installer as a known gap.
Windows staying unsigned is the one claim that survived, so it is still
stated — SignPath allows one origin and this branch is not it.
Library validation was left enabled, which neither codesign nor notarization
reports — it surfaces on a real Mac at launch, and this line had never produced
a signed build to find out on. The desktop line's set is the only one in this
repository a signed Wails build has ever launched under, so the first signed
Studio release uses it rather than an untested tightening.
studio-build.sh signs with a Developer ID when the keychain holds one and
ad-hoc signs when it does not, and the workflow never staged one — so every
macOS artifact this line could have published was ad-hoc signed and
un-notarized. Studio declares SelfUpdate: true, which promises a replacement
bundle Gatekeeper still opens, so the gap would have surfaced as a broken
update rather than a refused first launch.
The desktop line's own step, unchanged: one Developer ID signs any bundle
identifier its team owns, and all five APPLE_* secrets are repository-level,
so the build job reads them without an environment. Official macOS builds now
fail closed the way the desktop line's Authenticode gate does.
node:fs typechecks only where @types/node is installed, and the frontend does
not install it — the gate passed locally on a stale node_modules and failed the
moment CI resolved the lockfile from scratch. import.meta.glob reads the same
files with types the project already has.
The named steps stopped at 1.3, which is a 1080p answer: on a 2560 display it
leaves the transcript around 150 characters to the line, and there is no step
anyone could have named in advance because what a 2560 display wants a 3840
one does not. The range takes over past the names rather than the list
growing a tail of numbers, and it reaches 2.5 safely only because the layout
now folds on the room it actually has.
Not doing: capping the column width. tokens.css records that a 900px --doc
was tried and taken out because it hung the flow in the middle of a wide
window, and the 68ch measure was refused for the same reason. Raising the
scale shortens the line by itself, since the columns beside it are fixed.
A media query answers for the real viewport, and the zoom setting does not
move it — at 1.3 the interface is a third larger while the layout still
believes it has the whole screen, so the columns never give way when they
have run out of room. Measured: innerWidth reads 1920 at every zoom, and the
1200px query returns the same answer at all four steps.
document.body is already laid out in the scaled space, so its content box is
the viewport divided by the zoom with no arithmetic anywhere: 2133 at 0.9,
1477 at 1.3, 960 at 2.0, exact at each. viewport.ts reads that and publishes
which columns have folded; the stylesheet names the fold and never the
number. Two things move it, a resize and the zoom setting, and each calls the
one derivation rather than keeping a copy of the thresholds.
Container queries would say this in CSS alone and are the better answer once
Safari 15.6 is no longer a target — it still is, which is also why there is
no nesting here.
The vh compensations come with it: those lengths measure the unscaled
viewport, so the model picker's cap rendered 1150px tall on an 855px screen
at the ceiling this makes reachable, with its tail past the edge.
Seventeen keys the interface asks for were never in the catalogue, so scope
and server-onboarding rendered Chinese to an English reader. The catalogue's
own header says a test is what keeps it from staying incomplete quietly —
that test did not exist. It does now: it reads every t("…") in the source and
fails naming the key and the file it came from.
It initialised an STA apartment and then let the goroutine migrate, so under
load the WebView2 environment was created on a thread that had never called
CoInitializeEx — the CI-only "CoInitialize has not been called". The package's
own init() already locks its thread before initialising COM; the test now does
the same. Its two subtests become plain closures for the same reason: t.Run
would run them on their own goroutines, and a COM object answers only to the
thread that made it.
"echo ok | sh -c 'exit 4'" asserts PIPESTATUS is [0 4], but the right side
exits without reading: when the machine is loaded enough for it to win, the
echo takes SIGPIPE and reports 141. Measured both ways locally — a left side
that writes late reports 141 every time, one that never writes reports 0. The
case is about the last command failing while the first succeeds, so it uses a
left side that does not write.
dialAgent's Windows build only ever returns an error, so the shared callback
in auth.go held a branch that could never be taken — staticcheck says the
comparison is always true, and it was right. The platform split now sits on
agentAuth itself, which is what the Windows comment already claimed, and the
IdentitiesOnly filtering that exists only to serve it moves with it.
Several input methods end the composition just before the confirming Enter
arrives, which is what the grace window in useIme exists for. But the
composer only returned early on it — it never stopped the event, so the
textarea did what it does with an unhandled Enter and inserted a newline.
Finish a word, press Enter, and the first press broke the line while the
second one sent. Measured on the running composer: that Enter now reports
defaultPrevented and leaves the text alone, and the next one sends.
Every turn on the timeline is the same shape, so your own message was told
apart from the agent's by a 20px inverted square in the gutter — a screen of
cards later, you cannot find where you spoke. It now carries a filled block
and a left rail, in neutral --text rather than a hue: every hue in this
system already means something (net/deleg/warn/err) and borrowing one would
lie. Newlines survive too, because the shape you typed is half of how you
recognise it.
The window had no copy affordance at all — the system context menu was the
only way to take an answer out of it — so the button under the body is
present rather than revealed on hover, and it appears only once the answer
is whole. navigator.clipboard is undefined where Wails serves over its own
scheme, hence the fallback.
Also routes the thinking label through t(): the catalogue has carried a
translation for it the whole time and the call site was passing the Chinese
string straight through.
The lint job runs repo standards before golangci-lint, so while the former
failed the latter never got to speak. reflect.TypeFor, slices.Backward,
WaitGroup.Go and t.Context, applied by the analyzers themselves.
Splitting rebuildWith out gave every caller an explicit adopt flag, and the
one-line wrapper that used to be the entry point kept compiling with nobody
calling it. rebuildOptions still has its other readers.
The test drives bash to park its output, then follows the pointer. On a
host with no OS sandbox the enforced bash tool refuses fail-closed, so
there is no pointer and the second turn never happens — the failure reads
as "got 1 tool result", naming nothing about the sandbox. CI's coverage
job never installs bubblewrap and had been passing on whichever runners
happened to ship it. The subject here is the pointer, not the jail.
run had grown past the function-size limit carrying a twenty-line asset
middleware inline; it is one decision — hub, or assets — so it reads as a
function. The same edit that grew run also inserted windowNotifications
between grantWindowCapabilities and its doc, leaving four lines about
folder pickers and provider keys sitting above a notification sink.
VersionedInstaller grew a Line field — the host's declaration of what a
release carries — and the installer reads it to know which members to
extract. The linux test still built the installer without one, so both
cases failed at "release unit has no members" before reaching what they
were written to check.
Five files each carried their own k/M rule with different thresholds and
decimal places, four spelled a duration to four different precisions, two
converted bytes, and money was a symbol table glued to toFixed(2). The
English window had no thousands separator anywhere, because every large
number reached the screen by interpolating the raw value.
They now go through one module built on Intl. The kernel already sends
the ISO currency code and says it is preferred over the symbol — nothing
read it, so an English reader saw ¥ where CN¥ was meant, and no formatter
could place the symbol where a language wants it. Percentages take a
ratio and let Intl put the sign; durations and byte sizes state their
precision at the call site instead of each inventing one.
What deliberately does not go through it: SVG path coordinates, the
trajectory export's rounded values, and aria-valuenow. Those are machine
inputs, and a thousands separator in a path attribute draws nothing.
The technical suffixes stay untranslated for the same reason. Intl's
compact notation renders 12345 as 1.2万 in Chinese, which is a quantity
feeling rather than the scale a token count is read on — k, M, KB and s
mean the same thing to both readers, so Intl formats the number and the
domain keeps the unit.
SayCard was building its label by string concatenation and never called
t(), so an English window read it in Chinese. The catalogue already had
the entries; only the call site was missing.
The "notify me when it finishes" recipe was an osascript line, so on
Windows and Linux it was a suggestion that fails the moment it fires.
A starting point that cannot start is worse than one fewer.
The kernel will not pull a workspace out from under a pane that is still
writing, so removing a folder with tabs open just failed — and the
refusal named no pane, leaving the reader to work out which of eight tabs
belonged to that folder. Removal now closes the folder's own panes first,
the way dropping a session already did, and waits for them: the runtime
holds the transcript's lease until it is down.
onClose takes a set rather than one id, since the answer is "these", and
liveIds is asked only while the confirmation is on screen — run state
changes constantly and walking every runtime to render a row is not worth
it. busy() carries params now, so workspace.has_open_panes can say how
many there are; a refusal that says "close the pane first" is only
useful next to which one.
A new source had to be named by hand before it could be saved, and two
accounts on one host both ended up displayed by that host — which says
nothing about which is which. The name is now derived from the host
(derivedName) and prefilled, so nobody has to invent one, and it comes
from a single derivation so "is this still the name we generated" stays
answerable later.
That question is what the picker needs. modelEntry carries Preset, which
marks a name we shipped rather than one somebody chose, so accountLabel
can tell a curated entry and our own -2/-3 suffix from a name typed on
purpose; only when no entry has one does the shared host speak for the
account.
An extension author who edited their runtime's code had to restart the
app to load it. Reloading was already wired — CLI, serve and ACP all
expose it — but it rebuilt through the same options a model or workspace
switch uses, and those deliberately carry the serving generation forward:
the sidecars keep running, the dependency graph is not re-walked, and
skill/command/hook discovery is reused. That is right for a switch, where
the extensions did not move. A reload happens because they did, so
reusing either handed the old code straight back.
Reload now builds its own options: no sidecar manager, no reused
assembly, no previous plan, snapshot or graph. The runtime owner stays,
because it identifies the session lineage rather than the extension
state. Since the replacement now starts its own sidecars and the old
manager is closed right after the swap, the reload also records the new
generation as the base for later reuse — without that, the next switch
would reuse a manager that no longer exists.
Studio had no way to ask for it at all: no port method, no control, only
a stray busy.reload_extensions string left over from the old frontend.
The extensions pane gets a Runtime group above the package list, since
what it reloads is the whole runtime and not one package. The control
carries its own duration — a breathing dot while sidecars restart, a
settle when it lands, a nudge and the kernel's own reason when it is
refused mid-turn — reusing the motion and colour vocabulary already in
the sheet rather than introducing a spinner this interface does not have.
sse.ts and Settings.tsx were both at the file ceiling, so the transport
half of the port moves to sse_http.ts (mirroring how the fixture is
already split) and the reload control to its own hook.
An oversize tool result was snipped head+tail with the middle discarded,
even when the tool that produced it could simply be read on from where it
stopped. read_file numbers every line it returns and names the offset to
continue from; read_subagent_result pages by byte offset. Cutting the
middle out of either undid the paging the tool had just done correctly,
and left the model re-reading args it had already narrowed.
Tools now declare whether they address their own continuation
(tool.Paged). An oversize result from one is cut back to whole leading
lines with a marker saying to read on — nothing is discarded, so it
carries no truncation notice. Everything else still spills to a file and
only truncates when there is nowhere to write.
Two judgements that read wording are gone with it. The limiter picked its
head/tail geometry by matching the tool's name, duplicating the SnipHint
contract those same tools already implement and mis-serving every MCP
tool whose name happened to contain "read"; it now asks snipStrategyFor.
Failure was detected by searching the body for "error:" — which misses
`--- FAIL` and every non-English toolchain, and fires on prose that
mentions the word. The caller knows; it passes the fact.
Frontends could not tell a result that moved to disk from one that lost
its middle: both arrived as Truncated=true. event.Tool now carries an
OutputBound naming which of the four happened, with the original's size
and where the full text lives. Studio says so on the card and reserves
its warning colour for the one case where the model really did not see
the rest. Its fold is a clip against one visual budget rather than three
separate line thresholds, so the rows a grep or ls result reported are no
longer silently dropped at forty.
Users reporting one conversation appearing many times in the sidebar have to be
walked through %APPDATA%\reasonix\projects\<slug>\sessions by hand, and the
answer to "is this a recovery fork, a repeated create, or a dual writer" lives
in the .jsonl.meta sidecars nobody knows to look at.
The script collects it in one double-click: the session listing with content
hashes, the meta lineage (parent_id, recovered, recovery_reason,
recovery_depth), the conflict and lease sidecars, running Reasonix processes,
and doctor output when the CLI is on PATH. It groups the findings by identical
content, by title, by topic_id, and by zero-byte, so the three causes separate
in the report itself. Chat bodies never leave the machine; titles are truncated
and the user is told what is in the zip before sending it.
.gitattributes pins *.bat to CRLF. cmd.exe misreads an LF-only batch file and
runs past exit /b into the payload, which is what the file does on any checkout
that normalizes it — core.autocrlf hides this on Windows only.
The steer told the model to prefer grep, read_file, ls, glob, edit_file and
move_file over shell equivalents. Four of those six never reach the provider
schema: applyUnifiedProviderToolSurface narrows it to CoreProviderToolNames,
which has no grep, ls, glob or move_file — they are reachable only through
use_capability. A recommendation whose names the model cannot find discredits
the whole sentence, including the part that was true, so it reaches for the
shell instead. On Windows the same description handed it the recipe:
"Get-Content (cat)" plus "no head/tail: use Select-Object -First N" is exactly
the Get-Content | Select-Object -Skip N -First 20 paging users have reported.
Name only the three file tools that are provider-visible, drop Get-Content from
the PowerShell mapping (Select-String stays — grep really is unreachable, so
shell search is still the only way to search), and replace the abstract
"prefer the dedicated tools" with the concrete alternative it lost to: what
read_file returns per call, that the line numbers are what edit_file targets,
and what shell paging costs instead. The line count comes from
readFileDefaultLimit so the prose cannot drift from the constant.
bashSteerTools carries the names so internal/boot asserts each one against the
real provider request rather than the declared allowlist; putting "grep" back
fails it.
Live A/B, deepseek-v4-flash over a 2571-line file whose read_file output
exceeds the 32KB spill threshold, 4 runs per arm: shell paging fell from 3/4
runs to 0/4, first file action was read_file in 4/4 rather than 3/4, and mean
bash calls went 2.0 to 1.25. Below the spill threshold the old text already
behaved, which is why this only shows on large files.
Cache: ToolSchemaTokens 4236 to 4247 (+11), ToolsHash and PrefixHash rotate
once on upgrade. SystemHash is unchanged.
Close the window, reopen before the process finished, and the transcript starts
forking into an endless run of recovery copies. Three things had to line up, and
all three were real.
The window vanished on the close button while the process was still saving. That
is the app telling you it has closed, so reopening then is a reasonable thing to
do — and it is what puts two processes on one workspace.
Nothing refused the second one. Ownership of a session was arranged by whoever
happened to build the runtime: the CLI takes the lease before it builds anything
and refuses a held session there, hub.Open takes one when it is handed a path,
and hub.Adopt — the path the shell opens on — took none at all. A window
therefore never held the session it was writing.
And that is what decides the shape of a collision. A session that has bound
write authority at least once fails closed when it loses it; one that never
bound any forks a recovery copy instead (agent/session.go, authRequired). The
window's sessions never bound one, so two writers meant copies rather than a
refusal, and each copy gave the other something new to conflict with.
So: ownership becomes a property of a runtime rather than of the host that
happened to make it — Adopt arranges it exactly as Open does, and a host that
already has its own keeps it. Authority then follows the session instead of
being re-established at each entry point able to move it: it hangs off
setSessionPath, the single place every path change lands, which is what finally
covers the path no endpoint mints — the one a controller creates for itself on
the first turn, which is precisely the session a window runs on.
Being refused is not an error everywhere. A session that was named — CLI
--resume, a click in the sidebar — refuses, as /resume already did. A session
merely inherited, which is what a window opens on, is not worth refusing over:
the window takes a new one. Writing into the held file is what forks it.
The close button now starts the shutdown and keeps the window up for it. Nothing
is faster; nothing lies. Clicking again does not cut it short, because only the
quit the shutdown issues itself may take the window down.
Verified by removing it: with the setSessionPath handler disabled, a pane's own
freshly minted session is free for any other writer to take, and the test says
so. No timeout was shortened and nothing polls — a held session is refused at
the moment of adoption, which is while the caller can still choose another.
Studio saves a new key to the credential store and returns. The session
running at that moment kept sending the old one, because every provider
copied the key into itself at construction and no request ever asked again.
Swapping an exhausted key for a funded one therefore changed nothing: the
same 402 came back, from a key the user had already replaced.
A key is external mutable state and was modelled as an immutable value. The
config now carries where to get it, not what it was — the provider entry
already reads the credential store per call, so passing that method is the
whole live source. An empty answer falls back to the key the client was built
with, so a credential file that momentarily cannot be read does not break a
run that was working.
This is why the save path deliberately does not rebuild: the conversation
must not be interrupted to change a key, and now it needn't be. Config moves
to its own file, which is where its resolver belongs and what keeps
provider.go from growing.
Assigning the guardian role answered 204 and changed nothing. Config writing is
hand-rolled TOML, and the renderer had no line for guardian_model — so the API
accepted it, the file was written without error, and the next load returned the
zero it started from. The UI then drew "follows the main model", which is what
the config now actually said.
It was never only guardian. Walking AgentConfig field by field turns up eight
settings the kernel reads and the renderer cannot write: guardian_model,
guardian_temperature, triage_model, task_cost_budget, task_time_budget_minutes
and goal_token_budget are live and now render; auto_plan and its classifier are
retired and correctly do not.
The test is the part worth keeping. It reflects over every [agent] key, writes
a value, saves, loads, and demands it back — with an explicit list for the keys
the loader is supposed to drop, asserted NOT to survive so that list cannot
become somewhere to park a field the renderer merely forgot. A struct field
added without a renderer line now fails here instead of shipping as a setting
that silently does nothing.
The delegation keys move to their own file rather than growing RenderTOMLForScope,
which is already 750 lines and 155 branches. They belong together anyway: every
one of them names a model other than the main one, or bounds what those handoffs
may spend.
Phase B opens a second connection per server so a slow prompts/list cannot
queue behind a tool call — servers commonly answer one request at a time, and
that isolation is still worth having. But it handed the same timeout context
to both jobs `start` splits: the one that bounds the handshake, and the one
that owns the child. Five seconds later the child was killed regardless of
what it was doing.
A server that imports a data stack needs longer than that to reach its own
entry point, so it was killed mid-import, every time, having never run. What
the host saw was `read: EOF` from a pipe with nobody left to write it; what
the machine saw was a second and third process per server, each opening the
same database before dying. Neither looked like a timeout, which is why it
read as a server crash or a table deadlock.
The handshake keeps a budget — the server's own configured startup timeout
rather than a hardcoded five seconds — and ctx owns the child, as `start`
documents. The regression test uses a server slower to come up than the old
bound and fails against the old code with exactly the reported symptom.
Three times now the interesting logic on this side was verified by bundling it
out to a scratch script, reading the output, and deleting the script: the
reducer's rule for an interrupted turn, the port's recovery path, and the
stream-identity check found by running the real thing. None of it survived, so
none of it defends anything.
vitest, because vite is already the build — the config is the one it reads
anyway, and no environment is needed: both suites are pure logic over globals
they stub themselves, so there is no jsdom to carry.
What the fifteen cases cover is what a type error cannot reach. That a card
which never left its streaming placeholder is not the same as one that ran and
failed, since only one of them can have left the tree dirty. That a replay
lands in order, that frames arriving mid-replay wait for it, and that a result
therefore cannot overtake the dispatch it answers. That a gap nothing can close
is reported rather than rendered as a quiet turn. That numbering which goes
backwards is a restarted server and not a hole.
CI runs it between typecheck and build, so a break shows up before the slower
of the two.
Found by running the real thing: numbering starts over when the server process
restarts, and the client was still comparing against the watermark it held from
the process before. Every number after that is lower than what it has seen, so
the gap check can never fire again — the view stops noticing losses entirely,
and nothing says so.
Numbering that goes backwards is now read as what it is: a different stream.
Inferred rather than carried as a stream id, because a resumed client is never
sent a lower number than it holds — replay counts up from where it left off —
so nothing else produces this. The client resets to the new numbering and asks
the pane to rebuild, which is the same answer it already gives to a gap it
cannot close.
The desktop shell never hit this: its server is in-process and restarts with
the page. A browser pointed at a long-lived `reasonix serve` is where it shows.
A dropped frame used to be a lost frame. The buffer was a channel with a
`default:` arm, so whether a frame survived depended on how full that channel
happened to be when it arrived — a property with nothing to do with whether
anything downstream could recover from losing it. Sixty-four frames of streamed
text were enough to cost a client the approval_request behind them, and no
later frame would ever reveal the hole.
Frames a client cannot afford to miss are numbered now, and the number is the
whole recovery model. SSE already specifies this: `id:` on a frame, the browser
replaying Last-Event-ID on reconnect, and no id at all on a frame that should
not move the resume point. Streaming deltas get none, which is exactly right —
the text after one supersedes it, and numbering them would have a reconnect
asking to be sent output it has already displayed. The desktop shell's bus has
no connection to rebuild, so it asks over /events/replay instead; both arrive
at the same log and the same numbers. A gap the log can no longer close is
stated, and the client rebuilds from /history rather than rendering a hole that
looks like a quiet turn.
The bounds are on different axes because the two classes of frame want opposite
things. A numbered frame has to arrive, so it is bounded by memory in bytes —
frames here span three orders of magnitude and a frame count would bound
nothing anyone cares about. A streaming delta has to arrive *now* or not at
all, so its bound is the live window itself: a queue standing a whole channel
deep means the client is out of step, and a delta behind that backlog would
arrive describing text already on screen. That replaces the two hand-tuned
thresholds this started with, and the watermark on the keepalive closes the
last case — a frame lost at the end of a turn, which nothing later restates.
Verified against a real DeepSeek session, not only in tests: 165 frames, 13
numbered; reconnecting at Last-Event-ID 5 returned exactly 6–15 including the
pending approval_request, and /events/replay returned the same range for the
transport that cannot reconnect. Race detector clean across the package.
Measured against the real model: a bash project whose check is ./check.sh had
its bug fixed, ran the check, watched it pass — and the run exited 1. The
classifier cannot tell a project's runner from a deploy, so it read no check,
and the turn was failed for the host's own blind spot. Anyone driving `-p` from
CI got a failure for work that was done.
Nor did the failure buy anything. The gate reads the writer from this turn, so
the next one — having written nothing — passes with no evidence at all. It
could not collect later what it refused to accept now; it only cost a turn and
a false red.
So the gap now says which kind it is. Nothing ran at all is still the turn's
own miss and still fails. A command that ran and could not be read is an
advisory: it names what went unread and how to declare it, and lets the turn
end. Delivery is untouched, and its stricter static answer still stands.
Print mode dropped every warning, having nowhere but stdout to put one, so the
advisory would have been invisible where it matters most. Warnings now go to
stderr, where the run already reports itself — stdout still carries the answer
alone, and no pipeline changes. That also restores planner fallbacks and folded
user turns to view.
Verified end to end against deepseek-v4-flash: unreadable check → exit 0 with
the warning on stderr and the fix applied; wrote a file and ran nothing → still
exit 1.
Sixty-four frames of streamed text were enough to cost a subscriber the
approval_request behind them, and the turn_done behind that. The buffer was a
plain 64-slot channel with a `default:` arm, so what a frame's survival
depended on was how full that channel happened to be when it arrived — a
property with nothing to do with whether anything downstream could recover
from losing it. A frontend that misses an approval waits on a dialog that
never opens; one that misses a turn boundary stays running forever. Both are
states nothing later restates.
The frontend event sink already knows this — it refuses to let an extension
drop ApprovalRequest/TurnDone-class events for exactly this reason — but the
broadcaster underneath it dropped them on a buffer check.
So the kind decides now, not the timing. Streaming deltas stay droppable: the
text after one supersedes it and /history has the whole thing. Everything else
queues. Frames land on a per-subscriber queue that a single pump goroutine
drains into the channel, which keeps Emit non-blocking — the property the
original design was protecting, and the one worth keeping — while making the
choice of what to lose deliberate. That pump is also the only goroutine that
sends on the channel or closes it, so a client disconnecting mid-send cannot
race a send on a closed channel.
A hard cap bounds the queue for the case where even the frames that matter are
outrunning the client. It sheds oldest-first and says so in the log once: the
newest frames are the ones carrying the state that would let the frontend stop
waiting, and until now every drop here was silent.
Tests cover the three properties: prompts survive a backlog, the survivors keep
provider order, and Emit still does not block on a client that has stopped
reading. Race detector clean across the package.
The branch added a turn earlier told the model to have someone declare the
project's checks in project memory. That is a real mechanism but the wrong
answer to this question: it is project-level setup, it needs the user, and it
does nothing for the turn already stuck. Naming the check is something the
model can do right now, and 3c3e0938f already built the path — complete_step
carries a verification citation, and the ledger corroborates that the named
command ran after the write and exited zero.
So the ask offers that instead, quoting the command that actually ran. What
the model may decide stays one thing: which command was the check. Declaring
checks stays documented as the stronger, optional form, no longer as the way
out of a turn that cannot end.
The command classifier knows a fixed set of checks and deliberately cannot
tell `python deploy.py` from `python run_tests.py`, so a project driven by
its own scripts satisfies nothing it looks for. The gate then asked for "a
relevant verification command" — to a model that had just run one, and had
no way to learn that naming the project's checks is what settles it. One
report spent 357 steps against that wall.
Widening the classifier is the wrong repair: reading a deploy as a check is
exactly what it fails closed to avoid. Instead the ask now tells its two
situations apart. A recognised check that failed already had its own
wording; a command that ran unrecognised now quotes what ran and names the
section that would make it count. That section name is exported from the
parser rather than spelled out a second time.
The declaration syntax had never been documented either, which is the other
half of why nobody found it.
Three defaults, three separate reasons the window was tiring to read.
-webkit-font-smoothing: antialiased was written for macOS, where it helps.
On WebView2 the same line turns off ClearType's subpixel rendering, and
Chinese glyphs lose the fill their strokes rely on: at 13px the page goes
soft. It is scoped to the platform it was meant for.
The soft contrast tier — the default one — put --ghost at 2.7:1 against the
card it is drawn on. Its own comment claims both ends are inside four times,
and they were, measured against --page. But ghost almost only appears inside
cards, and against --raised it sat under the 3:1 floor. Both schemes clear it
now.
13.5px is a size chosen for Latin. Chinese fits more strokes into the same em
and blurs first, so the reading tier starts a step higher when the interface
is in Chinese. The appearance panel's steps move with it, and they live next
to the default now instead of repeating it.
The kernel emits a placeholder dispatch the moment a tool call begins, so the
card is on screen while its arguments are still streaming. Interrupt a turn
inside that window — the model was writing twenty file bodies and the user
stopped waiting — and every placeholder is still running when turn_done lands.
The seal told each of them the same thing: that the step ended without
reporting a result. Twenty identical sentences, every one of them the opposite
of what happened. Nothing was dispatched, nothing ran, no file moved, and the
reason the turn actually ended scrolled off the top.
They fold into one line now, and it is the line worth reading: how many calls
never started, and that the workspace is untouched. A call that was really
dispatched and really did die without a result keeps the old wording. The
difference is the whole point — only one of the two can have left the tree
dirty.
The wire omits `partial: false`, so the full dispatch that follows carried
nothing to clear the placeholder's flag; spreading it left every executed call
marked as one that never started. Folding through a merge that normalises the
flag is what makes the two distinguishable at all.
Every transport held a lock across the whole round trip, so a second call
on the same server waited out the first — and the wait was on a plain
mutex, which takes no context. A slow tool therefore did more than delay
its neighbour: it made the neighbour unabandonable, because cancelling the
turn could not return a goroutine parked on a lock. That is the shape of a
host that sits at idle CPU going nowhere while a long screening run works.
Nothing about it was load-bearing. stdio and SSE already demux replies to
the waiting call by id, writes are already serialised on their own mutex,
and the shared state has its own lock — the round-trip lock only undid what
id demuxing is for. HTTP's lock does guard state, so it now covers the
state and not the network.
MCP's cancellation notification goes out when a call is abandoned. Without
it the server keeps working on a result nobody will read, holding whatever
that work locked, and the next call arrives to contend with its own
predecessor. initialize is exempt: the spec forbids cancelling it.
Every component test passed while the loop was running: each spill was
individually cheap and provably smaller than what it replaced, and nothing
asserted the content ever reached the model. This drives Build end to end —
read a large file, follow the pointer it returns — and checks what actually
arrives at the provider boundary, which is where the promise is kept or lost.
Every front end hand-rolled its own loop over SessionSidecarFiles, which by
construction lists only regular files, so the one sidecar that is a directory
was skipped by all of them — spilled output outlived the conversations it
belonged to, unreferenced and unreachable. Collapsing the three loops onto a
store helper removes the class of bug rather than this instance: hand-rolling
is what let each caller drop something different.
Directories earlier deletes already stranded are aged out by the reconciler
the front ends run at startup.
read_file is how a pointer gets redeemed, so sending its output through the
same gate handed back a pointer to a further file instead of the content —
and the line numbers it prefixes grow the body every round, so the loop
diverged rather than converged. One session spent 1936 reads never seeing a
byte of what it asked for. A fetch aimed at the spill directory now stays in
context; anything else still spills.
The gate also priced a read-back at one more pointer while its own comment
said a whole extra turn. Charging what the turn costs puts the bar where a
single fetch stops recovering a result whole: under it, spilling buys a
pointer and a turn to arrive exactly where leaving it would have. Everyday
bash and read_file output stops leaving context at 1KB.
With neither transcript nor archive there was nowhere to spill and the only
remaining bound was truncation, which discards 99.7% of a 5MB result. Falling
back to scratch keeps that case lossless too.
Two checks outlived what they were checking. The Scoop launch test builds
cmd/reasonix-launcher to prove a desktop install starts through it, and that
command went with the desktop line. apply_darwin.go was left unformatted by the
same change that threaded the bundle identifier through the handoff; the desktop
module's gofmt gate is what catches it, and golangci-lint alone does not.
Studio is the only shell this module builds, and it publishes through
release-studio.yml. What is removed here is the machinery of the lines that no
longer ship from this branch: the desktop build and packaging scripts, the
desktop release workflow, the stable control plane that published CLI, npm and
desktop as one approved set, and the SignPath contract that existed to bind
Windows signing to that control plane's one protected origin.
The two commands go with them rather than being kept as orphans: the launcher
survives a swap that no longer happens, and the legacy migrator moves installs
of a shell that is gone. internal/desktoplauncher had no other caller, and
ci.yml no longer names it.
Nothing here touches what still ships. cmd/reasonix and npm/ stay: the CLI is a
product, not a release line, and removing a publisher is not removing what it
published. The guards that outlived their subject go too — release-workflows.
test.sh asserted properties of workflows this commit deletes.
The bundle swap was already written and Studio's main already dispatched the
detached child that performs it. Two things kept it shut: a package-level
MacSelfUpdate that nothing set once the desktop host was retired, and a bundle
identifier hardcoded to that host's — so the swap would have refused the very
bundle it was meant to install.
Both move into the line. MacLine carries the identifier the swap checks a
downloaded bundle against, and the flag that says whether this line's releases
are signed and notarized at all; a line that ships unsigned keeps the download
page rather than writing a bundle Gatekeeper will refuse. The package-level
variable goes with them, so nothing about a product line is left as process
state one host has to remember to set.
The detached child verifies too, and it is re-executed rather than told what it
is, so the identifier travels as an argument. Reading it back off the bundle
would ask a bundle that fails verification to say what it is.
The manifest resolves the universal archive for both macOS keys — the slices
ride in one file, so a second identical download would be a release asset with
nothing to distinguish it. The disk image stays a human download: handing the
swap an image gives it something to mount, not an app to install.
Studio's Windows install is one executable beside the SPA tree it renders, and
the shared versioned path exists to swap five of them under a launcher while
keeping a directory to roll back to. Adopting it here would have meant a
launcher Studio has no use for, an update helper to outlive the process, and a
current.json layout — machinery for a problem this shell does not have.
So Windows takes the same shape Linux already does: borrow the installer instead
of reimplementing version management. The manifest resolves the installer as the
platform asset, the download path verifies it exactly as before, and the running
build starts it and exits. Going back to an older version runs an older
installer, which is why nothing here asks the direction.
The handoff has one real hazard: for a moment the old Studio still holds its own
executable open and Windows refuses to replace it. The installer waits for that
handle to clear rather than failing, and gives up after twenty seconds so a
genuinely stuck process reports an error instead of hanging.
Two things the manifest must never do, now pinned by test: resolve an archive as
a platform asset — the updater cannot place one — and resolve the .deb as one
too, because writing its files behind apt leaves dpkg and the filesystem
disagreeing.
installlayout gains ActiveMemberPath so current.json can locate a file the
caller names. Which files a version directory carries is a product line's
business, not that package's.
A zip is not an install: nothing registers it, nothing puts it in Start, and
uninstalling means remembering where it was unpacked. Studio now ships an NSIS
installer beside the portable archive, carrying the one binary and the SPA tree
it draws its UI from — the tree has to stay a sibling of the executable, because
that is where frontendAssets looks.
The desktop line's installer could not be borrowed. Its NSIS sources are Wails
build output that the repository ignores, and they describe a five-executable
payload with a versioned layout Studio does not have. The WebView2 bootstrapper
is fetched from Microsoft's evergreen URL at build time for the same reason, and
a fetch that fails drops the bundled runtime rather than failing the release.
Windows artifacts stay unsigned: the production SignPath policy admits exactly
one origin, and it is not this branch.
studio-manifest's downloads now lists what installs itself — the disk image, the
installer, the package. The archives remain release assets for whoever wants
them, but offering one beside an installer only asks the reader to choose blind.
The bundle claimed LSMinimumSystemVersion 10.13 while its binary was stamped
minos 26.0, because nothing set a deployment target and clang defaults to the
builder's own OS. Finder reads the claim and opens it; dyld reads the stamp and
refuses. A release built on a current machine therefore ran nowhere but on
another current machine.
Both slices now carry a measured floor rather than an assumed one: 10.13 is as
far back as this source links, and Apple Silicon did not exist before 11.0.
Info.plist takes the lower of the two, because that is who can open the bundle.
The target has to reach the Objective-C compiler as well — Wails' own objects
otherwise keep the builder's version and warn at every link.
The Intel slice was never a toolchain limitation. It failed because clang was
not told -arch x86_64 and produced arm64 objects, so a universal build is simply
available now.
Signing uses the Developer ID in the keychain when there is one, with a hardened
runtime and the JIT entitlement notarization's hardened runtime would otherwise
deny WebKit — a bundle signed without it renders a blank window. Notarization
follows when credentials are present, and the disk image is signed and stapled
separately: a ticket in the app does not travel on the image, and the image is
what the user downloads. With neither certificate nor credentials the build
still produces a runnable ad-hoc bundle.
Retiring the old shell took desktop/frontend/src/lib/types.ts with it, and the
guard that keeps Go's event payload and the frontend's view of it in step read
exactly that file. The contract did not disappear with the shell — frontend-next
declares the same thing in port/wire.ts, whose first line already says it mirrors
this package — so the guard reads that instead.
Pointing it there is what surfaced the drift. The new frontend never mirrored
memoryCitations, checkpointTurn or the Context* token fields, so nothing on that
side could name them; outcome was a bare string where only two values exist; and
CacheDiagnostics marked as optional five fields the wire sends unconditionally,
which asks every reader to handle an absence the producer never emits.
The assertions themselves drop the Wire prefix they inherited: the shapes are
the same, and holding a new frontend to the old one's type names would fail on
spelling rather than on coverage.
The Wails-bound app and its React frontend are gone. Studio reaches the
kernel through internal/serve's HTTP routes instead of bound Go methods,
so the shell that replaces ~320k lines is next/ plus the SPA it serves.
Three things the deleted tree owned move rather than disappear: the
WebView2 fork's patch guard, the macOS dock-icon safe-area assertion, and
the Windows ICO the resource stamper needs. The fork itself stays — its
mixed-DPI and proxy-isolation patches are Studio's too.
CI keeps one desktop Go gate per platform, now built against WebKitGTK
4.1 the way studio-build.sh links; the frontend legs, the Wails CLI pin,
and the 4.0 leg went with the app.
The desktop release line (release-desktop.yml and the desktop channel in
release-stable.yml) is untouched here: it still serves installs that are
already out there, and unwiring it is release-pipeline surgery of its own.
The privileged install was written into the desktop host: the pkexec call, the
helper's exit-code and phase protocol, and the dpkg ownership probe all named
reasonix-desktop and /usr/lib/reasonix directly. Studio needed the same
mechanism against different names, and copying it into a second host would have
made the security-relevant half of an update path exist twice.
It moves to internal/update, keyed by the line: InstallDeb runs the helper this
line declares, OwnsInstalledPath asks dpkg about the package this line declares,
and the classification of what the helper reported is shared. The desktop keeps
its own error values as aliases, so errorClass buckets and every errors.Is on
them read exactly as before.
Studio's GoToVersion now takes the package channel when dpkg owns the running
binary and the manifest publishes one, rebuilding the updater with the deb kind
so assetIn resolves the package instead of the tarball. A dismissed Polkit
prompt returns to "downloaded" with the verified cache intact rather than
reporting an error the user caused on purpose.
The tarball path is untouched, and platforms stays empty: it stages single files
and Studio's release is a binary plus the SPA tree.
Studio shipped a tarball, which is a download rather than an install: nothing
registers it, nothing upgrades it, and the versioned layout the desktop line
self-updates through stages single files, while Studio's release is a binary
plus the SPA tree it draws its UI from. dpkg carries a tree, so the .deb is the
form Studio can actually be installed and upgraded in.
Everything it names is its own. The desktop package owns /usr/lib/reasonix and
io.reasonix.desktop.update; Studio takes /usr/lib/reasonix-studio and
io.reasonix.studio.update, so the two install side by side without dpkg seeing
either overwrite the other's helper. /usr/bin/reasonix-studio is a symlink, so
os.Executable resolves into the library directory and frontendAssets finds the
SPA beside the real binary rather than beside the link.
The privileged helper is the desktop's source built with Studio's package name,
now a var rather than a const so the build can set it. It is still fixed at
build time — no runtime input can point it at another package — and Polkit
still authorizes one absolute path with one argument.
studio-manifest publishes the .deb under native_packages. platforms stays empty:
that is the tarball apply path, and it cannot publish a tree yet.
The desktop kept its own extensionFormSubmitter interface and asserted the
controller against it, because when it was written SubmitExtensionForm lived
only on the concrete controller. The comment said the alias could go once the
port grew the method. The port has: control.SessionAPI declares it, so every
controller reaching this code already satisfies the assertion.
Left in place it was worse than redundant. A test double that embeds a nil
control.SessionAPI to stand for "port only, no submitter" now satisfies the
assertion through the embedded interface and segfaults in the generated
forwarding method — the panic the test was written to prove could not happen.
The guard goes, the call goes straight to the port, and the case the double
stood for no longer exists.
The shared updater knew the desktop line by heart: the members a release archive
carries, the binaries they install as, and the launchers that survive a swap
were all spelled out inside internal/update. Studio ships one binary where the
desktop ships three, installs under a different name and answers to a different
dpkg package, so every one of those constants was a wrong answer for it — and
two lines that both wrote /usr/lib/reasonix/reasonix-update-helper would have
had dpkg watch one package overwrite the other's helper.
update.Line is that identity, declared by each host and passed in. Extraction
checks the members the line names, the Linux activation stages exactly those,
and the launcher search walks the line's own candidates. A member with no
installed name is one the archive must carry but this version does not persist,
which is how the desktop keeps shipping reasonix-guard for updaters that still
read these archives.
Behavior for the desktop is unchanged: desktopLine() restates what the package
had hardcoded. Nothing here turns Studio's self-update on — that needs the
manifest to list assets, which lands with the artifacts themselves.
Also brings one test comment back under its budget so the standards gate passes.
staticcheck flags parser.ParseDir as deprecated since Go 1.25, and it failed lint
plus all four desktop jobs — the one finding behind five red boxes. The reason it
was deprecated is that it ignores build tags when grouping files, which is what
this guard wants: an Options behind a tag reads the wrong catalog too. Reading the
directory and parsing each file says that outright instead of relying on a rule
that was retired for being imprecise. Probe-tested: still reports the file and
line of an Options that omits IndexURL.
resolveTriageProvider had no callers and only wrapped resolveTriage to drop two
of its results; its reason for existing moves into the doc of the function that
survives. A membership loop becomes slices.Contains, a Split becomes SplitSeq,
and one test comment comes back under its budget.
The bench carried a private estimator described as mirroring the kernel's own.
It did not: for a string with no wide characters, RuneCountInString(s) is len(s)
and is therefore always greater than (len(s)+3)/4, so every ASCII transcript
came back at four times its cost. The scripted provider sizes its window refusal
with that number, so a fold whose real input was ~19K tokens was rejected as
76K against a 64K window, and each generation after it inherited a larger
canonical to fail on.
internal/tokencount already answers this question once, splitting by script
because neither rule survives being applied to the other half. The bench now
asks it instead. Six generations summarize, fold input settles at ~18.9K and the
projection converges rather than the run wedging at generation two.
Describe canonicalized the workspace root but not the gitdir a linked worktree's
.git file points at, so the two sides could disagree on a path that resolves to
the same directory: on macOS a tree under /var/... and its gitdir spelled
/private/var/... produced two digests for one repository. A switch turned off in
the main tree then failed to apply in the worktree, which is the one thing this
package exists to guarantee.
Both sides now canonicalize. The stability assertion that was meant to guard
this compared Key(a) against itself and could never fire; it now compares two
spellings of one folder.
updater_install.go retired the local artifactKindTarball/artifactKindDeb
constants for update.KindTarball/update.KindDeb, but the two //go:build linux
files were not carried over: updater_install_linux.go still named the deleted
constants, and updater_deb_linux.go referenced update.Cached without importing
the package. Neither file compiles on macOS, so the break only ever surfaced in
CI, where it failed every desktop job on all three platforms.
One name for the artifact kind, defined where the cache already defines it.
The corpus graders already skipped a host without python3, but Windows resolves
a Microsoft Store stub of that name on PATH: it exits 0 and prints nothing, so
LookPath succeeded and the graders ran against nothing, reporting the corpus as
broken. Findable is not usable — the probe now wants a version string.
Four serve tests failed their own TempDir cleanup on Windows, which refuses to
unlink an open file. The handles are the usage and history catalogs, and no Close
reaches them by design: they are process-wide, cached per home so one process
keeps one handle. Both already export a closer; the tests just never called it.
installsource asserted an unpacked hook keeps mode 0755. Windows carries no
executable bit — os.Chmod only toggles read-only — so the claim is checkable only
where the bit means something.
completion's scratch filter compared a literal "/tmp/" prefix against a path the
ledger had already normalized, so on Windows it matched nothing and a scratch
write counted as a change. The real filter uses filepath.IsAbs and a folding
compare, so this was the test's assumption, not the product's.
acp's RPC helper allowed one call two seconds. session/new runs a full boot,
measured at 5.2s cold, so the package failed whenever the tree was tested at
once and passed alone on a warm cache. The budget now follows the test binary's
own deadline: a hang detector, not a latency assertion.
Both only ever ran where the assumption happened to hold, and pointing CI at
this branch is what surfaced them.
SaveShellSettings pins by proving the interpreter runs, so "/bin/sh" made the
test a POSIX-only one. It now pins whatever this host offers, using the option's
own Prefer field rather than a guess at the name-to-prefer mapping.
The MCP test isolates the config home, which leaves provider resolution on the
built-in presets — whose DeepSeek entries are kind "anthropic", never linked
into the cli test binary. pinProviderOffline keeps the setup about MCP.
plugin.go was 60 lines past the ceiling it is already 1200 lines over, and the
two groups nearest the surface are each a separate concern: where a connection
change is announced, and the bookkeeping that lets a background connect be
cancelled and its result recognised as stale.
Pure moves within the package, so behaviour is unchanged. repolint is now clean
repo-wide — this was the last finding outside the baseline.
Six are standard library, fixed in go1.26.6: net/url, crypto/tls, net/http,
encoding/xml, encoding/asn1, and x/net/idna's Punycode label check. The seventh
is golang.org/x/image, fixed in v0.45.0 — both modules use it directly, for webp
decoding and for the image compressor.
CI pins no Go version of its own, reading go.mod through go-version-file, so the
toolchain line is the whole change there. govulncheck locally: 7 affected before,
0 after.
The assertion wanted "OCR/image/vision tool"; the note has said "OCR/image
tool" since the wording was simplified, and control's own tests moved with it
while this copy did not. A test that pins a sentence fails when the sentence
improves — the same reason judgements here read structure instead of phrasing.
ImageRoutingTag is exported so a frontend can assert the note is present and
leave what it says to the package that owns it.
Record folded only Paths, leaving Showed and Created in whatever spelling the
caller had. The matchers then compared a folded path against an unfolded one, so
on Windows an output that carried a change never counted as review of it, and
CreatedInTurn — asked with the folded Paths — could not find a file it had just
recorded as created. That is the difference between a cleanup and a deletion.
CreatedInTurn now asks in the same identity it stores, which is required rather
than optional: folding on write alone would have broken it the other way.
snapshotPaths keyed its map by the raw string while its inputs disagreed about
spelling: ledger.TouchedPaths already folds case on Windows, a directory read
does not. The same file landed under two keys, and Receipt.Paths then named it
twice — a Windows mutation counted as two changes.
The ledger already owned the answer in normalizePath, unexported, so agent grew
a second idea of path identity. Exporting it leaves one definition: the snapshot
keys by it and keeps the original spelling for anything read by a human.
TestObservationNamesWhatAnOpaqueCommandTouched was failing on windows-latest for
this reason.
The pointer carried 20 head lines, so its price tracked line width: the bar it
implied ran 2214 bytes at 40-char lines and 8643 at 200. Wider output paid more
to leave context, which inverts what spilling is for.
The preview is now bounded by the instructions it rides on and cut at a line
boundary, so cost is the instructions plus at most the same again. Measured bars
across 20..200-char lines: 1005..1134 bytes. The head-line constant is gone —
the file's own comment already argued a head sketch is a guess by the wrong
party, while the code kept 20 lines of one.
Real run, one read_file of 24.6KB on deepseek-v4-flash: 25800 bytes of context
originally, 2175 with the line-counted preview, 797 now.
The budget was window-relative (window x 3 x 0.10, clamped to 32KB), so on a 1M
window it computed 300KB and always landed on the clamp. Measured against what
spilling actually costs — the pointer, 2875 bytes for 120-char lines — the bar
sat 11x above it, and everything from 3KB to 32KB paid full price for output the
model was already told to read back from disk.
The pointer is a pure function of the body, so build it and compare: no ratio, no
bytes-per-token estimate, no floor. spillPays requires the saving to cover the
cost rather than merely break even, because a pointer read back costs a turn.
This also removes the trap in the low direction — under a 1KB threshold the
pointer is larger than the body it replaces.
Real A/B on one read_file of a 24.6KB file, deepseek-v4-flash: 25800 bytes in
context before, 2175 after. Derived bars: 2214 bytes at 40-char lines, 5445 at
120 — a constant cannot track that, and cannot follow spilledOutputHeadLines
either.
These files never faced a gate: ci.yml ran on main-v2, where none of the studio
surface exists. The desktop test still built agent.RecoveryPauseError, a type the
kernel removed — topicActivityStatusFromEvent only reads e.Outcome, so an
ordinary error proves more: the outcome has to win over it.
build() carried the legacy migration inline at 1814 lines; it moves next to
continuesGeneration, which also keeps boot.go from growing. plugin.go's overage
was the one comment block studio added.
window_fit.go is desktop-tagged but main.go calls fitWindow unconditionally, so
the package built only with that tag. ci.yml's desktop job builds the module
without it, which is also what vet, lint and every editor do. Same no-op shape
as applyDockIcon in dock_icon_other.go.
Rebuilding the argument array from a slice left the old -tags value in place as
a positional argument, so go read "desktop production" as an import path. Only
the linux leg took that branch, which is why two of three platforms passed.
The manifest command's package comment was also over its budget: the -only run
that missed it was given an untracked directory, not the file.
ci.yml ran on main-v2 only, so the kernel changes this branch carries had never
been gated. Studio's own surface exists nowhere else, so it gets a separate
workflow rather than an if-guard inside a file main-v2 also reads.
release-studio.yml publishes studio-v* tags: its own environment, its own
catalog prefix, always a prerelease. latest.json lists downloads and no
platforms because the shared apply path names the desktop line's members, and
a manifest must not claim an install that would fail after the download.
Both update.Options here left IndexURL empty, which falls back to the desktop
catalog: a Studio release would have listed desktop versions and offered to
install reasonix-desktop over Studio. An AST guard fails a new Options in this
package that omits the field, because the failure mode is a new call site.
GoToVersion now asks the manifest whether this platform has an installable
asset instead of downloading one it cannot apply.
The verifier table will never enumerate every project's own runner, and
`./scripts/ci.sh` says nothing about itself — three measured attempts at
having a model read the command string ended in the harness that disproved
them. The information the table lacks is not in the command; it is in the
turn, which read or wrote that script.
complete_step already carries it. Its evidence takes kind=verification with a
command, and the tool refuses a citation whose command has no matching
successful receipt — the model names which command was the check, and the host
proves it ran. Only the readiness gate never asked: it consulted the static
table and the project's declared checks, so a corroborated citation sat in the
ledger while the turn was told to go and verify.
It asks now. What the model may decide stays exactly one thing — which of the
commands it ran was the check. That the command ran, that it exited zero, and
that it did so after the latest write are all still read off receipts, so a
citation cannot manufacture a pass, reach back past a later write, or rescue a
check that failed. Each of those is a test.
Delivery is untouched: there a citation still has to satisfy
IsDeliveryVerificationCommand, and the strictest tier keeps its static answer.
The lease refusal's wording changed with it, so four tests that asserted a
same-process holder is "another Reasonix process" now assert what it is.
Twelve live runs, 37 labelled commands, both tiers. The reverse direction —
asking only where the table already says yes — looked like the answer: it
withdrew every hollow check (`--collect-only`, `--no-run`, `--list-tests`,
`-count=0`) in run after run. It also refused one honest check per run, and
never the same one twice: golangci-lint run, then cargo test, then pytest -k.
Guarding by shape only moved it. Excluding commands whose work is named
elsewhere (`npm run lint`, `make test`, a script path) removed those failures
and the next run refused `golangci-lint run` instead. Excluding test selectors
removed that shape and the failure moved again.
Asking one command eight times says why. go test ./..., cargo test and
golangci-lint run answer CHECK 8/8; pytest --collect-only answers NOT 8/8;
npm run lint answers CHECK 3/8, because what that script does is not in the
command and the model is right to be unsure. The rest carry a small residual
flip — temperature 0 is not determinism on a hosted MoE model, where expert
routing depends on batch composition — and a dozen commands at a few percent
each is the one refusal per run that kept reappearing.
A gate that refuses an honest check a few percent of the time manufactures the
complaint it was built to fix: a turn that verified, told to verify. So the
escalation stays unwired and the harness stays, runnable, with the numbers
reproducible.
The bugs it found are the part worth keeping: classification billed to
compaction at the turn's price, a one-word lookup sampled at the provider's
default temperature, and a nil sink panicking in the deferred emit.
Three runs against deepseek-v4-flash, sixteen labelled commands. It scores
12-14 of 16 where the static table scores 7 — but the wins are not where the
feature was for.
`./scripts/verify.sh` and `bash scripts/ci.sh` are answered NOT in every run.
Those are the motivating case, and the failure is not the prompt's: nothing in
the command string says what the script does, and the prompt correctly tells
the model to refuse when it cannot tell. Naming a runner it does know — tox,
bazel, ctest, make smoke, npm run e2e — flips between runs, and the per-command
cache then freezes whichever answer arrived first for the rest of the session.
So the escalation is unwired. What the measurement is worth keeping for is the
opposite direction: `go test -run NoSuchTest ./...` and `pytest --collect-only`
run nothing, exit zero, and the static table accepts both today, while the
model rejected both in every run. Asking where the table says yes would tighten
the gate instead of loosening it — on two cases, which is not yet a decision.
Three bugs the measurement found on the way, all in the existing classifier
and all fixed here:
- Its tokens were billed to compaction at the turn's own price, so the cost of
a tier that exists to be cheap was reported as the expensive one. They are
reported as classifier usage on the triage model now.
- The call passed the turn's temperature, and OptionalTemperature drops a zero,
so a one-word lookup was sampled at the provider's default. Pinned.
- A nil sink panicked in the deferred usage emit.
The verifier table has the read-only table's problem, and the same fix was
already built for that one. A project whose check is `./scripts/verify.sh` or
`make smoke` gets no receipt the gate will accept, so a turn that really did
verify is told to run a verification — and every rewording is the same unknown
command again.
So the table gets shellsafe's escalation rather than more entries. It stays the
fast path and answers everything it knows; only a command it cannot name, and
only while a write is still owed a check, costs one classification. The verdict
is cached per command because the ledger is audited and the same command has to
classify the same way every time.
What the model may decide is deliberately narrow: whether a command runs a
check. Whether that check passed is read off the exit status — through
PIPESTATUS, so a pipe cannot launder a failure — and no answer from a
classifier can reach it. That split is the reason this is safe to ask at all;
the call is also context-free, so it is a router being asked about a string,
not the turn vouching for itself.
Being wrong here was already possible without a model: `go test -run
NoSuchTest ./...` runs nothing, exits zero, and the static table accepts it
today. The prompt names that class of command as NOT a check, so the
escalation is likelier to catch it than the flag table it backs.
turn_done already carries the kernel's reason. The pane put it in the run
strip's status label — one line, ellipsised mid-sentence, replaced by the next
turn, and absent from the transcript, so a stream error read as the session
having simply stopped. It lands in the transcript as a notice now, in the
kernel's own words: classifying failures here would be the client guessing at
something it cannot see.
Dispatched calls were left spinning by the same path. Whether work finished is
the turn's end to decide, so anything still running when it ends is closed and
says on its own card that it never reported back. A backgrounded command is
untouched — it answers the moment it is launched, so its card has already
settled.
A notice at error level also stops coming out amber next to ordinary
cautions; both rails were already in the sheet.
The effort menu listed auto twice: the kernel's level list opens with it and
the composer prepended another.
A runtime torn down without releasing its lease leaves an owner entry behind.
Every later bind then fails against it, and the refusal names the holder from
the lease sidecar — which this process wrote, so it names itself. The reader
is told to close the other Reasonix window and goes looking for a window that
was never there.
The desktop shell already recovers its own leftovers; the keeper behind serve,
the CLI and ACP did not, so Studio had no way out but a restart. It gets the
same fallback, guarded the same way: a readable info naming someone else is
respected, and reclaim takes the OS lock, which a live holder still holds — a
sibling binding in this same process keeps its lease, as the test asserts.
Whoever ends up refused, the message no longer calls our own pid another
process.
.picker is the app's own menu class — Menu.tsx renders it and app.css sets it
relative. Declaring it again further down the sheet won every cascade that
followed, so an absolute overlay with a float background landed on every menu
in the app, the composer's model picker included.
Naming the folder a listing answers for fixed reading it, not reaching it:
the pane still only spoke for whichever tab was in front, so a switch meant
for a project you were not sitting in cost a workspace change and the
conversation that came with it.
The listings and both switches now take a project. Reads come from that
folder's config and the activation store, which is enough to answer what is
declared and what is on; live connection state stays absent, because only
the session pointed at a folder can know whether its servers came up. The
rows that need the running session — retry, remove, install — are withheld
there rather than shown and quietly acting on the wrong folder. A folder the
shell has never opened is refused: the parameter would otherwise read and
edit any directory's config.
The picker offers each project once. Worktrees collapse onto their
repository, a name that collides gains the shortest trailing path that tells
it apart, and the count of local exceptions is on every row — with 32
remembered folders, the ones worth finding are the ones already changed.
A shell holds several projects at once while the runtime points at one, so
the settings pane silently answered for whichever tab was in front. Two
consequences: the reader could not tell which folder a list belonged to, and
a skill switch — a bare name in the user config — disabled every same-named
skill in every project at once.
Activation becomes one durable store for both capabilities, resolved project
layer before global layer before what the capability itself declares. The
project layer keys on the repository rather than the path, so the nine
worktrees of one repo are one project: a switch flipped in the main tree
still applies in a tree cut from it, instead of vanishing on branch.
Installing stays a global act; how far a server reaches is the separate
question the new local scope answers, without a second storage mechanism.
Every listing now carries the project it answered for, and a row that holds
a local exception says so and offers the way back.
The v1 file is read once and matched by re-deriving the path fingerprint —
the stored digest cannot be reversed into a path, so migration reads rather
than rewrites, and the old file is left untouched for a downgrade.
A sidebar filled with dozens of rows carrying the same title and the same turn
count: not new conversations, one conversation copied. Recovery lanes are per
live Session, so a resume, a runtime rebuild or a reopened pane each start a
new one and the same unsaved turns land in file after file. The depth cap
bounds the chain, never how many siblings one parent may accumulate.
A conflict now lands on a sibling already holding this exact content, and only
opens a lane when none does. Digests come from branch metadata, so it reads
sidecars rather than transcripts, and a path that turns out to hold something
else is never retried — that metadata records the digest at fork time and a
branch written to since no longer matches it.
The divergence itself is reproduced from outside the process, which is where it
has to come from: writers inside are serialised by snapshotMu and guarded
across processes by the session lease, so memory and disk can only stop being
prefixes of each other when something else rewrote the file — a sync client
resolving a conflict copy, a restored backup, a shared home. Distinct content
still gets its own branch; only identical content converges.
The corpus had 67 Python tasks and no Go one, while the agent's own repository
is Go. A compiled language is a different verification loop — a build before
anything runs, go vet, -race, a module path that must agree with every import —
and its defects have no Python analogue: a data race, a += in a loop that is
quadratic where Python's would be too, map iteration order that makes a test
pass only sometimes. Nine tasks cover that half as ordinary members of the
existing classes.
README already required every task to fail on the pristine seed and pass on a
reference solution, but only the no-solution half was enforced. A solvable task
whose seed grades clean scores the same whether the agent solved it or never
ran and reports 100% forever; TestSolvableCorpusSeedsMustNotGradeClean holds the
other 62 to it. All of them already pass. stageSeed now tolerates the optional
workdir the README documents.
Harness metrics move out of the work dir. The agent reads what is in front of
it, and one observed run spent a tool call on .run-metrics-1.json.partial —
snapshots already dropped these files, which kept them out of the grade but not
out of the agent's context.
One observed turn wrote 832 reasoning records carrying 6.5k characters, and a
two-minute benchmark cost a 484KB trajectory whose content was 19KB — 25x
envelope, and one write syscall per record because each is flushed. The only
timestamp any reader consumes is the first: cmd/e2ebench keys time-to-first-
token off it and drops the rest.
Adjacent same-kind increments merge, TS stays the first one's, and the count
and end time ride along. Records drop 86% and the digest cmd/e2ebench prints is
byte-identical across the change. A cap bounds what a kill can lose, and
anything carrying more than its text is left alone so a field added to the wire
later stops merging rather than vanishing into a neighbour.
The sweep removed artifacts one at a time and returned on the first refusal.
The transcript went first and the event log — the authoritative one — fourth,
so a Windows host holding that log open left the conversation neither present
nor gone: the caller saw a 500 while the sidebar row was already unrecoverable.
The marker now goes down before anything is removed, every artifact is
attempted, and whatever survives keeps it for ReconcileCleanupPending.
The guard asked the pane map whether the session was someone's current
transcript, which is narrower than "is anyone writing this file" — a recovery
branch or a mid-rotation session is held without being anyone's current path.
It takes the removal guard instead, so the answer survives the delete; probing
and then removing leaves a window for a writer to arrive and lose its lock file
underneath.
SseHub flattened refusals into their message text, so a coded 409 reached the
screen as raw JSON or as a filesystem error naming a path. It parses the code
now, like SsePort already did.
A transition on grid-template-columns does nothing when the track list holds a
minmax(): that property only interpolates between plain lengths, so the rails
were snapping shut with the animation written and silently ignored. The
interpolation moves onto two @property-registered lengths and the columns read
them; dragging switches it off, or the rail chases the pointer.
Closing a pane becomes awaitable. Deleting a conversation has to close its pane
first and then wait, because the kernel refuses to erase a transcript its
runtime still holds — firing the close off and deleting in the same breath
races the teardown.
perf/panels.mjs measures what has no error to report: a re-introduced minmax()
would put the rails back to snapping without failing anything else.
A false-progress ratio needs a check that ran twice — nothing else can show a
fail→pass edge. Runs where no check repeated reported 100%, which reads as
every claimed advance being fake when the truth is that none was observable.
The digest now counts revisits and says unmeasured below one.
A start delay was one number over two different things. A call that waits
because a sibling is still executing is a serial batch behaving correctly; a
call that waits with nothing running is scheduling cost. Attribution is per
call — whether another call occupied that call's dispatch→start window — so a
batch that mixes both no longer files every delay under the same heading. On a
real run: queue p95 17.9s became queue p95 1ms plus serial wait p95 17.9s.
Splitting the render out of trajectory.go keeps it under the size ceiling.
Delivery rejects `python3 -c` and `node -e` in any arrangement, but that gate
sat last, after every shape block. The shape blocks answered first, and their
ways out all named a call this one refuses: a probe followed the mixed block's
"run that segment as its own call", ran a bare `python3 -c`, and was refused
again for a reason the first message never mentioned.
Moving it first costs no new text and ends the chain. The three arrangements —
interpreter first, interpreter last, interpreter alone — now get the same
answer, the one that says why and points at read_file, node --check, or a
script file.
TestDeliveryProfileBlocksMixedVerificationBeforeItBecomesMutation reached the
mixed block through a `python3 -c` command, which no longer describes what it
tests; it uses cp now and still pins the named segment.
Two faults hid one signal. The fail→pass edge was keyed on the raw command
string, and an agent never re-runs a check byte-for-byte — it writes
`go test ./... | head -60` first and `go test ./... | tail -15` after. The
verdict then came from the receipt's own exit status, which for a pipeline is
head's, so a failing suite read as a success that never needed redeeming.
Objective and Regression therefore never fired in any run, and the
false-progress ratio that divides by them reported 100% every time. Both
answers already existed and this path asked for neither: VerificationIdentity
reduces a command to the check it runs, VerificationOutcome reads the host's
PIPESTATUS classification. The offline digest mirrors the same identity so it
scores the edges the live tracker does.
Same task before and after: objective transitions 0 → 1, false progress
10/10 (100%) → 5/9 (56%).
Ordinary mode names the segment that tripped the block; delivery answered with
one fixed sentence that named nothing. TestMixedBlockNamesTheSegment already
says what that costs — "which is how one block becomes three" — and a delivery
run spent exactly that: refused at calls 6, 8 and 9, rewriting the shape each
time against three identical messages.
It also stopped short of the other half. Ordinary mode's way out is '&&', which
delivery refuses as well, so a run that follows the generic advice earns the
same block again. The message now says so.
The same run after the change: refused once, then split the command into three
separate calls.
parallelisable asked the registry whether a tool is read-only, and bash is
writer-capable in its schema, so no bash call ever joined a parallel batch —
which is most of what an agent runs. The host already resolves a concrete
invocation to read-only after parsing its arguments; permission, mutation
accounting and evidence all act on that fact, and only the partition did not.
Measured end to end: two greps over 32MB files now start in the same
millisecond and finish in 258ms, where serial execution took the sum.
CompoundLeafCommands only treated loops, branches, subshells and blocks as
compound, so a pipeline or an && chain fell between the two classifiers: the
single-command one cannot read several commands, and the leaf one refused to
receive them. Every `… | head` therefore counted as a write, which is the
shape agents reach for constantly.
A BinaryCmd is now compound, so each stage is classified on its own and one
writer anywhere still ends it — `| tee`, `| xargs`, `| sed -i`, `&& rm -rf`
and `tee >(sh)` all stay writes.
99ef4b2f0 removed the archive path and its field on HistoryMessage but left six
readers and a mock behind, so `tsc --noEmit` fails on this branch with seven
errors across bridge.ts, transcriptStore.ts and useController.ts. main-v2 still
has the field, which is why the break is invisible there.
Nothing renders item.archive — the only readers were the store, the controller
and one mock — so the field goes rather than coming back. `pnpm --dir frontend
build` runs tsc, so this would have failed the desktop leg on merge.
timeout_seconds only tightens the host cap, but a run reaching for a long job
asks for the length the job needs: one observed run asked for 600s and 900s
under the default 120s cap. Both were clamped, and the timeout then advised
"raise timeout_seconds" — the number the cap had already overridden.
The refusal now says which cap won and how much of the request it took, and
points at the mechanism that can actually run longer. A run under a 5s cap that
asked for 90s reads it and moves to run_in_background on the next call instead
of asking for more seconds.
Three paths stop a call before it runs, and only two of them said so in
structured form: the batch dependency barrier and bash's own preflight set
execution.failurePhase, while a permission refusal carried nothing but an
error line. A gate that misfires was therefore invisible to every digest —
the agent just retried and the round count grew.
Permission refusals now carry the authorization phase through the same
constructor the barrier uses, and the trajectory digest counts refusals by
the gate that caused them.
POSIX `command -v`/`-V` print how a name would resolve and execute nothing,
which makes them readers like `which`. Grouping them with exec/nohup/sudo
refused every environment probe an agent opens with, and the batch dependency
barrier then skipped the read-only probes queued behind them, so the agent
re-ran each one alone.
Measured on the same task before and after: 26 tool calls to 14, 21 model
rounds to 14, two dependency skips to zero, same conclusion both times.
REASONIX.md told the model to run `go run ./tools/repolint -only ...`, which the
host classifies as an unknown program that might write — so a delivery run that
followed the instruction could not cite the result. One observed run was refused
for `gofmt -l`, reached for the repolint command the file recommends, and was
refused again for the same reason.
A `make` target is the entry the host already recognizes, and Makefile is where
this project declares its checks. Nothing in the classifier changes.
The alternative — letting a project name its own verification commands in config
— was rejected. Delivery deliberately refuses to escalate (see
mixedShapeClearedByEscalation) because it only accepts what the host can confirm
by itself; a config channel would let the audited party define the audit.
An Ask decision with no interactive approver came back as "the user declined
this tool call — ask how they would like to proceed". Nobody declined it, and
the advice sends the model to consult someone who is not there. A headless run
asked to write one file spent two write_file calls on it and closed by offering
the user three choices about the file's contents, none of which was the reason.
denyPermissionApprover now answers with what actually happened. The same run
afterwards refuses once and leads with the permission mode as the fix.
The gate already threaded an approver reason through for exactly this; the
headless approver was the one that never supplied it, while the ask tool has
been saying "No interactive user answered" all along.
The refusal said "use a project test/check/lint command", so a run that had just
been refused for `gofmt -l` reached for `go run ./tools/repolint` — this repo's
own lint command, and refused for the same reason. Naming the category invites
the second wrong guess.
VerificationCommandSummary is already the single source for the accepted set and
already travels with the inline-interpreter block; it now travels with this one
too.
The client posted {text} while the handler reads {goal}, so the body decoded to
an empty string and took the clear branch. Against a running server: {text:AAA}
answers 204 and leaves the goal blank, and a later {text:CCC} erases a goal that
was set. SetGoal and SetPlanMode(false) were never reached.
The endpoint had no test at all. The new one pins the wire key rather than the
status code, since a 204 is exactly what the broken call returned.
`go build ./x && go test ./x | tail` was refused as a maskable mixture, but the
pipe-status probe already recovers each stage's status: a real run of that shape
reports exit 0 and verification failed. The block was guarding against a masking
the host had stopped suffering, and cost a round trip on an everyday shape.
The shape test the probe used to decide whether to inject itself moves to
evidence, so the gate and the probe read one judgement and cannot disagree
about a command.
The exemption covers exactly one masking source. `;`, `||`, and a backgrounded
mutation drop a status before the final pipeline, and no per-stage report brings
that back, so those stay blocked. Delivery is untouched: there a mutation
invalidates the receipt whether or not the exit status survived.
Splitting a long test file scatters one subject's table across files that then
have to be read together, so the ceiling only ever bought a worse layout. The
rule retires entirely rather than gaining an exemption flag; complexity and
struct-state already stand down for tests, and size was the last one that did
not.
The baseline drops the 74 test-file-size entries by hand rather than through
-update, which would have absorbed unrelated debt the tree carries today.
The host cap (bash_timeout_seconds) was the only foreground deadline, so a
command whose cost the model could not predict spent the full cap before
saying anything. A per-call timeout_seconds now rides the same resolution the
host cap already uses: it only tightens, never extends, and with the cap
disabled it becomes the only deadline.
grep and glob each carried a byte-identical clamp; both now share toolTimeout,
which bash reuses by passing its cap as default and ceiling.
A timeout that produced nothing says so — silence and partial output call for
opposite next moves, and the output alone cannot tell them apart — and names
the way out, which differs by whose deadline fired.
ClassifyMutationRisk raises a pathless mutation to RiskHigh only when its
MutationEvidence is MutationProven; anything else falls through to RiskLow.
The receipts rebuilt from a task artifact set Mutation but left the grade
empty, so a background writer recovered after a restart came back as low
risk — exactly the downgrade the opaque recovery exists to prevent, and what
three tests in this package had been failing on.
Both construction sites now share recoveredTaskMutationReceipt, which states
why the grade is not optional. It lives in artifacts.go: the artifact is what
proves the mutation, and jobs.go has no room left under its size budget.
"This argv runs a program written in the call itself" was answered twice.
Permission knew `bash -c`, `sh -lc`, lua, rscript, osascript; evidence
knew node, python, ruby, perl, php and deno and nothing else. So
`bash -c '...'` was code the approval layer refused to audit and an
ordinary program to the ledger that recorded it.
ArgvCarriesInlineCode is now the one rule, taking the wider of the two,
and both ask it — the same move ArgsMakeReadOnlyCommandWrite made for the
arguments that turn a reader into a writer. executableBase went with it:
two identical copies of "strip the directory and .exe".
This is a table, and it stays one: which flag makes an interpreter read
its program from the command line is knowledge about those programs, not
a shape any parser can derive. What it must not be is two tables.
A search that matched nothing came back to recovery as a list of English
phrases to look for: "no matches", "no files found", "0 matches", "not
found", "no results". Four of those five no tool has ever printed. The
fifth worked only because grep and glob happen to print it — a sentence
the host writes for the model, re-recognised as if it came from outside.
tool.NoMatches is that sentence, once, with a writer and a reader. The
guess is gone, and so is the drift a reworded or translated line would
have caused: the gate now reads what the tool actually emitted.
Two rules for one question had drifted apart. The coverage check now asks
whether an output carried the change; the review gate still read command
names, and accepted `git status`, which prints paths and no content, and
`echo internal/a.go`, which prints one path and nothing else. Either was
enough to make a turn look reviewed.
Both are gone. The gate asks for the change's content, exactly as the
coverage check does, and falls back to "the turn looked at something"
only where it must: a mutation from before this ledger, or a shell write
that named no path, is unknowable either way.
That fallback is what the retired table added nothing to. A plain
`git diff` counted because the host classifies it read-only, not because
its name was on a list — and the list could not tell that apart from
`git status`, which is why it accepted both.
`sed -n '1,80p' f` is a mutation to this host. So is `git -C dir status`,
and `mkdir -p "$TMPDIR/probe"`. Not because anything believes they write,
but because proving they do not means reading sed's own script language,
git's global options, or a path that only exists at expansion time — and
each of those answers is a table that covers one spelling and misses the
rest. The cost lands on the turn: phantom changes in the completion
report, a verification owed for a file nobody touched.
A call the host could not classify now takes a whole-workspace scan
before it runs and another when its receipt is written; if the tree is
byte-for-byte as it was, the receipt says so. Nothing is predicted, so
nothing needs a table, and it works the same for awk, perl or a program
written this morning.
The walk is unfiltered on purpose — npm install and a build write exactly
where ignore rules point away, so a filtered scan would miss the largest
writes there are. It skips only the VCS store, which `git status` rewrites
on its own. Past 50k files it reports itself incomplete and settles
nothing, and a backgrounded job never settles: its receipt is written
before the job has written anything. Every one of those falls back to
today's behaviour rather than to a guess.
Measured on this repository: 17ms per scan in a worktree, 126ms with
node_modules and build output present, against ~6.4s per model round.
Permission is untouched — it must answer before the call runs, so it
stays predictive and fail-closed.
A turn that ends by reading its own diff writes `git diff --stat && git
diff`, or puts a `cd` in front, or prints a separator between two halves.
The host asked whether the command's shape implied it had printed a
file — one statement, two arguments, no suppressing flag — so every one
of those shapes was rejected, and a turn that had reviewed its whole
change set was reported with review gaps. It could not be otherwise:
the receipt's output length is the whole command's, so a compound one
could always have printed something else.
So stop reading shapes. When a change is made, the preview the writer
already produced names the lines that differ; when a later call returns,
the host asks whether its model-visible output carries them, and records
the answer on the receipt. Matching is on substrings, so a `+` from a
diff, a line number from `grep -n` and a pager's indent all read the
same — the formats a shape rule would have had to enumerate.
This retires commandShowsContentForPath, commandShowsWholeGitDiff and
their helpers, including the suppressing-flag table and both command-name
switches: 168 lines of shell-shape reading for 60 of content matching.
A read receipt still covers its own path, unchanged.
Verified against a real run: its `git diff --stat && git diff` output
carries both witness lines and counts; the `--stat` half alone does not.
A server showed "not connected" while the agent was using it perfectly well,
and the connect button sat on "connecting…" forever.
Status views refresh on MCPSurfaceReady, and that event was only ever emitted
after prompts or resources finished listing. A tools-only server has neither —
windows-mcp, in the report — so nothing was ever emitted for it, and the view
kept showing the state it read at boot. The kernel was right the whole time:
connecting clears the recorded failure. Nobody was told.
The announcement moves to where the state actually changes. The Host holds the
sink rather than taking one per call, because a status change has no caller to
hand it one: a cache-miss server connects on its first real tool call, in the
background, long after whoever configured it is gone. That is also why the
existing StartPhaseB path could not have covered this — it has no callers at
all, so the prompt/resource announcements never fired either.
Also on the composer: the effort menu listed six rungs for every model, while
the kernel declares per-model supported_efforts and refuses the rest. Picking
one a model does not have was answered downstream with a refusal and nothing on
screen, which reads as a dead control. The menu now offers what this model
actually has.
The check that turns `find -delete`, `sort -o` or `git tag v1.0` back into a
write lived in three packages, and they had already drifted: only permission
knew that naming a tag creates one, so evidence recorded such a turn as having
changed nothing at all. Two of the copies also carried a `sed -i` branch no
call could reach, because sed is not in the read-only tables to begin with.
ArgsMakeReadOnlyCommandWrite is now the one rule, taking the strictest form of
each case, and permission, evidence and the nested-substitution check all ask
it. The unreachable branch is replaced by the reason sed stays out: it writes
through its own script language (`-i`, `w file`, `s///w file`), which nothing
here parses, so a flag check would cover one spelling and miss the rest.
fitted stopped shrinking by a fixed margin when the size became a ceiling, so
the test's own guard — "still not wider than the screen" — was still gated on a
constant that no longer decides anything. It now runs whenever the screen
reported a size at all, which is the condition the assertion was always about.
The prompt tells a run to keep probes out of the repository and now names
$TMPDIR. Bash writes there — that is where the variable points — but
write_file refused it, so the here-document block's own advice ("write
the file with write_file") led straight into a wall. One observed run
worked around it with printf and lost three rounds; an earlier one wrote
its probe into internal/agent/ instead, then had to rm it.
The writers now accept the session's own temporary directory, the same
one bash writes through, and a refused write names it. Its writes are the
kind the host can account for: a path, a receipt, a diff.
That made the second half visible: a probe under $TMPDIR armed the
post-write verification gate and appeared in the completion report as an
unreviewed change, so a turn that touched nothing in the repository was
told it had gaps. What the turn owes is measured on the work product, so
a path outside the workspace is not what the readiness gate and the
report count. Where bash wrote is often unprovable — those receipts name
no path and still count, as they did before.
Confirmed from the report: 125% scaling on 1080p. So the fix that landed —
shrink to fit — was aimed correctly but is only the floor of it, and it corrects
a window that has already been drawn.
Two things on top of it.
The preferred size is now a ceiling. A window opens at whichever is smaller,
1440x900 or most of this screen, where "most" is proportional rather than a
fixed margin: 64px of air is cramped on a 4K panel and generous on a laptop,
while nine tenths reads the same at every size. At 125% of 1080p that is
1382x777 instead of 1440x800 — the earlier version left the width untouched and
squashed only the height, which is the same window in the wrong proportion.
And the window starts hidden, shown from the same place once it has been
measured. Sizing a window that is already on screen is a flicker on every
launch, and on the machines where this matters it would be a flicker every time.
The package does not build in this tree — evidence/taskcontract are mid-refactor
elsewhere in the working copy — so the arithmetic was checked on its own rather
than through the test that encodes it. Still no Windows machine here: what is
verified is the decision, not the platform calls it drives.
Reported from Windows: the title bar starts above the top of the screen, on a
1920x1080 display — so not a small monitor.
Wails sizes windows in logical pixels. That display at Windows' common 125%
scaling is 1536x864 to lay out in, and 150% leaves 1280x720; the default
1440x900 fits neither. Centred in 864 the top edge lands at -18, which is the
title bar exactly. On Windows the frame is off and that bar is drawn by the app,
so what goes off-screen is also the only region that can drag the window back —
there is no recovering from it by hand.
The window is measured against the screen it opened on and shrunk to fit, and
centred either way, since Wails makes no promise about where a Windows window
lands. The arithmetic is a pure function so it can be tested from any platform:
the failing cases here are 125% and 150% of 1080p, which is what shipped.
Untested on Windows itself — I have no machine for it. What is verified is the
sizing decision, not the platform call it feeds.
The folder panel's title was a Chinese string compiled into the shell, so an
English interface opened a Chinese panel. It sits outside the webview, which is
why the frontend's catalogue never covered it.
It reads from internal/i18n now, but through a new Catalog(tag) rather than
DetectLanguage: the desktop interface language is a setting of its own and the
kernel's is another, and one process holds both — installing one would silently
retag the other. Catalog returns a catalogue and leaves M alone, which a test
pins, since the whole point is the absence of a side effect.
The title itself lands in all three catalogues, so the existing completeness
test is what refuses the next one that ships in one language.
A grep that matched nothing exits 1 and prints nothing, so the run saw
`error: command exited: exit status 1` and no more. It could not tell
absence from breakage, re-ran the same search with small variations for
sixty rounds, and collected a recovery steer each time telling it to
diagnose the tool.
A call that printed nothing, that the host proved changed nothing, and
that carries no verification conclusion reported a result: grep,
`test -f` and `git diff --quiet` all report absence that way. Say so in
the body, and leave recovery out of it. A verification keeps its old
reading — its exit status is its verdict, silent or not.
`cat > f <<'EOF'` inside a compound statement fell into the unparsable
bucket, whose message points at read_file and grep — advice for someone
inspecting, given to someone writing a file. The observed run hit it
twice, two hundred seconds apart, and learned nothing in between.
The parser reads a here-document fine; what an approval cannot see is
its body, which is file content rather than arguments. That is a
different gap and now says so, and points at write_file.
A run told only the workspace path prefixes every shell command with
`cd <root> &&` and spells every tool path out in full — 50 of 51 bash
calls in an observed run. The prefix is not only tokens: it turns a
simple call into a compound statement, and the evidence reader credits
neither its content nor a whole `git diff` as review of the change set,
so a turn that did review its own diff was reported with gaps.
The scratch line had the same shape. It says to keep probes out of the
repository and use a temp directory, without naming one; the run reached
for /tmp, was refused, and wrote its probe into the repository instead.
$TMPDIR is the session-private directory the host already provides.
Users concluded the app cannot create a project. It can — the picker has
CanCreateDirectories set and macOS puts a New Folder button in the panel — but
every word around it said otherwise: a rail footer reading "add a folder" and a
panel titled "open a working directory" describe picking something that already
exists, so nobody went looking for the button that was there all along.
The entry now says what it does, and the panel repeats it at the moment the
choice is made. No new path: the one that existed was simply unannounced.
Three things the rail got wrong, all reported from using it.
The marks drifted while dragging. They were placed in pixels, and a block
mounting swaps its estimated height for its real one — every pixel-derived
position on the rail moves a little while the content underneath sits still.
They are placed by entry count now, which mounting cannot change. Entries are
also the better answer to "how long was that turn": what it produced, not how
tall it happens to render.
The drag fell behind the pointer. What can be dragged is the track minus the
box, and what it covers is the content minus one screen; using the whole track
against the whole content leaves it slow by exactly the ratio of the two. Both
are read per move rather than captured on grab, because blocks keep mounting as
the drag travels.
The box could not be grabbed at all: each mark's hit box spans the rail's full
width and they are painted after it, so the press never reached it. The two now
occupy their own columns — the scrollbar at the very edge, the marks to its
left.
Jumping measured with offsetTop, whose nearest positioned ancestor is .pane —
which does not scroll. That reads "where in the window", and writing it back as
scrollTop barely moves. Measured against the scroller now.
repolint went red on comment length in four places, which blocks the pre-push
gate for everyone working in the tree. Each block keeps what it was saying — why
complete_step exists at all, why a path's shared head goes before its middle,
what ReadOnly buys a batch, why the reason for a contextual tool lives on the
tool — in fewer lines.
The two test-file-size overruns are left alone: shrinking those means splitting
test files, which belongs to whoever is adding the tests.
The escalation path asked a model about every command the static tables could
not read, including ones the user had already approved. A rule in the config is
a person's own answer, written down; asking a model to second-guess it is both
slower and less authoritative, so a matched rule now short-circuits the ask.
Telling the two apart takes care: Policy.Decide returns Allow for a writer under
the auto fallback exactly as it does for a rule that matched, because Mode's zero
value is Allow. Neutralizing the fallback is what separates them — with Mode set
to Ask, an Allow can only have come from a rule. Reading the rule list directly
would mean re-implementing bash's segment matching, which is the sort of second
copy that drifts.
The classifier generalizes to one call shape, since a second host question would
differ only in its criterion and its affirmative word.
A verification classifier is deliberately absent. The static tables miss a
project's own checks, but a model misses them for the same reason the tables do:
`python3 test_x.py` and `python3 deploy.py` are the same command shape, and which
one is a check lives in the project, not the command. That question already has
an answer that does not guess — a project names its checks in REASONIX.md, and
declaredChecksRanAfter takes the classifier out of the decision entirely.
Running real tasks against a real key, three of four verifications in one turn
came back unreadable. All three were the same shape — `go vet ./... && go test
./... 2>&1 | tail -5`, or a banner echoed before the suite — and the probe that
was supposed to recover the suite's own status only handled a command that is
nothing but one pipeline.
PIPESTATUS describes whichever pipeline actually ran, and which one that was is
answerable whenever the candidates differ in width: `go vet && go test | tail`
can end in a one-stage command or a two-stage pipeline, so two statuses can only
have come from the second. Equal widths stay refused — attributing a status to
a pipeline that never ran is the error this whole path exists to avoid.
Same task re-run: three unreadable verifications became zero.
Also: a check that failed before the latest change no longer counts as a gap
once something fresh has proven the tree. A project whose rules ask for a
failing test before the fix produces one every time, and reporting it back
after the green run reports the bug as an outcome of the work that removed it.
The neighbouring stale and inconclusive cases already worked this way.
Two vertical strips down the same edge saying the same thing — the viewport box
and the scrollbar thumb both answer "where am I" — read as a doubled scrollbar,
which is what it was.
So the transcript stops drawing the native one. The box is permanent now
instead of appearing on approach, and it drags: it inherited the job, so it
inherits the handle. A drag releases the follow the same way a wheel does,
through the same call, because it is the same intent.
⌘↑ / ⌘↓ walk the marks. Which one you are at is read from the viewport rather
than from a cursor the rail would have to keep in sync, so the keys always agree
with what is on screen. A text field keeps them — inside the composer they still
mean what the system means by them.
In a session you speak a handful of times and it works for the rest. So "what
did I ask it to do" always has a small answer — and it is buried under a few
thousand lines of output, reachable only by scrolling.
The rail marks those messages down the right edge, positioned where they
actually are: the gaps are how long each turn ran, and a mark is as thick as
that turn's change was (checkpoint.files). A viewport box says where you are
now, which is what separates a map from a list of bookmarks.
Pointing at a three-pixel line is not something to ask of anyone, so the whole
rail is a track: the pointer's y decides which mark it means and the nearest one
is drawn as held. The first cut had each mark move on hover, which took it out
from under the pointer — hover dropped, mark returned, hover again. The hit box
is fixed now and only the line inside it animates.
Marks locate by block, not by message. Under virtualisation most messages have
no node at all, but their block is always there holding its height, so a jump
lands on the block first and settles onto the message once mounting brings it
back. The jump also clears the follow the way a gesture would — otherwise the
next frame would pull the reader back to the bottom they just left.
Building a small CLI from scratch reported six unreviewed changes against six
files the model had just authored. The review gap asks whether the result of a
change was inspected — a real question for an edit, which has a before to
compare against, and none for a file whose entire content is the write itself.
Reading it back compares the model's text with its own text; what answers for
those files is the check that ran over them, which the report already counts.
So a path this turn created counts as reviewed until something edits it again,
at which point there is a before once more and the requirement returns with it.
The same run now reports two gaps instead of eight, and the two are the files
that were written and then edited.
Also here: golangci-lint's two findings on the observation code from the
previous commit.
shellsafe enumerates 145 commands and will never enumerate them all: a new
formatter, linter, or query tool arrives every week, and each one that falls
through reads as "might write". A read-only command classified that way blocks
work — a real run spent seventeen consecutive rounds trying to see one failing
test, rewriting the filter each time a pipe segment tripped the mixed-command
contract.
So the tables get an escalation path rather than more entries. They stay the
fast path and answer everything they know; when they come up short and the host
is about to refuse, one classification call decides, and the verdict is cached
so a segment is asked about once. triage_model points those calls at a cheap
tier — empty falls back to subagent_model, then the main model, so it works
before anyone configures anything.
The escalation cannot widen what actually runs. The OS sandbox still bounds
every write, the verdict is refused unless the reply is exactly READONLY, and
anything unestablished — no provider, a timeout, a hedged answer — lands on the
refusing side. Delivery never escalates: there a mixed command is refused for
what it does to the receipt, not for what it might write.
Two things this cost to learn, both from running it rather than reading it:
- A one-word answer needs thinking turned off. Under a tight token cap a
thinking model spends the whole budget reasoning and returns nothing, so four
classifications in a row silently failed.
- The classifier gets its own provider instance from boot. Borrowing the turn's
own would put extra calls into a stream the run is mid-conversation on — which
is exactly what hung the agent tests against a scripted provider, for the full
ten-minute default timeout.
repolint grows -only, which reports the budgets of named files instead of the
whole tree's recorded debt. A change could not tell its own violations from
inherited ones; the model in one run tried to build a git worktree to compare
against, and the sandbox refused it. Repo-wide ceilings still report, because a
file can push the tree past one without exceeding its own budget.
Carries the rest of the in-progress work in the same snapshot.
Two findings from a real session, both about telling the model something it can
act on.
The host answered an out-of-context call from a switch keyed on tool name,
while the condition it was reporting lived in that tool's own ProviderVisible.
Half a contract in each place, and the half in the host is the one nobody
remembers to extend: add a contextual tool and it gets the generic sentence.
ContextualReasoner puts the reason next to the state it reads, and a registry
test refuses a contextual tool that cannot give one — submit_plan and
conclude_no_changes turned out to already be in that position.
The dynamic surface is deliberately not the fix here. ContextualTool's contract
says schemas stay static for cache stability, and a list that shrinks when a
goal ends would break the prefix every turn. Availability is answered when the
call runs; what this changes is only the quality of that answer.
Second: complete_step already cites the receipts it has, but shortened each to
its first eighty characters. Under a deep root that is the shared prefix, so a
turn was told to cite one of three identical strings. Paths differ at the end.
The shared head goes first, then the middle is elided — the part that tells one
from another is what survives.
It was a table you could read and nothing else — the one record of where a
turn's time went, with no way to get it to anyone who was not looking at that
screen at that moment.
Export writes what a row is rather than how it is drawn: seq, at, dur, kind,
tool, plus the rendered line as text and any detail under it. Four of those are
the timing, which is the point of keeping it; the text is there so the file
reads as itself without the app.
The path out follows the one plugin export already uses: a webview starts no
downloads, so the shell writes the file through a save dialog and reports where
it went, while a served tab downloads it. SaveText is general because the shell
has no business knowing what the frontend assembled — the trajectory is simply
the first thing that needed disk. Handing bytes to a browser moved next to the
ports rather than into one, so the fixture takes the same path a tab does
instead of claiming a file was written somewhere it was not.
An investigation that was told not to change code still ended in error. The
model wrote a scratch probe, ran it, deleted it, and answered correctly — and
the host, seeing a write with no verification after it, reported a failed run.
The static classifier could not have known better. `go run x.go && rm x.go`
decomposes into commands it does not recognize, so it lands in unknown: a
mutation with no paths, about which every later question answers "something,
somewhere". Teaching it that `rm` removes its arguments would start a table of
command semantics that never ends and is wrong at the edges.
So the host watches instead. Before a mutating call it records the state of the
paths the turn already touched plus the call's own targets; afterwards it reads
which of them changed, and which it watched come into existence. Classification
is only ever sharpened — a call that changed nothing among the watched paths
stays unknown, because it may have changed something outside them. `sed -i` on
a file the turn had read now names that file instead of shrugging.
Knowing what appeared is what makes it safe to know what vanished: the baseline
for what a turn still owes is the latest change still on disk, and a file the
host watched appear and then vanish is not one. A write it never saw created is
assumed to survive — an unresolvable path looks exactly like a deleted one, and
only one of those may be waived.
Same investigation, re-run: finishes clean, workspace empty of scratch files.
An ordinary fix still verifies as before.
Measured against a real 262-second task: model rounds accounted for 99% of it,
tool execution for 0.6%. The timeline drew only the second number. Twenty-four
rounds — the thing the wait actually consists of — had no row at all, because
the table recorded events rather than activities, and a round is two events far
apart.
A row is now one activity: opened by the event that starts it, settled by the
one that ends it, both halves on the same line. The kernel already names them —
stream_attempt carries begin/commit under one id, a tool call carries its id
into its result — so the pairing is read from the stream, never guessed. A
tool's duration comes from the kernel, which measured it; a round's comes from
the wall clock here, which is what the reader waited.
Falling out of the same change: one call is one line instead of two, tool
errors take a distinct kind, and tool_progress stretches the bar it belongs to
instead of opening a row. Progress output is not copied into the table — this
records when, not what.
Two findings from running Python, JavaScript and investigation tasks against a
real key.
A model reviewing its own work reaches for `git diff`. In a workspace that is
not a repository it finds out by failing — twice, since the first attempt is
usually a compound command the safety gate rejects for other reasons. Every
non-repository run in the traces paid this. The environment section already
states the OS, the shell, and which tools are installed; it now also states
whether the workspace is under version control, read from the filesystem so it
costs nothing at boot and cannot flap into the cached prefix. In a re-run of the
same Python task the model made no git attempt at all.
Delivery reported one gap as three. A sign-off that cites a passing check is
not a valid sign-off until the change has also been reviewed — correct, but the
gate then also demanded "run relevant verification and cite that successful
command", which the model had just done and watched pass. The cited-verification
question is now asked on its own, so the message names the review and only the
review.
A bare binary draws its window fine, so nothing looks wrong until a native
panel opens: LaunchServices only treats a bundled process as a real GUI app,
and NSOpenPanel takes focus and closes in the same beat. "Add a folder…" reads
as broken, and the search goes to the frontend, where nothing is wrong.
make studio builds the frontend, builds the shell, wraps both in an .app and
opens it. The bundle symlinks frontend-next beside the executable — assetsFS
looks there first, which frees the launch from the working directory `open`
gives it (that is "/", and the binary exits before drawing anything).
The row under the composer was five identical grey pills for four different
kinds of thing. Each control now draws its own quantity: effort as a five-bar
level that lights up by step and colours by cost, approvals as a ring whose gap
is how much the gate lets through (closed with a bar through it is the strictest
posture, not the loosest — its old label said the opposite of what the kernel
does), plan as an icon that strokes itself in. The effort menu carries the same
scale, so opening it shows a gradient rather than six equal words.
Floating layers get their own tokens. A menu was never transparent, but on the
dark theme --raised sits a shade from what it covers and a black shadow lands
on near-black, so the only thing separating a menu from the transcript was one
border. --float lifts the surface, --shadow-float adds a lip and a ring. Five
popovers that each carried their own shadow now share it.
The trajectory grows a timeline column: a bar placed by +t and sized by
duration, coloured by tool category. A result is written when it ends, so bars
run from at-dur to at and parallelism shows itself — a subagent's 8.4s bar with
its own calls nested inside the span.
Following: scrolling up mid-turn did nothing at all (measured: 1500px undone
before the next frame). The marker at the bottom resumed the follow on position
alone, and blocks mounting push it across that edge constantly, so every
virtualisation event yanked the reader back. Resuming now needs a downward
gesture; releasing cancels the follow already queued for the next frame.
Jitter: the reveal clock appends characters on its own rAF and the follow
scrolled on another, so the distance to the bottom swung 0-142px through every
stream. The follow moves into the layout pass, where the DOM has grown and the
frame has not been painted yet. 142px of swing becomes 24.
The composer offers four postures and the kernel has always had four, but
/tool-approval-mode carried its own copy of the list with three names on it —
so choosing "don't interrupt" answered 400. The copy had a second fault that
would have outlived the first: it lowercased the request before comparing it
to ToolApprovalDontAsk, and "dontask" never equals "dontAsk".
Validation moves behind control.ParseToolApprovalMode, so which postures exist
is answered in one place. Aliases (dont-ask, deny) canonicalise with it and an
unknown name is still a 400.
The host recognized one way to finish a turn — everything verified — so the
model that did the work, found the task self-contradictory, and said so was
reported as a failed run. On a workspace where two suites demand different
values from one pure function, that left contriving a way past the checks as
the only path the host rewarded, and a real run took it: a call counter
returning 100 the first time and 250 after.
conclude_blocked is the missing exit. The claim costs what a claim of success
costs — every citation must match a receipt from this turn, and a failed
command counts, since the run proving a task impossible is usually the one that
failed. Readiness waives exactly one thing for it: that the check passed. The
check must still have run, and nothing else about the turn is waived.
The gate it answers to was itself too weak to notice: it asked for one passing
check and never looked at the failing one beside it, so `go test; go vet` read
as verified on a red suite. A check that still stands failed now counts against
the change, folded per check so re-running one until it passes still clears it.
Two places now name the exit at the moment it is relevant rather than after the
run has ended: the readiness gap, and ask's headless fallback — which is where
a model with no answer picks between guessing and a trick. In the same scenario
that produced the call counter, the model instead completed the possible half,
declared the rest blocked, and said what decision would unblock it.
Also here, from the same run traces:
- The delivery review gate told models to run `git status --short` and
`git diff` when a change reported no paths. In a workspace that is not a
repository that instruction cannot be followed, so it now states what the
host needs — which files the change touched — and leaves the means alone.
- A headless run dropped the end-of-turn quality verdict entirely: the same
turn the chat TUI flags as partial finished silently. Both frontends now read
it from one place on the event.
`go test ./... | tail -5` exits with tail's status, so a failing suite reported
zero and the host could only call the check inconclusive — which the readiness
gate reads as "no verification ran". A project whose house rules pipe test
output could therefore never finish a turn, and the gate's own instruction
("run a relevant verification command") was false to a model that had just run
one and watched it print `ok`.
bash already knows each stage's status. For the one shape a status can be lined
up with — a single pipeline whose exit is decided after the check — the host now
appends a report of PIPESTATUS and restores the command's own exit status, so
nothing downstream sees a different result. `set -o pipefail` would have been
simpler and wrong: it changes what `| head` means.
The report never reaches the model: it is stripped from the output, the tail,
and the live progress stream, and a run that truncates or dies simply reports
nothing rather than something wrong.
Where no report is possible — `a | tail && b | tail`, where PIPESTATUS covers
only the last pipeline — the two messages now say what is true. The tool result
says so as it happens, and the gate names the command whose status belongs to a
later stage. A run that used to end in error now re-runs the check on its own
one round later.
`gofmt -l`, `prettier --check` and `eslint .` were graded as writes, because
the host could not prove them read-only and treated that as proof they wrote.
A write with no path is opaque, so one such check after an edit pushed delivery
review to its high-risk gate, whose only instruction was to name the changed
files with `git status --short` and `git diff`. In a workspace that is not a
git repository there was no way to answer, and the run ended in error with a
green suite on disk.
Mutation now carries how well the host knows it: proven — a writer tool's
contract, or an output redirect to a named file the parser found — unknown, or
none. Risk scores only proven path-less writes as opaque, since a command that
merely resists classification describes no change set a reviewer could be
pointed at. The delivery baseline takes the latest proven write and falls back
to an unproven one only when there is no proven one at all, so a check that
runs after the verification no longer moves the goalposts past it.
ToolCallMutates keeps its conservative boolean view: permission and the
delivery floors still treat unknown as a write, exactly as before.
`bash -l -i -c` sets no pipefail, so `go test ./... | head` exits 0 on a suite
that just printed three failures. Six places read that status as the check's own
answer: the host classifier, the completion report, the readiness floor,
delivery sign-off, the contract's declared checks, and the summary line. Eight
real runs produced 22 verification commands between them; only 10 carried a
status that says anything about the check.
The verdict now comes from what a zero status actually proves.
shellparse.ExitZeroImplies reads it off the AST: both sides of `&&`, only the
last stage of a pipeline, only the last of several `;` statements, neither side
of `||`, and nothing at all behind `&`. A check whose verdict the shell handed
to a later stage is recorded as inconclusive — it neither proves nor refutes, so
it counts as neither. Receipts the host never classified keep reading their own
outcome, which is all a declared command or a replayed session carries.
Two shapes this fixes, both observed live rather than imagined:
- `ls -la && go test ./... 2>&1 | head -100`, run while three tests were red,
was recorded as a verification that passed.
- `go test -v ./... | tail -20 && git status --short`, run on a green tree
outside a repository, was recorded as the suite failing.
Verification items key on the check they carry rather than on the wrapper around
it, so re-running one inside a different pipeline supersedes the earlier outcome
instead of opening a second item the fresh run never clears.
A check is also no longer discarded for its company. `go test ./... && gofmt -l
.` carries a readable verdict even though the host cannot prove gofmt leaves the
tree alone: the short-circuit is the same reasoning the admission gate already
applies when it blocks only the maskable mixed shapes. Not adding gofmt to a
read-only table was the point — ruff, prettier and eslint follow it, and the
table never ends. IsDeliveryVerificationCommand keeps the stricter question for
sign-off, where "only verification and read-only work" is what is being asked.
The summary line and the completion receipt now answer together: a contract the
ledger cannot fully vouch for is no longer summarized as complete beside a
receipt listing what stays unproven.
Recovery guidance rides the steer path under its own host prefix. A model told
the user interrupted starts answering someone who never spoke, and cannot tell
that from a real interruption.
Switching sessions felt slow, and the length of the transcript was not why:
a 12MB record reads back in 8ms. What the reader waited on was /status, which
queried the provider's wallet endpoint on every call — 87-167ms, uncached —
while the pane held the transcript behind a Promise.all with it.
Three layers, measured at each end:
- billing.Cache serves one wallet answer for 30s, lets exactly one caller
refresh it, and keeps a good reading standing in for five minutes when the
endpoint starts failing: unreachable is not empty. billing.Store shares one
cache per endpoint and credential, because opening a conversation builds a
whole runtime and a per-runtime cache is cold on exactly the read a switch
waits on. control.Options collapses its three balance fields into that one
cache, which is also what keeps boot.build under its ratchet.
- The pane reads the record and the numbers over it separately. __restore no
longer carries the cache totals; __totals brings them when they arrive, so
they are still read back from the kernel rather than restarted at zero.
- fromHistory drops two O(n²) shapes — a linear search per tool result, and a
full copy of the folded list per item. 3200 turns: 121.6ms to 2.9ms.
/status 100ms to 15ms; transcript on screen 139-219ms to 48-125ms, and no
longer a function of how long the conversation is. perf/switch.mjs is the
bench that holds it, with PERF_STATUS_MS to separate the two waits.
Carries the rest of the in-progress studio work in the same snapshot.
/shell is registered on the kernel but was missing from the window's api-path
allow-list, so the request fell through to the static assets and answered
index.html. The pane read that as a failure and said 读不到 shell 配置 — a
routing miss wearing the costume of a broken kernel.
TestEveryRouteTheKernelRegistersIsRouted guards exactly this and catches it when
reverted; it went unrun because desktop is a nested module that a test sweep over
./internal/... never reaches.
Two things the workbench could describe but not act on.
An extension that publishes a view against a tool call now draws inside that
call's card. The takeover replaces the body only: the name, the status, the cost
and the failure line stay the host's, so a redrawn card is still recognisably
this call and still visibly the extension's work. The surface travels as a
first-class DTO through eventwire and uihub rather than as an opaque blob.
The shell tool's interpreter becomes a setting. It was already auto-detected —
real bash first, Git for Windows next, PowerShell only when a Windows host has
no bash — but nothing in the new UI said which one was chosen, and nothing could
change it. sandbox now exposes what auto-detection picks from (DetectShells) and
whether a chosen one actually runs (VerifyShell); the settings pane offers only
interpreters this machine really has, names what "自动" resolves to here, and
says on the row itself that Windows PowerShell 5.1 will not parse '&&'. Choosing
one persists to [tools.shell] and rebuilds the runtime, because boot binds the
interpreter into the tool while assembling it — the same path a role assignment
takes, and refused mid-turn for the same reason.
A shell card spends its mono tag on the interpreter instead of on the tool id:
the name above already says Bash, and on a host without one the command was
handed to PowerShell, which is the difference between a command that works and
the same text failing on '&&'.
The first launch asked for "deepseek 的 API key" because refreshProviderSetup
resolves the provider from the current default model, and the default is
DeepSeek. Anyone on another service had nowhere to start.
The connection step now asks the two things only the user knows — where and
with what — and lets probeProvider answer the rest. The shortcut row fills the
address and nothing else, so a service missing from it is not unsupported;
what decides that is what the endpoint replies. 中转站 / 自建 sits in the same
row rather than under a fallback, because a relay is what many people have.
A failed probe shows the endpoint's own words: 401, a wrong path and "no chat
models" send the user to three different fixes.
Before it, a sequence that plays once per machine: aurora drifting on a fixed
dark ground, the R drawn and then traced by a light, the wordmark swept by a
highlight, and three lines that say what the thing does. It does not cut to
the form — the whole group collapses into the card's header, so the brand
never leaves the screen. The progress line and the skip hint leave with it;
kept on screen beside an input they would read as "still loading".
The ground stays dark whatever the app theme is: this is a ceremony, not a
screen of the app. Any key or click skips it, reduced-motion goes straight to
the end, and a machine that already has a key gets the short cut of it.
[desktop] welcomed carries the once-only state. Browser storage would replay
the introduction whenever a cache was cleared, which reads as a bug rather
than a greeting.
A relay that does not know thinking or reasoning_effort rejects every request
that carries them, and its error rarely names the field - so the failure reads
as a broken key or a wrong path. reasoning_protocol="none" already produced
the plain-chat shape; nothing surfaced it.
The account card now carries the switch beside 联网搜索, in the two positions
a user actually has: 自动, or 不发送. Releasing it clears only that pin, so an
explicit deepseek/glm/kimi-k3 choice survives. Protocols whose wire has no
such field never offer the switch.
Three defects found by running the real DeepSeek API behind a recording proxy
and reading the trajectories.
A tool-call turn with no reasoning was treated as a lost field and answered
with one exact replay of the whole frozen request. Every run triggered it,
and on a long-context turn it re-sent 29k prompt tokens to recover five
reasoning tokens. Billed thinking tokens with no text mean the value really
was lost in transit; zero billed tokens mean the model stayed silent, which
is ordinary between tool calls. The classifier now separates them, and the
exclusive reasoningObservation states replace a (missing, shouldRetry) pair
that could spell 'not missing but replay it'.
Optional sink capabilities are delivered by type assertion, so CostQuoteSink
- which forwarded Emit alone - silently dropped all ten audit channels one
link before the trajectory recorder. Trajectories recorded zero audits while
the code faithfully emitted them. capabilityContracts is now the single
authority on the set, FanOut forwards them across the split, and the three
hand-written forwarders get the RunBudget channel they had all missed.
update_goal is unreachable in a headless run, yet its 2.2k-char schema shipped
every turn and the model duly called it and was refused. Whole-session
unavailability can leave the schema without churning the cache prefix; only
per-phase visibility must not. GoalTurnsUnreachable draws that line.
A turn that took more than one request billed the sum while its context was
only the last request's, and the input column showed the sum with no hint.
Measured on the same task before and after: 12 rounds instead of 14, 51.4s
instead of 58.8s, zero wasted tokens instead of 29,085, and 14 audit records
where there had been none.
Working snapshot of the studio branch: installable plugin packages (plan
ticket, archive, export, install-source permission subject), the extension
protocol's view/slot rendering path, desktop theme tokens, and the file-drop
surface on the next shell.
Grouped as one commit because the pieces share the generated protocol schema
and the desktop port they land through.
macOS reads a Dock icon out of the app bundle, and the shell also runs as a
bare `go build ./next` binary with no bundle around it — so it carries the
artwork itself, the counterpart to the committed .syso that brands Windows.
The copy lives in the package because go:embed cannot reach out of it; a test
pins it to build/darwin/icon.icns, which is the one the safe-area guard reads.
The theme picker asks for /themes/{id}/preview and /themes/{id}/background.
Neither was in the shell's route table, so both answered index.html and every
pack rendered as a broken image. /inbox fell through the same gap.
The existing guard could not have caught it: it scans the typed client, and
these two URLs are written straight into an <img src> and a CSS url(). The new
one reads internal/serve's own registrations back instead, which covers both
kinds of caller. Fixing the old scanner too — it read "/export" out of a
concatenated /plugins/{name}/export, a request no one makes.
Colours were only half of what a pack is. The eight that ship each carry a
background and a thumbnail, and the manifest field describing them was being
read past — so "install a theme" meant a palette swap and nothing else.
The image is not just an image. A pack says where its subject sits (focusX/Y,
so a portrait survives a wide window), which side the content is on
(safeArea), and — the part worth having — how far the picture recedes once
work starts: the shipped packs sit near 0.95 idle and 0.18 while a turn runs.
A photo that is right behind an empty window is in the way of a transcript
being read, and the old shell had already worked that out.
Drawing it takes two fixed layers under everything and a scrim of the page
colour over the top, so text keeps its contrast whatever the photograph is
doing. The block is inert until a pack sets --bg-image: a default build paints
no extra pixels. Only the empty page shows it through — cards, panels, and the
composer stay opaque, because a background is worth a window's margins, not
its content.
Assets are served by id, and the id arrives as a URL segment, so what can be
read is bounded twice: the id must be a bare name, and the filename is always
<kind>.<known extension> beside the manifest. A pack cannot name a path.
1.8MB of webp joins the binary. That is the eight palettes being complete
rather than a format with no example of itself — and the thumbnails are what
let the picker show a photo-backed palette as one, before it is applied.
The Wails shell keeps its own list of which paths are the kernel's and which
are the bundle's, so an endpoint that exists in serve but not in that list
answers with the SPA shell — JSON parses as HTML and the caller sees a broken
feature rather than a missing route. /themes and /extensions/* were added on
the serve side without it. TestEveryPathTheFrontendCallsIsRouted is what
catches this, and it was red.
/extensions goes in the prefix list, not the exact one: action and submit hang
off it the way /mcp/reconnect hangs off /mcp.
The themes_test rows get a name while passing through — the same anonymous
struct was written out three times to give the lookup helper a signature.
The composer parsed its own grammar, so the window's "@" meant something the
kernel had never agreed to — it had no way to read a directory at all — and "/"
listed only skills and custom commands, hiding every built-in the Submit path
already dispatches. control.Complete now answers all three menus: which token
the caret sits in, what may replace it, and the span to replace. The CLI reads
it too, so the terminal and the window cannot drift apart. serve exposes it as
GET /complete and converts the kernel's byte offsets to the UTF-16 units a
browser indexes by, which is what a Chinese prompt needs to splice correctly.
Fixes the work surfaced:
- a hand-typed /compact with nothing left to fold reported the provider limit;
manual carries Force, and the no-fold branch read Force as overflow
- every notice-only verb answered 409, because serve judged a submission by
whether a turn had started and a management verb starts none
- reopening a session showed the composed text, so a one-line @reference came
back as the whole file it referenced
- the window had no Edit menu, so a WKWebView had no copy, paste, or undo
- an input method's confirming Enter sent the half-written message
- cancellation during a fold was recorded as a summary failure
- internal/agent's test package did not compile, hiding both of the above
The tree carried other unlanded studio work in the same files — attachments,
changes, checkpoints, rewind, themes, extension surfaces — and file granularity
could not separate it, so it lands here as well. desktop/next's route list
still omits /themes and /extensions/*, so its routing test stays red; that
belongs to the extension work, not to this.
99ef4b2f0 removed ContextMaintenanceReceipt.Archive and updated the old
shell's TypeScript mirror, but not its Go side. desktop is a separate module,
so the main module's build never saw it: `go build ./...` at the repo root
passes while the desktop module does not compile at all.
Three finished files were never added, and the commits that use them went in
without them. On any clean checkout — CI, a fresh worktree, another machine —
the module does not build:
eventwire/wire.go calls e.Tool.ContextTokens(), defined in
event/tool_cost.go, which imports internal/tokencount
state/session.ts uses sample() and outWindow, from port/tokens.ts
Local builds pass because the files are sitting in the working tree, which is
exactly why this survived several commits.
They are complete as they stand: tokencount carries a package comment and a
test, and its by-script split is the fix for the estimator that read ASCII as
four times its real cost. Nothing here is new work — this is the add that
should have ridden along.
The frontend still does not typecheck after this: SsePort is missing changes
and attach, which port.ts declares. That is in-progress work, not a missing
add, so it stays where it is.
studio's palette was compiled in: tokens.css held one light set and one dark
set, and nothing could change them without a rebuild. The old shell has had
theme packs for a while — a directory with a theme.json, colours only — so the
format already exists and eight of them ship. What was missing is a reader that
does not live inside the old shell, and endpoints for the new one.
internal/theme reads packs from <memory root>/themes. Two things it refuses:
- a pack from a schema it does not know is skipped rather than half-read,
and one bad pack cannot hide the rest of the list
- a token that is not a plain hex colour is dropped, not escaped. The value
ends up interpolated into a stylesheet by whoever renders it, so url(),
an expression, or a stray brace never reaches that point
GET /themes carries every pack's whole token set, not just the active one's:
a picker that must fetch before it can preview cannot preview on hover, and
the payload is a few hundred colours. POST /themes activates one, and an empty
id is a real choice — it is how a user turns a pack off.
The frontend half (in progress separately) maps a pack's names onto its own
variables and paints them at runtime. What a pack may not touch is fixed
there: ok/warn/err/net/deleg encode what is happening — "this broke", "this is
running" — and a theme that could recolour them would let a failure render as
success. The palette is the theme's; the meanings stay the app's.
Adding one config field turned out to need the renderer too: RenderTOMLForScope
writes the file field by field, so a struct field it does not know about is
silently never persisted. The [desktop] table moves into its own function and
file on the way past — it was the longest run in a 777-line function, and
DesktopConfig follows into its own file, which puts both back under the size
ceiling instead of one line over it.
An extension could publish a card, a form, a notification, a status line —
every one of them a thing that happens and then scrolls away. What it could not
do is describe something that is still true: a watcher running, a sync at 40%,
a connection holding. That state belongs in the side rail, and there was no
surface kind for it.
UISurfacePanel is that kind, and it is a kind rather than a new RPC on purpose.
The method registry is frozen; growing it per feature is what turns version
compatibility into every extension author's problem. A new surface travels the
publish path that already exists, so an extension built against an older host
degrades to an unknown kind instead of a broken call.
UIPanelPayload carries no Markdown, unlike UICardPayload. The rail is a narrow
column and a rendered document there costs the layout more than it tells the
reader; an extension with a long story to tell publishes a card into the
transcript, which is what the transcript is for.
Registering the kind is what actually admits it: protocol.enumTypes is the one
table the strict decoder, the JSON Schema, and the generated SDK all read. The
generator's own guard caught the rest — a surface kind with no matching
UI<Kind>Payload in the SDK fails generation loudly, which is how it should
have gone. Regenerated artifacts follow, schema hash included.
The Extension* types move out of event.go and eventwire/wire.go into their own
files while passing through: both were already over the size ceiling, a new
surface kind touches every one of those structs, and the two conversion blocks
are the only thing in eventwire that is not a one-liner.
Extension surfaces already reach every frontend on the event stream, but the
user's half of the exchange — invoking an action a card offers, submitting a
form an extension published — needs endpoints, and serve had none. uihub's
consumers were boot, cli, acp, and control; the HTTP surface the new desktop
runs on was the one place a plugin could talk to a user but not be answered.
Controller already exposed what this needs. Two of the three were on
SessionAPI; SubmitExtensionForm was written for "stage-8b frontends" and had no
caller anywhere, so it joins the port alongside the two it belongs with.
Three routes, in the shape the other feature files here use:
GET /extensions/actions the handshake-declared actions, empty when no
runtime is up — a state, not a failure
POST /extensions/action invoke one, answering with the extension's own
(hub-redacted) message
POST /extensions/submit a published form's values, types intact
A declined action answers 422 with the extension's reason rather than a 500:
the extension refusing is its answer, and the caller should show it. Form
values keep their JSON types because the extension declared the field kinds
and decodes against them — a confirm stays a bool, a number stays a number.
The studio side (renderer, event wiring, port methods) sits on top of
frontend-next work that is still in progress, so it lands separately.
GET /sessions read the directory itself and called agent.SessionPreview on each
file, which decodes the whole transcript to count user turns. Studio's session
list is O(sessions x transcript size) on every refresh, and it recomputes from
scratch each time.
agent.ListSessions exists for exactly this and says so: "It never decodes a
transcript." The sidecars it reads were introduced to fix this same load in the
old shell's sidebar; the HTTP endpoint the new one runs on never picked them up.
Behaviour moves onto that shared path, which changes three things, all toward
what the other listers already do:
- order is by last activity instead of reverse filename
- a session with no user turn stops appearing (it has no title and no count;
it was rendering as an empty row)
- a legacy session whose sidecar has no counts yet shows the "History is being
indexed" placeholder until the catalog's repair worker validates it
The subagent-name filter stays here: IsVisibleSession deliberately does not
fold it in, because GC and redaction still have to see those files.
The new test corrupts both transcripts after saving and asserts the endpoint
still reports 1 and 2 turns — a reader that parses transcripts cannot pass it.
HandlerWithCORS has no caller. Its own doc says "Do NOT use in production — the
server has no auth", which makes an exported, unused, security-sensitive entry
point the worst kind to leave lying around: the next person wiring a dev
frontend finds it before they find the reason it is wrong.
Neither frontend needs it. frontend-next proxies through its own origin
(vite.config.ts says so explicitly: "The dev server is cross-origin to serve,
which its CSRF guard rejects"), and the old Wails shell serves same-origin.
It was also already inconsistent with the routes: Access-Control-Allow-Methods
listed GET, POST, OPTIONS while inbox has served PATCH and DELETE since it was
added, so anything that did opt in would have been blocked by preflight on the
endpoints it most needed.
Deleting it leaves same-origin as the single stated protection for
unauthenticated endpoints, which is what the csrfGuard comment already assumes.
A turn where the provider ran its own web_search left the session permanently
unusable: every following turn failed with the same numbers and never
recovered. Reproduced with a real key against a 20K window — turn 2 searched,
turn 3 onward died on "candidate would not reduce tokens".
The cause was not compaction. DeepSeek bills its fetched pages as input
(usage.server_tool_use.web_search_requests says how many searches ran, a field
wireUsage was dropping), so PromptTokens on such a turn counts content that
never passed through us. Learning the chars-to-tokens ratio from it inflated
every later estimate by roughly 3x, which read as overflow, asked for a fold
that cannot shrink what we never held, and refused the turn — and a refused
turn sends no request, so the observation never updated and the next turn
decided identically.
Three changes. Usage now carries ServerToolRequests and the calibration
declines to learn from a turn that has any. Where a failed fold would strand
the turn, a transcript that fits under the ceiling is sent anyway and the
provider rules. And oversize tool output goes to <session>.outputs/ with the
context keeping a pointer plus twenty head lines, because a head+tail sketch is
a guess about which part mattered made by the wrong party — read_file windows
the file and grep searches it. That threshold is window-relative: a fixed 32KB
is a rounding error in a 1M window and larger than a 20K one. Windows at or
above ~128K keep 32KB exactly.
Verified end to end on the same sequence that died: six turns, no failure, and
context tracking our own transcript (6.8K) rather than the provider's billed
input (27K). A 728KB bash result reached the model as 581 characters, which it
read correctly as "120001 lines, 712 KB, saved to a file, not lost".
AssessRuntimeResume and ResumeNotesForGeneration wrap extension.DecideResume
and format "doctor-facing notes". No doctor calls them; nothing outside
recovery_test does. boot/doctor_runtime.go, the real doctor path, calls
extension.DecideResume directly and formats its own report — so this was a
second formatter for a decision the actual caller already reaches without it.
Removing them also drops recovery's only direct import of internal/extension.
internal/capdiag imported internal/boot for exactly one call —
PluginSpecsForRoot — which made it the repo's only layering violation, carried
in the repolint baseline. capdiag is a diagnostic: it describes configured MCP
servers, it does not assemble a runtime. The rule it broke ("nothing below a
frontend may import one") was right; the placement was wrong.
Turning configured entries into plugin.Spec is a pure mapping over config,
plugin, sandbox, and mcplaunch — every one of them below boot. It sat in the
assembly layer because that was the first caller, not because it belonged
there. internal/pluginspec now owns it, and boot, cli, capdiag, and desktop all
reach the same function at a level each of them may legitimately import.
boot keeps what is genuinely assembly: partitionByTier reads a startup policy,
skillMCPBindings needs the live tool registry. Its pluginspec.go drops from 230
lines to 60. The mapping tests move with the code they cover.
appendUniquePaths and pathComparisonKey are copied verbatim rather than
simplified: they compare paths by cleaned, absolute, symlink-resolved,
case-folded-on-Windows form, and a shorter version would silently change which
sandbox roots dedupe.
The baseline loses its layering entry and the limit goes to 0, so the next
violation of this rule fails CI instead of joining a tolerated list.
Auto recovery and the guardian each stopped the turn on a count. Recovery's
was 3 failures of one operation, 6 per Episode, 3 reviewer rejects, 3 retries
of an already-stopped operation; the guardian's was 3 consecutive denials or
10 in the last 50. Both then interrupted: recovery burned a summarize-only
round and returned "Automatic retries paused. Send continue to start a fresh
attempt", the guardian injected "stop the current approach and request
explicit instructions".
Neither number came from the user, and neither measured what it claimed. Six
failures is a long debugging session in one codebase and a runaway in another.
The reviewer rejecting three proposals means the reviewer disagreed three
times, not that the work is unrecoverable. What the host actually did with
those counts was take the turn away and ask the user to type "continue" —
which is the user's decision arriving as a chore.
What survives is the part that reads the proposal in front of it: Decide still
routes an ordinary mutation to allow and an ambiguous retry of the same failed
operation to the reviewer, and the reviewer's own reject still blocks that call
with its rationale. A repeat now goes back to the reviewer instead of hitting a
ceiling. The guardian still denies, still forces deny on critical risk and on
high risk without authorization; it just no longer stops the turn on top of
that verdict.
Per-operation failure counts stay — the reviewer and the approval card read
them as evidence ("this exact call has failed N times"). They no longer arm
anything.
With this, RouteStop/RouteStopTurn, the Episode budget, StopReason,
RecoveryPauseError, and the finalization round it drove have no producer, so
they go. event.TurnOutcomeRecoveryPaused stays readable: sessions recorded
before this still carry it.
Nothing else bounds a turn by default (agent MaxSteps is 0 unless the user sets
one), so an Auto run that keeps failing now keeps consulting the reviewer until
the user interrupts it. That is the intended trade.
Ten declaration comments still describe a three-setting product ("light|
balanced|delivery", "all three role settings") that one setting left, and two
describe an injection that no longer happens: DeliveryRuntimeMarker's doc says
the agent appends it to user turns and calls its text cache-frozen for every
live delivery session, twelve lines above the code that stopped appending it.
A comment that names a mechanism is a claim the reader cannot check without
reading the whole path. Both of these sent the reader looking for a caller
that is not there.
Three word lists decided which capabilities got a prefer in the turn's route
block. looksLikeReview matched 审查/有没有问题 and hardcoded the built-in named
"review". looksLikeGitHub promoted every tool of any server whose name contains
"github" when the sentence said "issue" or " pr ". looksFreshData promoted any
search/fetch/read tool when it said 最新 or 查一下 — a list that also contains
"github", so a sentence naming the vendor scored twice.
Those are guesses about intent, and a prefer is not free: it takes one of five
route slots and tells the model to use the capability unless clearly
unnecessary. "查一下 GitHub issue 里有没有相关反馈" spent slots on every github
tool before anything read the request.
What stays is what someone actually stated: the user naming a skill or an MCP
server, and triggers the skill's own author declared in frontmatter. When
neither fires, the decision belongs to the semantic router, which reads the
whole request instead of a word list.
NeedsFreshData goes with them — it was parsed from needs-fresh-data, carried
through skill.Skill into capability.Entry, set by one built-in, and read by no
decision anywhere. negativeMatch was triggerMatch under another name.
When the keyword risk table retired, Risk kept its three levels and lost every
input: HighRiskHints and MediumRiskHints are set by tests and by nothing else,
and RaiseRisk has no production caller. Derive has answered RiskLow for every
turn since. Two gates read that constant and both failed open.
Explore: AllowExploreSubagent is `preset && risk > RiskLow`, so it was false
under both role settings, and taskPolicyToolGate blocked every explore/research
call with "the current task policy does not allow proactive explore/research
sub-agents for this turn." The setting that was supposed to permit them said
true the whole time.
Review: Review is ReviewForRisk(low) = ReviewNone under both settings, and
deliveryReviewGateFailure opens with `case ReviewNone: return ""`. Delivery's
stated contract — review on medium-risk mutations, security_review on high —
never ran. Its tests pass because they build an Agent whose policySet is false,
which is the one state a real turn never has.
So risk goes, and MutationRiskAfter stays: what a change owes is read off the
receipts it produced, which is the only source that ever knew. Route follows —
it had no reader outside the policy block, planner routing having moved to
"did the user ask for a plan". SemanticRouterAllowed follows; Delivery decides
the router directly, which is what the non-planner path already did.
RequireFullVerification goes too — parseConstraints never set it.
The new capability_gate case freezes a real Derive policy before calling the
gate, so the next constant that closes it fails a test instead of a release.
Verification block drops from four fields to one; PolicyVersion bumps to 2.
Compaction receipts carried an Archive field, the wire carried it, and both
frontends rendered it — the CLI as "archived <path>", the desktop card as
"，原件留在 …". Nothing has assigned it since summary checkpoints replaced
archiving: canonical keeps the originals, so there is no second copy to name.
Every reader was reading the empty string.
Four tests asserted it stays empty. They passed against a field that could
not be anything else, which is the shape a guard takes once what it guarded
is gone.
Deleting the light setting exposed the chain behind it. SkillEntriesFiltered
opened with `_ = profile`: it took the runtime profile and threw it away, so
the name promised a filter to every reader of the catalog. FilterForProfile
had no callers at all, AllowedInProfile had only that one, and the Store field
those fed — runtimeProfile — was written on every boot and read nowhere.
So the whole path existed to carry a value to a function that discarded it.
It is gone: skillCatalogEntries says what it does (skill entries plus the
frontmatter a reader sees), and boot no longer threads a profile through skill
assembly to reach it.
capability.Profile stays. Its constants are still the allowed-value list for
normalizeProfiles, and controller keeps it as a diagnostics label — but the
type and the CatalogOptions field now say they select nothing, because a name
that claims to filter is how this got missed for so long.
A skill's `profiles:` frontmatter is unaffected: it parses, it is reported,
and it has not hidden a skill from the model for some time.
"不是省钱档位" answered a question nobody asks now that light is gone, and
"规划深度"/"按复杂度自适应" described the planner route — the one dimension
that only ever reaches the model as a line of prompt text, with nothing in the
host to enforce it.
What separates the two settings is who decides a turn is finished: the model,
or the host reading its own receipts. The copy says that now, and delivery
lists the four things it checks instead of naming our internal term for them.
These tests used "economy" as "switch to something other than the default"
— for the tab profile, the persisted session profile, the rebuild event, the
in-place switch guards. It resolves to the default now, so the calls became
no-ops: nothing was saved, and the guards that fire on a real change never
fired. Delivery is the setting that is still different.
The desktop module is not built by the root module's ./..., which is why
these missed the earlier sweep.
The title bar's switcher carries its own PRESETS list, separate from the one
in settings, and it still offered 轻量. Sending it was harmless — the kernel
resolves the name to balanced — but the button's pressed state compares
against what the kernel stored, so it could never light up: clicking it looked
like nothing happened.
Two problems. A machine with no git could not install a plugin at all —
`git clone --depth=1` was the only path to a GitHub source. And on macOS a
machine without the command line tools claimed it *had* git: /usr/bin/git
is an Xcode stub that resolves on PATH and fails only when run, so the
LookPath check guarding worktree isolation read as "installed".
gitcmd.Available runs git rather than finding it, and the worktree lease
asks it. It is uncached on purpose: every caller is a low-frequency
decision, and caching the "no" would make installing git afterwards
require a restart.
A plugin source falls back to the GitHub tarball when git is absent. The
commit the approval contract pins comes from the archive root, so apply
still cannot swap in a tree the user never reviewed. The unpacker drops
symlinks — a link may point outside the tree — refuses entries that escape
the root, bounds each entry and the total against a bomb, and skips the
pax_global_header GitHub writes first, which the first draft mistook for
the archive root until a test said otherwise.
doctor gains a git section stating the absence as a fact and naming what
degrades (the changes list, worktree isolation) while saying rewind,
checkpoints and every tool keep working. Nothing else in the kernel touches
git: agent, control and tool have no reference to it, and checkpoints were
already git-free by design.
The role settings declared far more strategy than they enforced. Six fields
had no reader anywhere — RequireAtomicContract, SemanticRouterOnAmbiguity,
DeterministicFirst, PreferProxy, DiffReview, AllowPartialWithoutChecks —
including two that were the stated difference between delivery and balanced.
A policy table that names a contract nothing builds is worse than a smaller
one: it tells the next reader a guarantee exists.
Light goes with them. Against balanced its only enforced differences were two
sub-agent switches (explore agents, semantic capability routing); the things
its name promised — cheaper verification, lighter review — were identical
settings on both. Its high-risk elevation moves to balanced so no user's floor
drops, and its capability profile selected an economy catalog that
SkillEntriesFiltered discards on its first line.
That leaves one question for the user instead of two: default, or delivery —
where the host enforces acceptance criteria, sign-off, verification, and
review off its own receipts.
"light", "economy", "eco", "lite" all still parse and answer balanced, so an
existing config or an older client is never rejected. They no longer pass
IsValid: they resolve, but nothing writes them back out.
A turn that ends owing verification has not failed. The host read what is
missing off its own receipts — not off anything the model claimed — and then
stopped to show a card whose only action was "continue". That asked the user
to relay a message the host had already written.
Goal mode has auto-continued on exactly this signal all along; the difference
was a goal being set. It no longer is: an ordinary turn that ends with unmet
requirements runs them as further turns, with the missing list as the prompt.
Nothing new judges intent — readiness is the same host-computed check, and a
turn that changed nothing owes nothing, so questions and reads still end in
one turn.
What bounds it is the gap itself. Each round is admitted only while the list
of missing requirements is still shrinking, measured against the best round so
far so an oscillating gap cannot reset the counter. Two rounds that owe what
the last one owed hand the turn back, card and all.
The continuation inherits the finished turn's ledger through the same
authorization the recovery card used. Without it the next run would start
empty, where a turn that owed verification owes nothing — the gap would read
as closed because the record of it was dropped, which is worse than not
continuing at all.
PrepareReadinessContinuation lands in final_readiness.go rather than agent.go,
which is over its size budget.
DeepSeek's Anthropic face runs web_search on its own side, and its results
were formatted straight into the answer text. Forty titles and URLs pushed
the actual answer off the screen, and no tool card ever existed — the
spec's Search card had nothing to draw from.
Results now leave the provider as ChunkProviderTool, the query paired with
the listing that answered it, and the agent reports one finished
ToolResult. Result only, no dispatch: the call arrives finished, and a
dispatch is the one event deferredStreamSink holds back, so it would land
after its own result and never settle the card. The listing still joins
the turn's text — the only copy the next turn has, because the provider
keeps the result bodies encrypted — so request bytes are unchanged and the
prefix stays cache-stable.
web_search moves into its own file and Chunk out of provider.go, which
pays back the file-size, function-size and essay budgets the two new
stream branches would otherwise widen. The baseline carries only their
complexity: 45 to 47.
Controller.Send has always run its turn through runGoalLoop, and the name
made a goal sound like a precondition for sending a message. It is the other
way round: every ordinary message takes this path, and the Goal FSM answers
"do not continue" the moment it sees no active goal — one nil check, then the
turn ends like any other.
Reading Send meant learning the goal subsystem first to find out it was not
involved. runTurnLoop says what happens, and two doc comments say where the
goal actually enters: after the turn, as the thing that may ask for another.
Pure rename plus those comments; no behaviour change.
internal/autoresearch was a read-only compatibility boundary for Goal
sidecars naming a pre-unification .reasonix/autoresearch task. Its own doc
comment says new Goal runs never create, update, list, or expose those
archives — and searching the filesystem finds no archive to read: the
package and the machinery around it served zero files.
What went with it is everything that existed to keep such an archive
recoverable: the fail-closed restore path (a blocked Goal that could only be
unblocked through the archive boundary), its retry token on Controller, the
legacy-archive stop cause, and the FSM's pending-migration task identity.
SetGoal collapses to what it always did for every real goal — install the
text — since the archive was the only thing that could rewrite it.
One field stays: goalState.AutoResearchTaskID is now read-only migration
detection. A sidecar still naming a retired archive is rewritten as ordinary
Goal state on first write, which is how the last of them disappear.
The <autoresearch-evidence> stripping in agent/goal_display.go is unrelated
and stays: it scrubs a historical protocol marker out of model output, not
storage.
Net: 1799 lines of package and manager, plus ~250 of restore machinery.
The card said "正在压缩…" and nothing else for as long as the summarizer
took, which on a large fold is a minute of a placeholder that cannot be told
apart from a hang. The digest now streams onto the card as it is written.
It accumulates on the card's own summary, so the finished event replaces it
rather than fighting it — and a fold that dies mid-write leaves what it had
written instead of an empty placeholder. Only the newest line is shown: a
digest is thousands of tokens of headings and lists, and growing the card by
all of them would move everything below it for the length of the fold.
POST /model rebuilt the running controller and wrote nothing, so the choice
lasted exactly as long as the process. The next launch read default_model and
went back to whatever was there before — switching to an account's Anthropic
door and finding it on OpenAI again after a restart, with no sign the switch
had ever worked.
The CLI has persisted its /model since it had one, and the old desktop's picker
sets the config default alongside the live switch. Serve was the entry point
that did not, which is every studio window.
A refused write is logged and nothing more: the live switch already succeeded,
so failing the request would report the model unchanged when it had changed. A
ref that resolves to nothing leaves the existing default alone rather than
writing a value the next launch cannot start from.
Cache-impact: none - the prompt prefix is untouched; this writes default_model
to the user config after a switch that already happened.
Cache-guard: not applicable; no provider-visible bytes change.
Documentation-impact: none - no docs/*.md states whether the desktop model
picker persists, and it now matches the CLI's documented /model behaviour.
A fold holds the turn for as long as the summarizer takes, and all the user
had was a placeholder that says the same thing at second one and second
ninety. The text was already streaming — summarize consumed provider chunks
into a builder and forwarded none of them.
CompactionProgress carries each chunk on Event.Text, which is what lets the
existing coalescer merge it: it treats an event as a stream delta when only
Text carries meaning, so the digest batches at 16ms like reasoning does
rather than spending a frame per token.
The CLI shows the newest line of the digest on the "compacting…" line itself,
bounded, and replaces it with the finished card. Only the tail: a digest is
thousands of tokens and the card is about to render it anyway.
The three compaction cases fold into one handler, which takes 19 lines and
two branches out of chatTUI.update and lands them in a file that is about
compaction.
Repolint baseline: mostly tightened by today's work (complexity 2058→1994,
essays and function sizes down with it). One entry loosens — desktop's
types.ts gains the line for the new wire kind, which the shared-kind guard
requires and which no local edit can offset in a 2328-line type file.
The picker was models.map with the config entry's name as the subtitle, so a
DeepSeek account reached under two protocols listed four rows that all said
deepseek. Which one was the Anthropic route was not on screen anywhere, and
that route is the one carrying web search.
Rows now sit under the account they belong to — host beside the name, because
the name is the config's word for an entry and two doors share it — and carry
the protocol that reaches them. Both labels appear only where they resolve
something: one source with one door stays a plain list of models, and the
account caption is omitted entirely rather than stating the obvious.
Menu grows a header item for it. plain was the closest thing available and it
is still a button, so a caption would have taken focus and made the list twice
as long to arrow through.
Documentation-impact: none - no docs/*.md describes the composer's model picker.
The kernel started reporting a compaction's sizes and coverage; this is the
card reading them. A digest reads as finished whatever it dropped, so the
count of the fold's changes it carried is the one thing the card can say that
the summary text cannot — and it is stated whether or not anything is
missing, because a number that only appears on failure is a number nobody
learns to read.
The bar and the checklist are the .comp-bar / .comp-l the stylesheet has
carried all along with nothing to fill them. The bar's fill is what the fold
gave back rather than what it kept: the fill is the ok colour, so more of it
has to mean more room.
An older event carries none of these fields and renders exactly as before.
DeepSeek runs a server-side web search on its Anthropic and Responses wires and
not on chat completions, so one account answers differently through each of its
doors. Switching 接入方式 could take the capability away with nothing on screen
about it — a silent downgrade dressed as plumbing.
The door that has it says so, on itself. Picking the other one explains that the
difference is the protocol rather than a setting, because nothing in the panel
can turn it on there. Where a door does carry one, its tri-state gets a switch:
official DeepSeek endpoints default it on and a compatible third party stays
opt-in, so the effective answer is worth showing rather than inferring.
This is the argument for a connection-level 接入方式 in the first place. The
doors are not interchangeable transports; which one is open decides what the
agent can do, and that belongs where the account is configured, not hidden per
model row.
Documentation-impact: none - no docs/*.md describes the settings pane's
connection controls or which wires carry a provider-executed search.
A projection is valid only while the canonical prefix it folded is unchanged,
and the check for that fingerprints every message behind the fold. It ran on
every read of the model-visible view — the turn's prompt, the status gauge,
the compaction check — so the cost of one turn tracked the whole history
rather than the projection, which is the thing compaction exists to bound.
On a 40k-message transcript, measured:
modelVisibleMessages 41.8ms → 0.80ms 83MB → 14MB per call
ContextUsedTokens 1.42ms → 0.015ms
prompt assembly 41.1ms → 1.02ms
The transcript grows append-only, so a folded prefix can change in exactly
one way: a rewrite. The fingerprint is now remembered under the rewrite
counter it was taken with, passed in from the snapshot rather than read
fresh, so a rewrite landing between the snapshot and the check misses the
memo instead of silently validating it. A new conversation clears it — the
counter restarts, and a carried entry could answer for history this session
never had.
What remains linear is the snapshot copy itself (14MB), which is a slice of
headers, not a re-serialisation.
CanConfigureVision returns false for DeepSeek's official host, and
EffectiveVision short-circuits on it, so no vision_models list, provider flag or
per-model override can turn image input on there — their API takes text content
only. The editor offered the toggle anyway: it wrote the config, the config was
ignored, and nothing on screen said why.
The list reports whether the endpoint can be configured for images at all, and
the toggle goes flat where it cannot, with the reason on the row. A switch that
writes a value nothing reads is worse than no switch.
The re-probe button also said only "重新探测模型", which describes the
mechanism and not the occasion. It now says what it is for: asking the endpoint
again for its model list, after it has added or dropped one.
Documentation-impact: none - no docs/*.md describes the source editor's controls.
The connection list groups on host and credential, so two entries only read as
one account when they share a key slot. providerKeyEnv derives that slot from
the entry's name, which meant adding the same endpoint under the other protocol
produced DEEPSEEK_ANTHROPIC_API_KEY beside DEEPSEEK_API_KEY: two accounts, one
of them with no key at all. The 接入方式 switch could never appear for anything
the panel itself had added.
A blank key at a host that already has one now inherits that slot. Blank is the
signal because it is already the panel's word for "keep what is stored", and it
distinguishes the two things a second entry at one host can be: another door
onto the account, or a different account there — two tenants of one relay, where
sharing the slot would overwrite the first tenant's key. A supplied key keeps
its own slot for exactly that reason.
The form says which one it is about to do, rather than leaving the user to infer
it from whether a field is empty.
Documentation-impact: none - no docs/*.md describes how api_key_env is chosen
when a source is added from the panel.
Coverage has been measured on every fold since it became an acceptance
criterion, and it went to telemetry and nowhere else. The user saw a digest,
and a digest reads as complete whatever it dropped — the one thing its text
cannot tell you is what is missing from it.
CompactionDone now carries the sizes and the coverage counts, and the card
renders them: "128.0K → 31.2K · 10/12 changes kept (repaired)". A fold with
nothing to carry prints no quality line rather than a hollow 0/0.
The card moves out of chat_tui.go into its own file on the way past.
Approving a tool left the run strip reading 等你批准 for as long as the tool
then took. A 42-second OCR command spent all of it claiming to be waiting on
the user, which is the one line watched to know anything is happening at all.
The decision now hands the label back to the tool it released.
Re-probing a saved source sent the key field, which is deliberately blank when
the user is not changing it, so it probed as a provider with no credential and
failed before reaching the host:
fetch models: provider "probe" has no API key (set in .env)
A blank field means "keep the stored one", so the refresh goes through
/providers/check, which already uses what is saved. That route now answers with
the model names rather than a count, since a refresh needs the list.
One name for one thing: the add form asked for 协议 while the connection list
calls it 接入方式. Its note also still told the user to come back and switch
protocols in place, which was removed for being unsound — two protocols answer
the same model listing but their chat endpoints are different paths, so the
advice now says to add the second one as its own source.
Documentation-impact: none - no docs/*.md describes the run strip's labels or
the provider check payload.
The index was budgeted at half a percent of the window on the assumption
that its lines were a hint. They are addresses now, and the count of them is
the reach of recall: what falls off the end is what can no longer be asked
for. A percent buys roughly a hundred entries, shared across generations
since the index is cumulative.
It stays the cheapest thing a fold keeps — prose spends hundreds of tokens
to say what a line says, and prose cannot be recalled.
estimateTextTokens returned characters under a name that said tokens, and
estimateMessagesTokens summed it. Every remaining caller compared that against
a budget carved from the context window in real tokens, and three of them were
wrong by the factor between the two units:
- the verbatim tail kept a quarter of what the window had room for (measured:
7931 tokens against a 32768 budget), so recent turns nobody asked to lose
went to the summarizer instead of staying in context;
- a fixed prefix of 30K tokens was read as 120008 and refused compaction
outright, which leaves the context growing to the hard ceiling;
- an interrupted request's reconstructed billing line ran ~4x high.
Both estimators are gone. Everything sizes messages with estimatedPromptTokens
and bare text with textTokens, which is what the trigger, the acceptance test,
and the output clip already used. foldEconomics keeps its old threshold in the
new unit (400 characters is 100 tokens). CompressResult's source_tokens and
projection_tokens now mean tokens to the model reading them.
The two budgets that were wrong now have tests, and both fail if the estimate
is put back in the wrong unit.
A saved source could only be deleted and re-added, and which models read images
was whatever InferVisionModels guessed from their names at add time. That guess
is names-only by design — it cannot know what a relay serving gpt-4o under some
private id can do — and there was no way to correct it afterwards.
Each connection now opens an editor: endpoint, key, which models to keep, which
of them read images, and which is the default. The key field left blank keeps
the stored one, so changing a model list does not mean re-pasting a secret.
The edit merges rather than replaces. UpsertProvider assigns the whole entry, so
building one from this form would silently drop every field the form cannot show
— per-model prices, effort vocabularies, context windows, headers, the preset it
came from. A source with two priced models would have come back with none.
The vision list is the whole answer when it is written: the provider-wide flag
answers for every model a whitelist omits, and a per-model override beats both,
so a toggle that only wrote the list would be a switch that changes nothing.
/providers reports the resolved per-model answer for the same reason — the form
shows what is true now instead of asking the user to remember it.
Documentation-impact: none - no docs/*.md describes the settings pane's source
editor or the provider list fields.
Every fold has left an index of #n addresses since the last change, and
nothing could read one. This is the tool that does: recall names canonical
positions and returns them, with the tool results that answered a call, so
an address is a way back rather than a headstone.
Two things keep it from undoing the fold that made room for it. A recall
draws on a budget worth a tenth of the window, and a request past what is
left is refused whole rather than trimmed — half a span reads as the whole
of what was there. The ledger carries the generation it belongs to, so each
compaction grants a fresh budget with nothing to reset: a stale generation
already reads as unspent.
What is still visible is refused too. The model re-reads that itself, and
the description sends it back to read_file for anything a current copy
answers better. Recall is for what cannot be re-derived: the user's own
words, and the output of work that should not run twice.
The tool schema costs 199 tokens on the provider-visible prefix.
Switching to any Anthropic model failed with
switch model: provider: unknown kind "anthropic" (registered: [openai])
Kinds register themselves from init, so a binary builds only the ones it links,
and this shell linked none of them. openai reached the registry anyway — config
imports it for an endpoint check — which is why the failure looked like it was
about Anthropic specifically rather than about the whole registry being empty.
Nothing upstream could catch it. The picker offers what the config lists, and
the config needs no factory to list it; the old shell and the CLI both carry
these imports, so every other entry point worked. The two tests here fail on the
missing imports, and the second one also holds the curated presets to it: a
preset naming an unlinked kind is a source a user can add and then never select.
Documentation-impact: none - no docs/*.md lists which provider kinds a binary
links.
Two problems the host-only grouping and the silent runner between them made
one report: "切换不来".
The switch was not failing quietly by accident — Settings' run() had no catch,
so anything the kernel refused vanished. It refuses a model switch while a turn
or a background job is running, which is exactly the state a real session is in
and never the state a freshly started one is, so the click did nothing and said
nothing. Every switch on the page goes through that runner, so one line of
reporting covers the model, the effort, the roles and the protocol.
Grouping on the host alone then merged accounts that are not one. A relay
reached with two keys is two accounts — personal beside work, two tenants of
one gateway — and folding them showed one key state and one balance for both.
The account is the host and the credential together, so /providers and /models
carry keyEnv and both lists key on the pair. Where one host really does hold
two accounts, and only there, the config entry's own name joins the label.
A custom relay lands where it should from this: one account, its own models, no
protocol switch offered because it answers on one. The switch appears only for
a host that genuinely has two doors.
Documentation-impact: none - no docs/*.md describes the settings pane's grouping
or the provider list fields.
foldIndexBudget carves a token share out of the context window, but the
render and merge passes costed their lines with estimateTextTokens, which
counts characters. A 128K window granted 640 tokens and bought 640
characters of addresses: around thirteen lines where fifty fit.
The lines are what a folded turn has left, so the shortfall lands exactly
where the digest is already thinnest. Both passes now cost text with
textTokens, the calibrated ratio the rest of compaction plans against.
The fold input path sized itself with estimateTextTokens, which counts
characters, and compared that against a budget carved out of the context
window in tokens. Every stage therefore read a fold as four times its cost:
the omit stage cut a 32-turn English fold to 6 turns, and the guard then
confirmed the result fit — with room for all 32.
summaryInputTokens now goes through estimatedPromptTokens, the same
calibrated estimator the trigger and the acceptance test use, so the
shorten/compress/omit ladder and the budget speak one unit. That folds the
provider-split guardedSummaryInputTokens back into it, and makes the
FoldTokens telemetry a token count rather than a character count.
The model list folded rows by model name across protocols and gave each row a
route selector defaulting to "the active one, else the first". Provider order
put the Anthropic entry first, so every row the session was not already on
defaulted to Anthropic — picking a model moved the session to another endpoint
without being asked. That is what "切换不来" was: the switch worked and did
something the user had not chosen.
Protocol belongs to the connection, not the model. Entries sharing a host are
one account reached through more than one door, so the connection list groups
on the host and carries the switch; the model list shows the models behind the
door currently open, and picking one only picks a model. Changing the door on
the account that is running moves the same model onto the other endpoint —
a real switch, made deliberately, in the place that owns it.
The rows are named for the account now (deepseek, from the host) rather than
for whichever config entry happened to answer. One key and one balance showing
up as deepseek-flash beside deepseek was the whole complaint.
vite's dev proxy was missing /providers, /roles, /account, /hooks, /memory and
/network, so those panels answered with the SPA shell in dev — the same class
of failure the shell's own route list had, and its comment already warned about
it. The list it needs is not derivable from here, so it is spelled out.
Documentation-impact: none - no docs/*.md describes the settings pane layout or
the dev proxy's route list.
The digest is on the hook for what a fold changed and what failed. Everything
else it folded — the reads, the searches, the user turns the retention budget
could not hold — became prose or became nothing, and from inside the window
those two look identical. A model cannot ask for what it has no reason to think
existed.
Each fold now appends a host-written index to its digest: one line per folded
item the digest does not carry, addressed by transcript position.
## Folded work index (#n = transcript position)
- #31 you "the migration must not take the service down…" (summary only)
- #47 read_file internal/parser/lexer.go
- #52 bash go build ./...
- #58 grep {pattern} (1 keys)
The split with the coverage check is exact rather than approximate: an entry is
indexed if and only if coverage does not demand it. Writing that as one shared
predicate found a hole neither half had covered — a successful `go build`
classifies as a mutation but reports no path, so the digest was never asked for
it and the index skipped it as the digest's job. It fell between them.
Ranking decides what survives a bounded index, and the order is not a
preference: a user turn nobody can re-derive comes before a failed search,
which comes before a read whose file is still on disk. The budget is a small
share of the window because index lines are the cheapest thing a fold can keep.
The index carries across folds without being re-summarized. It is stripped out
of any prior digest before the summarizer sees it — asking a model to rewrite
host-authored address lines only spends output budget and risks garbling the
addresses — then merged back, trimming from the oldest and saying how many went.
An entry that has survived more folds is the one whose original is furthest out
of reach, which is the opposite of what a naive tail-trim would keep.
Addresses are canonical transcript positions, the same scheme the projection
already validates through CoveredCount and CoveredPrefixHash, so a rewind that
invalidates the projection invalidates the addresses with it. Positions inside
a previous projection answer -1 and render without an address: that content was
folded once already and has no canonical position of its own.
Nothing reads the addresses yet. The recall tool is the next stage; this one is
what makes it worth having, because a tool that retrieves what the model has no
reason to ask for is a tool nobody calls.
Cache-impact: none - no tool schema, system prompt, or memory text changes. The
digest message gains a section, which is projection content and already varies
per fold.
Cache-guard: go test ./internal/boot/ ./internal/agent/ (prefix_shape golden
unchanged)
Documentation-impact: none - the index is self-describing in the digest and has
no configuration surface; docs/*.md does not describe digest structure.
canonicalizeOfficialDeepSeekSource drops deepseek-flash and deepseek-pro into
the one "deepseek" entry, but only when every provider-wide field matches it.
A config holding the pair on the Anthropic protocol beside an OpenAI-protocol
"deepseek" fails that test — and correctly, because the fold keeps the
canonical entry and discards the rest, which would delete the Anthropic route.
So the pair stayed two rows while the OpenAI side showed one, and the settings
panel lists sources: one endpoint, one key and one account read as two
accounts. They now fold into each other instead. The survivor keeps the first
entry's name and slot, because provider order answers bare model names and a
new name would break refs that live outside this file — shell history, a
memorised --model. Refs naming the entry that went away resolve to it, and are
asked before the canonical retarget: a "deepseek" entry can exist without
having absorbed anything, and then it does not hold this route.
Per-model price and effort move into prices and model_overrides rather than
flattening, which is the shape ensureDeepSeekOfficialProvider already gives the
canonical entry. On a real config the pro model keeps its three effort levels
and the flash model its four, instead of the first entry's list answering for
both. A curated model list still declines the fold: carrying every model would
re-add the one the user removed.
Documentation-impact: none - no docs/*.md describes how legacy DeepSeek entries
are folded; the config keys involved keep their documented meanings.
Acceptance asked a digest one question: is it smaller than what it replaced. A
digest that summarized nothing answers yes — it is very small — so the one
failure mode worth catching was the one nothing looked for.
A fold is now also measured against the facts it produced. Those come from the
fold region itself, read through evidence.ReceiptFromToolCall, the same pure
classifier the ledger uses; the live ledger is per-task and never spans a fold,
so deriving them is the only way to have them. Two kinds count:
- files the fold changed
- commands the fold saw fail
Reads stay out on purpose. The workspace still holds what a read found, and
demanding reads back would push the summarizer toward listing paths to pass a
check rather than writing what happened.
When the digest forgot a change, one more summarizer call asks for exactly what
went missing — naming the files rather than restating the whole contract, so
the second attempt spends its budget on the gap. The better of the two results
wins.
Repair rather than rejection, and that is the part worth arguing. Refusing a
partial digest leaves the prompt uncompacted; the next attempt folds a larger
region and the pressure only ends at the hard ceiling, where the fold is forced
through whatever it produces. Strictness early buys a worse digest later. The
one case still refused is a digest that carried none of the fold's changes,
which needs no threshold to recognise — and even that stands down when the fold
is the only way out.
No ratio is configured anywhere. The severity line is the mechanism's own: a
forgotten change makes the agent wrong, because it will redo or contradict work
already on disk, while a forgotten failure only makes it slow. Counts land in
the compaction telemetry so the fold's fidelity is reportable rather than
assumed.
Cache-impact: none - no prompt, tool schema, or memory text changes. The digest
the projection installs is the same shape; only its acceptance path changed.
Cache-guard: go test ./internal/boot/ ./internal/agent/ (prefix_shape golden
unchanged)
Documentation-impact: none - internal acceptance logic with no user-facing
surface yet; the /context quality card lands with the UI stage.
The connection rows showed what was configured and nothing about whether it
still holds. A key revoked last week and an endpoint that moved both read as
a normal row, and the only way to find out was to start a turn and watch it
fail.
/providers/check re-runs the add-a-source probe against what is already
saved, so "is this key still good, and is this still the protocol we
recorded" is one button. The row reports the endpoint's own words, because a
401 and "no chat models" send the user to different fixes.
No protocol switch rides along with it, though the row can now tell you the
protocols disagree. A probe only lists models, and it tries both auth shapes
against the same listing URLs, so "both answered" says nothing about where
either chat contract lives: DeepSeek serves OpenAI chat at /chat/completions
and Anthropic at /anthropic/v1/messages. Flipping kind alone would aim one
contract at the other's address and call it a repair. The row says what it
found and leaves the fix to a human who can also change the address.
测一下 stays visible instead of riding the hover reveal 删除 uses. A
diagnostic nobody can find is not a diagnostic; a destructive action that
hides until you mean it is.
Documentation-impact: none - no docs/*.md describes the settings pane's
connection list or the serve provider routes.
The shell answers any path outside apiPaths with index.html, so the settings
pane asked for its role assignments and parsed the SPA shell as JSON. The
band reported "读不到分工" on every open, and no request ever reached the
controller to explain why.
TestEveryPathTheFrontendCallsIsRouted names this exact failure and caught it
on the first run; the pre-push list does not include ./desktop, which is why
it went out with the route missing rather than with it.
Documentation-impact: none - no docs/*.md lists the shell's routed paths.
Compaction is not the class of strategy the last few commits removed. The
context window is a physical constraint, not a judgment about how the model
should work, and every rejection in acceptCheckpointCandidate is already
grounded in a measured token count against the user's trigger or the provider's
ceiling. What did not survive review is the residue of the retired
multi-threshold scheme, and the numbers inside it that were never anyone's to
choose but the host's.
The residue:
- compaction.consecutive was incremented in one place and reset in four, and
read in none. It only ever existed to be cleared.
- soft_compact_ratio / tool_result_snip_ratio / compact_force_ratio are
forced to zero at config load, then threaded from boot through agent
Options and a twelve-parameter task constructor to fields nothing reads.
- SnipStaleToolResults and PruneStaleToolResults were exported no-ops with no
callers, and PruneStats existed to be their return value.
- ContextReport still declared SoftThreshold / SnipThreshold / ForceThreshold,
which nothing populated — and /context both printed them and branched on
them. "LatestPrompt >= ForceThreshold" against a permanent zero is always
true, so every session, including an empty one, reported "next: at the force
threshold". It now names the fold trigger and the hard ceiling, which are
the two thresholds that exist.
The numbers, now under [agent] and all off by default:
user_turn_keep_tokens your own turns kept verbatim through a fold
first_turn_pin_tokens first turn pinned into the cached prefix
checkpoint_ceiling_ratio how small a fold's result must be to be accepted
compact_ratio loses its 0.65–0.85 range. Compacting early to keep prompts small
and compacting late to keep history whole are both real preferences; only a
value that is not a fraction of the window is wrong. The desktop bridge's copy
of the range goes with it.
The user-turn retention budget was min(8192, 5% of window), so it stopped
growing at a 164K window: someone running a million-token model kept the same
8192 tokens of their own words as someone running 128K. It is now the window
share alone, with the fixed count kept only as the fallback when no window is
known. The separate 1500-token per-turn ceiling is gone — the remaining budget
is the only gate, and [[keep]] is still the way to insist on a specific turn.
Because the budget is the user's, /context reports what the last fold did with
it: turns kept, turns dropped and roughly what they cost, and the budget that
decided. noticeDroppedUserTurns already said it once, at the fold; this is what
can still answer afterwards.
Cache-impact: none - no prompt, tool schema, or memory text changes. Fold
behavior is identical for an unconfigured agent: every new setting defaults to
the value it replaced, and the retention budget's window share is unchanged at
every window where the old fixed count was not already the binding limit.
Cache-guard: go test ./internal/boot/ ./internal/agent/ (prefix_shape golden
unchanged; TestUserTurnKeepBudgetScalesWithTheWindow and
TestUnsetCompactionBudgetsKeepTheDefaults pin the defaults)
Documentation-impact: none - docs/*.md documents neither the retired thresholds
nor the fold budgets; the [agent] keys are self-describing in the rendered
config.
An attachment the main model cannot read is already handed down to whatever
sub-agent runs next, and that sub-agent's model was chosen for something
else — usually cost. A cheap worker is text-only, so the provider serializer
drops the image and the turn answers as though nothing was attached. The
composer has been promising a vision-capable reader since it shipped; the
only way to deliver one was to hand-edit subagent_model and give up the
cheap worker.
agent.vision_model names that reader. The routing travels in the turn
context beside the image candidates, because it answers the question they
raise: the parent could not read this, so who can. A sub-agent about to
receive candidates it would drop is moved onto that model; one that already
reads images, or a turn carrying no attachment at all, is left alone — a
review sub-agent spawned in a turn that happened to have a screenshot keeps
the model it was chosen for.
/roles gains the assignment and the band's 看图 slot stops reporting a
borrowed subagent, so what the settings pane shows is now a switch rather
than a readout.
config.roleModelRefs is the one list of model refs a role can name. The
fallback repair and the referenced-provider scan both walk it, and they have
to walk the same one: a role missing from either keeps alive a ref no
provider resolves.
Cache-impact: none - the system-prompt prefix is untouched. Vision routing
only rewrites a per-turn context value and a sub-agent's model ref, and the
new config key renders into user TOML, never into the prompt.
Cache-guard: go test ./internal/boot/ (prefix_shape golden unchanged)
System-prompt-review: esengine - config gains agent.vision_model; it is read
at sub-agent spawn time and rendered into user TOML, and reaches no
prompt-bearing surface.
Documentation-impact: none - no docs/*.md describes image routing or the
sub-agent model fields beyond SUBAGENT_PROFILES, whose precedence rules are
unchanged.
Memory had its limits inverted. The fact index — one line per saved fact,
loaded into the cached prefix and paid for on every session — had no bound at
all, and kept charging for facts already past their expires_at even though
automatic recall refuses to serve one. Meanwhile recall, which rides the cheap
turn tail, was pinned at four facts and 2400 characters by constants no
configuration could reach, and the pinned-guidance ceiling was a flat 1500
characters that told any user with more to pin that they were wrong.
So: expired facts leave the index. A line the model can never act on is prefix
rent, and dropping it is the one bound memory was actually missing.
Everything else becomes the user's, under [memory]:
pinned_budget_chars ceiling on pinned bodies; unset = none
recall_limit facts automatic recall may inject; unset = 4
recall_max_chars that injection's size; unset = 2400
The recall axes keep their old numbers as defaults but lose their ceilings —
configure fifteen and you get fifteen. A hit's snippet is now an equal share of
the char budget rather than a separate 520-rune cap, so it moves with whatever
was configured instead of standing as its own limit. A mid-session reload
carries the budgets forward rather than reverting to the defaults.
What replaces the hard cap is the number itself. `/memory` reports the prefix
cost — index characters and fact count, pinned characters and fact count, the
total, and the budget when one is set — because the axis ships off, and a cost
nobody can see is not a decision anyone can make.
Cache-impact: low - the prefix loses index lines for expired facts, which is
the intended change; nothing else about assembly or ordering moves, and a store
with no expired facts renders byte-identically.
Cache-guard: go test ./internal/boot/ ./internal/memory/ (prefix_shape golden
unchanged; TestIndexDropsExpiredFacts covers the new omission)
System-prompt-review: index composition changes only by omitting expired facts
— needs a reviewer's eye on whether any workflow relied on an expired fact
still being listed.
Documentation-impact: none - docs/*.md does not document the recall constants
or the pinned ceiling; the [memory] section is self-describing in the rendered
config.
Staging turn_orchestrator.go whole took three hunks of unfinished
image-routing work with it — calls to imageRoutingPrefix,
bindOrchestratedTurnImages, and unreadableImages — while their definitions in
turn_images.go stayed uncommitted, so studio did not build. This restores those
call sites and keeps only the withPlannerTurnMetadata signature change that
commit was actually for. The working tree keeps the newer versions; they belong
to the change that defines their helpers.
Cache-impact: none - control-flow call sites only, no prompt or tool surface.
Cache-guard: not applicable; no provider-visible bytes change.
Documentation-impact: none - restores a call site to its previous form.
The model pane was one flat list multiplying three independent axes —
which service, which protocol reaches it, which model — while the fourth,
which job a model takes, existed only in the config file. Twenty rows of
radio buttons, and no way to tell which of them reads images.
/models now carries a per-model capability face: the endpoint host, image
input, the effort levels that endpoint accepts, context window, price.
Each resolves back through ResolveModel so per-model prices and
model_overrides apply. A field stays absent when nothing declares it — an
inferred "reads images" badge sends the user to a rejected request with
nothing on screen to explain it, which is worse than a blank row.
The picker groups by endpoint and folds one model's protocol routes into
a single row, so a vendor reached under both OpenAI and Anthropic stops
listing the same model twice with nothing to choose between. Effort
offers only what the endpoint has; the fixed six were shown to every
model, including ones carrying no reasoning knob at all.
/roles gives the planner, subagent and guardian their own models, writing
the AgentConfig fields that already drove them and rebuilding the runtime
the way a model switch does. Image routing has no field of its own yet,
so its slot reports the subagent model it borrows and whether that model
reads images at all — the composer has promised this since it shipped.
A saved vision whitelist no longer raises the provider-wide flag as well.
That flag answers for every model the list omits, so a mixed provider had
its text-only half claiming image input.
Documentation-impact: none - no docs/*.md describes the serve HTTP
surface, and SUBAGENT_PROFILES keeps its meaning: /roles writes
agent.subagent_model without changing its precedence.
Two ladders came down.
The planner gate was scoring task text out of twelve keyword tables — work,
high-risk, cross-surface, ambiguous, atomic — and buying a second model round
from vocabulary. "migrate" was enough. So was a message over 240 runes, or two
file paths in one sentence. What the tables were reaching for is a judgment the
executor is better placed to make: it reads the same words with the repository
in front of it, and lays out steps with todo_write when a task needs them,
where the delivery gates and the contract can both see them. The gate now
answers only "did the user ask for a plan?" — plan mode, a synthetic turn, a
slash command, or a directive the user stated outright ("先规划再执行", "wait
for my approval"). taskpolicy loses the surface-shape signals that fed it for
the same reason: rune counts and path counts described the sentence, not the
work. Risk stays a host signal, and nothing derives one from wording.
The six per-round counters came down with it. A turn was being watched by the
zero-gain ladder (2/4/6), the storm breaker (3 identical failures, 3 all-blocked
rounds), the repeat-failure and repeat-success blocks (2 each), and the todo
stall checkpoints (8/16) — all reading the same receipts, all reaching for the
same "it looks stuck" from a different angle, and each one able to redirect the
model or refuse its call. run_budget.go already says why this was the wrong
axis: rounds are a poor proxy, and the failures worth stopping are reported in
hours and tokens. Those budgets remain, off by default and user-owned. Stopping
a task stays the user's call.
Removing them retires the loop-guard pass in final readiness too — an escape
hatch whose only job was to release a model the guards had cornered.
The outcome scorer survives as an instrument (internal/agent/outcome_shadow.go):
it still decomposes each round for the bench, and still decides nothing.
Net -3250 lines.
Cache-impact: none - the system-prompt prefix is untouched; the per-turn
<execution-policy> block keeps its shape and only ever carried preset-derived
values, which are unchanged for every preset.
Cache-guard: go test ./internal/boot/ (prefix_shape golden unchanged)
Documentation-impact: none - no docs/*.md describes the planner scoring or the
round counters; user-facing copy for plan mode and task budgets is unchanged.
A turn's obligations were being read off its wording. taskintent held ~1200
lines of CN/EN keyword tables, hand-rolled negation windows, and clause
splitting to answer "is this a mutation request?", and final readiness then
demanded a state change from any sentence that scored one. Its own doc.go
called the vocabulary a liability; boundary_test.go existed to stop it growing.
Readiness now reads the ledger: a turn that changed nothing owes nothing, and
one that did owes the verification, review, and sign-off it already owed. The
contract's intent label follows the same rule -- taskcontract.Kind is observed
from receipts after the fact instead of predicted from text -- and the atomic
contract shape is triggered by a mutation receipt rather than by a verb.
taskpolicy keeps the constraints a user stated outright ("don't modify", "only
run go test"): those restrict, and the user meant them. What goes is the risk
guessing, where "migrate" or "credential" bought a full plan and a forced
review from a topic word rather than from what the turn touches. Risk now
arrives only as host-computed signals.
Also removes machinery that decided nothing in production: the EBM and
reasoning-governor experiments (env-gated, off), the fork-bundle capture that
served them, and the shadow delegation-admission verdict. The per-round
contract replay went with them -- it rebuilt the whole contract from every
receipt on every tool round, quadratic in a long turn, for an audit channel
only the bench implements.
Net -3382 lines. Behavior change: a Delivery turn that claims work without
calling a tool is no longer refused. Catching that belongs to the model's own
claim (update_goal / complete_step), which internal/completion already checks
against the ledger, not to a keyword table.
Cache-impact: none - no tool schema, prompt, or memory text changes; the
per-turn <execution-policy> block rides the turn tail as before and its
route/risk values are derived from the same frozen preset.
Cache-guard: go test ./internal/boot/ (prefix_shape golden unchanged)
Documentation-impact: none - taskintent and the two experiments were never
user-facing; no docs/*.md describes the removed gates.
The official source ships as two provider entries, deepseek-flash and
deepseek-pro — a shape from before a single entry could carry several models.
The model picker hid it because it lists models, but the settings panel lists
*sources*, and there one endpoint, one key and one account show up as two
accounts, with every model appearing twice under different refs.
They now fold into the single "deepseek" entry at load, through the
compatibility gate that already existed for exactly this: provider-wide fields
have to match and per-model ones must not conflict, so anyone who edited either
entry keeps what they wrote. Per-model efforts, prices and context windows ride
the canonical entry's overrides rather than being flattened into one.
Refs are deliberately not rewritten. Resolution answers the old names instead,
because refs outlive the config file — shell history, scripts, a --model flag
someone has memorised — and rewriting the four that live in the file would fix
none of those while making Default().DefaultModel disagree with a loaded one.
Model sources, account and versions each get a section, and the 「高级」 tab —
which existed only to say "this still lives in the old app" — filters itself
out now that its list is empty.
Account state is fetched once by App and passed down, and an unknown state
renders as unknown. The first cut drew 「登录」 while the request was in flight
and swapped to 「退出登录」 a few hundred milliseconds later, which is long
enough for a signed-in user to click it and actually sign out. Signing out is
two steps for the same reason, and the button that does it always sits next to
the sentence saying what it does not touch.
The identity entry in the title bar is an outline when signed out: an entry
point, not a pitch. Reasonix works without an account and the chrome should
not imply otherwise.
A settings section that throws now takes down only itself — the other sections
and the conversation behind them are unaffected.
The account and provider endpoints are behind host grants like the workspace
switch already was, so the three of them become one decision — this server is
a window, not a network service — instead of three independent bools spelling
states no host means.
A model or effort switch now carries the serving generation into its
replacement rather than assembling one from cold: sidecars keep running, the
dependency graph is not re-walked, and discovery is reused when the extension
surface has not moved. The switch also stops re-resolving the workspace from
the process working directory, which is what made a rebuild quietly serve
another project's conversations.
Studio's apiPaths was a whitelist that silently answered index.html for
anything unlisted — /skills and /todos had been falling through it for a
while. A test now walks what the frontend actually calls, because the comment
saying "register your route here" plainly did not.
Reasonix runs on the user's own key against their own provider, so there is no
structural reason to require an account and we are not going to invent one.
What an account buys is the handful of surfaces that cannot work without a
server on the other end: posting in the community, following up on a crash
report, publishing a skill later.
`reasonix login` runs the device flow — the browser gets the address bar, we
never show a password field — and the token lands in the existing credential
store, which already carries the file permissions, the edit lock and the
environment override that lets CI inject one.
The serve endpoints are off unless the host grants them, for the same reason
the workspace switch is: signing in writes a token into the credential store
of whichever machine runs the kernel, which is not necessarily the machine in
front of the person clicking.
Adding a provider by hand means knowing which protocol the gateway speaks,
which models it serves, whether it wants a Bearer header, and whether it can
see images — none of which the person who just bought an API key has any way
of knowing. So the endpoint is asked instead: /probe reports what answered,
and nothing is written until the user has looked at it and confirmed. Where
more than one protocol answers, the result says so rather than picking
silently — that is a preference, not a finding.
The probe also retries with the proxy bypassed and reports it, because a
China-only endpoint reached through a foreign exit resets the handshake and
would otherwise look simply dead.
ChatModelList moves out of config.go into its own file; the picker filter has
nothing to do with the config schema and config.go has no room left.
A release that turns out to be bad currently leaves the user hunting for an
old installer. The version panel lists what has been published and installs
any of them — the same code path forward or back, because a rollback that took
its own path would be the less-tested one. The chosen version is pinned before
the download starts: if the machine dies mid-install, the next launch must not
helpfully update past what the user picked.
The update core moves out of the old shell into desktop/internal/update so
both shells share it. Beyond deduplication that finally makes it compile on
every platform — updater_mac.go could not even be type-checked from Windows,
so the macOS half was only ever verified by CI.
Publishing writes a per-tag index alongside the artifacts, so the catalog the
panel reads is produced by the release itself rather than maintained by hand.
Two things the transport learned the hard way, now covered by tests: a 404 is
not transient and must not burn the full retry budget, and a resumed download
has to verify the range it was actually given — a middle box that answers
`bytes 0-` to a range request will otherwise append the whole file to what is
already on disk.
Every path that mints a session file before knowing whether it will be used —
an inbox enqueue, a window that opens and closes, a switch the user backs out
of — leaves a transcript with no user message in it. They accumulate in the
session list forever, and the list is the user's history, not a log.
ReconcileCleanupPending now reclaims them on the same pass that retries
delayed cleanup, after a grace period long enough to cover the gap between
creating the file and the first turn reaching it: a live session holds the
write lease, so it is never a candidate. Reclamation goes through the host's
cleanup path, so a host that trashes deletions trashes these too rather than
unlinking them.
Switching model, effort or extensions used to duplicate that definition at
every call site: serve spliced the fresh system contract over the carried
history by hand, restored session authorizations by hand, and each caller
decided for itself which axes — approval mode, plan mode, a running goal — a
switch was allowed to reset. CaptureRuntimeMigration/ApplyRuntimeMigration
state it once, and BuildRuntime hands back the whole generation (controller,
frozen snapshot, bound closables) so the next rebuild can reuse the assembly
it already paid for instead of rediscovering skills, commands and hooks.
Resume keeps its cold-cache notice; the migration path takes the private
`resume` that records the cache state without announcing an idle gap the user
never sat through — they never left the session.
boot.go was at the file-size ratchet with no room to add a line, so the parts
that are their own concern now live next to it: memory set, phase timing,
plugin specs, skill discovery.
A real profile listed 189 sessions, 154 of them named subagent-sub-*. Those are
a task's internal trace — persisted since the subagent-transcript work so a run
can be continued or forked — and mean nothing outside the session that spawned
them. Switching reasoning effort rebuilds the runtime, the frontend reloads the
list, and a wall of them appeared where the user's own conversations should be.
The rule already existed, spelled inline twice in the downgrade migration with
the reason written out, and was simply missing from the listing. It becomes
store.IsSubagentTranscriptName, next to the sidecar-suffix rule it belongs with,
and the migration now calls it instead of restating it.
It is applied at the surfaces that list the user's own conversations, not inside
IsVisibleSession: recovery GC scans for recovered branches through that helper
and would stop reclaiming a subagent's, leaking them on disk.
Saving a fact is the one tool call that changes what the agent will do in later
sessions, and it happens without being asked. As an ordinary step it scrolled
past between a grep and a read, so the behaviour and the moment it was learned
were never connected — which is exactly the connection someone needs weeks later.
The card says what was taken away and when it will apply: pinned facts ride in
every prompt, relevant ones surface when a turn looks related, and project scope
is narrower than global. Undo sits on the card because it is only cheap right
now, while the conversation that caused it is still on screen. Taking it back
marks the card rather than removing it — the transcript is the record of what
happened, and erasing the row would erase that too.
It reads the call's own arguments, which carry what was saved and how it will be
recalled; the tool's textual receipt carries neither. A failed save stays an
ordinary failed tool call.
Memory is the only thing in the product that changes how the agent behaves
without the user ever configuring it — the agent writes it. Weeks later it
insists on something and there is no way to find out why, because the fact
behind it was saved silently during some conversation.
So the pane answers the question that gets asked, not the one a list answers.
The last recall is folded into the rows: a fact the turn actually used is marked,
and it says what it matched on. Grouping follows activation — always in the
prompt, or only surfaced when the turn looks related — because that is what
decides whether a fact is a standing instruction or background. The write-side
types are the author's classification and do not tell a reader when a fact
applies, so they do not organise anything here.
Forgetting archives rather than deletes, which is the store's existing choice
and the right one for something removed by mistake.
The mock's scripted turn moves to its own file: it is content, not transport,
and mock.ts had grown past the size ceiling holding both.
A wrong proxy shows up as a chat turn that hangs. Nothing in that message says
whether DNS failed, the proxy refused the connection, a corporate MITM cert was
rejected, or the key was simply wrong — four different fixes behind one symptom.
netclient.Diagnose walks proxy → dns → connect → tls and stops at the first
failure, because every later step fails for the same reason and three red rows
hide the cause. The controller appends the auth step, since only it knows which
provider is selected: a host that answers but rejects the credential is a
different problem from one that never answered. Each failure carries the next
thing to try, and an untrusted certificate says so by name rather than reading
as "the network is down".
The pane is three modes, not six proxy variables; the fields for a manual proxy
only exist once that mode is chosen. Saving validates first, because a spec that
cannot even be composed into a URL would otherwise be written and then fail on
every request far from the screen that set it. The stored proxy password is
never handed back to the editor — only whether one exists.
Hooks run arbitrary shell on the user's machine and two of the events can stop
the agent outright, so this is the most dangerous writable surface in the
product. It had no editor here at all: the writing half lived in the desktop
app, and internal/hook could only read.
Save and DryRun move into internal/hook, where the CLI, the desktop and Studio
can share one implementation. Save preserves every other key in settings.json,
which is not a hooks file it happens to live in. DryRun really executes the
command against a representative payload, because a simulated pass proves
nothing about a command that does not exist — and reports the consequence for
that event rather than the exit code, since the same code stops a PreToolUse and
only warns after a PostToolUse. Editing swaps the live runner, so a rule the
user just fixed applies to the next tool call instead of the next launch.
The pane leads with recipes, not events: nobody arrives wanting a PreToolUse
hook with an anchored matcher, they want their formatter to run. The event table
is one click behind that, blocking rules carry a warning stripe, and the scope
choice says out loud that a project rule ships to everyone who clones the repo.
The controller does not keep its own copy of the hook runtime options; the
runner's spawner already binds them, and the second copy would have pushed two
already-oversized files further over their budget.
Adding a server meant leaving for the old desktop app. Bringing it here as a
form would have been the wrong shape: nobody knows whether they want stdio or
http, they have whatever the README printed — an mcpServers block, a command
line, or a URL. internal/mcpsetup takes all three and says which one it got.
Parsing is its own step. What comes back is a card naming the process that will
run on this machine, the endpoint it will talk to, and any credential written
out in full rather than referenced, because a pasted config is a stranger's code
and the user is the one agreeing to it. Where it gets written is a choice, not a
default: a project entry ships to everyone who clones the repository.
Installing connects first and persists only if that worked — a saved entry that
never connects reads as installed while contributing no tools. Authentication is
the exception: its config stays, since finishing OAuth is impossible once the
entry is gone. Removal asks, names the file it will edit, and reports when a
same-named declaration underneath takes over instead of implying it is gone.
The argv grammar, naming rules and secret detection moved out of internal/cli,
which is where the CLI happened to need them first; the frontends take the same
descriptions and cannot import a frontend. ParseArgs lost the 122-line body and
the complexity that came with it rather than carrying that debt to a new file.
The Studio shell matched API paths exactly, so /mcp reached the kernel while
/mcp/reconnect fell through to the assets and answered with index.html. The
frontend then failed parsing HTML as JSON, which is indistinguishable from a
broken endpoint. The dev proxy had the same hole, and had been missing /mcp and
/slash since they were added.
Both now list resource families: a sub-path belongs to the resource it hangs
off, so the next endpoint under one is routed without a second registration.
The extensions page could only report. A failed server named its error and
offered nothing to do about it, a configured server could not be switched off,
and the skill list was built from the slash surface — so a skill the model
discovers on its own, having no slash name, did not appear at all.
Reconnect and the durable activation switch land on the controller, where the
desktop's own copies should eventually collapse into them, and serve exposes
what the controller already knew: /skills now answers every discoverable skill
with its trigger paths and capability face, and /mcp resolves the activation
state so "switched off" stops reading as "not needed yet".
Studio spends it on the row that needs it: a retry button that says re-authorize
when the failure is a 401, a switch per server and per skill, and a trigger note
only on the rows that are missing one. The transcript names the profile a
delegated step ran under, and an MCP tool drops the prefix its own badge repeats.
The session rail ended in two disabled buttons whose explanations were
unreachable — .lnk[disabled] sets pointer-events:none, so the title tooltip
never appeared — and one of them blamed a missing kernel API that has existed
all along in internal/worktree. Both are gone. What they promised is real now,
and each half lives where it belongs.
Skills were already invocable: the kernel resolves /<name> through
resolveSkillInvocation, so the only thing missing was discovery. GET /slash
lists what Submit actually resolves, custom commands ahead of skills in exactly
the order the kernel picks them, and the composer offers it on "/". Built-in
verbs stay out — most are chat-TUI only, and offering one the HTTP path drops
is worse than listing nothing.
Changing the working folder rebuilds the runtime at another root. It is a fresh
boot.Build and never boot.Rebuild: Rebuild migrates the conversation and
continues the outgoing session file, which would drag one project's transcript
into the next. Permission is a host grant (Server.AllowWorkspaceSwitch) rather
than a config key, because a server reachable beyond localhost must not let a
client repoint the agent at any directory it can read. The shell grants it —
its only client is its own window — and reopens the folder it last drove.
Studio also pinned no SessionDir, so every project shared the global session
store and the rail listed another project's history. It now resolves the
per-project directory the CLI has always used.
MCP servers surface in two places, chosen by how much each one changes. The
settings page lists them; the tool card stamps which server answered, because
that is the moment someone can judge whether an external service should have
run at all. The metrics rail stays empty unless one is failing.
The preferences surface was a generic settings skeleton: one bordered box per
option, plus a status strip that existed only because the nav said nothing.
Options are now a single hairline-separated list carrying the same left accent
bar the transcript already uses for state, and every nav row shows its
section's current value — so an approval mode that allows everything reads as a
risk without opening the section.
strings.SplitSeq and a range-over-int clear the two golangci findings this
branch had accumulated in its own files.
Streaming stuttered. It was not the wire: the kernel emits one event per
provider delta and flushes each one, and a probe against a live turn measured
2-3 characters per frame (reasoning p50 3, text p50 2, minimum 1). The cost was
in the client, and it was quadratic.
Two causes, measured on the same fixture back to back (25-card transcript,
40-character chunks). The larger one is first: at 457 characters the p50 was
already 98.6ms, so most of the work had nothing to do with message length —
every token redrew all 24 other cards. Transcript rows are now memoised on
their item, and App's two card callbacks are stable so the memo holds. The
second is the markdown pipeline re-parsing the whole message per chunk; it now
splits on safe blank lines and memoises each settled block. Splitting only the
tail was not enough — re-parsing the settled head whenever a block closed cost
184ms at 7.3K. Result:
457 chars p50 98.6 -> 6.6ms total 1050 -> 110ms
3.7K chars p50 114.1 -> 2.9ms total 10499 -> 275ms
7.3K chars p50 142.4 -> 3.9ms total 26474 -> 854ms
The split changes when parsing happens, never what it produces: 66 prefix
lengths compared, zero differences.
Frames also arrive in bursts (median gap 0ms, 90th 32ms), so arrival order was
being reproduced as visible jitter. Text is now revealed on the frame clock,
draining the backlog proportionally — the lag stays at roughly five frames
whatever the token rate, and the render count drops from 944 frames over 12s to
60/s.
Thinking never streamed at all: the transcript gated the card on answer text,
so 10.2 seconds of reasoning stayed invisible and then landed in one block when
the first answer token arrived. A card now draws with either.
Layout: prose is capped at a reading measure (68ch, about 37 Chinese characters
per line) but code was not, so at 1920px the column was 1333px with prose using
495px of it and a hole to the right. The measure is right; the column was too
wide. --doc binds the flow, the composer and the tabs to one 900px document
column, taking prose from 37% to 59% of the column and leaving code 120 mono
columns. The remaining space reads as a page margin.
Settings drifted from the rest of the UI: .prow was a second copy of the ask
card's .opt with nothing but accidental differences (gap, padding, line-height),
the one dangerous mode only turned red after it was chosen, three theme options
with no descriptions sat in full option rows, and the tablist ignored the arrow
keys the main tabs answer. All four are now consistent, and a status strip
shows what is currently set without visiting each tab.
The session rail was blank and the header showed a filename. The shell mints no
session file at launch by design, so the list starts empty — but nothing ever
refetched it once the first turn created one. /sessions has always carried a
title (generated when ready, first message truncated until then); no surface
displayed it. The list now lives in App, reloads when the session changes or a
run ends, and feeds the header.
MockPort is why none of this showed in development: it answered with a static
session and echoed the prompt into the goal. It now behaves like the kernel. It
is also dev-only now — a shipped build that cannot reach its kernel used to
render a scripted session as if it had happened, and now says so instead.
A read dumped the whole file into the transcript, so one look at a 133-line
file buried the rest of the turn. read_file numbers every line it returns
(" 1→…"), so the count is already in the output and needs no guessing — the
format was measured off a real turn rather than assumed.
Long reads collapse to "读了 133 行" and open on click; short ones stay inline,
because folding nine lines only adds a click. Verified against a real turn:
the details box is 21px closed and 2570px open.
A tool card rendered stdout and nothing else, so a command that failed looked
exactly like one that worked. The status was on the wire the whole time —
tool.execution carries state, exitCode, failurePhase and outputTail — but the
field was never declared, so the client could not see what it was already
being sent.
The card now carries a small pill in the error colour, shaped like the tag
beside it. It prefers the exit code over the state word: "failed" only repeats
what the colour says, while "exit 2" is the part worth reading.
The badge is live-only. A reload rebuilds the transcript from /history, which
is the provider conversation and has no execution on it — the same reason
durations disappear. The failure text itself survives, because the kernel puts
it in the tool output too.
Opening a session that contained math went white. KaTeX throws on an undefined
control sequence by default — verified directly: \badcmd{x} raises, the same
input with throwOnError:false renders the source in red — and a throw during
render unmounts the tree, so the window goes blank over a single token the
model happened to write.
Two changes, because the second one is the point. KaTeX no longer throws. And
each message renders inside an error boundary that falls back to its source
text, so anything else the renderers choke on costs that one message instead
of the whole conversation. Model output is arbitrary text; the transcript
should not be one unlucky token away from an empty screen.
Thirty sessions were clicked through to find it, and none of them contained a
formula, which is why the earlier passes came back clean.
The model answered an integral question in \[…\] and \(…\), and nothing
rendered: remark-math reads only dollars, so no math node was ever built, and
the lazy-load detector — which also looks for dollars — never fetched KaTeX
either. Both layers missed it for the same reason.
The delimiters are rewritten to dollar form before parsing, which keeps one
math parser rather than teaching two of them a second syntax. Code is split
out first: a \[ inside a fence is text, and an equation is not.
Walking a real turn through the browser found three things the earlier passes
could not, because they only checked that the page rendered.
/trajectory reached neither allowlist — not the vite proxy, not the shell's
apiPaths — so it fell through to the SPA and the HTML parsed as a failure the
caller swallowed. The persistence committed in 446f1217f therefore never
worked in Studio at all: the pane was empty on every reopen. With the route in
place a reload reads 19 frames back and draws 17 rows.
Both decision cards read their sealed state off the item, and the reducer
never recorded one, so an answered question stayed answerable and an approved
write kept offering its three buttons. The decision is now stored when it is
made: the ask goes read-only with a line naming what was chosen, the approval
states what allowing once actually means, and the chosen option stays on
screen because reviewing an old turn is the point.
turn_done carries the kernel's reason, and reducing it to "失败" threw that
away — the run above wrote its file and answered the follow-up, then was
flagged for not verifying afterwards. That reads nothing like failure, so the
reason is shown instead of the word.
Cards showed the raw tool id and one generic "正在执行…" for everything. The
spec names a call by what it is — Read, Search, Update, Task — and derives the
running line from its category, so "正在读取…" and "正在联网…" come out without
per-tool copy. The id has not gone anywhere; it is the tag beside the name.
KaTeX and its fonts were half the bundle — 906kB down to 267kB by splitting
them out — and most coding sessions never produce a formula. The plugin and
its stylesheet now load on the first message that contains math, cached at
module scope so it happens once per run.
remark-math stays eager: it only parses $…$ into nodes, and until the chunk
lands those render as their source text, which still reads. A failed fetch
degrades the same way rather than blanking the message.
The detector uses no lookbehind. Older WebKit treats it as a syntax error and
takes the whole page down with it, which is how the macOS 12 blank screen
happened.
Every session opened grew a phantom "archived" entry in the rail. The wire log
I added ends in .jsonl, and IsSessionTranscriptName classifies any .jsonl that
is not explicitly excluded as a primary transcript — the exact trap
SessionEventLogDamaged's comment already warns about. The listing was faithful;
the file had never been declared.
Declaring it once fixes more than the listing. SessionSidecarFiles is what
delete, rename, migration and recovery GC all walk, so an unregistered
companion would also have outlived the session it belongs to. serve now asks
store for the path instead of building the name itself, leaving one owner for
the convention.
KaTeX renders $…$ and $$…$$, :shortcodes: become emoji, and mark/sub/sup/kbd
are allowed through. Raw HTML is parsed and then cut back to an allowlist:
model output is untrusted markup, and nothing that can navigate, load or
script survives the filter. Subscript and superscript ride that same channel
rather than a shorthand plugin — Pandoc's ~2~ collides with GFM's
~~strikethrough~~, and one mechanism beats two that fight over a tilde.
Plugin order is load-bearing: raw parses HTML into nodes, sanitize prunes
them, katex renders after so its own generated markup is not pruned in turn.
Code blocks now render as .term, the box every tool result already uses, and
inline code falls to the .out .txt code rule the spec always had; the parallel
set I had invented for them is gone.
A long session title ran underneath the delete control, which is positioned
over the row. The title now stops short of it, reserved even while the button
is hidden so revealing it on hover does not reflow the text.
Deleting the active session raised 409 from the kernel, and the rail relayed
the transport string — "/delete-session: 409 cannot delete active session" —
which is plumbing, and offered on a button that could never succeed. Stepping
off the session first is what the action means: a new session becomes current,
the transcript clears with it, and the old file is then free to remove. The
confirm reads "关闭并删除" on that row so the consequence is stated before it
happens rather than explained after it fails.
The pane was built from the live stream alone, so re-entering a session showed
an empty table. Nothing was on disk to reload: trajectory.Recorder is wired
into the CLI and e2ebench, never into serve, and the .events.jsonl beside each
session is a conversation projection with no timings, usage or audit records.
Serve now mirrors the broadcast frames it already hands the SSE clients into
<session>.wire.jsonl, and GET /trajectory reads them back. Frames are what the
pane consumes, so replaying them reproduces it row for row with no second
schema in between; internal/trajectory keeps recording its richer audit stream
for offline analysis, which answers a different question.
Only kinds the pane draws are kept. Streamed text and reasoning arrive one
frame per chunk and would be nearly the whole file while contributing no rows,
and dropping them is what makes it affordable to close the handle after every
write — a retained one blocks the session directory from being removed on
Windows, which is how TestConcurrentResumeAndForkKeepAlignment caught it.
Deleting the active session is refused by the kernel with 409, but the rail
collapsed the row and reloaded regardless, so a rejected delete looked like it
had worked. The failure now restores the row and surfaces the reason.
The ask tool raises both a tool_dispatch and an ask_request, and the transcript
drew a card for each: two copies of the same question, both answerable. Worse,
the copy built from the tool call carried tool.id where /answer expects the ask
id, so submitting it addressed a question the kernel has no record of and did
nothing. AskFromTool is gone; ask_request is the only interactive surface.
The trajectory footer claimed the rows came from what internal/trajectory
persists. Only the CLI builds a Recorder — serve builds none — so nothing is on
disk and re-entering a session shows an empty table. The note now says what the
pane actually is.
Three provider blocks on one endpoint — a two-model block plus a single-model
block per model, each pinning its own price — made GET /models return the same
two models four times. The refs differ, so nothing was wrong with the data; the
picker just asked the user to choose between rows that resolve to the identical
endpoint, key and model. Entries are now collapsed by (endpoint, model).
The survivor is the active entry, so the current selection stays selectable,
then the default, then the single-model block, whose price table is the exact
one rather than a provider-wide fallback. Distinct endpoints are left alone:
one model name at two vendors is two real choices.
Settings only lived under the project picker, whose affordance is "switch
project" — nobody clicks a project name looking for preferences, and ⌘, only
helps people who already know it exists. That matters most exactly when it is
hardest: recovering from a bad API key requires finding this screen. It gets
a button in the chrome's icon cluster, reusing the theme toggle's class so it
sits in that weight class rather than competing with the preset control. The
menu entry and the shortcut stay; two doors to one room is not clutter.
Deleting a session snapped the row out instead of collapsing it: the CSS
transitions height, but the row is content-sized and height:auto has nothing
to animate from. Pin the measured height and force a paint before the
collapsing class lands. Leaving the row now cancels a pending confirm, which
had no way out short of deleting.
Wails v2's windows options expose DisableWindowIcon but no Icon: the title
bar and taskbar read the icon out of the executable's resource section. The
shell builds with plain `go build`, which emits none, so it shipped with the
stock Go binary icon. go-winres compiles build/appicon.png into a .syso the
linker picks up automatically. Committed rather than generated at build time
so `go build ./next` alone produces a correctly branded binary.
frontend-next had the design's stylesheet ported in full but only a fraction
of the markup using it. This fills in what the spec calls for: the project
picker, preset segmented control and theme cycle in the chrome; activity and
trajectory as sibling panes with a shared composer; model, effort, plan and
approval as real menus rather than labels; and the cache, subagent, job, plan
and pending-change blocks in the metrics rail. The traffic lights are gone —
they imitate a control Windows puts on the other side of the title bar — and
the wordmark takes that slot, masked so it follows the theme instead of
carrying one hard-coded blue. Tool glyphs move to lucide-react, matching the
version desktop/frontend already pins.
Six defects surfaced while wiring it to the real kernel:
/models returns {current,label,models}; the client parsed it as an array, so
the model menu would have thrown the first time it opened. Mid-turn input
went to /submit, which 409s once a turn holds the session — it belongs on
/inbox/items with intent=steer. The Wails allowlist was missing
/provider-setup, so it fell through to the SPA and the 200 HTML parsed as a
failure the caller swallowed: a user with no key never saw onboarding. The
mock probe treated vite's SPA fallback as a live kernel and booted SsePort
against HTML. A turn blocked on approval still read as running, so the glow
kept animating and the action slot offered stop instead of send.
The last one was the user's own message never appearing: both event.Message
emitters carry assistant text, so nothing on the wire echoes what was typed —
only /history has it, after a reload. The client owns that turn now, and the
dead itemId=="user" branch is gone. Assistant text renders as markdown
(react-markdown + remark-gfm, matching desktop/frontend) with the caret the
spec always had and nothing used.
The shell forwards broadcaster frames over the Wails bus. Its asset server
buffers a response until the handler returns, and the SSE handler never
returns, so /events delivered nothing inside the window — silently, with no
error to see. The payload is byte-identical to what the browser reads; only
the transport differs, and a replay path covers the reload the bus has no
handshake for. It also no longer mints a session file at launch, which left
an empty transcript behind every time the window opened.
GET /sessions generated a missing title inline, one model round-trip per
session, serialized. With 29 sessions and 17 cold entries the list took 11.7s
to render; warm it was 44ms. A title is decoration on a navigation list, so
the request no longer waits for one: a cache hit is used, a miss returns the
preview and queues generation on a bounded background pool that writes into
the same cache for the next read. Cold-start now measures 0.052s.
TestSessionTitleDoesNotBlockOnGeneration pins the contract with a provider
that never returns, so the wait can't come back. The recording fake grew a
mutex because generation moved off the request goroutine.
/status gains workspaceRoot. cwd reports SessionDir — where transcripts are
stored, not the tree the agent edits — so a client had no way to name the
workspace it is pointed at.
preset, model, effort and status move to settings.go. serve.go was 941 lines
over its repolint budget after the previous commit added the three endpoints
without resyncing the ratchet; extracting them puts it back under at 1642.
The existing desktop frontend talks to the kernel through Wails bindings, so
its App surface has grown to ~950 methods — most of them shell concerns (tabs,
themes, tray, updater) rather than kernel capability. A UI built on that is
welded to the shell.
frontend-next talks to control.Controller the way the chat TUI and the HTTP
server already do: as another frontend, over internal/serve. It depends on one
interface (AgentPort) with two implementations — SsePort for serve, MockPort
replaying a fixture — so the same build runs in a browser with no Go process
and inside Wails with no port open. desktop/next mounts serve.Handler() as
AssetServer middleware: in-process HTTP, no port, no CORS, no second transport
to keep in sync.
port/wire.ts mirrors internal/eventwire field for field. That is deliberate:
every place this file was written from what seemed reasonable instead of what
the kernel emits turned out wrong — /history returns the provider conversation
rather than the event stream, tool calls are camelCase, todo payloads live in
args and not output, user turns arrive wrapped in control-plane blocks that are
instructions to the model rather than anything the user said, and /submit takes
"input", not "text". A mismatched key there is a request that 400s with nothing
on screen, so the client now surfaces failed writes instead of dropping them.
The existing frontend, main.go and wails.json are untouched; the new shell is a
separate main package and builds with -tags desktop,production.
The controller already had SetAgentPreset, and serve already had switchModel
and switchEffort — but the only way to reach the latter two over HTTP was by
sending "/model <ref>" through /submit and having the handler intercept the
string. A browser client had to compose slash commands to change runtime state.
Add POST /preset, /model and /effort, each forwarding to what already exists.
/status gains preset, effort, modelRef and sessionPath: without them a client
can set these but never read them back, so the controller stops being the
single source of truth for its own settings. sessionPath in particular is what
lets a client tell which session it is in — a fresh session has not been
written to disk yet, so it is absent from the /sessions directory listing.
Nineteen fields on Agent were who it talks to, interleaved with what it
remembers. They are now agentServices, reached as a.svc.
This stage is deliberately not framed as a lifetime, because it is not one.
Thirteen of the nineteen are rebound at runtime through the Set* seams the
controller uses between turns, and fork wraps prov mid-run. The axis here is
collaborators versus state, and the doc comment says so rather than implying a
process scope the code does not have.
It pays down no ratchet either: every one of them is an interface or a pointer,
and struct-state counts scalars. What it buys is that Agent's remaining fields
are recognisable as state at a glance — after the four stages it is
agentConfig, svc, sess, task, turn, pending, and a short tail of flags.
New would have crossed the 120-line function limit carrying the literal, so the
binding moves to newAgentServices: adding a collaborator now touches one place
instead of two.
repolint: no entry increases; agent.go essay 62 -> 55 and file-size 2155 ->
2061 as the field docs move to services.go, which adds no findings of its own.
Part of #8523.
main-v2 fails `go run ./tools/repolint`: Transcript.tsx measures 278 over the
file-size ceiling against a recorded budget of 269.
That 269 is mine. #8564 branched from 71c7c6f3e, before the React Virtuoso
refactor landed, and `repolint -update` regenerates the whole baseline from the
local tree — so it recorded the pre-Virtuoso size of a file that PR never
touched, and squash-merging it overwrote the 322 the Virtuoso PR had correctly
raised it to. #8586 then grew the file to 278 against a budget that was already
wrong.
This resyncs that one entry and the file-size total. Nothing else moves, which
is checked key-by-key against origin/main-v2 rather than asserted.
The reusable lesson is in the verification, not the fix: I checked that no
baseline entry increased and treated that as sufficient. A decrease in a file
the PR does not touch is the same bug wearing the opposite sign, and it is the
one that silently discards someone else's headroom. Both directions need
checking against the merge base.
Transcript.tsx is 1078 lines against an 800 ceiling. That debt is real and
belongs with the desktop transcript work (#8569), not with a baseline resync.
The turn was two types: perTurnState, embedded in Agent and zeroed by
assignment, and runLoopState, a genuine local threaded through the loop. Both
described one Agent.Run. They are now one turnRuntime, and beginRunTurn returns
a pointer to the agent's copy instead of opening a second object — the loop
fields used to be built into a fresh literal that discarded everything the
classification above had just computed onto perTurnState.
executeBatch, executeOne, resolveToolPolicy and applyDeliveryPolicyGates take
*turnRuntime. Reading it off the receiver compiled and behaved identically, and
would have kept doing so right up until a turn was not the agent's current one.
Two more fields moved after checking their write sites:
- classifierTaskText is written only by New, so it is agentConfig, and the
existing immutability guard now covers it.
- preserveEvidenceOnce, deliveryRecoveryPending and forkRestore are armed by
someone outside the Run — a sub-agent spawner, the turn that just failed
readiness, the fork capture — and consumed by the next one. They are
pendingTurn. Putting them in turnRuntime would have been wrong in a way
that compiles: beginRunTurn's replacement assignment would wipe state armed
before the turn existed.
capabilityLedger and capabilityGate stay on Agent for the same reason. Their
reset lives in internal/control, which calls SeedCapabilityRoute before a Run;
a controller cannot seed a value the Run has not created yet.
turnruntime_test.go guards all three properties: the type stays free of mutexes
and atomics so the single assignment keeps compiling, the tool path reads its
parameter rather than a.turn, and beginRunTurn's replacement literal stays
empty.
repolint: struct-state for agent.go 10 -> 3, repo total 122 -> 115. Verified
key-by-key that no baseline entry increases.
Part of #8523.
* fix(desktop): stabilize native transcript thumb dragging
Problem:
Dragging the workbench native scrollbar thumb across long variable-height transcripts could make the scroll range change under the pointer and jump between distant turns.
Root cause:
React Virtuoso replaced estimated row heights with live measurements while the browser was mapping the native thumb against scrollHeight. Wheel scrolling and thumb dragging shared the same measurement path.
Fix:
Detect primary-button gestures in the real native scrollbar gutter, freeze mounted rows and Virtuoso size accounting only for that gesture, and resume real measurement on pointer release, cancellation, or window blur. Ordinary wheel, trackpad, middle-button, and creation-mode custom scrollbar paths remain unchanged.
Verification:
- pnpm test:transcript
- pnpm build
- Real Chromium transcript scroll stability browser gate
* Stabilize transcript scroll regression gate
Problem: the browser benchmark sampled wheel position before Chromium finished applying the gesture, and pinned tail growth could race Virtuoso's at-bottom callback ordering.\n\nRoot cause: the gate had no render-frame settle condition, while the hook treated every transient atBottom=false notification as user intent even when only the measured scroll range had grown.\n\nFix: wait for real wheel movement to settle, make tail ownership setup deterministic, preserve pinned intent only for layout growth that does not move upward, and keep the shared four-pixel threshold unchanged for ordinary scrolling.\n\nVerification: pnpm test:transcript; pnpm build; transcript scroll stability benchmark passed eight consecutive runs in system Chrome.
SetSession reset fifteen fields one by one and carried a comment explaining
which of them was deliberately spared. Those fields are now sessionRuntime and
that seam is a.sess.reset(s).
Three corrections came out of checking each candidate against its write sites
rather than its name:
- workspaceID is written only by New, so it belongs in agentConfig. The
existing immutability guard now covers it, which matters because it is a
prompt-cache lineage component: a mid-life change would silently rekey the
cache.
- activeTurnCreatedAt is cleared by a defer in Run, so it is turn state and
stays put for the turn stage.
- pendingResolveAt was the spared field, and the reason it is spared is that
it answers to the provider configuration rather than to any conversation.
It is now its own type, unwrittenResolve, sitting beside the warn state it
belongs with. missingReasoningWatch is session state again, with no
exception to explain.
outputBudgetState stops being embedded and becomes a named field that owns
lastUsage, so restarting it is one visible r.output.reset() instead of an
Agent method reaching across two layers.
sessionRuntime holds three mutexes and five atomics, so the whole-value
assignment taskRuntime uses is illegal here — vet's copylocks would reject it.
The "no field is forgotten" property is therefore enforced by
sessionstate_test.go: both lifetime lists are checked against the struct, and
reset's body is read back from source to confirm it touches everything the
reset list claims. A field added to sessionRuntime fails the test until someone
states which side it is on.
Behaviour is unchanged. lastPrefixShape and haveLastPrefixShape survive a
conversation swap exactly as before; that is recorded on the carry-over list
rather than changed here.
repolint: struct-state for agent.go 18 -> 10, repo total 130 -> 122; essay,
file-size, complexity and function-size all fall. No baseline entry increases.
Part of #8523.
consumePrevious claims a previous run's record by renaming it, then re-reads it
to confirm the schema did not change under the claim. Both were bare syscalls
with no retry, and on Windows both fail with a sharing violation while any
other instance still holds the file open. The rename failure was skipped and
the re-read failure was read as "the file changed", which renamed the record
back and dropped it — so when two instances start together, every claimant can
lose the same race and the crash evidence is lost by all of them.
fileutil.ClaimRename is the rename half: the retry ReplaceFile already performs,
without the copy fallback, since a copy would let two claimants both succeed. A
source that has vanished ends the retries at once — that is the loser of a race,
not a lock. The re-read gets a bounded retry that separates a transient lock
from a record that genuinely changed.
Measured on TestDesktopLifecycleConcurrentConsumersClaimOnce: 33 failures in 60
runs before, 6 in 60 with the rename retry alone, 0 in 100 with both.
TestDesktopLifecycleAsyncWriterKeepsLatestPhase failed for an unrelated reason:
it assumed stopWriter flushes. stopWriter deliberately leaves after 250ms so
quitting never blocks on diagnostic I/O, and one atomic replace on a loaded
Windows runner has taken over 500ms. The product behaviour is correct and
unchanged — terminal phases go through the synchronous mark — so the test now
waits for the writer to drain, which is the coalescing contract it means to
check. 200 consecutive runs pass.
Eight fields on Agent outlive a single Run but are narrower than a session:
they belong to one delivery scope. resetTurnEvidence only runs when that scope
changes, which is what made them a lifetime of their own rather than
session state — recorded until now in comments rather than in a type.
Group them into taskRuntime and reach them as a.task.<field>. Reset conditions
are unchanged: the ledger group, the checkpoint, and the repeat-failure records
each keep their own condition in beginRunTurn, so restartLedger carries scope,
checkpoint, and failure records forward exactly as before. The gain is that the
carry-over is one named list in a single assignment instead of an emergent
property of which fields each call site happened not to mention.
prepareRepeatFailureScope moves to taskRuntime.prepareScope verbatim.
The mechanical rename went through gopls so internal/control's own
deliveryCheckpoint and taskBudget — different types, same names — were left
alone by construction.
The repolint baseline goes down: struct-state 20 -> 18 for agent.go, essay
81 -> 76, file-size 2276 -> 2251. No entry increases.
Part of #8523.
* fix(session): bind generation write authority and stop false diverged
Problem:
- Mid-turn autosaves classified same-revision reshapes as diverged and
forked recovery branches every ~30s (#8294).
- Process-level "I hold a lease" ownership could authorize stale
controllers after rebind (ABA).
- Empty/missing .jsonl checkpoints with a valid WAL could still enter
conflict paths instead of healing in place.
Root cause:
- checkSnapshotWrite required digest ownership for same-revision rewrites
and had no unforgeable write permit bound to controller generation.
- Release did not wait for in-flight authority-guarded saves.
Fix:
- Introduce SessionWriteAuthority issued by SessionLease with generation
and owner binding; Release waits for active saves.
- Controllers, desktop tabs, CLI, serve, and bot bind authority before
Ready/autosave; missing/stale authority returns typed errors and never
forks recovery.
- Owned same-revision rewrite uses authority or digest ancestry; 0-byte
checkpoints heal from the path's own WAL under the save locks.
- Prefer SaveRewrite for same-revision diverged before recovery fork.
Verification:
- go test ./internal/agent/ -run 'WriteAuthority|SaveSnapshot|SaveConflict|FixedWriter|ZeroByte|Authority'
- go test -race ./internal/agent/ ./internal/control/ focused subsets
- go vet ./internal/agent/ ./internal/control/
Cache-impact: none - no prompt, tool schema, or provider request changes
Documentation-impact: none - internal session save/authority contracts
Fixes#8294
Refs #8342#7982
* fix(session): bound recovery paths and rebind projection lineage
Problem:
- Depth-cap and continuous conflict ticks created digest-keyed recovery
files without bound (#8342).
- Projection sidecars dropped across upgrade/model switch (#8390) and
recovery forks (#8400), snapping the model view to full canonical
history and re-triggering expensive compaction (#8393).
Root cause:
- Isolated recovery paths were content-digest keyed.
- LoadProjectionSidecar treated lineage key mismatch as total invalidation.
- Recovery forks did not inherit a still-valid parent projection.
Fix:
- One fixed recovery file per {lineage, writer}; in-place rewrite with
compact event log and preserved in-flight turn markers.
- Split projectionContentValid from lineage gate; rebind matching content
across key changes and fail closed on prefix mismatch.
- Inherit valid parent projection onto recovery forks; load sidecar on
commitRecoveredSession.
- Dedup conflict diagnostic log entries by path/revision/outcome.
Verification:
- go test ./internal/agent/ -run 'LoadProjection|SaveRecoveryBranchInherits|SaveRecoveryBranchSkips|SaveConflict'
- go test ./internal/control/ -run 'Snapshot|Recovery|Conflict'
Cache-impact: none - projection body and provider-visible prefix unchanged;
rebind only rewrites lineage key; removed full-canonical fallback was a
cache break by construction.
Cache-guard: go test ./internal/agent/ -run 'ProjectionValid|LoadProjectionSidecar|CoveredPrefixHash'
Documentation-impact: none - internal projection/recovery contracts
Co-authored-by: SivanCola <[email protected]>
Co-authored-by: erphenheimer <[email protected]>
Fixes#8342Fixes#8111Fixes#8393
Refs #8390#8400#8444#8430
* fix(catalog): rebuild v3 lineage and reclaim covered recovery copies
Problem:
- 1.24.0/1.24.1 users accumulated covered recovery copies; v1/v2 catalogs
could be polluted and still listed near-duplicates.
- Open paths could keep pointing at covered ancestors when a unique
adopted leaf already covers the group.
- Periodic GC waited a full day before clearing upgrade storms.
Root cause:
- Disposable catalog lacked recovery lineage roles and used v2.sqlite
shared with polluted 1.24.1 data.
- No content-based group classification (covered/adopted/diverged).
- Startup GC used the same long grace as steady-state.
Fix:
- Independent session-catalog/v3.sqlite (v1/v2 left byte-unchanged).
- recovery_group_id / recovery_role / recovery_canonical derived from
ParentID and content coverage, never filename alone.
- Optional SessionMeta fields for Wails; old clients ignore them.
- Retarget Resume to a unique adopted canonical leaf before Controller
rebind/authority bind.
- 15-minute startup grace + 20-minute follow-up, then 6h period; only
covered_copy moves to recoverable .trash after re-checks.
Verification:
- go test ./internal/sessioncatalog/
- go test ./desktop -run 'RecoveryGC|SessionMeta|RecoveryCopy'
Cache-impact: none - catalog is a disposable projection of authoritative
session files; provider-visible prompts unchanged
Documentation-impact: none - catalog stays internal; release notes follow
Refs #8294#8425
* fix(desktop): surface diverged recovery branches and v1.24.2 notes
Problem:
- Topics with multiple independent recovery leaves looked like ordinary
multi-session topics without an explicit choice prompt.
- Release notes needed a clear split between v1.24.1 hygiene and the
v1.24.2 root-cause fix.
Fix:
- Project tree marks topics with multiple diverged recovery branches
(non-destructive; no auto-merge/delete).
- Frontend SessionMeta carries optional recoveryGroupId/role/canonical.
- CHANGELOG documents authority/lineage/GC behavior and distinguishes
v1.24.1 (hide/reclaim copies + Windows flash) from v1.24.2 (stop the
source, bound real conflicts, repair existing directories).
Verification:
- go test ./desktop -run 'SessionCatalog|Recovery'
- go test ./internal/sessioncatalog/ -run 'Lineage'
Cache-impact: none
Documentation-impact: updated - CHANGELOG Unreleased records v1.24.2
recovery root-fix scope for operators and release drafting
* fix(acp): bind session write authority with transcript leases
Problem:
- ACP acquired session leases but did not issue a generation-bound write
authority, leaving saves on the unbound path while other frontends
required authority for ownership decisions.
Fix:
- After session/new, session/load resume, and recovery lease handoff,
bind SessionWriteAuthority on the concrete controller.
- Test fakes without *control.Controller stay unbound.
Verification:
- go build ./internal/acp/
- go test ./internal/acp/ -run 'Lease|Recovery|Switch'
Cache-impact: none
Documentation-impact: none - ACP internal lease handoff only
* Fix session authority and recovery handoffs
Problem: stale controller generations could retain write access, recovery callbacks could publish a path without rebinding authority, and process-wide recovery filenames could overwrite independent transcripts.
Root cause: authority validity was not tied to the lease's live generation, frontend handoffs updated leases and controllers in different phases, and canonical recovery promotion lacked full-lineage content proof.
Fix: make authority admission fail closed, bind controller and lease changes atomically across CLI, serve, ACP, bot, and Desktop, isolate recovery lanes per live session, delay startup GC, preserve legacy recovery filename discovery, and promote catalog canonical leaves only after authoritative content coverage checks.
Verification: focused package suites, full Desktop tests, deterministic authority and recovery regressions, go vet, and race tests for agent, control, sessioncatalog, ACP, serve, CLI, and bot.
* Fix session authority handoff review findings
Problem:
The integrated recovery fix still left stale controller generations writable across several runtime handoffs, reused process-wide recovery lanes, and widened the repolint struct-state baseline.
Root cause:
Lease ownership, controller publication, recovery lineage classification, and catalog cleanup were not committed through one fail-closed authority path on every frontend.
Fix:
Bind generation-scoped write authority before publication across Desktop, ACP, Serve, CLI, and Bot; bound recovery files per live session; verify lineage from transcript content; preserve startup/GC compatibility; extract hotspot helpers and restore immutable agentConfig without changing the lint baseline.
Verification:
go test core affected packages; Desktop go test ./...; focused and surface race suites; Desktop recovery/catalog race; pnpm build; go run ./tools/repolint; git diff --check.
* Fix session recovery lint regressions
Remove two superseded helpers and replace the empty same-revision authority branch with its explicit SaveRewrite ownership contract.
Verification: golangci-lint v2.12.2 reports 0 issues; repolint is clean; agent, control, and CLI tests pass.
* Fix ACP recovery lease retirement
* Deliver the diverged-recovery prompt and correct catalog docs
Problem: the diverged-recovery choice prompt never reached the UI, and the
reference docs still named the previous catalog file.
- session_catalog_runtime.go set node.Status = "diverged_recovery", but
both status whitelists (desktop/tabs.go and projectTreeTopic.ts) accept
only six values, so the status was dropped and the advertised prompt never
surfaced.
- The same block appended a hardcoded English "multiple recovery branches"
label, bypassing the localization used elsewhere in the function and leaking
English into every non-English locale.
- Four docs/* files still documented session-catalog/v2.sqlite as the live
catalog, so anyone clearing a corrupt catalog would delete an orphaned file.
- The CHANGELOG described the 15-minute value as a post-startup wait; the code
uses it as an idle threshold on two early sweeps before falling back to the
24-hour threshold on the 6-hour ticker.
Root cause: the status value and its label were added at the producer without
registering the value with the shared whitelists or the locale dictionaries.
Fix: register diverged_recovery as a first-class topic status. Add the
topicStatusDivergedRecovery constant, admit it in both whitelists, and drop
the hardcoded label so the frontend renders it from the locale dictionaries
(en, zh, zh-TW). Live runtime states take priority in topicStatus() so a
running topic still reports streaming, and the marker does not block
archiving since it is informational and awaits a user decision. Point the four
docs at v3.sqlite, note that v1/v2 stay for coexistence, and restate the GC
grace accurately. Shorten the startRecoveryGC doc comment to satisfy the
repolint budget resynced by #8503.
Verification:
- go test ./internal/agent/ ./internal/control/ ./internal/sessioncatalog/ -race
- cd desktop && go test .
- npm run typecheck (desktop/frontend)
- make lint (golangci-lint 0 issues; repolint clean, baseline unchanged)
- New TestNormalizeTopicStatusKeepsDivergedRecovery fails without the
whitelist change.
* desktop: bump raw bundle budget for diverged-recovery i18n
The trilingual projectTree.status.divergedRecovery labels and
ProjectTopicStatus union addition add 0.1 KiB raw JS+CSS. Ratchet the
budget from 2268.5 to 2268.7 KiB (0.2 KiB headroom). Gzip budgets stay
flat — the strings compress well and aren't on the startup path.
repolint reported 4812 lines of file-size debt against
desktop/frontend/wailsjs/go/models.ts and, through it, a repo total above the
ceiling — the two findings that made every run look dirty and that the recent
struct-state work had to route around by hand-editing baseline numbers.
That directory is Wails-generated Go bindings and is gitignored (.gitignore:32).
It is not anyone's debt, cannot be edited, and is present only if a desktop
build has run on that machine, so its size also varied by workspace. wailsjs
joins skipDirs beside node_modules and vendor.
With the noise gone the whole ceiling problem goes with it: 113412 - 4812 =
108600, under the recorded 108761. The repo total was never over budget; one
build product was being counted.
That left the real drift, which -update now records. Every limit moves down —
complexity -1, essay -13, file-size -161, function-size -4, test-file-size -60 —
and no per-file entry loosens, verified field by field against the previous
baseline. The tree had simply improved faster than the baseline was refreshed,
so the recorded budgets were more generous than the code needed.
A test pins the skip: removing wailsjs from skipDirs turns it red.
Fourteen of Agent's scalars are written once in New and never again: budgets,
model identity, delegation depth, workspace paths. They take no part in the
state product the struct-state ratchet measures — an immutable field combines
with nothing — so counting them alongside live state measured size rather than
reachable states.
agentConfig holds them, embedded the way perTurnState already is, so field
promotion keeps every read site unchanged: a.contextWindow still resolves. Only
New's literal and the test literals that construct an Agent directly had to
move, and New's fourteen scattered assignments become one block.
The claim that this is configuration is enforced rather than documented. Field
promotion means a.contextWindow = x still compiles from anywhere in the package,
so an unchecked claim would turn the ratchet's exclusion into a way of hiding
state. agent_config_test.go walks the package AST and fails on any assignment to
a promoted config field, reading the field list from the type itself so the
guard cannot drift. Verified by mutation: adding one assignment in compact.go
turns it red.
Agent 46 -> 32 scalars, baseline tightened to match (agent.go 34 -> 20, total
146 -> 132, file-size 2297 -> 2286).
This is where the bucket series stops. What remains is genuinely mutable and
coordinated, and the two groupable candidates left are worth one field each.
compactStuck, consecutiveCompacts and lastCompactionTurn are reset on three
consecutive lines in three different places — SetSession, and both preflight
lineage resets — always immediately after compactionState is zeroed. They are
already part of compaction's state; they just were not part of its struct.
CompactionState cannot hold them: it is serialized to the projection sidecar,
and these are runtime-only. compactionProgress is the runtime half, next to
ContextManager, which is the only thing that advances stuck and consecutive.
lastCompactionTurn stays an atomic inside the value because it is read from the
post-turn observer while a tool loop may still be running; the other two are
touched only under the Prepare path.
Fourth bucket under the struct-state ratchet: Agent 49 -> 46 scalars, baseline
tightened to match (agent.go 37 -> 34, total 149 -> 146, file-size 2301 -> 2297).
recoveryAgentID, recoveryTaskID and recoveryRunSeq are read as a unit: both
call sites build a RecoveryObservation whose first three fields are exactly
these, and Agent already exposes them through a setter named
SetRecoveryIdentity. The concept had a name everywhere except in the struct.
recoveryIdentity gives it one, next to the gate it describes. The counter stays
an atomic inside the value, so the identity is assigned field by field rather
than wholesale — an atomic cannot be copied, and nothing here wants to reset it
anyway.
Third bucket under the struct-state ratchet: Agent 52 -> 49 scalars, baseline
tightened to match (agent.go 40 -> 37, total 152 -> 149, file-size 2317 -> 2301
for the 16 lines this removes).
Four fields on Agent tracked one provider incident: whether it is active,
whether the persisted state records it, the healthy-round streak, and a resolve
timestamp whose write failed. Only observeMissingToolCallReasoning ever moved
them, and it moved them together in twelve places across eighty lines — an
interleaving that reads as four independent flags while only a few of their
combinations are reachable.
missingReasoningWatch names the four with their roles rather than their history:
warnedMissingToolCallReasoning becomes active, missingReasoningWarnStateChecked
becomes stateRecorded. The legacy names were kept for the on-disk contract,
which the persisted state (missingReasoningWarnState, untouched here) still
owns; the in-memory view has no such obligation.
The type and its only user move to their own file, which also takes 87 lines out
of agent.go's 3194.
One behaviour is deliberately preserved rather than tidied: SetSession clears
three of the four and leaves pendingResolveAt alone. Zeroing the struct would
have been the obvious write and would have silently dropped an unwritten resolve
watermark on every session switch — the watermark belongs to a provider
configuration, not to the conversation being replaced. The reset is explicit and
says so.
Second bucket under the struct-state ratchet: Agent 56 -> 52 scalars, baseline
tightened to match (agent.go 44 -> 40, total 156 -> 152). The file-size budget
also drops 2404 -> 2317 for the 87 lines moved out; the 10-unit drift already
recorded there is left as-is, since correcting it belongs to whatever PR takes
on the baseline drift as a whole.
Three bools on Agent — capabilityPreferReminded, capabilityRequireMissSeen,
capabilityPreferMissSeen — are one turn's gate memory, reset together in
SeedCapabilityRoute and read only by capabilityGateFailure. Held separately
they were three independent flags in the product of Agent's state, and nothing
recorded that only some of their eight combinations are reachable.
capabilityGateState carries them with the lifetime they already had. Their
whole read/write surface was capability_gate.go, so the type lives beside its
only user and the three-line reset becomes zeroing a struct.
This is the first bucket under the struct-state ratchet (#8436). Agent drops
from 59 scalar fields to 56, and the baseline tightens with it — agent.go 47 ->
44, the repo total 159 -> 156. Leaving the recorded budget at 47 would turn the
three freed slots into headroom for three new flags, which is the outcome the
ratchet exists to prevent; a repaid debt has to be written down.
Two fields that look like they belong to a turn bucket are deliberately left
alone: preserveEvidenceOnce and deliveryRecoveryPending are read in
beginRunTurn *after* perTurnState is zeroed, because carrying a prior turn's
readiness-recovery intent across the boundary is exactly their job. Grouping by
name rather than by reset point would have broken the recovery path.
Agent's field count went 16 -> 105 between 2026-05-29 and 2026-08-12, and its
bare scalars 8 -> 52 before easing to 48. Each independent bool, counter, or
atomic multiplies the states the type can be in while nothing records which
combinations are legal, so fixing one boundary case by adding one more flag is
cheap at the call site and paid for by everyone downstream.
The counter-pressure already exists and works: perTurnState absorbed five
delivery flags along with an explicit lifetime ("before the next turn resets
this state"), which is why the scalar count fell for the first time. What is
missing is anything that stops the next flag from being added faster than the
last one is grouped. That is a ratchet, not a refactor: a refactor moves the
current pile once, while the growth rate stays the same.
struct-state counts scalars, not fields, because the field total cannot tell a
new flag from the container that just absorbed five — grouping would otherwise
score as no progress. Only types owning a mutex or atomic are measured: a
struct without one is not concurrently mutated state. That distinction is what
makes the rule usable. Counting every struct produced 131 findings led by a
505-field translation table and a metrics DTO; counting guarded ones produces
12, and every one is a type that genuinely coordinates concurrent state
(Agent, Controller, desktop App, the provider clients).
The baseline records those 12 with -update, which is what a new rule requires;
the diff was reduced to struct-state entries only, so no unrelated drift rides
along. Verified both ways: the tree is clean today, and adding one more scalar
to Agent trips both its per-file budget and the repo total.
KeepErrors classifies a failure from ToolExecution rather than from message
text, because text matching was proven to miss real failures: a failing
`go test` log opens with "=== RUN", and no prefix match can see it. But
checkpointProjectionMessages wrote the projection through ModelMessages, which
strips ToolExecution on the way to a provider — so the record survived exactly
one fold. The second fold saw a tool result with no failure record and text
that matches nothing, folded it into the digest, and the model stopped being
told about the failure.
Measured on a fixture shaped like real `go test` output: present after fold 1,
record stripped after fold 2, gone from the projection after fold 3.
A projection is read twice — as what the model is sent, and as the input the
next compaction classifies — and only the second reading needs the host's own
record. So the strip belongs at the provider boundary, which every request path
already crosses (context_manager.go builds each request through ModelMessages
of its own accord, making the strip at write time redundant as well as harmful).
ProjectionMessages is that same projection with ToolExecution preserved.
Both functions and their shared implementation move to provider/projection.go:
deriving the two copies of a transcript is one responsibility, and provider.go
was already carrying recorded file-size debt this would have widened.
The regression test uses a "=== RUN" fixture on purpose. A synthetic
"error: ..." body survives either way through the text-prefix arm, which is
what let this go unnoticed. Verified by mutation: restoring ModelMessages at
the write site turns it red at fold 2.
Compatibility holds in both directions: ToolExecution is already persisted in
canonical transcripts, so no new field enters the sidecar format, and a
projection written by an older build simply has no record to read.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* fix(desktop): restore recovery-copy catalog and hide Windows git flash
Problem:
- Windows desktop cold-start flashed two git.exe consoles because workspace
watch probes used raw exec.Command without HideWindow/CREATE_NO_WINDOW.
- Session catalog v1 lost RecoveryCopy, so the project tree flooded with
redundant recovery "copies" and History could not group or safely clean them.
Root cause:
- workspace_watch gitMetadataDirsForWorkspace bypassed gitcmd.Command.
- Catalog schema/projection never stored recovery_copy; topic stats summed all
recovery branches; sessionMetaFromCatalog dropped RecoveryCopy; background GC
used unguarded DeleteSession.
Fix:
- Route both startup rev-parse probes through gitcmd.Command.
- Add SessionRecord.recoveryCopy + schema v4; open disposable v2.sqlite cache.
- Prove RecoveryCopy via agent.RecoveryBranchCoveredByParent at index time.
- Exclude idle recovery copies from tree/stats; keep open/pinned/adopted ones.
- Propagate RecoveryCopy into History; GC via DeleteRecoveryCopy with recheck.
- Focused regression tests for catalog, tree pagination, GC races, and Windows.
Verification:
- go test ./internal/sessioncatalog/ -count=1
- go test -race ./internal/sessioncatalog/ ./internal/agent/ -run Recovery
- desktop focused recovery/catalog/workspace tests (+ -race)
- go run ./tools/repolint
Cache-impact: none - no prompt, tool schema, or provider request changes
Documentation-impact: updated - session catalog cache path v1→v2 docs
* fix(desktop): make recovery cleanup atomic
Problem:
- Adopted recovery branches were added to ordinary topic turns instead of treated as alternate continuations.
- DeleteRecoveryCopy proved coverage before acquiring the parent and branch removal guards, leaving a logical race before the trash move.
Root cause:
- Catalog SQL only distinguished covered copies from all other rows.
- Desktop reused the generic delete path whose coverage check preceded its destructive lock boundary.
Fix:
- Restore the pre-catalog turn rule: max(sum(normal turns), max(adopted recovery turns)).
- Route recovery-copy cleanup through an atomic agent helper that locks the parent and branch, re-proves coverage, and publishes a recoverable trash entry.
- Preserve open/read-only recovery branches instead of detaching them during bulk cleanup.
Verification:
- go test ./...
- go test -race ./...
- desktop go test ./...
- desktop go test -race ./...
- go vet for root and desktop modules
- Windows amd64 desktop test cross-compile
- go run ./tools/repolint
Cache-impact: none - no prompt, tool schema, provider request, or compaction changes.
Documentation-impact: none - behavior completes the recovery catalog contract documented by the parent commit.
Retention landed with no way to see it fail. A turn past the budget still folds
into the digest, and the projection reads exactly the same either way — so the
one case where compaction hands a user's own words to the summarizer was the
one case nobody could observe. That also left [[keep]] useless in practice:
an escape hatch only helps someone told it exists at the moment it is needed.
keepUserTurns now returns a userTurnRetention count that rides the existing
telemetry to CompactionTelemetry (user_kept / user_dropped), and a committed
checkpoint that dropped a turn emits a warning naming [[keep]]. The notice
fires after commit, never on a rejected candidate: a checkpoint that was not
installed folded nothing.
The retention code moves to compact_user_turns.go — compact.go was 705 lines
against the 800 ceiling, and this is one responsibility. partitionFoldForProjection
drops its early/carried return values, which have been nil since content-driven
summary replaced the hoist, rather than growing to five results.
Coverage follows the two gaps this series left open:
- A boot-level effect test drives the real Build assembly through a fold and
asserts the constraint reaches the provider request, with a summarizer whose
digest deliberately records nothing. Verified by mutation: stubbing
keepUserTurns to a no-op turns it red.
- Sub-agents inherit retention through subagentOptions, the single construction
point they share; a test pins that inheritance and the child-scoped budget,
since a parent's instructions are the child's constraints and nothing else in
the child transcript records them.
partitionCoversRegion additionally asserts the conservation law: every user turn
in a region is either kept or counted as dropped, so a turn cannot go missing
from the accounting the way it previously could from the projection.
A constraint stated mid-session ("do not change the public API") existed
nowhere but the transcript, yet only the first user turn was pinned and the
rest reached the fold region — so whether it survived was one summarizer
judgement call. The code it constrains stays re-derivable from the workspace;
the constraint does not. That asymmetry of loss, not the token count, is what
decides here.
Every user turn in the fold region now stays verbatim within a budget, on the
existing kept channel rather than a new one. Three properties make it hold:
- It is structural, not a keep-policy bit. A stated constraint is a fact about
the task, so it is not something a policy flag can switch off.
- It ignores policyStart. The keep policy is scoped to messages after the
latest digest so it cannot grow forever; user turns are bounded by budget
instead, which is what lets protection survive repeated compaction.
- It measures with a fixed estimate. A threshold tracking the last turn's
calibrated ratio would keep a turn at one checkpoint and fold it at the next.
Retention is bounded, not unconditional: hoisting user turns without a budget
is what padded an earlier revision's candidates past the acceptance ceiling,
failing compaction outright instead of degrading it. One turn may spend 1500
tokens and all of them min(8192, window*5%), oldest first — the recent tail
already covers the newest turns. Past those bounds a turn folds like any other
content, so KeepUserMarked joins the default policy and [[keep]] becomes the
documented way past the size budget.
Two tests had fixed the defect as correct behavior.
TestCompactKeepsMidSessionUserTurns asserted the mid-session turn must fold and
then relied on a fake summarizer echoing the fact back; its reply now drops the
fact entirely, so the turn has to survive on its own. The partition test that
asserted all user turns fold is rewritten with budget, total-budget and
across-digest guards. TestKeepUserMarkedRequiresUserPrefixMarker moves down to
isUserMarked, which is the only level that can still observe the marker match.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem: main-v2 push CI fails on the Windows leg in
projectiondb.TestOpenAppliesLedgerAndPrivatePermissions and
sessioncatalog.TestRebuildFailureKeepsExistingCatalog, introduced by
the sqlite catalogs integration and never executed on Windows because
the PR smoke suite omits these packages.
Root cause: os.ReadDir of a plain file returns ENOTDIR on POSIX but
yields the file itself on Windows (FindFirstFile semantics), so Rebuild
silently treated a file path as an empty directory. The projectiondb
permission assertion assumes POSIX 0600, which os.Chmod cannot express
on Windows (read-only bit only).
Fix: directorySignature stats the path first and rejects non-directories
on every platform; the permission assertion skips on Windows while
keeping the ledger assertions.
Verification: gofmt, go vet (darwin + GOOS=windows), go test -race on
both packages, repolint clean.
Problem: main-v2 advanced with the execution-role and completion-summary stack while PR #8373 was in CI, leaving the Goal runtime branch conflicted.
Root cause: both changes touch the Desktop and ACP runtime DTO owners and their repolint baselines.
Fix: merge main-v2, preserve the upstream execution-role behavior, retain the additive Goal workDurationMs mappings, and combine the exact repolint baselines.
Verification: git diff --check; go run ./tools/repolint
Problem:
main-v2 advanced with the SQLite catalog integration while this PR's final CI was running, leaving the continuous Goal branch conflicting and unmergeable.
Root cause:
Both branches update Desktop runtime DTO owners and the repolint baseline; the catalog merge also extracts substantial Desktop code.
Fix:
Merge the latest main-v2 catalog stack, preserve the Goal workDurationMs contract, and carry forward only its two-line file-size delta on top of the reduced Desktop app baseline.
Verification:
The updated integration tree is rerun through Goal, catalog, race, Desktop, frontend, cache, and repository lint gates before push.
Resolve concurrent changes in desktop preset switching, frontend event contracts, bundle budgets, tests, and repository lint state.
Preserve the in-place execution-setting switch and completion-summary routing while retaining the latest catalog, billing, hydration, and runtime behavior from main-v2.
Verified with full Go and desktop tests, frontend test:all and production build, race checks, go vet, and repolint.
Problem: End-of-turn quality summaries cluttered the desktop transcript and exposed internal receipt values, while the CLI always printed raw summaries.
Root cause: completion_summary events had no presentation policy separating normal completion, actionable exceptions, and verbose audit output.
Fix: keep ordinary summaries out of the transcript, show a compact warning for actionable gaps, expose localized details in the Changes panel, and reserve raw CLI receipts for verbose mode.
Verification: pnpm build; targeted frontend completion/workspace/controller tests; go test ./...
Problem:
The latest main-v2 merge tree adds two cohesive lines to each of the Desktop and ACP Goal runtime DTO owners, exceeding their existing file-size ratchets.
Root cause:
workDurationMs requires one additive compatibility field and one boundary mapping at each owner; splitting these contracts would reduce clarity.
Fix:
Raise only the two affected repolint file-size baselines by two lines. The increases are 0.0163% for desktop/app.go and 0.2478% for internal/acp/status.go.
Verification:
- go run ./tools/repolint
- git diff --check
Problem:
The PR head predates newly merged main-v2 changes, so its previous green checks do not cover the current integration tree.
Root cause:
main-v2 advanced in overlapping Desktop runtime DTO, frontend, and capacity budget surfaces after the last PR update.
Fix:
Merge the latest main-v2 history while preserving continuous Goal semantics and the newly landed UI and bundle-budget changes.
Verification:
The merged tree is verified by the focused Goal, race, vet, Desktop, frontend, cache, and repository lint gates before push.
* fix(desktop): unify turn action hover labels
Problem:
Message turn actions used inconsistent label behavior: Copy collapsed to an icon while Fork, Compress, and Rewind always occupied their full labeled widths.
Root cause:
The three non-copy actions rendered permanent text and disclosure icons without the inline collapsed-label contract used by CopyButton.
Fix:
Wrap Fork, Compress, and Rewind labels in a shared collapsible container. Expand it on hover and keyboard focus, and keep it expanded while a menu is open or Fork is confirming. Preserve disabled and menu semantics.
Verification:
- pnpm exec tsx src/__tests__/turn-actions-rendering.test.ts
- pnpm build
- Real-browser hover, focus, disabled-state, and menu-open checks
* chore: ratchet Message size budget
Problem:
The turn-action markup adds four intentional wrapper lines and raises Message.tsx from 891 to 895 lines, exceeding its baselined 91-line file-size allowance.
Root cause:
The repolint baseline still reflected the file's previous overage and therefore rejected the otherwise verified UI change.
Fix:
Raise only Message.tsx's file-size allowance from 91 to 95, matching the exact four-line increase without relaxing any other repository standard.
Verification:
- go run ./tools/repolint
- pnpm exec tsx src/__tests__/turn-actions-rendering.test.ts
- pnpm build
- git diff --check
* chore(desktop): ratchet raw bundle budget
Problem:
The latest main-v2 merge plus the turn-action label styles produces 2254.9 KiB of initial raw JavaScript and CSS, 0.9 KiB above the 2254 KiB ceiling.
Root cause:
The shared hover/focus label contract is always-available UI CSS and was not represented in the raw startup budget.
Fix:
Raise only the initial raw JavaScript and CSS allowance from 2254 to 2255 KiB and document the turn-action label cost. Keep all gzip and per-chunk budgets unchanged.
Verification:
- pnpm build (2254.9 KiB / 2255.0 KiB)
- go run ./tools/repolint
- pnpm exec tsx src/__tests__/turn-actions-rendering.test.ts
- git diff --check
* feat(provider): add exact custom request URLs
Problem:
Custom provider setup mixed base URLs and full request URLs, while legacy chat_url semantics differed across protocols.
Root cause:
The desktop editor reused chat_url for both legacy compatibility behavior and new exact endpoint intent.
Fix:
- add request_url as an explicit exact endpoint field
- preserve legacy chat_url behavior for existing OpenAI, Anthropic, and Responses configs
- simplify the desktop editor to one API address field and migrate only on save
- document and test global and project config round trips
Verification:
- frontend production build and focused editor tests
- focused provider, config, boot, and desktop tests
- desktop go test ./...
* fix(provider): preserve base URL on unchanged endpoint
Problem:
Saving an existing custom provider could rewrite base_url from request_url, changing model discovery and endpoint-derived capabilities even when the user had not changed the API address.
Root cause:
ProviderEditor always derived base_url from the effective request URL instead of preserving the independent stored value for unchanged providers.
Fix:
Preserve the stored base_url when provider kind and effective request URL are unchanged, and derive a new base only for new providers or intentional endpoint/protocol changes. Extract endpoint compatibility logic and provider request URL tests into focused owners, with exact repolint ratchets for the cross-layer contract.
Verification:
- pnpm test:all && pnpm build
- go test ./...
- cd desktop && go test ./...
- go test -race ./internal/provider/openai ./internal/provider/anthropic ./internal/provider/responses
- go vet focused root packages and desktop ./...
- go run ./tools/repolint
* fix(provider): mirror exact URL for legacy OpenAI
Problem:
Older clients ignore request_url and could keep using a stale chat_url after a custom OpenAI-compatible provider was saved with a new exact endpoint.
Root cause:
The desktop editor and save boundary preserved chat_url independently from the authoritative request_url.
Fix:
Mirror the exact OpenAI-compatible request URL into legacy chat_url in both the editor payload and desktop persistence boundary, retain non-OpenAI legacy behavior, and document the downgrade limitation. Add focused downgrade-compatibility coverage and complete the Chinese specification.
Verification:
- pnpm test:all
- pnpm build
- go test ./...
- (cd desktop && go test ./... && go vet ./...)
- go test -race ./internal/provider/openai ./internal/provider/anthropic ./internal/provider/responses
- go vet ./internal/provider/openai ./internal/provider/anthropic ./internal/provider/responses ./internal/config ./internal/boot
- go run ./tools/repolint
- git diff --cached --check
* test(provider): align exact URL copy assertion
Problem:
The provider editor test still asserted the previous English helper copy after the production hint was shortened without changing its meaning.
Root cause:
The final copy-size adjustment and its standalone TSX assertion were not updated together.
Fix:
Assert the current unchanged-URL helper text so the focused editor test covers the shipped copy again.
Verification:
- pnpm exec tsx src/__tests__/provider-editor-model-picker.test.tsx
- pnpm build
- go run ./tools/repolint
- git diff --cached --check
Problem:
The task monitor exposed duplicate stop and cancel actions with a cramped confirmation flow, while the topic toolbar repeated command and shortcut entry points and placed the workspace control inconsistently.
Root cause:
The desktop UI surfaced backend control aliases as separate primary actions and accumulated utility controls without a clear priority order or complete localization.
Fix:
Merge active-task termination into a single accessible stop flow, localize task state and session-summary labels, remove redundant toolbar entry points, and place session summary before the workspace toggle. Keep the underlying cancel APIs and keyboard/settings access paths intact.
Verification:
- pnpm exec tsx src/components/TaskMonitorPanel.test.tsx
- pnpm exec tsx src/__tests__/app-chrome-tabs.test.ts
- pnpm check:css
- pnpm typecheck
- Browser verification at 127.0.0.1:5174
* feat(billing): unify multi-currency cost accounting
Problem:
Reasonix exposed provider prices, wallet balances, and session totals through independent currency paths. Mixed model runs could clear or mislabel costs, and display preferences could mutate regional list prices.
Root cause:
The runtime had no currency-tagged money domain, occurrence-time valuation, or shared quote boundary. Individual sinks accumulated floating-point Pricing.Cost values and inferred display semantics locally.
Fix:
Introduce fixed-point Money, CostQuote, official regional price catalogs, ECB FX snapshots, occurrence-time ledgers, wallet conversion, config v6 migration, and a central quote sink shared by Desktop, Serve, CLI, ACP, Remote, stats, and eventwire. Preserve additive legacy aliases and document the new contracts in English and Chinese.
Verification:
- go test ./...
- (cd desktop && go test ./...)
- (cd desktop/frontend && pnpm typecheck && pnpm test:usage-stats && pnpm build)
- go test -race ./internal/billing ./internal/event ./internal/stats ./internal/boot ./internal/config ./internal/cli ./internal/acp ./internal/serve
- go test -race ./internal/billing ./internal/acp ./internal/eventwire ./internal/event
- golangci-lint run --timeout=5m
- (cd desktop && golangci-lint run --timeout=5m)
- go run ./tools/repolint
- ./scripts/cache-guard.sh
- CACHE_IMPACT_PR_BODY_FILE=/tmp/reasonix-billing-pr-body.md ./scripts/check-cache-impact.sh
- DOCS_IMPACT_PR_BODY_FILE=/tmp/reasonix-billing-pr-body.md ./scripts/check-docs-impact.sh
- git diff --check
* fix(billing): keep cost totals complete and lossless
Problem:
Exact original-currency totals could be marked incomplete when an unused FX valuation was unavailable. CLI and ACP recomputed authoritative totals from a 64-quote sample, and live controllers retained the pre-refresh FX table pointer.
Root cause:
CostQuote completeness conflated cost-fact availability with optional valuation coverage. Run surfaces used bounded quote slices as ledgers, while QuoteContext captured a one-time RateTable snapshot.
Fix:
Make completeness follow the selected shared display total, preserve unrecoverable fact failures, and keep incomplete frontend quotes unavailable. Accumulate CLI and ACP totals through the billing ledger, including restored ACP scalar history, and read the current FXCache snapshot for every quote.
Verification:
- go test ./...
- go test -race ./internal/billing ./internal/event ./internal/boot ./internal/cli ./internal/acp
- (cd desktop && go test ./... && go vet ./...)
- pnpm --dir desktop/frontend typecheck
- pnpm --dir desktop/frontend build
- ./scripts/cache-guard.sh
- go run ./tools/repolint
* refactor: remove runtime FX from billing
Problem: runtime FX downloads and wallet conversion mixed pricing estimates with provider balances and could fabricate cross-currency totals.
Root cause: CostQuote, ledger aggregation, display selection, and wallet rendering shared one currency path and treated display completeness as cost completeness.
Fix: keep fixed-point original facts, restrict new valuations to identity and official regional tables, add explicit cost/display status and currency buckets, remove ECB startup/cache paths, and use exact original wallet balances with runtime-only hints.
Verification: go test ./..., desktop go test ./..., targeted race suites, frontend typecheck/usage-stats/build, cache guard, cache-impact review, and secret scan.
* Fix display-only currency rebinding
Problem: changing the billing display currency still rebuilt Desktop controllers, stale wallet responses could bind a newer session, and two obsolete locale-pricing helpers failed golangci-lint.
Root cause: the display preference reused the general runtime-settings rebuild path, while wallet callbacks validated only the controller pointer and had no tab/session display generation.
Fix: persist the preference without rebuilding, re-select existing ledger valuations across runtime tabs, compare-and-apply wallet hints against controller and telemetry generation, and remove the obsolete locale-pricing paths.
Verification: focused RED/GREEN tests; Desktop focused race tests; go test ./... in root and desktop; go vet; golangci-lint; repolint; cache-impact check.
* Clarify cost display currency settings
Problem: the Desktop setting still used ambiguous pricing terminology and packed the auto-selection rule into the segmented control.
Root cause: the billing refactor renamed the preference but left the surrounding appearance copy and compact option label partially aligned with the old pricing semantics.
Fix: present one cost-display preference, mark auto as recommended, explain wallet, pricing-table, fallback, and mixed-currency behavior in the hint, and align English, Simplified Chinese, and Traditional Chinese copy.
Verification: source contract scan; pnpm typecheck; pnpm build with bundle budgets.
* Shorten cost display currency guidance
Problem: the Desktop cost-display hint wrapped to roughly four lines and visually dominated the setting row.
Root cause: fallback and mixed-currency details duplicated behavior already surfaced by the cost UI.
Fix: retain only the display-only contract and automatic currency-selection order in concise English, Simplified Chinese, and Traditional Chinese copy.
Verification: in-app browser DOM measurement at 904x936; pnpm typecheck; pnpm build with bundle budgets.
* Fix narrow settings control overflow
Problem:
- General settings kept its two-column layout at narrow desktop widths, clipping controls at the modal edge.
Root cause:
- A component-specific 900px override won over the shared 980px responsive rule and sized the row independently of its actual content pane.
Fix:
- Make the general page an inline-size container and stack fields below 620px of available width.
- Align the media-query fallback with the shared 980px breakpoint.
- Add responsive and startup contract coverage.
Verification:
- pnpm test:settings-responsive
- pnpm exec tsx src/__tests__/startup-settings-contract.test.ts
- pnpm check:css
- pnpm typecheck
- pnpm build
- 904x936 browser DOM check: maximum control overflow is 0px
Problem:
- Ubuntu CI intermittently observed Indexed=1 while ListPage returned no task after an observed FileStore save.
Root cause:
- Initial background reconciliation could scan an empty project concurrently with exact snapshot indexing, then mark the freshly indexed row missing after the exact write committed.
Fix:
- Serialize authority scans, exact snapshot indexing, and event indexing per canonical project key.
- Keep projects independent and keep all projection work outside the authoritative FileStore write path.
Verification:
- Observed-store regression passed 500 iterations and 200 race iterations.
- Full root tests, task catalog race tests, vet, root/Desktop golangci-lint, gofmt, repolint, and diff checks passed.
The exact-path migration API replaced the slice-only wrapper. Remove the now-unused compatibility helper so the macOS golangci-lint unused check passes.
Problem:
- Linux desktop CI timed out after a new CLI session migration because topic metadata was durable while the catalog row remained behind a generic directory reconcile.
Root cause:
- Explicit reconcile did not retain the exact successful migration paths, so loaded catalog workers could delay visibility past the project-tree deadline.
Fix:
- Return exact successfully migrated session paths and index them through the lightweight path projection before queuing the full directory reconcile.
- Preserve background, non-blocking behavior and the eventual directory checkpoint.
Verification:
- Migration regression tests passed 100 iterations.
- Targeted race tests passed 20 iterations.
- Desktop tests, vet, gofmt, repolint, and diff checks passed.
Problem:
- main-v2 advanced with #8169 while #8257 was being repaired and retested.
- desktop/app.go conflicted because #8169 extracted shutdown into a lifecycle-diagnostic wrapper while #8257 changed startup and shutdown ordering.
Root cause:
- Both branches owned the Desktop lifecycle boundary for independent correctness guarantees.
Fix:
- Preserve lifecycle diagnostics initialization and clean/panic attribution.
- Set shuttingDown and cancel tab/catalog workers before entering the diagnostic shutdown wrapper.
- Keep the extracted shutdown body and retain #8257's 250ms derived-catalog flush.
Verification:
- Desktop Go tests and full race suite.
- Frontend test:all and production build with bundle budgets.
- Windows amd64 CGO-free cross compilation.
- Affected root tests and race tests, root/Desktop vet, gofmt, repolint, and diff checks.
Problem:
- macOS CI could finish runAgent while the asynchronous usage catalog still opened or reconciled inside a test TempDir.
- TempDir cleanup then raced a late SQLite write and failed with a non-empty usage-catalog directory.
Root cause:
- CLI shutdown flushed accepted stats records but did not cancel and join the process-local usage projection worker.
- Focused tests call runAgent directly, bypassing the public Run shutdown boundary.
Fix:
- Flush and close usage catalogs at the public CLI boundary.
- Apply the same idempotent fence to direct runAgent invocations.
Verification:
- Failing macOS test repeated 100 times.
- Focused race test repeated 10 times.
- Full internal/cli tests and stats/usage catalog race tests.
- go vet, gofmt, repolint, and diff checks.
* fix(desktop): add Windows crash attribution diagnostics
Problem: Windows LTSC 2019 abrupt exits could not be attributed reliably, test telemetry could reach production, and Diagnostics counted lifecycle events rather than affected installations.
Root cause: legacy startup state was replayable, WebView2 failures were inferred from log text without native process details, and the crash Worker lacked build-, runtime-, and installation-level aggregation.
Fix: fail-close Desktop test endpoints, consume legacy state atomically, add lifecycle v2 and native WebView2 Args2/Args3 observation, and extend privacy-bounded telemetry, D1 rollups, Diagnostics filters, and bilingual release runbooks.
Verification: go test ./... in root and desktop; focused race tests; Worker typecheck and 86 tests; frontend tests and production build; fresh and migrated SQLite schema validation; Windows amd64 Desktop and vendored WebView2 cross-compilation; git diff --check.
* refactor(diagnostics): satisfy owner size budgets
Problem: the initial diagnostics implementation exceeded the repository's incremental file and function size budgets in Desktop startup, Worker ingestion, and dashboard rendering owners.
Root cause: lifecycle initialization, installation aggregation, and group-detail rendering were added directly to already baselined entry-point files.
Fix: move lifecycle setup into its tracker owner, extract diagnostics-v2 storage and query policy, and isolate crash-group rendering without changing wire contracts or runtime behavior.
Verification: repolint; Worker typecheck and 86 tests; focused Desktop and repair tests; Windows amd64 Desktop cross-compilation; the unrelated transient updater test passed three consecutive focused reruns.
* test(repair): use WaitGroup.Go for claim race
Problem: the current PR lint rejected the manual WaitGroup Add/go/Done pattern in the concurrent legacy-state claim regression test.
Root cause: the test used the legacy goroutine setup even though the repository modernize rules require sync.WaitGroup.Go.
Fix: use WaitGroup.Go while preserving the explicit ready barrier and deterministic interleaving.
Verification: go test ./internal/repair; go test -race ./internal/repair; go run ./tools/repolint; git diff --check.
* fix(repair): serialize legacy startup claims
Problem: Windows CI observed zero reports when concurrent launches tried to consume one dead legacy startup record.
Root cause: concurrent pre-claim reads can keep Windows file handles open long enough for every rename attempt to fail.
Fix: acquire the existing non-blocking cross-process file lock before reading and atomically renaming the legacy record, so exactly one observer owns the claim path.
Verification: 100 concurrent-claim repetitions; 20 race-enabled repetitions; full internal/repair normal and race suites; Windows amd64 test compilation; repolint; git diff --check.
* fix(diagnostics): close Windows crash attribution gaps
Start lifecycle tracking after the Wails single-instance gate and serialize anonymous install identity creation across concurrent callers.
Wait for WebView2 navigation completion before recording renderer recovery, commit crash group/sample/aggregate writes in one D1 batch, and align runtime CLI schema and diagnostics ordering.
* fix(diagnostics): address PR review findings
Problem:
- Renderer recovery could consume an unrelated navigation and recoverable COM errors could terminate the desktop.
- Per-install daily rows overwrote WebView2 dimensions, relabeling earlier GPU and runtime events.
- The PR exceeded repository size gates and did not execute vendored patch tests in Windows CI.
Root cause:
- Recovery completion was not correlated with NavigationStarting IDs, and shared fatal error handling was reused.
- Mutable dimension columns and event counts lived in the same deduplicated installation row.
Fix:
- Correlate renderer reloads by navigation ID, keep recovery errors non-fatal, and default failed kind reads to unknown.
- Add immutable event-dimension facts for filters and distributions while retaining installation deduplication.
- Split diagnostics tests, trim size regressions, and run vendored WebView2 tests in Windows CI.
Verification:
- go test ./...
- targeted Desktop and internal/repair race tests
- Worker tests and typecheck
- Frontend 146-suite test run
- repolint, actionlint, gofmt, and Windows cross-compile
* fix(desktop): align raw bundle ratchet
Problem:
The Desktop CI inherited a main-v2 raw startup bundle size of 2204.8 KiB while the ratchet still allowed only 2203 KiB, so frontend builds stopped before all Desktop checks.
Root cause:
Recent always-loaded desktop contracts already moved the baseline beyond the old threshold, and this PR adds the required diagnostics privacy attribution copy without materially changing gzip size.
Fix:
Raise only the raw aggregate allowance to a tightly measured 2205 KiB and document the native diagnostics copy. Keep gzip, CSS, locale, and largest-chunk limits unchanged.
Verification:
- pnpm build
- go run ./tools/repolint
- git diff --check
* feat(desktop): add cross-platform crash diagnostics
Problem: Desktop runtime failures lacked reliable ownership, lifecycle attribution, and affected-install analytics across Windows and Linux.
Root cause: legacy startup records could replay, WebView2 diagnostics were platform-specific, and Worker aggregation mixed recovery outcomes into unstable groups.
Fix: add fail-open primary ownership and lifecycle v2, generic Web Runtime reports, native WebView2 and WebKitGTK observers, privacy-safe platform dimensions, additive D1 aggregates, and cross-platform Dashboard filters.
Verification: go test and race suites, go vet, golangci-lint, Worker typecheck/tests, frontend tests/build/bundle budgets, repolint, actionlint, and Windows amd64 cross-builds.
* fix(diagnostics): preserve future lifecycle schemas
Problem:
A future lifecycle schema that removes v2 PID or phase fields could be treated as an invalid v2 record and pruned after retention.
Root cause:
The consumer validated v2-specific fields before checking the schema version.
Fix:
Reject unknown schemas before applying v2 validation or cleanup, and cover an aged future record without current fields.
Verification:
- cd desktop && go test . -run '^TestDesktopLifecycle'
- cd desktop && go test -race . -run '^TestDesktopLifecycle'
- git diff --check
* fix(diagnostics): correlate WebKit reload events
Problem:
The native WebKitGTK recovery smoke classified a successful renderer reload as failed and could not reach the cooldown assertion.
Root cause:
WebKit can emit load-failed for the terminated navigation after web-process-terminated. The recovery state treated every pending load failure as belonging to the new reload.
Fix:
Track whether the recovery reload has emitted LOAD_STARTED and only accept load-failed and LOAD_FINISHED after that boundary. Reset the marker on every terminal path and extend the source contract test.
Verification:
GOCACHE=/tmp/reasonix-pr8169-go-cache go test . -run '^(TestWebKit|TestWebRuntime)'
git diff --check
* fix(diagnostics): defer WebKit recovery reload
Problem:
WebKitGTK 4.1 still timed out the success recovery smoke after load events were scoped to the recovery navigation.
Root cause:
Starting webkit_web_view_reload synchronously inside the web-process-terminated signal callback is unreliable while WebKit is still dispatching process teardown.
Fix:
Schedule the single recovery reload on the GTK main context's idle queue, retain the WebView until dispatch, and guard the helper with the pending recovery owner. Update the source contract test to enforce this deferred abnormal-only path.
Verification:
GOCACHE=/tmp/reasonix-pr8169-go-cache go test . -run '^(TestWebKit|TestWebRuntime)'
git diff --check
* test(diagnostics): isolate WebKit smoke scenarios
Problem:
After the deferred reload made the success smoke pass, the next scenario aborted inside WebKitGTK while constructing another test WebView in the same process.
Root cause:
The smoke harness repeatedly destroyed and recreated WebViews that share WebKitGTK's process-global default context. That cross-scenario lifecycle does not match the single-WebView Desktop process and leaves asynchronous teardown active between cases.
Fix:
Run success, failure, timeout, and cooldown scenarios in isolated test subprocesses. Keep the cooldown pair in one child and one WebView so repeated native termination and single-reload behavior remain covered.
Verification:
GOCACHE=/tmp/reasonix-pr8169-go-cache go test . -run '^(TestWebKit|TestWebRuntime)'
git diff --check
* test(diagnostics): keep WebKit smoke local
Problem:
The isolated success and cooldown smoke scenarios still reported reload failure while failure and timeout behaved correctly.
Root cause:
The test HTML used https://reasonix.invalid as its base URI. Reloading the terminated view attempted to resolve that unreachable URI, so the smoke measured a synthetic network failure instead of native process recovery.
Fix:
Load the smoke HTML with a NULL base URI, which WebKitGTK maps to local about:blank content and requires no network access.
Verification:
GOCACHE=/tmp/reasonix-pr8169-go-cache go test . -run '^(TestWebKit|TestWebRuntime)'
git diff --check
* test(diagnostics): use reloadable WebKit smoke URI
Problem:
The native success and cooldown scenarios still timed out with load_html content even after removing the unreachable base URI.
Root cause:
A transient document created by load_html does not provide a stable reloadable resource after its WebProcess is terminated on the tested WebKitGTK runtime.
Fix:
Load a fully local data URI before terminating the WebProcess. This provides a stable current URI for the same production reload call without adding network or filesystem I/O.
Verification:
GOCACHE=/tmp/reasonix-pr8169-go-cache go test . -run '^(TestWebKit|TestWebRuntime)'
git diff --check
* test(diagnostics): allow WebKit process startup
Problem:
The native smoke used a one-second recovery timeout and classified cold WebProcess startup under Xvfb as a failed reload.
Root cause:
The smoke-only timeout was substantially shorter than observed headless WebKitGTK process creation, while production correctly allows thirty seconds.
Fix:
Raise only the tagged smoke timeout to five seconds. Keep the production timeout at thirty seconds and the smoke safety timeout at fifteen seconds.
Verification:
GOCACHE=/tmp/reasonix-pr8169-go-cache go test . -run '^(TestWebKit|TestWebRuntime)'
git diff --check
* Automate diagnostics D1 migration before worker deploy
Problem:
The diagnostics-v2 schema had to be applied manually even though the production Cloudflare credential is available only to Actions. Deploying the new Worker first would make ingestion depend on missing D1 columns and tables.
Root cause:
The crash Worker workflow validated and deployed code but had no guarded database migration stage.
Fix:
Add a fail-closed schema inspector that skips a complete migration, applies the SQL only when entirely absent, rejects partial state, records the current D1 Time Travel bookmark, and verifies the final schema. Run it after tests and before Worker deployment.
Verification:
- npm test (96 tests)
- npm run typecheck
- node --check scripts/apply-diagnostics-v2.mjs
- bash scripts/release-workflows.test.sh
- actionlint v1.7.7
- git diff --check
* Keep diagnostics copy within locale bundle budget
Problem:
Merging the latest main-v2 bundle ratchets made the expanded Chinese telemetry disclosure exceed both locale budgets.
Root cause:
The cross-platform disclosure repeated verbose phrases for the anonymous identifier, runtime fields, abnormal-exit payload, and privacy exclusions.
Fix:
Compact the Simplified and Traditional Chinese copy while preserving upload timing, diagnostic dimensions, and excluded sensitive data. Keep the existing bundle budgets unchanged.
Verification:
- cd desktop/frontend && pnpm build
- node scripts/check-bundle-budget.mjs
- git diff --check
Problem:
- main-v2 advanced with #7584, #8101, and #8382 while #8257 CI was running.
- The locale bundle allowance and repolint baseline conflicted with the catalog integration branch.
Root cause:
- Both branches added localized desktop UI and changed files covered by repository size baselines.
Fix:
- Merge the latest appearance, capability, and Goal token-budget changes.
- Keep the combined locale output within #8257's existing narrow bundle limits.
- Regenerate the repolint baseline from the semantically combined tree.
Verification:
- Focused root and race tests for control, agent, boot, and catalogs.
- Desktop frontend test:all and production build with bundle budgets.
- Root and Desktop go vet, gofmt, repolint, and staged diff checks.
A Goal was bounded by 10/20/40 turns, picked by classifying its own text as
simple, write, or research. That is two guesses stacked: guess how big the
task is, then stop it on the guess. It was also the only axis, so a loop that
was slow and expensive never came close to it while a fast empty one hit it
for no reason.
Codex, which this feature follows, bounds /goal on a token budget that is
optional, and stops with a summary into a budget_limited state rather than
ending the goal. It has no iteration cap. This matches that: cumulative
tokens, off unless [agent].goal_token_budget is set, one summary and a
resumable budget_spend pause on reaching it.
Tokens are the axis that generalizes. A slow expensive loop accumulates them
and so does a fast empty one, since every iteration pays for at least one
prompt; wall clock catches only the first, and money is not portable across
models. #7725 removed token limits for a different reason — it enforced a
class-derived ceiling at every provider boundary, conflating cumulative
autonomous-work safety with per-request context size. This is the cumulative
check at the FSM's continuation decision, which is where the loop actually
decides to keep going.
Resume grants the budget again instead of returning into an exhausted one;
openai/codex#34215 is the same situation without that.
What still stops a Goal, all of it reading content rather than counting:
completion, a blocked report, a failed or uncertain evaluator, the structural
no-progress loop. TurnsLimit stays in the sidecar and the runtime view for
compatibility and is never set; GoalRuntimeView reports the real TokensLimit
again, which #7725 had pinned to zero.
Tests that used the quota as a termination condition now configure a budget
and bill usage against it. Several of them looped forever without that, which
is the shape of the design: an unattended loop with nothing configured has no
host-owned stop, by choice.
Problem:
The live main-v2 branch advanced with localized active-work errors while PR #8275 was being prepared.
Root cause:
Both changes touched execution-setting notices and Chinese locale bundle budgets.
Fix:
Merge the upstream capability guidance, retain the adopted execution-setting terminology, update its contract tests, and set narrow bundle budgets for the combined locale payload.
Verification:
- pnpm exec tsx src/__tests__/capability-busy-notice.test.ts
- pnpm exec tsx src/__tests__/use-controller-meta.test.ts
- pnpm build
- go run ./tools/repolint
Problem:
The upstream main-v2 branch advanced again before PR #8275 could be pushed against the live base.
Fix:
Merge the latest Creation appearance overview swatch fix without changing the execution-setting implementation.
Verification:
- pnpm exec tsx src/__tests__/theme-pack.test.ts
- pnpm build
- go run ./tools/repolint
* fix(desktop): localize capability busy errors
Replace active-work debug details with localized guidance across MCP, skills, and plugin mutations while preserving unrelated actionable errors.
* refactor(desktop): isolate capability mutation helpers
Problem:
The capability busy-error change added code and tests directly to two files whose repolint size ratchets were already exhausted.
Root cause:
The helper and its focused coverage were owned by the large CapabilitiesPanel module and its broad action suite instead of dedicated files.
Fix:
Move capability mutation helpers into a focused library module and move the busy-notice regression cases into an auto-discovered test suite without changing runtime behavior.
Verification:
- pnpm exec tsx src/__tests__/capability-busy-notice.test.ts
- pnpm exec tsx src/__tests__/capabilities-panel-actions.test.ts
- pnpm typecheck
- pnpm build
- pnpm check:bundle
- go run ./tools/repolint
- git diff --check
Co-authored-by: SivanCola <[email protected]>
* fix(desktop): localize subagent busy errors
Problem:
Subagent profile mutations still exposed active-work debug fields, and English background-job notices used plural grammar when only one job was active.
Root cause:
The Subagents settings wrapper bypassed the shared active-work notice mapper, while four English messages interpolated counts into plural-only sentences.
Fix:
Reuse the shared mapper for Subagents mutations and use count-neutral English wording across capability, model, effort, and work-mode notices. Add regression coverage for the Subagents wiring and single-job output.
Verification:
- pnpm exec tsx src/__tests__/capability-busy-notice.test.ts
- pnpm exec tsx src/__tests__/capabilities-panel-actions.test.ts
- pnpm exec tsx src/__tests__/use-controller-meta.test.ts
- pnpm lint:hooks
- pnpm typecheck
- pnpm build
- go run ./tools/repolint
- git diff --check
Co-authored-by: SivanCola <[email protected]>
---------
Co-authored-by: xiaojia-afk <[email protected]>
Co-authored-by: SivanCola <[email protected]>
* fix(creation): restore AppearanceOverview hero theme swatches
Creation compact theme-card swatch rules (7px pills) were unscoped and
crushed AppearanceOverview hero preview into a black block. Scope those
rules to .theme-card only and add Creation glass polish for the overview.
* fix(creation): keep Graphite gold swatches on AppearanceOverview hero
Only size/layout rules stay scoped under .theme-card; Creation Graphite
color rules remain unscoped so hero matches live --accent/#c99a3a gold.
* fix(creation): keep appearance hero within bundle budget
Problem:
- AppearanceOverview styling restored readable hero swatches but exceeded the frontend raw bundle budget.
- The fragile Creation-only selector and Graphite palette contract had no focused regression coverage.
Root cause:
- The PR duplicated the shared AppearanceOverview skin with more than one hundred lines of Creation overrides, even though only hero sizing and swatch growth needed specialization.
Fix:
- Reuse the shared overview skin and keep only the Creation-specific hero height and flex behavior.
- Add source-level contracts for real-card scoping, readable hero dimensions, and the Creation Graphite gold palette.
Verification:
- pnpm --dir desktop/frontend build
- pnpm --dir desktop/frontend exec tsx src/__tests__/theme-pack.test.ts
- git diff --check
- Browser computed-style checks in light, dark, and Workbench modes
Co-authored-by: SivanCola <[email protected]>
---------
Co-authored-by: Li-Charles-One <[email protected]>
Co-authored-by: SivanCola <[email protected]>
Problem:
The upstream main-v2 branch advanced while the execution-setting changes were under CI, leaving PR #8275 behind the live base and conflicting in the generated repolint baseline.
Root cause:
Both branches updated files covered by the baseline, so Git could not choose combined finding counts.
Fix:
Merge the three latest upstream fixes and regenerate the repolint baseline from the combined source tree.
Verification:
- go test ./...
- cd desktop && go test ./...
- go vet ./...
- go test -race ./internal/acp ./internal/control ./internal/agent
- go run ./tools/repolint
- cd desktop/frontend && pnpm test:all
- cd desktop/frontend && pnpm build
Problem:
- main-v2 advanced with #8335, #8347, and #8357 while #8257 was awaiting merge.
- The repository complexity baseline conflicted with the catalog branch's owner-file extractions.
Root cause:
- Both branches updated controller and frontend ownership measurements while evolving independent runtime behavior.
Fix:
- merge the latest protected main-v2 prompt-queue, todo-stall, and Goal runtime changes
- preserve the catalog session identity and hydration fences in the automatically merged frontend
- regenerate the repolint baseline from the combined tree without widening any measured budget
Verification:
- focused root/control/catalog tests
- focused race tests for control, agent, and all catalog packages
- Desktop Go test suite
- frontend test:all and production build with bundle budgets
- root and Desktop go vet
- gofmt, repolint, and staged diff checks
Integrate the newly landed no-Todo-stall and no-Goal-round-ceiling changes from #8347 and #8357 without rewriting the published PR history.
Preserve this PR's broader continuous-runtime behavior: Goal Todo stalls still trigger a second-stage replan and epoch reset, while goal_stuck finalization remains removed.
Verified with full Go tests, agent/control race tests, go vet, repolint, Desktop tests, frontend typecheck/test/build, and cache guards.
A Goal turn was cut at 16 model rounds. Rounds were the wrong unit there for
the same reason they were wrong for chat in #8320: a turn that reaches a
high count while still producing new work is the case least worth
interrupting, and one that produces nothing is caught by something that
actually measures that.
Writing the test for this showed the second half is already true. A
wandering Goal turn stops at round 13 with no ceiling present at all —
exploration decay stops crediting look-only rounds after six, the
zero-evidence ladder escalates to its stop six rounds later, and the Goal
structural guard ends the run. The ceiling was never what caught a stalled
Goal; it only ever cut productive ones short.
Goal keeps every boundary that reads what a turn is doing rather than
counting it: completion, a blocked report, a failed or uncertain evaluator,
the structural no-progress loop, and the cross-Run turn budget (which the
next change takes up). stopCauseGoalRunBudget stays as a legacy value so an
old sidecar still resumes.
A stalled todo could end a run: 8 rounds without a new completion, read,
command or mutation got a reassessment nudge, 16 got a resumable pause. The
pause goes; the nudge stays.
It was never the mechanism that caught the stall it claimed. The
zero-evidence ladder escalates on the same receipts and reaches its stop at
6, and the storm breaker reaches its own at 3 — writing the Goal test for
this proved it, since Goal never reached 16 at all: the ladder's structural
pause always fired first. So under Goal it was dead code, and in ordinary
chat it was the last remaining way for the host to end a turn the user never
asked it to end.
What it measured was also narrower than it read. Any first-time successful
read, command or mutation renews the streak, so 16 rounds meant 16 rounds
producing literally nothing new — a state the two guards above already
handle, twice over and far sooner.
todoStallPause and maxTodoStallRounds are gone with it, along with the
todo_stall pause class, its RunPauseInfo mapping, the planner's
non-finalization message for it, and the Goal FSM's stop cause.
Ask took promptMu before it registered or emitted anything, so a question
raised while an earlier approval was still open existed only inside a
blocked goroutine. No AskRequest reached the frontend, the prompt snapshot
did not list it, and ReplayPendingPrompts therefore could not recover it —
not on a tab switch, not on a status reconcile. The user saw a tool card
that never opened a dialog while the turn blocked indefinitely, since
approvalTimeout defaults to zero and Ask waits without a deadline.
Registration now happens before the queue, which is what makes the waiting
question visible at all. It is marked queued so replay still skips it:
surfacing it early would put a question on screen ahead of the prompt it is
waiting behind, and the ordering promptMu exists to enforce is unchanged.
Waiting longer than a few seconds now says so. A prompt answered promptly
emits nothing; one stuck behind another explains why nothing has appeared
instead of leaving the user watching a dead interface.
Cancelling while queued drops the registration and hands the lock on rather
than leaking it to the next prompt.
Problem:
Slash-invoked runAs=subagent Goal turns counted provider requests and tokens but left cumulative workDurationMs at zero.
Root cause:
The isolated answer was copied into the parent session without its turn duration, and this controller path bypassed the existing Goal duration capture.
Fix:
Stamp returned subagent answers with cumulative turn work time and commit the new-message maximum through the existing scope/epoch recorder. Add success and deterministic Goal-replacement regression coverage.
Verification:
- go test ./...
- go test -race ./internal/control
- go vet ./...
- scripts/cache-guard.sh
- scripts/check-cache-impact.sh
- go run ./tools/repolint
Problem: CI failed in race, coverage, and platform test jobs after the product terminology changed.
Root cause: TestToolContractDocCoversDefaultBootSurfaces still expected the former role-settings heading.
Fix: Match the documentation contract assertion to the new execution-settings heading.
Verification: go test ./internal/boot; go test -cover ./internal/boot; go test -race ./internal/boot; go vet ./internal/boot; go run ./tools/repolint.
Problem: User-facing role terminology suggests a persona switch, while these presets actually control planning, verification, and delivery behavior.
Root cause: Desktop, CLI, ACP, and documentation retained the earlier role-setting product name.
Fix: Use Execution setting / 执行设定 / 執行設定 consistently across product surfaces while preserving agent_preset, work_mode, tokenMode, and compatibility values.
Verification: go test ./internal/i18n ./internal/cli ./internal/acp; cd desktop && go test ./...; cd desktop/frontend && pnpm test:all && pnpm build; local browser menu click and overflow check.
Problem:
Windows CI could not remove temporary REASONIX_HOME directories after boot tests completed because v1.sqlite remained open.
Root cause:
The indexed history catalog is process-global, while several Build and rebuild tests changed config homes without fencing that shared lifecycle. Unix unlink semantics masked the leaked handle.
Fix:
Add a deterministic boot-test catalog fence that closes inherited state before each affected build and closes the replacement before temporary-directory cleanup. Apply it consistently to model boot and session-temp rebuild coverage.
Verification:
- focused boot lifecycle tests, 20 repetitions
- focused race tests, 5 repetitions
- go test -count=1 ./...
- go test -race -count=1 ./internal/boot
- make lint
- go vet ./...
- Windows amd64 boot test binary cross-compile
Problem:
Catalog reindex commands only reconciled the existing database, metadata-only history edits could miss reconciliation, and concurrent rebuilds could race during replacement.
Root cause:
History, usage, and task entry points had no validated replacement pipeline; the history root signature ignored sidecar metadata; and projection rebuilds had no cross-process lifecycle lock.
Fix:
Build each derived catalog in a validated sibling database before atomic replacement, fence process-global managers during rebuild, retain task notifications across the fence, include metadata in history signatures, and serialize rebuilds with an advisory lock.
Verification:
- go test -count=1 ./...
- cd desktop && go test -count=1 ./...
- go test -race for boot and all affected catalog packages
- cd desktop && go test -race -count=1 ./...
- go vet for root and desktop modules
- make lint plus CI build-tag lint matrix
- CGO_ENABLED=0 builds for darwin, linux, and windows targets
main-v2 advanced after the exact role-settings CI completed with corrected over-limit context capacity rendering. Merge commit bb58eec2 so the pull request keeps the latest Desktop context UI and localized status contract without changing the role-setting behavior.
Verified with the full frontend test:all suite, remote and performance tests, production build, and bundle budgets.
Problem:
The PR lint job rejected five new regression-test loops under the intrange rule.
Root cause:
The tests used classic counted for loops even though the repository targets Go 1.22 integer ranges.
Fix:
Rewrite the five bounded test loops with integer range syntax without changing their iteration counts or assertions.
Verification:
- golangci-lint run --timeout=5m
- go test ./internal/agent ./internal/control
- go run ./tools/repolint
- git diff --check
* fix(desktop): align context capacity meter with usage
Problem:
The context window meter mixed token composition into a capacity gauge, so the visible fill could disagree with the displayed usage. Over-limit values were also clamped to 100% without an explicit status.
Root cause:
The meter reused token breakdown segments and a single clamped percentage for both physical layout and user-facing text.
Fix:
Render a single capacity fill, preserve the raw percentage for labels and status, cap only the physical fill, keep the compaction marker, and apply the same contract to the context ring popover.
Verification:
- 68 focused context UI assertions
- pnpm typecheck
- pnpm check:css
- pnpm build
- Playwright Chromium DOM, hover, computed-style, accessibility, and console checks
* fix(desktop): preserve just-over-limit context status
Problem:
Context usage that exceeded the window by less than half a percentage point rounded to 100%, so the panel and ring hid the overflow.
Root cause:
The over-limit status was derived from the rounded integer percentage instead of the exact token counts.
Fix:
Keep the existing integer percentage contract, but force the raw value above 100 whenever used tokens exceed the window. Add focused helper, panel, and ring regressions for 1001/1000.
Verification:
- 69 focused context UI assertions
- pnpm build
- In-app Chromium DOM, hover, computed-width, accessibility, and console checks
* fix(desktop): align status bar context overflow
Problem:
The status bar still clamped over-limit context usage to 100%, so it disagreed with the context panel and ring.
Root cause:
The status bar kept a local percentage calculation instead of using the shared raw/display context-window contract.
Fix:
Move contextWindowPercentages into a shared frontend library and use its raw percentage for the status bar label while preserving capped graphical fills.
Verification:
- 114 focused context and status-bar assertions
- pnpm build
- Playwright Chromium DOM, visibility, and console check
* fix(desktop): satisfy context meter lint budget
Problem:
The shared context percentage helper pushed StatusBar.tsx one line beyond its baselined file-size budget, leaving PR #8307's lint job red.
Root cause:
formatRate used a two-branch statement where a behavior-equivalent conditional expression is sufficient.
Fix:
Keep the shared context percentage contract and simplify formatRate without changing its zero or negative denominator behavior.
Verification:
- go run ./tools/repolint
- 54 context panel assertions
- 6 capacity meter assertions
- 9 context ring assertions
- 45 status bar assertions
- pnpm test:typecheck
- pnpm build
Problem:
Goal mode could pause at host-owned numeric ceilings even while useful work was still progressing.
Root cause:
Default round, turn, wall-time, and stall thresholds were wired as terminal runtime boundaries and persisted as blocked Goal state.
Fix:
Remove host-owned Goal execution ceilings, preserve only user-selected resource limits, convert numeric stall guards into replanning redirects, migrate legacy numeric pauses, and expose cumulative work duration as observational runtime data.
Verification:
- go test ./...
- go test -race ./internal/agent ./internal/control
- go vet ./...
- cd desktop && go test ./...
- cd desktop/frontend && pnpm typecheck && pnpm test:all && pnpm build
- scripts/cache-guard.sh
- scripts/check-cache-impact.sh
- go run ./tools/repolint
main-v2 advanced after the role-settings CI completed with the production WebView2 smoke moved out of the shipped Desktop binary. Merge commit 717497e2 so the pull request remains based on the latest reviewed startup and packaging contracts while preserving the role-setting UI and bridge paths.
Verified with root and Desktop Go suites, vet, repolint, targeted race tests, frontend test:all and production build, bundle budgets, and release workflow contract tests.
Problem:
- main-v2 advanced with #8333 while PR #8257 was being brought to an approvable state.
- App.tsx still carried the catalog branch's reference to the retired in-app smoke component.
Root cause:
- Both branches touched frontend startup while the base moved the WebView2 release check out of production code and into an exact-binary Windows smoke script.
Fix:
- Remove the retired production smoke import and preserve the external Windows startup gate, Chromium approval-animation gate, and release workflow contracts.
Verification:
- cd desktop/frontend && pnpm test:motion
- cd desktop/frontend && pnpm test:motion-browser
- cd desktop/frontend && pnpm build
- cd desktop && go test -count=1 ./...
- cd desktop && go test -race -count=1 ./...
- bash scripts/release-workflows.test.sh
- actionlint on changed CI/release workflows
- go run ./tools/repolint
- gofmt -l desktop internal cmd tools
- git diff --cached --check
Problem:
- main-v2 advanced again with #8329 after the catalog integration merge had been fully tested.
Root cause:
- The context gauge and compaction trigger previously measured different provider-visible inputs, and the frontend counted completion tokens as prompt occupancy.
Fix:
- Integrate the latest prompt/tool-schema accounting and frontend prompt-occupancy semantics without conflicts.
Verification:
- go test -count=1 ./internal/agent ./internal/provider ./internal/tool
- go test -race -count=1 ./internal/agent ./internal/provider ./internal/tool
- pnpm exec tsx src/__tests__/use-controller-stream-progress.test.ts
- pnpm build
- go run ./tools/repolint
- gofmt -l internal desktop
- git diff --cached --check
Remove test-only WebView2 approval instrumentation from the shipped Desktop executable. Preserve approval behavior coverage in real Chromium and validate the exact Windows production binary externally through UI Automation, including the real composer identity.
Problem:
- main-v2 advanced with #8270 and #8340 while the catalog integration was under review.
- Both branches changed the controller frontend and startup bundle budgets.
Root cause:
- The inbox recovery localization and opt-in task-spend defaults overlapped the catalog hydration guards and measured frontend budget ratchets.
Fix:
- Preserve the history hydration identity/error fences alongside locale-aware inbox recovery.
- Keep the latest task-spend defaults and use measured startup bundle budgets without widening the repolint baseline.
Verification:
- env REASONIX_RELEASE_CACHE_GUARD=1 go test -count=1 ./...
- env REASONIX_RELEASE_CACHE_GUARD=1 go test -race -count=1 ./...
- cd desktop && go test -count=1 ./...
- cd desktop && go test -race -count=1 ./...
- cd desktop/frontend && pnpm test:all && pnpm build && pnpm test:motion
- go vet ./... and pinned golangci-lint for native and cross-platform build tags
- CGO_ENABLED=0 root/Desktop builds for darwin amd64/arm64, windows amd64/arm64, and linux amd64
- Wails binding generation, repolint, release workflow contracts, SDK ordinary/race tests, and go mod tidy -diff
Problem: main-v2 advanced with context-gauge cache invalidation while this PR independently narrowed the provider-visible tool surface, creating a Registry conflict and a stale-cache risk when the allowlist changes.
Resolution: merge main-v2 at ee2a6a76, preserve both contracts, advance schema revision only for real provider-visible allowlist changes, and cover both mutation and no-op updates.
Verification: go test ./...; go test -race ./internal/tool ./internal/agent; go vet ./...; go run ./tools/repolint; cd desktop/frontend && pnpm test:all && pnpm build.
* fix(agent,desktop): align the context gauge with the compaction trigger
The desktop context gauge measured something different from the
compaction trigger, in both directions:
- The backend gauge (ContextUsedTokens) used the message-only estimator
while the trigger sizes messages + role projection + tool schemas
(estimatedVisibleRequestTokens). With a non-empty tool registry the
gauge under-reported the fill, so a session could display below
compact_ratio while the trigger had already crossed it (the #8221 test
passed only because its tool registry was empty).
- The desktop frontend overwrote the backend gauge with the last turn's
real usage and added completion tokens to the used figure. A long
output round inflated the displayed fill (e.g. 90%) while the trigger,
which only counts the next request's prompt, still sat below the
configured 85% — compaction never fired and the session ran into a real
overflow.
Both now use one measurement: the gauge calls the trigger's own estimator,
and the frontend counts prompt tokens only. Completion stays in the output
metrics, not the occupancy gauge.
Refs: #8191
* fix(agent,desktop): keep context gauge current
Problem:
- Context usage stayed cached after live MCP tool changes.
- Completion-only latest usage could collapse prompt occupancy to zero.
- The PR also tripped formatting and repository budget gates.
Root cause:
- The memoization key omitted the provider-visible tool registry revision.
- Frontend fallback selected context prompt data based on unrelated completion data.
Fix:
- Track tool schema revisions and include registry identity plus revision in the gauge cache key.
- Select prompt and completion fallbacks independently and align ContextFillTokens with prompt occupancy.
- Add deterministic backend and frontend regression coverage while removing budget-breaking comments.
Verification:
- go test ./...
- go test -race ./internal/tool ./internal/agent
- go vet ./...
- pnpm build
- go run ./tools/repolint
---------
Co-authored-by: SivanCola <[email protected]>
Problem:
- A late asynchronous controller build could launch a shared-host MCP while an explicit reconnect was still replacing the same single-instance server.
- The loser failed with an address-in-use error, and an early generation check still allowed stale registries to publish after a later MCP mutation.
Root cause:
- Optimistic boot intentionally runs outside runtimeAdmissionMu, but shared-host extension startup had no dedicated mutation fence.
- extensionGeneration was checked before the final admission boundary instead of as part of publication.
Fix:
- Add a reader/writer extension gate so controller boots remain concurrent with each other while MCP mutations exclude shared-host startup.
- Bump the extension generation before releasing a mutation and revalidate it both after entering the boot gate and under publication admission.
- Extract boot failure handling from the oversized tab assembly path and add a deterministic publication-fence regression.
Verification:
- go test -count=50 -run 'TestAuthorizeAndConnectMCPServerBlocksLateControllerBuild|TestControllerPublicationRejectsMutationThatCompletesAfterBoot' .
- go test -race -count=10 -run 'TestAuthorizeAndConnectMCPServerBlocksLateControllerBuild|TestControllerPublicationRejectsMutationThatCompletesAfterBoot' .
- go test -count=1 ./...
- go test -race -count=1 ./...
- go vet ./...
- golangci-lint run ./...
- go run ./tools/repolint
- CGO_ENABLED=0 cross-builds for darwin, windows, and linux
Problem: TaskPolicy recognized a user's no-push/no-publish/no-deploy constraint, but the execution gate matched only literal command spellings and exact tool names. Valid global options or resolved capability names could bypass the host block.
Root cause: External-action detection used substring checks instead of the repository's static shell argv parser and did not tokenize resolved tool names.
Fix: Parse command segments and wrappers into static argv, conservatively recognize external action tokens across global options, fail closed for opaque dynamic subcommands, and classify resolved capability action tokens before execution.
Verification: focused classifier and end-to-end direct/use_capability tests; go test ./internal/agent ./internal/taskpolicy; go test -race ./internal/agent -run 'TaskPolicy|ExternalAction' -count=1; go vet ./...; go run ./tools/repolint.
Problem: The target branch advanced with opt-in task spending and durable Inbox recovery, leaving the role-settings PR conflicted on the frontend bundle ratchet.
Resolution: Merge main-v2 at ced0eeeb, preserve both role-setting and Inbox contracts, and set narrowly measured locale/raw bundle ceilings for the combined tree.
Verification: go test ./internal/agent ./internal/taskpolicy ./internal/control ./internal/sessioninbox ./internal/config; cd desktop && go test ./...; focused Inbox frontend tests; pnpm test:typecheck; pnpm build; pnpm check:bundle.
The wall-clock default went out with the round ceiling. Nothing bounds an
ordinary chat task now: not rounds, not tokens, not time, not money. It runs
until the model finishes, an adaptive guard finds it stopped making
progress, or the user stops it.
Deciding a task has run too long is a judgement only the user can make.
Money does not survive a model switch — a budget loose enough for DeepSeek
lands a frontier model within a couple of answers — and a task that runs for
an hour is as often the job that was asked for as it is a runaway. A default
that fires on real work is worse than no default, and neither axis has one
that would not.
The gate itself is unchanged and still there for anyone who wants it:
[agent].task_cost_budget and task_time_budget_minutes, each independent,
scoped to a whole task, landing on one tool-free summary and a resumable
pause. taskBudgetOrDefault becomes normalizeTaskBudget, which now only reads
a negative value as unset.
TestUnconfiguredBudgetNeverCrosses pins the promise: eight hours and 55M
tokens against an unconfigured budget cross nothing.
* fix(desktop): localize inbox state errors
Problem:
- Paused Inbox actions surfaced raw English backend errors in localized desktop sessions.
- Non-recovered paused queues had no actionable recovery surface and could still attempt guidance admission.
Root cause:
- Wails transported product-state text instead of stable identifiers, and the Composer rendered Error.message directly.
- Pause state was only propagated for recovered Inbox snapshots.
Fix:
- Encode known Inbox states as stable error codes while preserving Go error unwrapping and unknown diagnostics.
- Localize current and legacy error forms in English, Simplified Chinese, and Traditional Chinese.
- Propagate pause state, disable guidance admission, and expose resume controls for ordinary paused queues.
Verification:
- cd desktop && go test ./... -count=1
- Inbox localization tests: 18 passed
- Inbox recovery interaction tests: 13 passed
- cd desktop/frontend && pnpm build
- Verified the zh-CN pause and resume flow in a real browser
* fix(desktop): localize inbox cancellation failures
Problem:
- Inbox cancellation failures exposed English context or stable transport codes in localized sessions.
- PR checks were blocked by errorlint and ratcheted source-file budgets.
Root cause:
- The controller cancellation path bypassed the shared Inbox error formatter.
- An intentional error identity assertion lacked a scoped errorlint explanation, while added lines exceeded existing budgets.
Fix:
- Localize cancellation context and nested Inbox errors while preserving unknown diagnostics.
- Add formatter and controller regression coverage.
- Keep source budgets unchanged and document the intentional identity assertion.
Verification:
- go run ./tools/repolint
- cd desktop && go test ./... -count=1
- cd desktop && golangci-lint run --timeout=5m ./...
- cd desktop/frontend && pnpm build
- Inbox localization, cancellation reconciliation, and recovery regression tests
* fix(inbox): recover orphaned guidance ownership
Problem:
Durable in-flight guidance could outlive Controller ownership and become an immutable zombie item while the UI kept offering invalid operations.
Root cause:
Same-process snapshots had no ownership reconciliation, and durable claim/active/ack transitions were not serialized against recovery. The guidance shelf also treated every persisted state like a queued item.
Fix:
Recover unowned in-flight records to paused, reviewable uncertain state; serialize the full ownership lifecycle; and expose state-aware disabled or retry actions with localized labels.
Verification:
- go test ./...
- go test -race ./internal/control ./internal/sessioninbox
- cd desktop && go test . -run Inbox\|Steer
- cd desktop/frontend && pnpm test:typecheck && pnpm test && pnpm build
- make lint
- real Chromium recovery/retry interaction in zh-CN
Fixes#8276
* fix(inbox): make retry admission idempotent
Problem:
A recovered item could start as a new turn on retry and then reject a stale frontend steer. Completion also held the inbox admission lock across transcript snapshot I/O.
Root cause:
The steer idempotency path omitted the running state, and completion removed active ownership before persistence, requiring broad serialization.
Fix:
Treat Controller-owned running items as already admitted. Keep active IDs published while snapshotting and hold admission exclusion only for durable acknowledgement and ownership removal.
Verification:
- go test ./...
- go test -race ./internal/control ./internal/sessioninbox
- cd desktop && go test ./...
- frontend typecheck, focused Inbox tests, and production build
- make lint
* fix(inbox): keep durable I/O outside admission lock
Problem:
Inbox snapshots and turn completion held admissionMu while waiting on session inbox disk transactions, allowing bounded file-lock waits and per-item acknowledgement loops to block admission.
Root cause:
Recovery consumed a stale active-ID snapshot, so a broad Controller lock bridged the durable claim-to-ownership and ownership-to-ack windows.
Fix:
Track admitting and active ownership in lock-free registries that Store recovery consults after refreshing its transaction. Keep ownership published through durable acknowledgement, and remove admission locking from snapshot and completion I/O.
Verification:
- go test -race -count=1 ./internal/control ./internal/sessioninbox
- go test ./...
- cd desktop && go test ./...
- go vet ./...
- make lint
- frontend typecheck, Inbox focused tests, and production build
* fix(inbox): keep durable FIFO dispatch live
Problem:
Queued guidance could remain idle after rotation, a rejected steer, a transient dispatch failure, or the previous durable turn completing. The desktop fallback also disabled the queued action while idle.
Root cause:
Inbox dispatch used a one-shot edge guard, so kicks that arrived during a scan or a closed admission gate could be lost. Several gate-release paths did not publish a new kick, and the frontend exposed no FIFO-safe recovery action.
Fix:
Use a level-triggered drain with bounded retry, re-kick after rotation and rejected steering, and expose an idle head-item Send action that reuses the idempotent resume/drain path. Keep later items disabled to preserve FIFO ordering and localize the new states.
Verification:
- go test -race ./...
- go test -race ./internal/control -count=1
- focused inbox race tests with -count=10
- pnpm test:typecheck
- pnpm lint:hooks
- pnpm build
- composer-inbox-recovery.test.tsx
* fix(ci): budget inbox recovery controls
Problem:
The Linux and Windows desktop jobs failed the raw initial asset budget after the inbox recovery UI landed, even though every compressed startup and chunk budget remained green.
Root cause:
The new localized recovery controls add 2.7 KiB to the current main-v2 raw initial bundle beyond its 2246 KiB allowance.
Fix:
Raise only the raw aggregate allowance to 2249 KiB and document the durable inbox recovery contract. This leaves roughly 0.3 KiB of headroom while preserving all gzip, CSS, locale, and largest-chunk limits.
Verification:
- wails generate module
- pnpm --dir frontend build
- pnpm --dir frontend check:bundle
- pnpm --dir frontend test
- go test -race ./... (root and desktop modules)
* refactor(inbox): keep recovery paths within lint budgets
Problem:
Repository lint rejected the queue liveness patch because it expanded two baselined legacy files and pushed TrySteerInboxItem five lines over the function limit.
Root cause:
The drain kick and idle recovery details lived inline in already oversized controller and Composer functions.
Fix:
Move the idle UI kick into composerGuidance, colocate rotation release with inbox dispatch, and extract steer-admission unlock handling. This restores every existing file/function budget without adding lint baselines.
Verification:
- go run ./tools/repolint
- focused inbox race tests with -count=10
- pnpm lint:hooks
- pnpm test:typecheck
- composer-inbox-recovery.test.tsx
Problem:
- The live-context controller test failed before initial context and balance data loaded.
Root cause:
- Its fixture mocked only the legacy HistoryPageForTab method while startup hydration now requires HistorySliceForTab.
Fix:
- Reuse the shared history-slice fixture for an empty startup transcript.
Verification:
- pnpm exec tsx src/__tests__/use-controller-live-context.test.tsx
- pnpm test:all
- pnpm build
- go run ./tools/repolint
Problem:
- main-v2 advanced while #8257 was under final review, adding trusted completion-contract input handling.
Root cause:
- The catalog integration branch needed the latest protected runtime behavior before final validation and publication.
Fix:
- Merge the latest main-v2 commit without conflicts, preserving both the catalog integration and trusted completion receipt routing.
Verification:
- Full root, Desktop, race, frontend, cross-platform, and repository gates will run on this exact merge head before push.
Problem:
- main-v2 advanced while #8257 was under review, adding task spend guards across agent, boot, config, and control.
- The repolint baseline conflicted with the catalog integration, and the new real-Build budget test used a machine-speed-dependent round threshold.
Root cause:
- Both branches changed boot assembly and repository budget snapshots from the same earlier base.
- Counting rounds does not prove a wall-clock budget boundary under different runner loads.
Fix:
- Merge main-v2 semantically while preserving the catalog TaskStore and observed-session wiring.
- Recompute the exact combined repolint baseline without increasing the finding count.
- Assert the typed task_budget/time pause with a bounded context instead of a round-count heuristic.
Verification:
- go test ./internal/boot passed in three independent processes
- go test -race -count=1 ./internal/boot
- focused task-budget and history real-Build tests
- go run ./tools/repolint
* fix(agent): keep transient routing out of completion receipts
Problem:
Ordinary turns could surface an unverified completion receipt whose acceptance criterion exposed the internal capability-route block and invented a required-change check.
Root cause:
The agent kept the provider-composed turn as the completion contract input even though the controller already supplied authenticated raw user text separately.
Fix:
Use the raw user input for live and final completion contracts while preserving the composed provider prompt. Add regression coverage for mutation receipts and advisory turns containing capability routing with delivery-like wording.
Verification:
- go test ./internal/agent ./internal/completion ./internal/taskcontract
- go test ./...
- cd desktop && go test ./...
- git diff --check
* fix(agent): preserve trusted task text in completion contracts
Problem:
The first completion-receipt fix used raw user input unconditionally, which did not preserve Goal scope task text or pristine sub-agent classifier text. Its explanatory comment also exceeded repository lint budgets.
Root cause:
Completion contracts and delivery classification selected their task source independently even though both require the same host-trusted text.
Fix:
Store the already-selected trusted classification input as the per-turn contract input. Add regressions for Goal continuations and host-wrapped sub-agents, and remove the lint-expanding comment.
Verification:
- go run ./tools/repolint
- go test -race ./internal/agent -run TestCompletionContract -count=1
- go test ./internal/agent ./internal/completion ./internal/taskcontract
- go vet ./...
- go test ./...
- cd desktop && go test ./...
- git diff --check
* chore(ci): refresh PR metadata checks
Problem:
The documentation-impact field was added after the pull_request_target event was created, and rerunning that workflow reused the old event payload.
Root cause:
GitHub Actions reruns preserve the original pull request metadata snapshot.
Fix:
Create a new synchronize event so metadata guards evaluate the corrected PR body without rewriting published history.
Verification:
- PR body contains Documentation-impact
- local code and test gates passed at b0fb0fbcd
Problem:
- The integration branch lagged main-v2 and conflicted in Desktop startup, boot wiring, and frontend guardrails.
- In-memory shared-cache projections could return SQLITE_LOCKED during concurrent reconcile/write operations.
- A timed-out session catalog close could leave its database open, while macOS updater tests shared raw descriptor ownership with production-style helpers.
Root cause:
- The branch and main evolved the same runtime owners independently.
- SQLite shared-cache table locks do not honor busy_timeout across pooled in-memory connections.
- Session catalog close completion and test file-descriptor ownership lacked explicit lifetime fences.
Fix:
- Resolve the merge semantically, preserving catalog task-store and registration-scope behavior alongside upstream config warnings and agent runtime updates.
- Use one database/sql connection for memory projections, make session catalog close eventually complete exactly once, and duplicate updater handoff descriptors for exclusive ownership.
Verification:
- go test and go test -race ./internal/projectiondb ./internal/sessioncatalog
- Desktop session catalog regression: 100 ordinary runs and 30 race runs
- macOS updater handoff/TempDir regression: 100 ordinary runs and 20 race runs
* feat(agent): gate a task on spend; drop the chat round ceiling
The gate moves to the axes a runaway is actually reported in. A task that
reaches its wall-clock or cost budget gets one tool-free summary and a
resumable pause — the same landing the round ceiling produced, now triggered
by what the work costs instead of by a count.
Ordinary chat loses its round ceiling entirely rather than getting a bigger
one. Rounds carry no information the spend axes lack: a turn that reaches a
high count without crossing either is one whose rounds are individually
cheap and fast, which is the case least worth interrupting. The only failure
rounds could catch alone is a loop that is both free and instant, and wall
clock catches that one too, in the right unit. Goal keeps its 16-round
boundary — an FSM yield point, not a runaway guard — and an explicit
--max-steps still owns either turn.
Wall clock is the only axis with a default, deliberately: half an hour means
the same thing on every model, an amount of money does not. A cost default
loose enough for DeepSeek would land a frontier model within a couple of
answers, so cost stays off until someone who knows what they are paying sets
[agent].task_cost_budget. Cost also only judges what it can price — an
unpriced model never crosses that axis rather than reading as free — and
wall clock still bounds a free or local model's loop.
Landing is now one path. armFinalizationRound owns arming the grace round,
injecting the finalization request, and emitting the notice; the spend gate
and an explicit max_steps both go through it, and gracePause names which one
stopped the Run. The grace round, not the wording, is what refuses tools.
toolOutcome moved to execute_batch.go, where it is used, to keep agent.go
inside its budget. The remaining baseline diff is 5 lines in config.go for
the two keys and 1 in boot.go for passing them; both files are far past the
800-line ceiling already and the added code is at its minimum shape.
* docs(guide): document the task spend budget
Both guides get the two keys, why only wall clock has a default (money is
not portable across models), the unpriced-model rule, and the fact that
ordinary chat no longer has a round ceiling at all.
Problem:
Stale controller builds could roll back shared MCP instances owned by a newer build. Session tombstones could underfill paginated results and their same-revision refresh event could be ignored. Legacy topic migration markers could also miss same-size or event-log changes.
Root cause:
Registration scopes tracked creation without transferable instance claims, catalog pagination applied tombstones after SQL limits, and migration completion used only transcript names and sizes while explicit reconciliation still trusted that marker.
Fix:
Track exact MCP instance claims through scope commit or abort, scan catalog keyset pages until visible limits are satisfied, publish overlay refreshes that accept equal revisions, fingerprint bounded session artifacts and authoritative event logs, and add a marker-bypassing explicit migration path.
Verification:
go test ./internal/plugin ./internal/sessioncatalog
go test -race ./internal/plugin ./internal/sessioncatalog
go test ./desktop focused migration, tombstone, restore, clear-session, and registration cases
pnpm typecheck
npx tsx src/__tests__/project-tree-shell-race.test.ts
* fix(config): avoid repeated DeepSeek migration warnings
Problem:
Switching or resuming sessions rebuilds the desktop runtime and repeatedly shows a DeepSeek migration warning when an unrelated TOML value is malformed.
Root cause:
The automatic DeepSeek protocol migration decodes the entire user config before the resilient loader runs, so any parse error is mislabeled as a migration failure on every controller build.
Fix:
Let the resilient config loader own malformed-file reporting for automatic migration, preserve the invalid file byte-for-byte, and keep explicit Settings upgrades strict.
Verification:
- go test ./internal/config -count=1
- go test ./internal/boot -run 'TestBuild(MigratesLegacyDeepSeekProtocolWithOneNotice|DoesNotMislabelMalformedConfigAsDeepSeekMigrationFailure)' -count=1
- go test ./... -p 4
* fix(boot): scope malformed config warnings by frontend
Problem: automatic DeepSeek migration parse failures were either shown as duplicate desktop session notices or hidden from headless frontends.
Root cause: malformed TOML recovery belongs to the resilient loader on desktop, but the migration layer is shared by desktop, CLI, serve, and bot builds.
Fix: keep migration parse errors intact, suppress only the duplicate desktop notice when a loader warning exists, preserve headless diagnostics, and move focused regression coverage out of the oversized boot test file.
Verification: go run ./tools/repolint; go vet ./internal/config ./internal/boot; focused race tests for config and boot; go test ./... -p 4.
* fix(desktop): surface runtime config load warnings
Problem:
Malformed config introduced after startup could be silently ignored during desktop session rebuilds.
Root cause:
Boot inferred warning presentation from the usage StatsSource label without transferring resilient-loader warnings to the frontend.
Fix:
Add an explicit warning acceptance callback, publish warnings through the desktop event bridge, deduplicate repeated fingerprints, and fence stale startup responses.
Verification:
- go test -race ./internal/boot
- go test -race . in desktop
- go test ./... -p 4
- go test ./... in desktop
- pnpm build
- go run ./tools/repolint
* fix(desktop): order config warning reloads
Problem: Runtime config warnings could miss project-only damage, and an event queued before a successful reload could reopen a stale banner.
Root cause: Boot delivered warnings only through the DeepSeek migration error path, while desktop warning events and reload snapshots had no shared source ordering.
Fix: Deliver every resilient-loader warning through the explicit frontend callback and assign monotonic build/snapshot revisions so reloads reject older queued events while newer recurrences remain visible.
Verification: go test ./... -p 4; cd desktop && go test ./...; go vet ./... in both modules; pnpm build; race-focused config warning tests; go run ./tools/repolint.
A per-Run total cannot see the failure this axis exists for. runLoopState is
rebuilt every Run, so every "continue" restarts the count from zero — and
the reported runaway was four hours, which is many Runs. A ceiling or a
budget scoped to one Run offers exactly no protection against it.
The task scope resets with the evidence ledger. That boundary already means
"this is new work": a continuation preserves the ledger, an unrelated turn
resets it, and the delivery scope decides which. Reusing it keeps one answer
to "is this the same task" instead of inventing a second one that can
disagree with the first.
Samples now carry both scopes. Turn is what this Run spent, Task is what the
work has cost since it started; a reader that wants either has it without
differencing.
Still shadow — no threshold reads it.
agent.go was 4 lines over its file-size budget with the new field, so the
storm breaker moved to storm_breaker.go: threshold, block message, signature,
and the guard itself were already one concern sitting in the middle of
another file. agent.go drops 151 lines and 13 essay findings, which the
baseline diff moves rather than forgives.
Problem:
main-v2 advanced again while the final lint cleanup was being pushed, leaving the pull request without a mergeable synthetic ref.
Resolution:
Merge the latest target tip and validate the combined role-policy and turn-spend changes before rerunning CI.
Verification:
focused Go tests, golangci-lint, repolint, and frontend bundle checks rerun after conflict resolution
# Conflicts:
# tools/repolint/baseline.json
Problem:
The full CI lint job reported 19 issues that were not covered by repolint or go vet, including stale compatibility helpers, inefficient test string assembly, and staticcheck simplifications.
Root cause:
The role-setting refactor retired several helper call sites without removing their declarations, and its new policy/test code had not been run through the repository-pinned golangci-lint suite.
Fix:
Remove unused compatibility and boot helpers, simplify role-policy branches, use builders in tool-output tests, and ratchet the repolint baseline down after the cleanup.
Verification:
golangci-lint v2.12.2 run --timeout=5m
go test ./internal/acp ./internal/agent ./internal/taskpolicy ./internal/cli ./internal/boot
go run ./tools/repolint
Rounds are the axis we bound and the one nobody reports a failure in. The
turn behind #8228 was four hours, 524 requests and 194M tokens; not one of
those numbers is a round count, and the same hundred rounds cost minutes or
hours depending on what each one read and how long the model thought.
This adds the axis that is missing: tokens, requests, wall clock and money,
accumulated per turn and reported after every round to sinks that opt into
event.RunBudgetSink. Cost goes through provider.Pricing, so a cache hit
prices at a fiftieth of a miss instead of reading as a full-price prompt —
on a cache-first agent, anything else would misreport the bill by an order
of magnitude.
Shadow only. Nothing reads a verdict from it and no threshold exists yet:
the distribution these samples record is what a threshold should be chosen
from, and picking one first would repeat how 100 was picked.
Rounds still count when a round's usage never arrived, so the axis never
reads cheaper than the turn was.
run_loop.go was 3 lines over the file-size ceiling with this, so the
sampling-usage accounting it already carried — estimate, merge, finalize,
emit — moved to run_usage.go as its own concern. That drops run_loop.go
under 800 lines and retires its file-size debt; the baseline diff carries
the two findings that moved with the extraction and records one fewer
finding overall.
Problem:
After the PR fix was pushed, main-v2 added an arbiter and transcript scrolling contracts. GitHub tests the synthetic merge, where those additions exceeded the PR's repolint and raw frontend budgets even though each branch passed independently.
Root cause:
The checked-in ratchets were generated against the previous main-v2 tip and had no room for the newly merged always-available contracts.
Fix:
Regenerate the combined-tree repolint baseline and extend the initial raw asset allowance by 3 KiB while preserving the existing gzip ceilings.
Verification:
go run ./tools/repolint
pnpm check:bundle
go test ./internal/agent ./internal/control ./internal/acp ./internal/boot
Problem:
The target branch advanced after the role-policy fix was pushed, so the CI merge result inherited new code outside this PR and exceeded the freshly generated repolint baseline.
Resolution:
Merge the latest main-v2 before regenerating and validating the combined-tree lint baseline.
Verification:
go run ./tools/repolint
focused and full suites rerun after the merge
Problem:
Role settings derived policy fields that were not consistently shared by planner, capability routing, execution, and final readiness. ACP prompt admission could race an in-place role switch, and desktop branch metadata could restore a stale canonical preset. CI also exposed stale role-copy assertions, locale bundle overages, and an outdated repolint baseline.
Root cause:
Each layer independently inferred role behavior, prompt admission did not participate in the state-change lock, and session persistence updated only the legacy tokenMode field.
Fix:
Freeze one TaskPolicy per turn and enforce its route, capability, mutation, external-action, verification allowlist, explore-subagent, and post-write verification constraints. Serialize ACP admission with role changes, dual-write desktop role metadata, keep planner/router runtimes role-neutral for in-place switching, and repair lint/bundle/test contracts.
Verification:
go test ./...
cd desktop && go test ./...
go test -race ./internal/acp ./internal/control ./internal/agent
go vet ./...
go run ./tools/repolint
cd desktop/frontend && pnpm build && pnpm test:all
Three signals write the round tail — storm breaker, progress guard, evidence
nudge — and all three built it the same way, from outcomes[0].output. They
run in sequence, so a round that fired two delivered only the last one's
guidance and silently dropped the earlier one. A batch that trips the loop
guard and the evidence nudge together is exactly the batch that needs both.
Each signal now returns an intervention (verdict, guidance, notice, stuck
reason) instead of writing the slot, and applyInterventions folds a round's
signals into one delivery: strongest verdict, every notice, all guidance
concatenated in signal order.
The verdict ladder — advise, redirect, land — is the vocabulary the rest of
this work needs. Nothing reads it yet beyond the strongest-wins fold; it is
introduced here so the signals already speak it when the remaining
interventions move onto this channel and when a resource axis joins them.
Behaviour is unchanged for any round that fires one signal, which is every
round the existing suites cover; the two-signal round gains the guidance it
was dropping.
Problem:
Three P1 merge blockers remained on the catalogs integration head:
1) Host registration journal used a Host-global regJournalActive flag, so
sibling hot-adds during a stale build were attributed and rolled back.
2) RemoveSession stored tombstones only after mutex waits; a 150ms desktop
context could expire mid-lock, leave SQL undeleted, and ListTopics still
returned archived topics (race-mode restore test).
3) Topic migration markers used strict mtime ordering, which failed on
Windows coarse timestamps for new CLI sessions after the marker.
Root cause:
1) Ownership was time-window based rather than token-based.
2) Query paths trusted SQLite without an immediate removal overlay.
3) Marker validity compared file mtimes instead of directory content.
Fix:
- Replace the global journal with per-build RegistrationScope tokens
propagated via context through EnsureConnected and LazyToolset; abort
rejects late registrations; sibling writes without the token are ignored.
- Do not hold a Host lock across boot.Build (scopes do not serialize builds).
- Record removedPaths before any mutex; filter ListTopics/ListSessions/
GetSession through the tombstone; TryLock durable DELETE and retry async.
- Persist migration markers as name+size directory signatures; new sessions
invalidate without mtime ordering.
- Extract registration scope, removal, migration marker, and legacy migration
helpers to keep repolint budgets clean (baseline carry-forward only).
Verification:
- go test ./internal/plugin/ -run TestRegistration (-race)
- go test ./internal/sessioncatalog/ -run 'TestRemoveSession|TestListTopics' (-race)
- cd desktop && go test -run 'TestProjectTreeMigratesNewCLISessionAfterProjectDirMarker|TestRestoreGlobalTopicSessionReindexesProjectTree|TestClearSessionForTab'
- cd desktop && go test -race -count=3 -run TestRestoreGlobalTopicSessionReindexesProjectTree
- go run ./tools/repolint
* fix(desktop): hide base providers from plugin models
* fix(cli): filter base providers from plugin models
Problem:
The Desktop fix added an over-budget comment, while the CLI model picker still accepted every descriptor from the merged provider catalog.
Root cause:
The CLI merge path did not enforce the plugin namespace boundary, and the expanded Desktop explanation crossed the repository comment budget.
Fix:
Require a canonical plugin owner in the CLI merge, cover an unnamespaced base descriptor, and shorten the Desktop contract comment.
Verification:
- go test ./internal/cli -run TestMergeExtensionModelRefs -count=1
- cd desktop && go test . -run TestModelsForTab -count=1
- cd desktop && go vet .
- go run ./tools/repolint
- git diff --check
Co-authored-by: SivanCola <[email protected]>
---------
Co-authored-by: SivanCola <[email protected]>
* fix(desktop): stop trackpad scroll stalls in the chat transcript
Problem: On macOS, two-finger scrolling the chat content area felt sticky
and jumpy—especially over markdown tables—because nested overflow
containers latched the trackpad and virtualizer/stream rewrites fought
native inertia mid-gesture.
Root cause: CSS overflow-x:auto promotes overflow-y to auto, so ordinary
tables/code blocks became vertical scroll ports; virtualizer height
compensation and stream tail-follow could still write scrollTop while the
user was gesturing.
Fix: Add a short user-gesture lock that blocks compensating scroll writes,
promote edge/non-scrollable nested wheels to the transcript with latching
handoff, keep small tables and code blocks out of nested vertical scroll,
and mark large virtual tables for handoff.
Verification: npx tsx scroll-manager, transcript-scroll-session,
nested-scroll-handoff, markdown-table-virtual, typography-overflow-contract,
and transcript-virtualization tests.
* fix(desktop): fold large tables and idle-remeasure after scroll
Problem: Large markdown tables still introduced nested vertical scroll
ports by default, and virtualizer remeasure could jump after a trackpad
gesture settled.
Root cause: Oversized tables mounted a max-height virtual scroller
immediately, and height compensation was deferred only mid-gesture, not
batched once after the hold window.
Fix: Collapse tables above the virtual threshold to a 12-row document-flow
preview with Expand all / Collapse; expanded tables keep the nested
virtual scroller with handoff. After gesture idle, measure once and
reconcile the reading anchor.
Verification: npx tsx markdown-table-virtual, scroll-manager,
transcript-scroll-session, and nested-scroll-handoff tests.
* fix(desktop): stabilize native transcript scrolling
Problem:
Long variable-height transcripts could stall or jump while trackpad inertia, native scrollbar input, or Windows middle-button auto-scroll overlapped virtualizer and resize compensation. Creation scrollbar sensitivity could also change while rows mounted.
Root cause:
Scroll ownership only covered wheel, touch, and keyboard intent; treated unowned native scroll events ambiguously; remeasured the entire virtualizer after every idle gesture; and recomputed custom-scrollbar geometry during a drag. A stale scrollend could also settle a newer gesture.
Fix:
Model native input sessions explicitly, arbitrate controller-owned scroll events, normalize wheel delta modes, guard stale scrollend, freeze custom-scrollbar drag geometry, and measure only real layout invalidations with anchor reconciliation. Split interaction and scrollbar concerns out of Transcript and add real-browser stability coverage.
Verification:
- pnpm --dir desktop/frontend test:transcript
- pnpm --dir desktop/frontend test:transcript-browser
- pnpm --dir desktop/frontend typecheck
- pnpm --dir desktop/frontend test:typecheck
- pnpm --dir desktop/frontend test:motion
- pnpm --dir desktop/frontend build
- go run ./tools/repolint
* fix(desktop): latch manual transcript scroll intent
Problem:
A short upward wheel, trackpad, native scrollbar, or Creation scrollbar movement could remain inside the 80px near-bottom band. After the gesture quiet window, streaming output could therefore re-enable tail-follow and pull the viewport back down.
Root cause:
The scroll manager treated geometric proximity as user intent and recomputed stick mode from the near-bottom threshold after every native scroll event.
Fix:
Latch explicit user detachment across gesture settlement, keep resize and stream repins disabled while detached, and restore tail-follow only at the physical bottom or through an explicit bottom/reset action. Apply the same contract to the Creation scrollbar.
Verification:
- pnpm --dir desktop/frontend test:transcript
- pnpm --dir desktop/frontend test:transcript-browser
- pnpm --dir desktop/frontend test:typecheck
- pnpm --dir desktop/frontend test:motion
- pnpm --dir desktop/frontend build
- go run ./tools/repolint
* fix(desktop): preserve tail follow across scroll ownership
Problem:
- Nested downward handoff at the physical bottom detached streaming tail-follow.
- Passive tail writes rejected during an active gesture were dropped, so final token and row-size growth could leave the viewport behind.
Root cause:
- Nested handoff discarded wheel direction and always released auto-scroll.
- Gesture arbitration had no generation-aware replay for blocked passive owners.
Fix:
- Propagate normalized nested deltas and release only for upward or detached reading intent.
- Replay blocked stream, resize, footer, and row-size repins once after gesture idle using the current scrollHeight.
- Cancel deferred work on manual intent, selection, explicit navigation, and tab generation changes.
- Adapt #8291's row-size ownership, pinned measurement rule, and stream-end fallback into the unified gesture controller.
- Add deterministic and real Chromium regression coverage.
Verification:
- pnpm test:transcript
- pnpm test:transcript-browser
- pnpm test:typecheck
- pnpm test:motion
- pnpm build
- go run ./tools/repolint
Co-authored-by: LI Xinyu <[email protected]>
---------
Co-authored-by: LI Xinyu <[email protected]>
Problem:
The feature branch was behind the current integration base.
Resolution:
Merge the latest main-v2 changes before applying review fixes so validation covers the current agent runtime.
Verification:
Focused and full validation will run after the review fixes are applied.
Problem:
Desktop CI failed with TS2305 because hydrateErrorState imported a non-existent
Item type from ./types. Host generation-loss rollback still used name-diff
snapshots, so a deterministic interleaving where sibling/new-generation resources
appear after the snapshot incorrectly deleted those live clients.
Root cause:
1. The helper was typed against a concrete Item export that does not exist in
types (and created a fragile circular import surface).
2. Name-set diff has no ownership: any server name created after the snapshot
was attributed to the lost build, including post-snapshot sibling work.
Fix:
- Make applyHydrateErrorState / hydratePlaceholderItems generic over TItem so
the helper needs no types import.
- Assign Host-local Client instance IDs, journal registrations during
RunWithRegistrationJournal, and roll back only with RemoveIfInstance.
- Controller builds wrap boot.Build in the journal; supersede/generation-loss
paths call RollbackRegistration on journaled refs only.
- Add deterministic instance-scoped regression tests (including post-journal
sibling preservation and same-name newer-generation survival).
- Make Client.close nil-safe for transport-less test clients.
Verification:
- go test ./internal/plugin/ -run 'TestRegistrationJournal|TestRunWithRegistration' -count=1
- go test -race ./internal/plugin/ -run 'TestRegistrationJournal|TestRunWithRegistration' -count=1
- cd desktop && go test -c . && go test -run TestClearSessionForTab -count=1
- cd desktop/frontend && pnpm typecheck
bindTurnScope claimed the adaptive guards "stay silent while a loop keeps
finding something new". That was true when #8228 landed and false an hour
later: #8233 added evidence.explorationRunLimit, so a look-only run stops
scoring past six rounds and the no-progress ladder reaches its first rung
on exactly the shape the ceiling was added for.
Leaving the claim in place misreads the ceiling as the primary defence. It
is the backstop for a shape the ladder has not learned yet, and it counts
rounds per Run — a "continue" starts them over, so it bounds one turn and
never a whole task. Both facts now sit next to the constant.
Agent.Run's doc carried the same gap from the other side, naming
cancellation and compaction as the real bounds and omitting the ladder. It
also ran two overlapping paragraphs; this collapses them into one.
No behaviour change.
At physical overflow, and at pressure above the hard input ceiling, the
summarizer is the only way out of context pressure. Its failure surfaces
as ErrCompactionRequired and blocks every further message: "context
exceeds provider limit and compaction failed / context deadline
exceeded".
#4138 made the 90s summary bound safe by pairing it with a deterministic
mechanical fold: the summarizer may time out, a timeout is deliberately
not retried, but the fold still frees context. #7839 removed
mechanicalFoldDigest and added CompactionModeDegraded without ever
wiring it, so the no-retry policy stayed while the fallback did not.
Restore the fold, and only where the caller would otherwise answer
ErrCompactionRequired. Below that ceiling nothing changes: the turn
still goes out, and the blocked fingerprint keeps a second summary from
being paid for, so a recoverable view is never folded without a summary.
Manual compaction keeps reporting the error to a caller who is present
and can retry, and cancellation never degrades. The canonical transcript
stays untouched on every path; only the projection changes.
A degraded fold freed the context, so its telemetry is a notice carrying
the summarizer's error rather than a "compaction failed" warning.
Problem
af6b1cbe0 failed Desktop CI: App.tsx JSX was invalid (two roots without a
Fragment), unused purgeUnwantedSharedHostServers and a classic for-range
failed macOS lint, and generation-mismatch cleanup wiped the entire shared
MCP Host including servers owned by other tabs or a newer rebuild.
Root cause
Hydrate-error UI was sibling-adjacent to Transcript in a ternary branch.
Host rollback used a full reset instead of build-scoped cleanup.
Fix
- Wrap Transcript + hydrate error in a Fragment.
- Remove unused purge helper; use for-range in cold history test.
- Snapshot Host servers before boot.Build; on generation loss or build
failure roll back only names introduced by that build.
- sameMeta compares sessionGeneration; hydrate uses shared
hydrateIdentityCurrent fence.
- Add deferred-barrier clear→late-A race test and keep source contracts.
Verification
- gofmt -l desktop
- go run ./tools/repolint
- go test -run 'TestClearSessionForTab|TestRollbackSharedHost|TestClearSession|TestTabScoped' ./desktop
- npx tsx desktop/frontend/src/__tests__/clear-session-identity-race.test.ts
- npx tsx desktop/frontend/src/__tests__/clear-session-identity-contract.test.ts
Problem
After Clear Context, immediately switching Plan/layout/token mode could
briefly re-show the destroyed transcript. ClearSession rotated the backend
session path but the frontend only wiped the view; meta, TranscriptStore
resident cache, and hydrate identity still pointed at the old session.
Root cause
ClearSessionForTab returned no replacement identity. clearSession did not
evict TranscriptStore or apply a new sessionPath/generation. Hydrate only
checked request sequence numbers, so a post-clear load started with stale
meta.sessionPath could still preferResident-serve session A.
Fix
- ClearSession/ClearSessionForTab return SessionClearResult with path,
revision, digest, and a bumped tab SessionGeneration.
- clearSession applies that identity atomically, resets transcript state,
and evicts the tab from TranscriptStore.
- loadSessionDataForTab rejects results when meta sessionPath or
sessionGeneration no longer match the load's identity.
- On MCP extension generation race, resetSharedHostMCP drops all shared-host
clients (including same-name still-enabled servers) before rebuild.
- gofmt app.go; keep repolint clean.
Verification
- gofmt -l . (clean)
- go run ./tools/repolint
- go test -run 'TestClearSessionForTabReturnsReplacementIdentity|TestResetSharedHostMCPClearsStillEnabledFailure|TestClearSession|TestTabScoped' ./desktop
- npx tsx desktop/frontend/src/__tests__/clear-session-identity-contract.test.ts
Problem
Review of #8257 found residual blockers: body-only history hid the search
input, MCP ClearAuth skipped generation bumps and stale builds could
re-register deleted shared-host servers, task control could adopt SQLite
roots, open-status page fill disagreed with the frontend, and repolint
failed on size/complexity/trailing blanks.
Root cause
UI gated search on metadata session count; generation barriers were
incomplete for Host-owned MCP state; catalog rows overwrote allowlisted
project roots; SearchHistoryContent grew past complexity budget.
Fix
- Always show history search in non-trash mode, including body-only hits.
- Bump extensionGeneration on ClearMCPServerAuthentication; purge unwanted
shared-host servers when a stale build loses the generation race.
- Keep allowlisted task project roots; catalog may only supply labels.
- Align backend open filter with open-but-not-current UI semantics.
- Split history search/index helpers to satisfy repolint; fix docs EOF.
Verification
- go run ./tools/repolint
- go test ./internal/historycatalog/ ./internal/usagecatalog/
- go test -run 'TestHistorySliceCold|TestHistorySliceReports|TestTaskAction|TestExtension|TestProjectTreeShell' ./desktop
- npx tsx desktop/frontend/src/__tests__/history-catalog-body-hits.test.ts
- npx tsx desktop/frontend/src/__tests__/history-load-failure-contract.test.ts
- git diff --check
Problem
#8257 could leave the project sidebar permanently empty when
project-tree:changed-v2 advanced revision before the initial shell
snapshot, and large-session hydration still waited on controller ready
while failed history loads looked like successful empty transcripts.
Root cause
Shell snapshots reused the disposable catalog revision watermark, and
HistorySlice/listSessions treated read failures as empty success without
preserving prior content or offering retry.
Fix
- Accept projects.json shells when the tree is empty even if catalog
revision is already ahead; re-fetch the shell on empty-tree v2 events.
- Prefer cold HistorySliceForTab before controller ready; surface slice
Error instead of silent empty pages.
- Defer transcript reset until history succeeds; keep placeholders/items
on hydrate_error; expose retrySessionHistory + UI banner.
- Stop listSessions from swallowing catalog failures as [].
Verification
- go test -run 'TestHistorySliceColdPathBeforeControllerReady|TestHistorySliceReportsErrorInsteadOfEmptySuccess|TestProjectTreeShellSurvivesCatalogRevisionRace|TestHistorySlice|TestProjectTree|TestTopicArchive|TestArchive' ./desktop
- npx tsx desktop/frontend/src/__tests__/project-tree-shell-race.test.ts
- npx tsx desktop/frontend/src/__tests__/history-load-failure-contract.test.ts
- npx tsx desktop/frontend/src/__tests__/history-catalog-body-hits.test.ts
Problem
Integration PR #8257 left six functional/concurrency gaps: history tool
tool_output was never indexed, History UI hid body-only hits, open/current
filters ran after pagination, MCP install/update/remove/reconnect did not
bump the controller extension generation, task control required a ready
SQLite catalog, and usage Ready ignored same-size rewrites.
Root cause
Disposable catalogs filtered or published after partial candidate windows,
and control-plane paths depended on projection readiness or incomplete
generation barriers.
Fix
- Index tool_output while keeping default search kinds excluding it.
- Fill ListHistorySessions/SearchHistoryContent pages after runtime filters,
and show body hits with an independent body cursor in the History UI.
- Bump extensionGeneration on Install/Update/Remove/Reconnect MCP paths.
- Resolve task action projects from the allowlisted roots/FileStore path.
- Compare mtime_ns in usage Ready (and record mtime on live receipts).
Verification
- go test ./internal/historycatalog/ ./internal/usagecatalog/ ./internal/sessioncatalog/ ./internal/history/
- go test -race ./internal/historycatalog/ ./internal/usagecatalog/
- go test -run 'TestTaskActionProjectResolvesAllowlistWithoutCatalog|TestExtensionGenerationBumpsOnMCPMutationSites|TestTaskMonitor|TestStopTask|TestCloneDetached|TestApplyRuntime|TestCloseRemoved' ./desktop
- npx tsx desktop/frontend/src/__tests__/history-catalog-body-hits.test.ts
Problem: the context panel again exposed internal full-history, model-visible, trigger, threshold, and checkpoint diagnostics after the content-driven maintenance rewrite.
Root cause: PR #8244 added a new context checkpoint block and reversed the source contract that had kept internal maintenance details out of the user-facing panel.
Fix: remove the checkpoint detail render path, presentation-only state, styles, and locale strings. Preserve the real compression-distance gauge, backend checkpoint behavior, and maintenance notices. Restore a source contract that prevents the block from returning.
Verification: focused context-maintenance contract test; ESLint; Wails bindings regeneration followed by pnpm build; browser DOM verification.
Problem
CI still failed on lint (intrange), desktop race ordering for new CLI sessions
(LastActivityAt=0), Windows TempDir cleanup locking usage-catalog SQLite, and
migration-marker timing flakes. The branch was also behind main-v2.
Root cause
SyncMetadata inserted topics with last_activity_at=0/turns_state=valid before
sessions were indexed; reconcile requests could be dropped when the channel was
full; process-local usage/history catalogs kept SQLite handles open after tests;
marker assertions used a single Stat.
Fix
- Merge latest main-v2.
- Floor session activity on file mtime; SyncMetadata inherits live aggregates.
- Retain overflow reconcile requests in a dirty map and drain them.
- Close shared history/usage/task catalogs on desktop shutdown and test cleanup.
- Wait for migration markers; fix for-range lint.
Verification
- go test ./internal/sessioncatalog ./internal/stats ./internal/history ./internal/cli
- go test -race ./internal/sessioncatalog
- cd desktop && go test -race -run 'TestProjectTreeMigratesNewCLISession|TestCoveredRecoveryCopy|TestTopicMigrationMarker'
- go run ./tools/repolint
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* fix(ci): unblock Windows main-v2 full suite before v1.23.0
Problem
main-v2 push CI has a red Windows streak that blocks Stable tagging:
internal/agent, internal/boot, and internal/control hit the 3m package
timeout on loaded runners, sessioninbox asserted Unix 0700 modes on
Windows (reports 0777), and cold PowerShell hooks timed out at 60s.
Root cause
The PR smoke suite was already raised to 8m after measured 2.2x runner
variance, but the full push suite still used -timeout=3m with a 10m step
budget. Session-inbox permission checks did not gate on GOOS. Nested
PowerShell spawn shared the default 60s real-spawn budget under -p 4.
Fix
- Raise Windows full push suite to -timeout=8m and timeout-minutes: 20.
- Gate session-inbox directory mode assertion to non-Windows.
- Allow 2m for the nested PowerShell hook spawn under Windows load.
Verification
- go test ./internal/sessioninbox/ -count=1
- GOOS=windows go test -c ./internal/hook/
* fix(sessioninbox): keep store_test under repolint file-size ceiling
Problem
The Windows mode-gate edit pushed store_test.go to 801 lines and failed
repolint test-file-size (800-line ceiling).
Root cause
Extra comment lines around the GOOS permission assertion.
Fix
Collapse the comment to one line so the file stays at 800 lines.
Verification
go run ./tools/repolint
* fix(hook): clamp the Windows hook spawn timeout with max (modernize)
Problem
CI lint (golangci-lint v2.12.2, GOOS=windows leg) fails the Windows hook
test: the manual min clamp is flagged by the modernize linter
(minmax: use max).
Root cause
The 2m floor for the real-spawn budget was written as an if-statement
instead of the max builtin.
Fix
Replace the if/assign pair with max(realSpawnTimeout, 2*time.Minute).
Verification
- GOOS=windows golangci-lint run --timeout=5m ./internal/hook/...: 0 issues
- make lint (CI pin v2.12.2): 0 issues, repolint clean
- go test ./internal/hook/ -count=1: ok
Problem
PR #8257 failed Windows reindex, empty-cache path safety, history flush
semantics, locale gzip budget, and PR policy guards (docs/cache impact,
repolint baseline).
Root cause
SQLite file URIs were not Windows-safe, so disk open failed and fell back to
memory during rebuild. Sibling catalogs joined CacheDir without empty checks.
History Flush did not drain work; tool_output was always FTS-indexed; zh-TW
locale budget was tight to the byte.
Fix
- Cross-platform diskFileDSN and RequireDisk rebuild opens.
- Empty CacheDir => memory for history/usage/task catalogs.
- History Flush drains dirty roots and queue; signature-skip periodic rescan;
stop indexing tool_output by default.
- Ratchet zh-TW/zh locale gzip budgets and refresh repolint baseline.
Verification
- go test ./internal/projectiondb ./internal/sessioncatalog ./internal/historycatalog ./internal/usagecatalog ./internal/taskcatalog ./internal/cli
- go test -race ./internal/projectiondb ./internal/sessioncatalog ./internal/historycatalog
- go run ./tools/repolint
Add the cross-project task catalog, Desktop task center APIs, and CLI
reindex surface on the shared multi-domain SQLite projection stack while
keeping history/usage registration and the hardened session foundation.
Add idempotent usage rollups as a disposable SQLite projection with CLI
doctor/reindex surface, layered on the shared projection lifecycle and
preserving the hardened session/history foundations.
Add the token-only FTS5 history projection, non-blocking persist observer,
paged Desktop history manager, and CLI doctor/reindex surface on top of the
hardened session-catalog foundation. Keep corruption-only projectiondb
quarantine and session-catalog lifecycle fixes from #8186 while adopting
history session pagination (schema v3).
Problem
Desktop session discovery still risked quarantining healthy catalogs on
busy/permission errors, rebuilding by renaming the live DB first, dropping
repair work beyond a fixed queue, and serving stale ProjectTree search results.
Off-lock controller builds could also re-publish removed MCP tools onto a shared
host, and shell-only project trees never expanded enough for lazy topic pages.
Root cause
Open treated every open failure as corruption; Rebuild swapped before validation;
repair enqueue was lossy; ProjectTree dropped concurrent queries while loading;
shared Host mutation raced plugin config changes; and active-folder expansion
required already-loaded topic children.
Fix
- Introduce internal/projectiondb for open/migrate/rebuild/quarantine with
corruption-only quarantine, future-schema memory fallback, atomic rebuild,
and 0700/0600 permissions.
- Route sessioncatalog through projectiondb; empty CacheDir uses memory; resume
scan_cursor; drain unknown repairs from the durable index; bound per-topic
session pages.
- ProjectTree uses request sequence + debounce and expands shell folders by
workspace identity so lazy pages and bench mock load.
- Capture extensionGeneration around off-lock boot.Build and abandon publication
when plugin/MCP config changes mid-build.
- Fix lint modernize issues and Windows migration-marker test flake.
Verification
- go test ./internal/sessioncatalog ./internal/projectiondb ./internal/pluginpkg
- go test -race ./internal/sessioncatalog ./internal/projectiondb
- cd desktop && go test -run 'Catalog|TopicMigration|ProjectTree.*Migrat'
- pnpm --dir desktop/frontend run typecheck
* feat(agent): content-driven context maintenance with single compact_ratio
Replace multi-threshold prune/snip/native auto maintenance with one
content-driven checkpoint path (stable prefix + one summary + recent
tail) gated solely by compact_ratio (default 0.85). First-visible tool
results are bounded at creation; prune/snip APIs remain no-ops for
call-site compatibility while legacy config/sidecar fields load and
migrate away.
Also align max_output_tokens auto ladder (0=auto; 128K explicit only),
desktop/settings/docs, and force CompactNow planning so mid-size
strict-alternating sessions (e.g. guardian) still reduce tokens.
Verification: go test ./...; desktop go test ./...; frontend test:all;
cache-guard; race on core packages; live seed→resume→continue smoke
(version=1, one summary, ~$0.0012).
* fix(agent): make context projection durable on Windows and clear CI gates
Problem:
- SaveCompactionState fsynced the parent directory after rename. Windows
returns ERROR_ACCESS_DENIED for directory Sync, so every projection
install failed and Windows smoke tests went red.
- gofmt, repolint, frontend AgentView fixtures, and required cache/docs
PR-body lines also blocked CI for #8244.
Root cause:
- Custom atomic write path reimplemented durability with a directory Sync
that is not portable, instead of using the shared Windows-safe helper.
- Residual format/debt and a missing coldResumePrune fixture field.
Fix:
- Persist sidecars through fileutil.AtomicWriteFile (temp + file fsync +
replace) without directory Sync.
- gofmt touched Go files; shorten essay comments; extract fold helpers;
carry residual structural debt in the repolint baseline after reducing
new essay debt; restore coldResumePrune on settings fixtures.
Verification:
- gofmt clean; go run ./tools/repolint clean
- go test ./internal/agent/ ./internal/config/ ./internal/provider/...
./internal/guardian/ ./internal/cli/
- pnpm settings-refresh-snapshot: 91 passed
* chore: nudge PR head refresh after Windows durability fix
Empty commit so GitHub re-resolves the fork head for #8244 after the
merge of main-v2 and the Windows sidecar write fix.
* fix(agent): close#8244 review blockers for content-driven maintenance
Problem:
Review of PR #8244 requested changes for CI failures, threshold under-count,
legacy native lineage drop, non-atomic CAS/write, residual cold-resume UI, and
duplicate context_maintenance notices.
Root cause:
- Threshold used message-only estimates without tools/role projection.
- Sidecar lineage required exact PromptCacheKey and marked restored before
covered-hash validation.
- Checkpoint install checked transcript outside the install lock and used
non-strict atomic write with EXDEV copy fallback.
- coldResumePrune UI/API remained after behavior removal; locale gzip grew.
- Maintenance notices ignored operationId on reconnect/replay.
- golangci reported unused prune/summary helpers and minor modernize issues.
Fix:
- Estimate compact trigger from final request shape (messages + tools +
provider role projection).
- Normalize legacy |context-editing-native-* keys; restore only if projection
still validates; persist normalized key without version bump/events.
- CAS install under compactionMu; SaveCompactionState uses AtomicWriteFileStrict.
- Remove coldResumePrune settings UI/Wails field/locales; keep config migration.
- Dedupe context_maintenance notices by operationId (bounded FIFO) + tests.
- Delete unused prune/summary helpers; clear golangci; trim locale strings for
bundle budget; strip SPEC trailing space.
Verification:
- make lint (golangci + repolint) clean
- go test agent/config/control/guardian/provider
- pnpm frontend build (locale budgets pass)
- context-maintenance-notice + settings-refresh-snapshot tests
* fix(desktop): gofmt reasoning_display fixture after cold-prune removal
Desktop CI failed gofmt on reasoning_display_app.go after ColdResumePrune
was dropped from the AgentView fixture literal.
* fix(agent): unblock context-maintenance merge blockers
Problem: PR #8244 still had three merge blockers: emit under
compactionMu (deadlock risk), restore rewriting exact-key
sidecars, and initial raw bundle over budget.
Root cause: commitSummaryProjection held the lock through
synchronous sink.Emit; LoadProjectionSidecar persisted whenever
the key already matched; ContextPanel/TranscriptSelectionMenu
were eagerly imported into the initial chunk.
Fix:
- Unlock before emitContextMaintenance; reentrant sink test
- needsNormalization only for legacy native lineage rewrite;
log persist errors instead of ignoring them
- Lazy-load ContextPanel and TranscriptSelectionMenu
- Document pre-interceptor threshold estimate + overflow recovery
- CLI/GOAL docs: compact_ratio default 85%
Verification:
- go test ./internal/agent/ (+ race focused tests)
- make lint (repolint baseline essay bump)
- pnpm build: initial raw 2236.8 / 2240 KiB
- context-maintenance-notice test ok
* fix(agent): close remaining context-maintenance plan gaps
Problem: After the merge blockers landed, plan gaps remained: no
parent-dir fsync on strict checkpoint writes, new writers still
mirrored last_*/blocked_* fields, dead CompactionCapabler shell,
and the pre-interceptor threshold contract lacked a regression test.
Root cause: AtomicWriteFileStrict only fsynced the temp file;
LastReceipt was authoritative but writers still dual-wrote mirrors;
provider.CompactionCapabler had no production callers; Prepare never
invoked interceptors by design without an explicit test.
Fix:
- Strict atomic write: fsync parent directory after rename (Windows/
unsupported FS soft-fail)
- SaveCompactionState / commit / blocked paths: LastReceipt only;
strip last_trigger/last_mode/token mirrors and top-level blocked_*
- Restore receipt-only blocked sidecars on load
- ContextReport/CLI/status prefer LastReceipt with legacy fallback
- Delete unused CompactionCapabler/NativeCompaction shell
- TestPrepareThresholdSkipsExtensionInterceptors
Verification:
- go test ./internal/agent ./internal/fileutil ./internal/provider
- go test -race focused packages
- make lint (repolint clean)
* docs: drop removed context_editing example from zh GUIDE
Problem: GUIDE.zh-CN still suggested context_editing = "native"
after native Anthropic context editing was removed and startup
migration deletes that key.
Root cause: bilingual GUIDE config sample was not fully synced
with the single compact_ratio local-summary contract.
Fix: remove the obsolete config line from docs/GUIDE.zh-CN.md.
English GUIDE already had no such example.
Verification: grep docs for remaining context_editing user examples
(only SPEC migration notes remain, which correctly describe removal).
* fix(fileutil): never fail strict write after successful rename
Problem: AtomicWriteFileStrict returned parent-dir fsync errors after
rename had already published the new file. commitSummaryProjection
and blocked-receipt writers treated that as "not committed" and
rolled memory back, forking disk (new generation) from process
memory (old generation) and allowing paid re-summary loops.
Root cause: post-publish power-loss durability was modeled as a
hard failure even though the atomic publish already completed.
Fix:
- After successful rename, parent-dir fsync is best-effort only
- Returned error still means "destination not published"
- syncParentDir also covers relative parents (".")
- Agent tests: applied and blocked receipts survive injected
post-publish dir-sync faults without generation fork / re-summary
- PR body: document AtomicWriteFileStrict + best-effort dir fsync
Verification:
- go test ./internal/agent ./internal/fileutil
- make lint
Seventy tasks, and every one of them changes code: bugfix, refactor,
migrate, diagnose. The runaway a user reported was the other shape — read a
lot, change nothing, produce a written artifact — and the corpus could not
have caught it, nor can it measure the threshold that now guards it.
Three tasks in that shape, each requiring several files to be read before
anything can be written:
document-handover the incident itself: report what is done,
what is half done, and which recorded claim
is now false
document-dependency-direction state the layering, not just the module names
audit-config-drift find the one setting that differs across three
environments
Each grader was checked in both directions, the discipline the no-solution
corpus already demands of itself: it fails on the pristine workdir, passes a
correct document, and fails a hollow one that names the right words without
having read anything. document-handover additionally fails if the code it was
asked to describe was edited — a handover that changes the state it reports
is not a handover.
No git in the graders: nothing else in the corpus assumes the workdir is a
repository, so containment is asserted against file contents instead.
The class is new and only groups report rows; nothing switches on it.
This is the measurement e2ebench could not take: how long a legitimate
look-only run gets before the work turns into writing. explorationRunLimit is
currently a judgement call informed by a synthetic trace, and this is what
would replace that with a distribution.
* feat(desktop): add logical transcript selection
Problem:
Cross-message transcript selection either lost native endpoints when virtual rows unmounted or retained every selected row in the DOM.
Root cause:
Selection state depended on live DOM ranges, and Markdown rows had no frozen readable-text projection for virtualized content.
Fix:
- promote cross-row pointer drags to UTF-16 logical selection snapshots
- render selection overlays only for mounted rows and keep virtualization bounded
- derive copy text from the Markdown HAST, including LaTeX, code, and tables
- guard copy and Add to Chat against stale tabs and asynchronous results
- add browser, store, projection, cache, and clipboard coverage
Verification:
- pnpm --dir desktop/frontend test:transcript
- pnpm --dir desktop/frontend test:transcript-browser
- pnpm --dir desktop/frontend test:typecheck
- pnpm --dir desktop/frontend test:motion
- pnpm --dir desktop/frontend build
- go run ./tools/repolint
Known baseline:
- test:bench still hits the retained-heap gate on both this branch and main-v2
* fix(desktop): preserve logical selection endpoints
Problem:
Logical transcript selection could slice Markdown at incompatible offsets, miss the final pointer position, or survive pointer cancellation.
Root cause:
The HAST projection inserted different block separators than the DOM adapter, pointerup stopped dragging before applying its coordinates, and pointercancel shared pointerup button filtering.
Fix:
Use one canonical structural newline within Markdown rows, keep source fallbacks in native mode, apply pointerup coordinates before settling, clear canceled gestures independently, and avoid full Transcript rerenders for logical focus frames.
Verification:
- pnpm test:transcript
- pnpm test:transcript-browser
- pnpm test:typecheck
- pnpm test:motion
- pnpm build
- go run ./tools/repolint
* Stabilize logical transcript selection
Problem:
- Cross-page logical selections could lose their overlay after virtual rows committed.
- Long transcripts recomputed layout styles for every cold row estimate.
- Settled selections retained projection pins outside the final selected interval.
Root cause:
- Focus reconciliation could run before the virtualizer committed replacement DOM, overlay observers restarted on every selection snapshot, and cache pins tracked no row positions.
Fix:
- Reconcile focus after virtual DOM mutations and add a bounded overlay stabilization paint.
- Cache one layout snapshot per measurement epoch and reuse it for row estimates.
- Trim frozen rows and release unselected projection pins when logical selection settles.
Verification:
- pnpm test:transcript
- pnpm test:transcript-browser
- pnpm test:typecheck
- pnpm lint:hooks
- pnpm test:motion
- pnpm build
- go run ./tools/repolint
* Fix logical transcript selection races
Problem:
Linux browser runs could lose the logical selection overlay. Streaming tokens also rebuilt every historical text projection, expanded offscreen reasoning was omitted, and edge scrolling kept requesting frames at a loaded-history boundary.
Root cause:
Logical focus reconciliation depended on DOM mutation timing, live content was mixed into the full row projection pass, reasoning membership depended on mounted DOM, and the edge loop rescheduled without confirming movement.
Fix:
Reconcile focus after virtual range commits, split stable and live selection projections, use the structural row model for reasoning membership, stop edge scrolling when no offset is written, and cover each path with deterministic tests.
Verification:
- pnpm test:transcript
- CI=true pnpm test:transcript-browser
- pnpm test:typecheck
- pnpm lint:hooks
- pnpm test:motion
- pnpm build
- go run ./tools/repolint
- pnpm test:bench (all relevant gates pass; existing retained-heap baseline remains above its repository gate)
* Reconcile selection on virtualizer commits
Problem:
Linux desktop CI could finish edge scrolling at the loaded-history boundary with zero logical-selection overlay rectangles.
Root cause:
TanStack direct DOM updates can advance the final virtual window without a React virtualRevision commit, and the boundary path stopped before one last caret remap.
Fix:
Reconcile logical focus from the virtualizer onChange callback and schedule exactly one final focus pass when edge scrolling reaches the loaded-history boundary.
Verification:
- pnpm test:transcript
- CI=true pnpm test:transcript-browser
- pnpm test:typecheck
- pnpm lint:hooks
- pnpm build
- go run ./tools/repolint
* Cover both virtual selection commit paths
Problem:
Linux desktop CI could still finish a logical edge-selection with no visible overlay after a virtual page transition.
Root cause:
TanStack direct-DOM range changes can skip a React commit, while its onChange callback can also run before replacement row DOM commits. Either notification alone leaves one ordering uncovered.
Fix:
Reconcile the logical caret from both the virtualizer callback and the post-commit virtual revision. The existing RAF guard coalesces duplicate notifications, and the loaded-history boundary still schedules only one final focus pass.
Verification:
- pnpm test:transcript
- CI=true pnpm test:transcript-browser
- pnpm test:typecheck
- pnpm lint:hooks
- pnpm build
- go run ./tools/repolint
* Reject stale virtual caret targets
Problem:
Linux Chromium repeatedly completed an upward logical drag with mounted rows but no overlay rectangles.
Root cause:
After transformed virtual rows changed, caretPositionFromPoint could return a still-mounted row that no longer matched the pointer's geometric hit target. Accepting that stale row left the logical focus below the visible window.
Fix:
Resolve the geometric selectable root first and accept caret API offsets only when they belong to that root. Otherwise use the visible root fallback. Remove the redundant post-commit callback and cover the stale-caret case with a deterministic DOM test.
Verification:
- pnpm test:transcript
- CI=true pnpm test:transcript-browser
- pnpm test:typecheck
- pnpm lint:hooks
- pnpm build
- go run ./tools/repolint
* Improve transcript selection CI diagnostics
Problem:
The Linux browser gate reports zero logical-selection overlay rectangles even though the same gesture passes locally, leaving no structural evidence to distinguish caret mapping from Range layout failures.
Root cause:
The benchmark only reported row count and scroll-owner data at the assertion boundary.
Fix:
Record structural, content-free browser diagnostics for the edge hit, caret row, mounted and visible selectable rows, scroll geometry, and rows with positive DOM Range rectangles.
Safety:
No message text, selected text, clipboard data, or row identifiers are logged; production code and behavior are unchanged.
Tests:
- node --check desktop/frontend/bench/transcript-selection.mjs
- CI=true pnpm test:transcript-browser
* Reconcile logical focus after virtual commits
Problem:
On Linux, edge scrolling could mount a new virtual page while logical selection focus remained on the prior page, leaving no selected mounted row for the overlay to paint.
Root cause:
The focus RAF ran in the same frame as TanStack virtualizer updates. Coalescing then discarded the commit-triggered request, so narrow mounted windows could keep the caret one virtual page behind.
Fix:
Use a bounded two-frame reconciliation: the first frame lets the virtualizer commit its direct DOM update and the second resolves the caret against that committed page. Pointerup and cleanup still cancel the tracked frame and apply the exact final focus synchronously.
Safety:
The scheduler retains at most one tracked focus frame, does not add scroll writes, does not log transcript content, and keeps the existing bundle budget.
Tests:
- pnpm test:transcript
- CI=true pnpm test:transcript-browser
- pnpm test:typecheck
- pnpm lint:hooks
- pnpm build
- go run ./tools/repolint
* Make transcript drag depth deterministic
Problem:
The Linux browser test reached a valid logical overlay but copied only 14 turns because a fixed six-second edge-scroll duration covered fewer rows under Ubuntu font and layout metrics.
Root cause:
The gesture depth was time-based even though the assertion was content-depth based.
Fix:
Wait until the active drag reaches the first 30 percent of the loaded transcript scroll range before evaluating and copying. The existing 20+ turn assertion remains unchanged.
Safety:
This changes only the production-build browser benchmark, does not reduce coverage, and does not log transcript or selected text.
Tests:
- node --check desktop/frontend/bench/transcript-selection.mjs
- CI=true pnpm test:transcript-browser
* Settle transcript drag on visible text
Problem:
After reaching the required history depth, the Linux benchmark could stop inside a viewport-filling tool row. The settled selection correctly released its offscreen overscan row, so a visible-overlay assertion had no visible selectable target.
Root cause:
The gesture completion predicate checked scroll depth but not whether selectable transcript text intersected the viewport.
Fix:
Keep edge scrolling until both the 30-percent history depth and a visible selectable body are present before pointerup.
Safety:
The test still requires bounded DOM, a painted dragging and settled overlay, 20+ copied turns, and restoration after scrolling away and back. Product code and privacy behavior are unchanged.
Tests:
- node --check desktop/frontend/bench/transcript-selection.mjs
- CI=true pnpm test:transcript-browser
* Stabilize deep transcript drag sampling
Problem: the browser gate sampled logical selection while edge auto-scroll was still advancing, so machine-dependent row heights could leave the caret on a transient or tool-only row and occasionally cover only 19 turns.
Root cause: a scroll-depth ratio was used as a proxy for the intended selectable endpoint, and the assertion raced the selection focus and overlay animation frames.
Fix: stop edge scrolling at a neutral viewport point, locate a visible deterministic early-turn body using user wheel input, move the live pointer onto it, and wait for the logical overlay before sampling diagnostics.
Safety: production code and selection semantics are unchanged; the gate still requires 20+ turns, bounded virtual DOM, selection-only scroll ownership, overlay restoration, copy parity, and the 2MiB cleanup budget.
Tests: CI=true pnpm test:transcript-browser; pnpm test:transcript; node --check bench/transcript-selection.mjs; git diff --check
The web frontend read parentId only to filter todo_write, so a sub-agent's
tool calls were appended to the timeline as top-level cards —
indistinguishable from the session's own work. A user who asked for an
install and saw "blocked: read-only subagents can run only ..." on a
phone reasonably concluded the new session itself was a subagent.
Sub-calls now render inside their parent card, matching what the desktop
Transcript already does: the parent opens while it runs and collapses when
it settles, unless the user has taken over the toggle. Card folding moves
from an inline style to the data-open attribute so the body and the nested
region fold together.
Three fixes are specific to the phone layout that produced the report:
narrow screens hide the status badge, so a refusal kept the badge — a red
icon alone reads as "failed" rather than "never ran"; the preflight phase
is shown as a localized "not executed"; and the tool name no longer
competes with the argument summary for width, which was truncating bash to
"b…" on the very cards a user needs to identify.
A read-only subagent that rejected its own bash command returned the
refusal as ordinary output with a nil error. The agent had no way to see
it: the call was recorded as a success, frontends drew a green check on a
command that never ran, and the storm breaker — which counts blocked
outcomes to detect a model bouncing off the same host refusal — was blind
to it.
The host already has one shape for a refusal, toolOutcome{blocked, errMsg},
produced by the permission, plan-mode, and hook gates. What was missing was
a way for a tool enforcing its own policy to reach it. tool.Blocked carries
that signal out of Execute; executeOne turns it into the standard blocked
outcome, with the not-run shell metadata a blocked bash card already
renders elsewhere.
Both subagent bash wrappers now report through it, so the read-only command
policy and the background-execution rule refuse the same way. The review
and desktop-try registries share the wrapper, so their contract assertions
move with it.
Extracting blockedToolOutcome/shellPreflightExecution and the evidence
receipts keeps execute_one.go inside its ratchet budget.
The reviewer already weighs ExpandedScope, but the rule behind it compares
the failed call's paths against the retry's: it asks whether a retry drifted,
which says nothing about the plan the user agreed to. A model that abandons
the approved surface entirely and edits somewhere else answers "no drift".
The plan names its touchpoints and the contract already carries them, so the
question can be asked directly: does this pending write touch a path the
approved plan never named. That is the fourth of the automatic replan
conditions, and the only one whose evidence is already flowing.
Two deliberate limits, both about not over-claiming:
- A plan that named no touchpoints says nothing about scope, so nothing
escapes it. Silence is not a claim that everything is out of bounds.
- Directory containment counts. A plan naming internal/pay/retry.go puts
internal/pay in play, which is how the test file beside it stays in
scope without the planner having to enumerate it.
Candidate paths count as scope even though they were inferred rather than
read: scope is where work is expected, not a claim of fact — the same
distinction the plan already draws everywhere a claim is made.
The old rule is unchanged and still runs; this widens what the field means
rather than replacing how it was computed.
recoveryPlanTransition handed the isolated reviewer two rendered task lists
and left it to work out the difference. samplePreview clips both before the
reviewer sees them, so on a long plan the change can fall past the cut — the
reviewer is asked to judge a rewrite it cannot fully see.
It now also receives an identity-paired diff. The task list is the plan's
projection, so rebuilding its shape as a Plan lets #8235's Compare serve both
layers instead of growing a second implementation: an inserted step reads as
Added with its neighbours Preserved, and a retitle under a kept id reads as
Changed rather than as a replacement.
It stands down when either side predates step ids. Pairing a list without
them would read every step as replaced, which is worse than the plain
renderings the reviewer already has.
Scope narrowed once the types were read: recovery.Proposal is an alias for
agent.RecoveryProposal, so the reviewer already receives the field and
PendingProposal never needed it. That copy is gone, and with it the ratchet
pressure it created.
execute_one.go shrinks: the recovery proposal assembly moved out beside the
diff, which is the field most likely to grow next. repolint 1958 -> 1957.
The last place in the pipeline where a structured thing was compared as
text. recoveryPlanTransition detects a structural rewrite of an active plan
and hands an independent reviewer two rendered strings:
return true, planReviewText(before), planReviewText(after)
A text diff cannot distinguish "s2's touchpoints widened" from "s2 was
replaced by different work", and it calls every step below an insertion
changed. Compare pairs by step id — which is why identity is host-assigned
and never regenerated — so an inserted step is Added and its neighbours stay
Preserved.
NeedsApproval turns the diff into the decision it exists for: a revision
that expands what the user agreed to asks again, and one that narrows,
reorders, retitles, or adds evidence does not. Re-asking for a narrowing
trains the user to approve without reading, which costs more than the gate
saves.
It ships with a consumer rather than waiting for one: a planner that
resubmits now gets the diff back as its tool result. Left to describe its own
edit a model reports intent instead of effect, and a step it dropped by
accident reads exactly like one it meant to keep.
A revision that changed nothing renders nothing — Preserved is the
reassurance beside a change, not a standalone report. The test that caught
that is in the file.
No schema change: only the tool's runtime result text moves, and the boot
golden baseline passes unchanged.
The no-progress ladder escalates on consecutive zero-gain rounds, and
gainNewRead scores every first-seen path. A turn that keeps opening files it
has never opened therefore scored positive on every round, reset the streak
every round, and could never reach the first rung — which is how the reported
turn read for four hours across 524 requests without writing the document it
was asked for.
Reading something new is progress while it might still lead somewhere. Past
six consecutive rounds that read and did nothing else, the novelty stops
counting; any mutation or command in a round starts the run over, so an
ordinary read-read-edit-verify rhythm is untouched.
The measurement is in the tests, not the reasoning. Before, all eight
wandering rounds scored 1, identical to real work's opening reads. Now rounds
seven and eight score 0 while real work is unchanged, because its longest
look-only run is two.
TestReadOnlyWanderingNeverTripsTheProgressGuard, landed in #8225 to record
the gap, inverts to TestReadOnlyWanderingTripsTheProgressGuard. The outcome
comparison now pins both sides of the threshold: never decaying is the
runaway, decaying at once would nudge ordinary investigation on arrival.
This is the judgement half. #8228 is the ceiling half; neither replaces the
other, and the whole repository's 116 packages pass unchanged.
A user report: four hours, 524 requests, 194M tokens, and the handover
document never written. The turn was reading one more file every round.
#8185 bounded Goal Runs at 16 rounds and said so precisely — "these hard
boundaries apply only to active Goal execution; ordinary chat keeps the
existing advisory behavior". Ordinary chat had nothing: [agent].max_steps
was retired in #6497 and is normalized to zero, and the run loop reads
`runMaxSteps <= 0` as no ceiling at all.
The adaptive guards were the stated replacement, and they cannot cover this.
They escalate on consecutive zero-gain rounds, while gainNewRead scores every
first-seen path, so a loop that keeps touching something new resets the
streak before it can climb. internal/agent/runaway_repro_test.go reproduces
that in 0.01s with no context maintenance at all.
This reuses #8185's mechanism rather than adding a parallel one: same
WithDefaultRunStepLimit, so an explicit max_steps still wins, child agents
still inherit, and crossing the line still yields one tool-free summary and a
resumable pause instead of a truncated turn. 100 rounds is a runaway
backstop, not a budget — real work stays far under it, and being wrong costs
one "continue" while leaving it unset costs hours.
The Goal recorder setup moved with it into bindTurnScope, so the decision
"what bounds this turn" lives in one place and runOrchestratedTurn shrinks
rather than grows.
The desktop job failed on #8228 — a Go-only change to internal/control —
with "timed out waiting for the pre-prepend anchor row to remount". Same
shape as the Go flake in the previous commit, one layer over: a fixed budget
standing in for "wait until settled".
const waitFor = async (..., attempts = 8) => { ... await flush() }
const flush = async () => { await act(() => sleep(30)) }
Eight attempts reads like a retry count; it is a 240ms deadline. Remounting
fifteen rows after a prepend does not reliably finish inside that on a loaded
runner, and the desktop job passed on the three PRs before it.
waitFor returns the moment the condition holds, so a larger cap costs nothing
on the happy path and only makes a genuine failure slower — which beats
failing a correct test.
Not verified locally: the frontend workspace has no node_modules here and
installing it needs network. The change cannot turn a passing test red — a
wider retry cap only converts a timeout into a pass or the same failure
later — so CI is the appropriate verifier.
TestThirtySteersApplyAndAckExactlyOnce failed on two unrelated PRs — #8203,
which changed one JSON data file, and #8222 — and passed on rerun both times.
The Windows job log names it exactly:
--- FAIL: TestThirtySteersApplyAndAckExactlyOnce (18.64s)
inbox_test.go:210: timed out waiting for TurnDone
Not a race: twelve local -race runs pass. The thirty durable enqueue/steer
round trips are real filesystem work, and on a loaded Windows runner they
consume roughly 13 of the wall clock before the turn is released, leaving the
helper's fixed five-second budget to expire on arrival.
The test asserts exactly-once acknowledgement, not latency, so the five
seconds was an accidental constraint. waitForDoneWithin already exists for
this; the assertions are unchanged.
A test that fails on unrelated PRs and passes on rerun costs more than the CI
minutes: it teaches everyone to re-run red instead of reading it.
A user report: four hours, 524 requests, 194M tokens, ¥27, and the handover
document never written. The model kept restating one intent and reading one
more file. #8185 bounded Goal Runs at 16 rounds, but says so explicitly —
"these hard boundaries apply only to active Goal execution; ordinary chat
keeps the existing advisory behavior" — and this happened in ordinary chat.
These tests reproduce it in 0.01s with no provider and, deliberately, no
context maintenance at all: they assert zero ContextMaintenanceEvent, so the
shape is isolated from the tool-result trimming under separate investigation.
It runs away on its own.
read a new path each round 40 rounds, guard silent, turn never self-limits
read one fixed path the same loop, caught within a few rounds
Novelty is the only variable. gainNewRead is scored per first-seen path, and
any positive round resets the streak, so a turn that keeps touching something
new can never reach the nudge threshold — and with [agent].max_steps retired
in #6497 there is no ceiling behind it.
The outcome test measures what a promotion decision needs: the legacy scorer
reports positive gain on all eight wandering rounds, identical to real work's
opening reads, while the outcome decomposition separates them — the runaway
is exploration with zero discriminating observations, and real work reaches
one within two rounds. It also records that a repeated verification scores
zero legacy gain, so re-running the tests after a second edit reads as no
progress.
Tests only; no behaviour changes. They fail the day either gap is closed,
which is the point.
The panel splits one turn into prompt/completion/reasoning/cache segments, so
its total has to be that turn's usage. Reading the live-view gauge instead left
the segments no longer summing to the total. The status-bar gauge keeps the
live measurement; this panel keeps the turn.
The contract has known what the work agreed to since #8183 and been able to
answer mid-turn since #8193, and criteria became provable in #8201. Nothing
consulted it. A turn could satisfy every delivery ceremony — todos closed,
complete_step called, verification run — while a criterion the user approved
sat unproven, because those ceremonies check that steps happened, not that
the agreed outcome holds.
finalReadinessCheckFor now folds the contract's outstanding criteria into
the same `missing` list it already builds. One gate, one FinalReadinessError,
one host recovery path: the Goal FSM's auto-continue and the recovery card
work unchanged, which they would not if this were a second parallel refusal.
The existing missingAcceptanceCriteria field asked whether criteria were
*established*; this asks whether they are *proven*, and names which one. A
proof that went stale under a later mutation reads as outstanding again, so
"verified before I changed it" stops counting as verified.
Only a planned turn contributes. Without a plan the contract's requirements
are the todo list, which the checks above already cover, so an unplanned turn
inherits nothing.
Placed before the loop-guard escape deliberately: a criterion the model
cannot prove must still be able to stop asking, or an unprovable acceptance
line ("P95 under 100ms") would loop forever. The guard that already exists
for that keeps working.
Outstanding() now annotates a stale requirement the way it already did a
stale check — "verify it" and "re-verify it, the code moved" are different
instructions and only one is actionable.
Debt moved, not added: readiness left agent.go for final_readiness.go, so
agent.go drops 233 lines (complexity 61->37, function-size 125->103) while
the new file records exactly what moved. Every baseline total falls or holds
— complexity 2099->2096, file-size 110345->110104, function-size 9165->9159,
essay 4085->4082, test-file-size flat.
Problem: golangci-lint flagged duplicated manual lower-bound checks in full and incremental History indexing.
Fix: use the Go max builtin to clamp pre-epoch activity timestamps consistently.
Verification: historycatalog/history tests pass and golangci-lint reports zero issues.
Problem: after Session Catalog adopted projectiondb, the old filesystem probes and migration entrypoint remained unused, while CI also flagged two modern Go style issues.
Root cause: the common projection extraction preserved obsolete package-local helpers to minimize the first refactor diff.
Fix: remove the dead remote-filesystem and migration helpers, use integer range in the benchmark, and iterate managed plugin path segments with strings.SplitSeq.
Verification: sessioncatalog, pluginpkg, and projectiondb tests pass; golangci-lint reports zero issues.
Problem: after Session Catalog adopted projectiondb, the old filesystem probes and migration entrypoint remained unused, while CI also flagged two modern Go style issues.
Root cause: the common projection extraction preserved obsolete package-local helpers to minimize the first refactor diff.
Fix: remove the dead remote-filesystem and migration helpers, use integer range in the benchmark, and iterate managed plugin path segments with strings.SplitSeq.
Verification: sessioncatalog, pluginpkg, and projectiondb tests pass; golangci-lint reports zero issues.
Problem: the shutdown barrier used an intentionally empty mutex critical section, which staticcheck rejects.
Fix: guard a reconcileDone flag with the same mutex used for scheduling so Close prevents late WaitGroup additions without an empty critical section.
Verification: taskcatalog tests pass and golangci-lint reports zero issues.
Problem: after Session Catalog adopted projectiondb, the old filesystem probes and migration entrypoint remained unused, while CI also flagged two modern Go style issues.
Root cause: the common projection extraction preserved obsolete package-local helpers to minimize the first refactor diff.
Fix: remove the dead remote-filesystem and migration helpers, use integer range in the benchmark, and iterate managed plugin path segments with strings.SplitSeq.
Verification: sessioncatalog, pluginpkg, and projectiondb tests pass; golangci-lint reports zero issues.
ContextSnapshot fed every frontend's gauge from the last turn's provider usage
(promptTokens + completionTokens). Compaction decides on something else: the
estimated size of the model-visible projection the next request will send. Two
channels, and they disagree in three ways at once. The gauge lags a turn, so a
turn that just took on a large tool result reads small while the trigger has
already fired. It counts completion tokens the trigger never looks at. And it
reads zero until the first turn of a rebound session, which desktop does on
every tab switch and every recovery adopt.
Measured on a recorded 13-message session: the old gauge reads 0 and the
trigger's input is 27076. Desktop papered over the zero by falling back to a
telemetry-persisted last-used value, so the bar showed a plausible but
unrelated number instead of an obviously broken one. That is the "上下文充足
8%" sitting next to "正在压缩对话" — the gauge was never reporting the quantity
being compared against compact_ratio.
ContextUsedTokens is now that quantity, memoised against the transcript
version, the projection version and the calibration, since gauges redraw far
more often than any of the three move. The desktop fallback goes with it: a
rebound session measures its own view immediately.
Problem: the latest main-v2 transcript-selection work intentionally enlarged existing frontend files after the Task branch had captured its repository lint baseline.
Fix: regenerate the carry-forward baseline on the merged Task branch without adding new domain violations.
Verification: repolint, focused Desktop tests, frontend production build, and task/control package tests pass.
Problem: the latest main-v2 transcript-selection work intentionally enlarged existing frontend files after the Usage branch had captured its repository lint baseline.
Fix: regenerate the carry-forward baseline on the merged Usage branch without adding new domain violations.
Verification: repolint, projection/statistics tests, and usage race tests pass.
Problem: the latest main-v2 transcript-selection work intentionally enlarged existing frontend files after the History branch had captured its repository lint baseline.
Fix: regenerate the carry-forward baseline on the merged History branch without adding new domain violations.
Verification: repolint is clean and git diff --check passes.
The contract took its requirements from the plan in #8183, but nothing could
ever satisfy them: the only Contract.Resolve call in the tree resolves
todo-derived ids, and Observe auto-satisfies only Atomic's requirement. A
planned turn's criteria were permanently Pending. Harmless while the
contract only observes, and a hard break the moment FinalRejection is wired
— every final answer would be refused forever.
complete_step evidence can now name the criterion it proves. The tool
already verifies each proof against the ledger, so the citation is what adds
the binding: "the command ran" and "the criterion holds" are different
claims, and only the model knows which proof was for which. The host records
it as an EvidenceRef at the current epoch, which makes freshness work — a
criterion proven by a test run goes Stale the moment code changes underneath
it, while mutation evidence does not, because a change having happened is
not something a later change undoes.
Identity had to stop being regenerated at the boundary, the same defect as
step ids: FromPlan re-keyed the plan's criteria to r1/g1/o1, so a proof
citing c2 could never match. PlanFacts carries PlanCriterion{ID, Text} and
FromPlan uses the id the plan assigned. Render now prints it — a criterion
the executor cannot name is one it cannot satisfy, and dropping the id from
the rendered plan was my own omission.
A citation the plan does not contain is rejected in the tool, with the ids it
may cite, rather than resolving into nothing and surfacing later as a refusal
the model cannot connect to this call.
Cache: tool schema grows 99 tokens (14303 -> 14402) for complete_step's
criterion_id; SystemHash unchanged, prefix byte-stable after the one-time
change. Golden regenerated.
execute_one.go stayed inside its ratchet by folding both context injections
into one call — the task list and the criterion ids travel together because
both answer "does this claim name something real".
Problem: the isolated Task Catalog branch lacked shell completion metadata and only flushed its shared projection during desktop shutdown, allowing late reconcile goroutines to outlive the shutdown boundary.
Root cause: the task implementation was originally layered on the integrated History branch, so domain-specific lifecycle and documentation details were lost when it was split into an independently reviewable branch.
Fix: register task reindex completions, document the task cache and recovery commands, gate reconcile scheduling during close, wait for scheduled workers, close the shared catalog within the 250ms desktop drain, and account for the measured 1 KiB frontend bundle increase.
Verification: focused Desktop tests, frontend production build and bundle budgets, repository lint, core package tests, and race tests for projectiondb, taskcatalog, taskmonitor, and control passed.
Problem: Task Monitor could only scan the active project synchronously and could not page or safely route controls across projects.
Root cause: Task snapshots and event logs had no disposable query projection, while control APIs implicitly depended on the active tab instead of a stable project identity.
Fix: Add an observed authoritative FileStore, resumable snapshot and lazy event indexing, SHA-256 project-key routing, runtime overlays, paged Wails APIs, a cross-project Task Center, diagnostics, and bilingual documentation.
Verification: Covered by lock-boundary notifications, corrupt snapshot/event isolation, event-tail pagination, lease reconciliation, stale cursor, project-key action routing, Wails arrays, and 100,000-task warm-page benchmark tests.
Problem: Each disposable catalog would otherwise duplicate SQLite migration, integrity, quarantine, permission, and in-memory fallback behavior.
Root cause: The original session catalog owned database lifecycle policy together with session-specific schema and reconciliation logic.
Fix: Extract the reusable lifecycle into internal/projectiondb, migrate the session catalog to it, and add schema-v3 keyset session pagination for follow-up consumers.
Verification: Covered by projectiondb lifecycle tests and session catalog migration, pagination, cursor, and compatibility tests.
Problem: Operators need a discoverable cache path, diagnostic command, exact-fallback guarantee, and safe rebuild path for usage rollups.
Fix: Link the bilingual Usage catalog guide from CLI and storage references and ratchet repolint to the Usage-only branch shape.
Verification: repolint baseline generation and git diff --check passed.
Problem: The catalogs dispatcher was absent from shell completion and did not expose the Usage reindex flags.
Root cause: Catalog execution and completion used separate static registries.
Fix: Build the catalogs reindex completion tree from the same domain registration and publish the Usage --json contract without increasing completion-function size.
Verification: go test ./internal/cli passed.
Problem: Each disposable catalog would otherwise duplicate SQLite migration, integrity, quarantine, permission, and in-memory fallback behavior.
Root cause: The original session catalog owned database lifecycle policy together with session-specific schema and reconciliation logic.
Fix: Extract the reusable lifecycle into internal/projectiondb, migrate the session catalog to it, and add schema-v3 keyset session pagination for follow-up consumers.
Verification: Covered by projectiondb lifecycle tests and session catalog migration, pagination, cursor, and compatibility tests.
Problem: Catalog-backed compatibility listing lost legacy filename-only recovery markers, and old Desktop fixtures invoked listing without installing the startup-owned catalog.
Root cause: SessionMeta projection trusted only the persisted recovered flag, while tests still assumed ListSessions could synchronously scan JSONL when the catalog pointer was nil.
Fix: Conservatively infer legacy recovery names from catalog metadata and migrate the affected fixtures to an explicit in-memory catalog without restoring any synchronous scan fallback.
Verification: The three ownership/recovery regressions, go test ./internal/cli, bundle budgets, and repolint passed.
The calibration is the ratio between wire characters and the tokens the
provider billed - a property of the model's tokenizer, not of the transcript.
SetSession dropped it anyway, and desktop rebinds sessions constantly: tab
switches, forks, rewinds, and the snapshot-conflict path that adopts a newer
disk transcript (a session held by two windows can do this hundreds of times
a day, #8190). Every rebind therefore put the next turn back on the cold
estimate, which is the least accurate reading available and the one most
likely to cross a maintenance threshold that the calibrated view was nowhere
near.
A model switch rebuilds the controller and with it the agent, so nothing
carries a ratio across tokenizers. Per-transcript observations - the latest
usage and the in-flight request shape - still reset, and the CJK safety floor
still covers a session whose script composition shifts after calibration.
The existing test asserted the drop; it now asserts what actually has to go.
main-v2 has since raised the raw bundle budget to 2_218 for transcript
scroll arbitration and measurement invalidation. This branch takes that file
verbatim: it opened to unbreak a gate, and reverting a newer owner's number
to the 2_205 recorded here would break the desktop build instead.
The baseline is regenerated against the merged tree rather than carried
forward, since it is generated data and a stale recording would misstate
budgets for files that have legitimately moved since. Against current
main-v2 it loosens nothing and tightens 33 entries (-1430).
Problem: The independent cross-boundary review status created recurring red PR statuses and forced every qualifying head through another manual approval cycle.\n\nRoot cause: Protected review workflows published a failing commit status until a non-author maintainer approved the exact head.\n\nFix: Remove the evaluator, workflows, tests, PR template guidance, and CI invocation while retaining a negative contract against stale references.\n\nVerification: Full pull-request CI passed on Linux, macOS, and Windows, including lint, race, CodeQL, desktop builds, and WebView2 smoke.
Problem: The History bridge adds one KiB of always-available typed contracts and exceeded the prerequisite branch's exact raw bundle ceiling by 0.9 KiB.
Fix: Increase only the raw initial JavaScript/CSS allowance from 2,209 to 2,210 KiB while preserving all gzip and largest-chunk gates.
Verification: The production bundle measured 2,209.9 KiB raw and all bundle checks passed.
Problem: Adding the catalogs dispatcher without a matching shell-completion root caused the dispatch coverage test to fail and hid reindex flags from users.
Root cause: Catalog subcommands were registered only for execution, while the completion registry remained a separate static list.
Fix: Carry completion flags in each catalog registration and build the catalogs reindex completion tree from the same registry without increasing lint debt.
Verification: go test ./internal/cli and repolint passed.
Problem: Users and operators need a discoverable cache location, diagnostic command, and safe rebuild path for indexed history.
Fix: Link the bilingual history catalog guide from CLI and storage references, document its cache path, and ratchet repolint to the History-only branch shape.
Verification: repolint baseline generation and git diff --check passed.
Problem: Agent history search and the Desktop history manager scaled with the total transcript set and could synchronously decode session files.
Root cause: Search, metadata listing, and context retrieval shared filesystem-scanning code instead of a disposable query projection.
Fix: Add token-only FTS5 indexing with resumable reconciliation, post-commit persistence hints, indexed Agent search, keyset Desktop pagination, runtime overlays, progress reporting, diagnostics, and bilingual storage documentation.
Verification: Covered by tokenizer/search compatibility, append/rewrite reconciliation, stale cursor, corrupt source, Wails array, and warm-query benchmark tests; provider-visible history tool schema bytes remain unchanged.
Problem: Each disposable catalog would otherwise duplicate SQLite migration, integrity, quarantine, permission, and in-memory fallback behavior.
Root cause: The original session catalog owned database lifecycle policy together with session-specific schema and reconciliation logic.
Fix: Extract the reusable lifecycle into internal/projectiondb, migrate the session catalog to it, and add schema-v3 keyset session pagination for follow-up consumers.
Verification: Covered by projectiondb lifecycle tests and session catalog migration, pagination, cursor, and compatibility tests.
Bring the session catalog prerequisite onto the current upstream base before publishing the History, Usage, and Task follow-up branches.
# Conflicts:
# desktop/frontend/scripts/check-bundle-budget.mjs
`run` exited 1 with an empty stderr and a half-written answer whenever the
turn failed under text output. -p/--print selects text and builds a result
sink, and the text branch of runOutputSink.Finalize prints the final response
and nothing else, so the error had no path out: the stderr fallback was gated
on there being no sink at all. Structured formats were fine — they encode the
failure in their own payload.
Compaction failures are where this hurts. A run that cannot free enough
context stops mid-task, and the user sees a truncated answer and no reason,
which is what makes "it just stops" reports unactionable.
Text output now always reports the reason, with the error prefix when the run
actually failed and without it for a reportable pause. Structured formats keep
carrying it themselves, and still fall back to stderr when no sink was built.
Tool-result maintenance had its own trigger at tool_result_snip_ratio (0.6),
below the fold. Every pass rewrites messages in the middle of the prompt, and
that invalidates the provider's cache from the rewrite point on. DeepSeek bills
a miss at 50x a hit, so a pass that drops 20% of a 100K prompt turns 95K cached
tokens into 75K uncached ones: the turn gets cheaper in tokens and about ten
times more expensive in money. #8109 made a pass idempotent per view, which
stops the same results being rewritten twice but not a new stale result
arriving every turn - and in a coding session one usually does. The steady
state was a cache reset per turn, which is what #8118 and #8132 report and the
opposite of what the cache-first design is for.
Maintenance now runs only at compact_ratio, where the prefix is being reset
anyway. It still runs first, because eliding stale results is cheap and often
enough on its own: tool_result_snip_ratio keeps its name and its default but
now says how far down that pass has to land to stand in for the summary. One
prefix switch per fold either way. soft_compact_ratio no longer gates anything,
it just emits its notice.
Below the trigger the transcript is now byte-identical to what the provider
cached, however large it grows.
Problem: A jump animation started in one transcript could finish after a tab reset and change the new transcript from tail-follow back to manual mode.
Root cause: resetGeneration cancelled frame-batched bottom writes but left the native smooth-scroll completion timer alive and unguarded by generation.
Fix: Cancel the timer, stop the in-flight native smooth scroll at its current offset, and reject any already-queued completion callback whose generation is stale.
Verification: test:transcript, test:transcript-browser, test:typecheck, build, and repolint pass, including a regression test that waits beyond the old completion timer.
Problem:
- main-v2 advanced to 4e36c130 after the CI normalization push.
- The new base independently adopted the same bundle and repolint budgets, leaving a comment-only merge conflict.
Resolution:
- Keep the latest base budget rationale and retain the Task Monitor timer fix.
- The resulting PR diff against main-v2 is limited to TaskMonitorPanel and its tests.
Verification:
- pnpm build
- pnpm typecheck
- pnpm test:task-monitor
- go run ./tools/repolint
- git diff --check
Problem: The draft pull request became conflicting after main-v2 merged Goal run-boundary changes while transcript stabilization work was in progress.
Root cause: Both branches updated the tightly ratcheted initial raw bundle allowance and its explanatory comment.
Fix: Merge origin/main-v2 without rewriting history and combine the Goal observability and transcript selection allowances at 2218 KiB, above the measured 2215.3 KiB while preserving all gzip budgets.
Verification: test:transcript, test:transcript-browser, test:typecheck, lint:hooks, build, the CI contract, and repolint pass after the merge. test:bench has one pre-existing retained-heap failure at 46.1 MiB, matching origin/main-v2 at 45.9 MiB with the 20 MiB gate unchanged.
Problem: Active transcript selections could be preempted by forced bottom scrolling or stale settle frames, copied selections retained virtual rows, async row growth left the height cache stale, and Linux CI installed Chromium into a path the browser gate did not use.
Root cause: Selection reset and copy paths did not own their delayed work, force scrolling changed mode before arbitration, height caching wrapped only the initial ref measurement, and the Playwright path was resolved from the pnpm child working directory.
Fix: Fence delayed selection work by generation, release copied selections safely, arbitrate forced writes before mode changes, cache official ResizeObserver measurements with deferred layout invalidation, stabilize the prepend anchor assertion, and align plus contract-test the Chromium install path.
Verification: test:transcript, test:transcript-browser, test:typecheck, lint:hooks, build, and the selection menu suite pass. test:bench retains 45.8 MiB versus 45.9 MiB on origin/main-v2; the unchanged 20 MiB baseline gate remains red. repolint reports only the pre-existing App.tsx baseline drift tracked separately.
The calibrated path carries the same unit bug the cold path had. When a
session's CJK share rises above what calibration saw, the excess runes fall
back to a hard 2 tokens each - a number chosen to match the old cold estimate
of runes + one per han rune. Against DeepSeek's real ~0.6 that is 3.3x, so an
English-calibrated session that starts discussing Chinese reads 120K tokens
for 60K runes worth ~36K, and lands back in exactly the early compaction this
branch removes from the cold path.
Price the excess as bytes at the same ~4 chars per token: 0.75 tokens per han
rune, still conservative, and identical to what the cold path now returns for
the same text (measured: 45002 either way).
The CJK floor test grew its input for the same reason its sibling did - at the
corrected unit, 430K runes leave most of a 1M window free, so nothing would
have been clipped and the assertion would have proven nothing.
estimateTextTokens returns max(runes, bytes/4), and runes > bytes/4 holds for
every string, so it always returns the rune count: one "token" per character.
That unit is fine for the internal planning budgets it was written for, but
estimatedPromptTokens carried it into the comparison against contextWindow
whenever no usage had calibrated the session yet - and then added a second
token per CJK rune on top. Chinese landed near 2 tokens per han rune against
a real 0.6, English at 1 per character against a real 0.25: a context 25%
full measured as full, and the turn force-compacted.
Calibration hid this for warm sessions and left it in place for cold ones -
resume, tab switch, fork, rewind, or a relay that reports no usage - so the
same session compacted at 25% or at 80% depending on when it was asked. Both
readings came from the same threshold.
Estimate the cold case from the wire character count at the documented ~4
chars per token instead, which leaves CJK at a conservative 0.75 per rune,
and route /context and the maintenance snapshot through the same estimator so
what the user reads is what the decision used.
The guarded-fold test grew its input to 200K han runes: at the corrected unit
its old 50K no longer exceeds the summarizer budget, so it would have proven
nothing about the bound it exists to check.
An output budget can exceed the whole configured context window: DeepSeek's
Anthropic-compatible endpoint defaults to 128K output, and the custom-provider
wizard wrote context_window = 128000 unconditionally until #8124, so that pair
is ordinary in existing configs. hardInputCeiling subtracted the budget whole,
the ceiling fell to its max(1, ...) floor, and soft, snip, fold and force all
landed on 1 token. Every turn then crossed every trigger and force-compacted,
with the "context is getting large" notice unreachable because soft and snip
were equal - the user saw only the compaction, never a warning, and the
configured compact_ratio never applied. Windows between 131K and 656K were
scaled down the same way, just less visibly: 200K compacted at 34%.
Reserve at most a quarter of the window for the reply. effectiveOutputBudget
already clips the real reply against the measured prompt at send time, so
reserving more than that here protects nothing it does not already cover.
Windows that genuinely fit their budget keep reserving it whole and are
unchanged.
main-v2 raised the raw bundle budget to 2_205 KiB independently while this
branch was in CI, with its own justification. Taking that version and
dropping the 2_206 written here: a concurrent owner's deliberate number
should not be overwritten by a repair that only needed the gate to pass.
The baseline is regenerated against the merged tree rather than
hand-resolved, since it is generated data. Against current main-v2 it now
loosens nothing at all and tightens 33 entries (-1459); the App.tsx entry
this branch was opened for no longer needs absorbing.
Problem:
The PR merge result failed the required lint job and both desktop build jobs
even though the focused Task Monitor checks passed.
Root cause:
The current main-v2 baseline measures App.tsx at 4,733 findings over the file
ceiling against a 4,725 ratchet, and initial raw frontend assets at 2,204.8 KiB
against a 2,203 KiB budget. The PR does not modify App.tsx or the eager asset
path responsible for those already-reviewed base increases.
Fix:
Merge the current main-v2 tip and minimally normalize only the owning guards:
set the App.tsx ratchet to 4,733 and the raw asset budget to 2,205 KiB.
Verification:
- go run ./tools/repolint
- pnpm build
- pnpm typecheck
- pnpm test:task-monitor (19 panel tests and 3 navigation tests)
- git diff --check
Problem:
- Cross-message selection in the virtualized desktop transcript could lose DOM endpoints or jump while wheel, stream, resize, and virtualizer writers competed for scroll ownership.
Root cause:
- Programmatic scroll writes were distributed across Transcript and useScrollManager, while the virtualizer could unmount rows referenced by the browser Selection.
Fix:
- Centralize scroll-write arbitration and generation reset.
- Retain the continuous native-selection row interval and namespace virtual row identity per tab.
- Add bounded layout-aware height caching plus jsdom and real Chromium coverage.
Verification:
- pnpm --dir desktop/frontend test:transcript
- pnpm --dir desktop/frontend test:transcript-browser
- pnpm --dir desktop/frontend test:typecheck
- pnpm --dir desktop/frontend test:motion
- pnpm --dir desktop/frontend build
main-v2's desktop job fails at "initial raw JavaScript and CSS is 2204.8
KiB; budget is 2203.0 KiB" — 1.8 KiB, 0.08% over. Same cause as the repolint
entry in the previous commit: #8103 passed its own CI (desktop=SUCCESS,
lint=SUCCESS) and only crossed the line once merged alongside other work.
The failing budget is the uncompressed total, the least user-visible of the
five. All four gzip budgets — what actually crosses the network — still pass
with margin: initial JS 383.6/400.0, largest chunk 215.7/280.0,
render-blocking CSS 3.1/4.0, deferred app-shell CSS 110.4/114.0.
Raised to 2_206 KiB: enough to clear the collision, tight enough that real
growth still trips it. Reverting is one line if the frontend owner would
rather shrink the bundle instead.
main-v2 fails `make lint`: desktop/frontend/src/App.tsx sits 8 lines over its
recorded budget. It arrived with #8103 and every branch cut from main-v2
inherits the failure, so the ratchet is currently blocking work it did not
catch in the first place.
Re-recording is a deliberate decision made in its own commit rather than
inside a feature PR, because widening a budget to land a change is exactly
what the ratchet exists to prevent. Here the net moves the other way:
loosened 1 entry App.tsx file-size 4725 -> 4733 (+8)
tightened 20 entries (-1147)
essay 4090 -> 4087
file-size 111363 -> 110541
function-size 9254 -> 9223
test-file-size 70202 -> 69919
The tightenings lock in cleanups that had not been re-recorded — among them
coordinator.go 267 -> 13, agent.go 2807 -> 2746 and coordinator_test.go
1239 -> 1025 — so the debt they removed can no longer be quietly spent again.
The App.tsx regression itself is not fixed here; it is a 5533-line component
and splitting it is frontend work with its own review. This commit only
stops it from failing every unrelated branch.
Problem:
- main-v2 advanced after the prior validation, merging session inbox, reasoning display, and live-contract work.
- run_loop had a semantic conflict, while the combined frontend and repolint baselines exceeded their ratchets.
Root cause:
- live contract initializes perTurnState.turnInput at the same run boundary where Goal execution resets structural guards.
- parallel main merges also left the unchanged App.tsx repolint baseline eight lines behind, and Goal request observability adds a small always-loaded frontend contract.
Fix:
- preserve turnInput while resetting Goal structural guards at run start.
- keep batch-guard cancellation inside the helper so executeBatch remains within its size budget.
- ratchet only the initial raw bundle allowance to 2205 KiB and synchronize the App.tsx baseline to latest main.
Verification:
- go test ./...
- go test -race ./internal/agent ./internal/control ./internal/evidence ./internal/taskcontract ./internal/sessioninbox
- go vet ./...
- go run ./tools/repolint
- cd desktop && go test ./...
- cd desktop/frontend && pnpm build
- git diff --cached --check
Problem:
- The timer fix added one line to the already-ratcheted shared frontend type file, so the merge-result repolint job failed its file-size budget.
Root cause:
- The optional lease timestamp was modeled globally even though only the Task Monitor timer consumes it.
Fix:
- Describe the existing optional payload field with a component-local intersection type and leave the shared type file unchanged.
Verification:
- pnpm test:task-monitor
- pnpm typecheck
- pnpm build
- git diff --check
Problem:
- The PR head lagged main-v2 and overlapped agent.go with the structured Plan contract wiring from #8183.
Root cause:
- main-v2 advanced after the Goal boundary implementation was published.
Fix:
- Merge the current main-v2 while preserving both the per-Run Goal boundary state and structured Plan contract installation.
Verification:
- go test ./...
- go test -race ./internal/agent ./internal/control ./internal/evidence ./internal/taskcontract
- go vet ./...
- go run ./tools/repolint
- cd desktop && go test ./...
- cd desktop/frontend && pnpm build
The contract was built once, at the end of the turn, from a full replay of
the receipts — and then discarded. Anything that needs to ask "is anything
still unproven" mid-turn has nothing to ask: GateMutation must answer before
a mutation runs, FinalRejection at the moment a completion is claimed, and
both currently have no contract in scope. That, not a missing call site, is
what blocks wiring them.
LiveContract answers now. It reruns the same pure replay against the
receipts recorded so far rather than keeping incremental state, so one code
path serves the per-round view and the end-of-turn record and the two cannot
disagree — a property the tests assert directly.
Each tool round records the contract alongside the outcome sample, so a
trajectory carries how the evidence graph filled in rather than only where
it landed. A turn with nothing to prove records nothing.
This still observes and decides nothing. Enforcement is the next change, and
it has an open design question that belongs in its own review: GateMutation
expects a mutation to name the unsatisfied requirement it serves, and no
tool carries such an argument today.
turnInput rides the existing single perTurnState zeroing assignment, so the
turn can never forget to reset it and run_loop.go stays inside its ratchet.
Problem:
- Reconciled stale tasks retained an old updated_at timestamp, so their frozen duration could be zero or otherwise misleading.
- Requeued tasks displayed the time since their original creation as if it were active runtime.
Root cause:
- The frontend treated updated_at as a universal end time for every non-live task state.
Fix:
- Use the expired runtime lease as the bounded end time for stale tasks when available.
- Render no elapsed runtime for queued tasks.
- Type the existing optional lease field and cover both states with regressions.
Verification:
- pnpm test:task-monitor
- pnpm typecheck
- pnpm build
- latest main-v2 overlay: Task Monitor 19/19 and navigation 3/3
- git diff --check
Co-authored-by: SivanCola <[email protected]>
The restore-safety follow-up adapts the conflict-preflight mechanism from PR #8178 by @nanami7777777 while preserving PR #8061's discardable-transcript behavior.
Co-authored-by: Contributor <[email protected]>
Problem: golangci-lint rejected the Goal zero-evidence fixture's traditional counted loop under the intrange rule.
Fix: use the Go 1.22 integer range form without changing the generated mock turns.
Verification: focused agent test; golangci-lint run --timeout=5m; go run ./tools/repolint; git diff --check.
Problem:
The initial session catalog implementation exceeded incremental repository size and complexity budgets in several existing owner files, and Desktop CI reported stale helpers plus two modernization findings.
Root cause:
Catalog lifecycle, runtime projection, frontend topic presentation, mock bindings, plugin compatibility, and CLI wiring were colocated with already-large modules. Removing the eager project tree also left legacy runtime-tree helpers unused.
Fix:
- split catalog lifecycle from runtime projection and metadata mapping
- extract frontend catalog contracts, mock bridge, topic presentation, and count formatting
- isolate plugin compatibility, session projection, and CLI completion wiring
- remove obsolete eager-tree helpers and address CI modernization findings
- preserve behavior without changing repolint baselines
Verification:
- go run ./tools/repolint
- golangci-lint v2.12.2: 0 issues
- go test affected root packages
- focused Desktop catalog and workspace regression tests
- pnpm test:all
- pnpm build
Problem: the Desktop CI gofmt check rejected blank-line removals used to stay within the legacy app.go size ratchet.
Fix: restore gofmt layout and compact nearby bridge comments instead, preserving the file-size baseline and behavior.
Verification: gofmt -l desktop/app.go; go run ./tools/repolint; git diff --check.
Problem:
Fresh installs still selected summary mode, so the new settings did not match the standard, live-follow, auto-collapse experience.
Root cause:
Backend and frontend fallback paths, browser mocks, and test fixtures retained the previous summary and compact defaults.
Fix:
Resolve missing or unknown reasoning modes to auto while preserving explicit selections and legacy localStorage migration. Align startup and browser defaults, and add config/Wails persistence coverage.
Verification:
- go test ./internal/config
- cd desktop && go test ./...
- cd desktop/frontend && pnpm test:typecheck
- cd desktop/frontend && pnpm test
- cd desktop/frontend && pnpm build
- go run ./tools/repolint
- git diff --check
Problem: the Goal boundary implementation grew several grandfathered files beyond the repository's repolint ratchet.
Root cause: run-boundary state, sidecar compatibility helpers, evidence novelty logic, and their tests were added directly to legacy owner files.
Fix: extract the new logic into focused same-package files, reduce the affected owner functions, and keep the existing repolint baseline unchanged.
Verification: go run ./tools/repolint; go test ./...; go test -race ./internal/agent ./internal/control; go vet ./...; desktop go test ./...; frontend pnpm build.
Problem: restoring a trashed session over a discardable transcript could silently delete a newly queued durable inbox or another active sidecar.\n\nRoot cause: restore validated only transcript content, then removed every owned artifact before checking the remaining restore conflicts.\n\nFix: preflight all owned session and subagent destinations, allow only the verified discardable transcript collision, and abort without mutation when any sidecar conflicts. Keep the restore transaction in a focused file so sessions.go stays within its repolint ratchet.\n\nVerification:\n- cd desktop && go test ./...\n- cd desktop && go test -race . -run 'TestRestoreTrashedSessionFile' -count=1\n- cd desktop && go vet ./...\n- cd desktop && go build ./...\n- go test ./...\n- go vet ./...\n- go run ./tools/repolint\n\nAdapted-from: https://github.com/esengine/DeepSeek-Reasonix/pull/8178 by @nanami7777777\nCo-authored-by: Contributor <[email protected]>
Problem: PR #8061 was behind the current main-v2 integration baseline.\n\nRoot cause: main-v2 advanced after the last session inbox review round.\n\nFix: merge the latest main-v2 before applying the restore-safety follow-up, preserving both histories without a force push.\n\nVerification: the merge completed automatically; focused and repository gates run with the follow-up fix.
Reason:
The official base advanced by six plan-contract commits after the session catalog implementation began.
Resolution:
Merge the current official main-v2 without rewriting the reviewed feature commit.
Verification:
- go test ./... passed at the repository root after the merge
- go test ./... passed in desktop after the merge
- the feature commit retains focused race, frontend, vet, and cross-build evidence
Problem:
Desktop startup and project-tree queries could synchronously migrate and decode legacy session JSONL, blocking navigation, creation, and shutdown.
Root cause:
Session discovery, metadata repair, controller admission, and plugin startup shared UI-critical paths and broad lifecycle locks.
Fix:
- add a disposable SQLite session catalog with incremental reconciliation, repair checkpoints, corruption recovery, and memory fallback
- expose revisioned cursor pagination and migrate the desktop project tree to lazy loading
- move controller construction outside lifecycle admission and isolate incompatible plugin startup
- add session doctor and reindex commands while preserving authoritative JSONL and metadata
- retain CGO-free builds with platform-specific fallbacks
Verification:
- go test ./...
- cd desktop && go test ./...
- go test -race ./internal/sessioncatalog ./internal/agent
- cd desktop && go test -race .
- go vet ./... in root and desktop
- cd desktop/frontend && pnpm test:all && pnpm build
- CGO_ENABLED=0 cross-builds for supported macOS, Windows, and Linux targets
Problem:
Goal mode could pause useful research after a text-derived 4/6/10 no-progress streak, while the outer 10/20/40 continuation budget did not bound actual model rounds inside one Run.
Root cause:
Cross-turn novelty was acting as both progress telemetry and a termination proxy. The agent exposed no typed host-owned Run boundary, so the controller could not distinguish default Goal budgets, explicit max_steps, or structural stuck conditions.
Fix:
Add a default 16-round Goal Run budget with one tool-free finalization response, typed resumable pause metadata, inherited child budgets, and Goal-only structural stuck detection. Keep cross-turn novelty observational, migrate legacy no_progress pauses, preserve unknown sidecar fields, and expose requestsUsed across CLI, ACP, and Desktop surfaces.
Verification:
- go test ./...
- go test -race ./internal/agent ./internal/control
- go vet ./...
- cd desktop && go test ./...
- cd desktop/frontend && pnpm build
- live DeepSeek, LongCat, and GLM normal/stuck/16-round-resume matrix
Co-authored-by: Will <[email protected]>
taskcontract.FromPlan and PlanFacts were written to build a contract from a
plan's own acceptance criteria — Planner to Contract to Executor — and have
had no caller since. The shadow contract instead inferred requirements from
todo titles, which restate the steps rather than what the work agreed to:
"thread the model ref through" is a step, "two model refs never share a
cache entry" is the thing that must be true when it is done.
An approved structured plan now becomes the contract. The coordinator
installs it on the executor just before the run and clears it at the top of
every turn, so a turn never inherits the last one's plan. Without a plan the
todo list stands in exactly as before.
PlanFacts gains Optional so a nice-to-have criterion is recorded without
holding completion open; Contract.Requirements already carried Required and
Complete() already skipped it.
This changes what the contract observes, not what it decides: GateMutation
and FinalRejection still have no callers. Wiring those is the behaviour
change and belongs in its own review.
Adding a field to Agent pushed agent.go past its ratchet, so the canonical
todo-state accessors moved to todo_state.go rather than widening the
baseline: 3567 -> 3501 lines, one responsibility out of the god file.
Problem:
The reasoning display PR could change invalid-config behavior across restarts, fail to auto-open remounted subagent reasoning, rely on stale settings tests, load settings-only CSS eagerly, and break its navigation at narrow widths.
Root cause:
Fallback explicitness and legacy alias persistence were conflated, disclosure state assumed it observed the phase transition, settings ownership moved without focused contracts, and responsive navigation changed flow without changing the parent grid.
Fix:
Keep unknown modes on a stable summary fallback, initialize auto disclosure from the current phase, extract focused reasoning/settings components and tests, lazy-load settings CSS, preserve repository ratchets, and switch narrow settings to a top navigation row.
Verification:
go test -race ./internal/config
cd desktop && go test ./...
cd desktop/frontend && pnpm test:typecheck
cd desktop/frontend && pnpm test
cd desktop/frontend && pnpm build
go run ./tools/repolint
git diff --check
Responsive browser checks at 720x800 and 480x800
Problem: PR #8103 was behind main-v2 and conflicted in bundle and repolint budgets.
Root cause: both branches evolved the same budget contracts independently.
Fix: merge the latest base without force-pushing and keep the main-v2 budget and baseline values so feature work must satisfy the existing ratchets.
Verification: conflict markers are gone and git diff --cached --check passed before commit.
ask was excluded from the planner registry and then reinvented as a
<planner-ask> text block the host parsed back, backed by 28 decision
phrases that scraped 方案x/A) lines out of prose for options. That is a
complete round trip through text for a tool that already existed.
The planner keeps ask, and the coordinator propagates the host's asker to
both models. The answer now arrives while planning, so it shapes the plan
the executor receives instead of being stapled onto a finished one — which
is also why PlannerUserDecisionAsker and its controller adapter go: a
parallel path to the same approval surface, built only to carry prose.
Retired with it: the phrase heuristics, their tests, and the guards those
tests needed against ordinary plan wording conjuring an ask dialog. That
whole class of false positive is gone because nothing infers a question
any more.
Net -490 lines. planner_text_fallback.go is down to 84 lines and now holds
only what an unstructured plan still needs: the approval phrases and the
[no_changes] marker.
Cache: none. ask was already in the executor's registry, so only the
planner's own prefix changes; the boot golden baseline passes unchanged.
Component correctness is not system effectiveness: submit_plan had
tool-level tests and the coordinator suite proved no regression, but
nothing proved the whole chain — planner calls submit_plan, the host
renders it, the executor is handed the plan rather than the prose the
planner happened to end on.
Five tests at that boundary: the rendered plan reaches the handoff and the
planner's trailing prose does not, the user sees the plan through the sink,
requires_approval gates a plan whose prose never mentions approval (the
case the phrase fallback cannot catch), a plan without it runs straight
through, and a planner that ignores submit_plan still reaches the executor
on the text path.
The machine protocol between planner and host was text: [no_changes] and
[planner_requires_approval] markers, a <planner-ask> block, and behind them
24 approval phrases with a 30-byte negation window plus 28 decision phrases
that scraped options out of prose. Those exist only because free text has
no fields to read.
submit_plan gives the planner a structured exit. Validation runs in the
tool, so a malformed plan comes back as an actionable error the planner
fixes in the same turn rather than a silent misparse downstream. plan() now
returns a plannerOutcome, and approval reads requires_approval from the
plan when one was submitted; prose keeps the phrase fallback because prose
has nothing else. [no_changes] stays: it marks the ABSENCE of a plan, which
by construction cannot be a field of one.
Every text heuristic moved to planner_text_fallback.go so the fallback
retires as one file once both plan producers submit structured plans, and
so coordinator.go reads as structured-first.
Cache: none. submit_plan is added only to PlannerToolRegistry, so the
executor's tool prefix is byte-identical and the boot golden baseline
passes unchanged; only the planner's own prefix shifts once.
coordinator.go 1114 -> 839 lines and Run's routing splits into deliverPlan,
both under their ratchet without widening the baseline.
The planner already knows what a plan contains — the prompt asks for
objective, touchpoints, risks, acceptance criteria and verification — but
emits all of it as prose, so the host guesses the structure back out.
taskcontract.PlanFacts and FromPlan have been waiting for that structure
since they were written and have never had a caller.
Plan makes the fields real. Two rules keep it honest: identity is
host-assigned (ID and Revision carry json:"-", so a planner cannot claim
one), and evidence is not blurred (VerifiedFiles are paths that were read,
CandidateFiles are paths that were inferred — a distinction free text
cannot enforce).
Ordered is the single ordering Render and ProjectTodos share, so the list
a user approves and the task list the host seeds cannot disagree. Render's
only markdown list items are the steps, which also closes a live defect on
the free-text path, where any bullet — an assumption, a non-goal — becomes
a todo. DependsOn orders siblings and is deliberately advisory: the todo
projection is serial, so a dependency becomes order, never gating.
A plan past MaxSteps is rejected rather than silently truncated, which the
existing markdown seeder does at 20 items.
complete_step resolved a citation by 1-based index, then by normalized
title text, then by >=6-rune substring containment. A replan invalidates
all three: inserting a step shifts every index below it, and retitling
"Fix authentication" to "Fix authentication refresh flow" moves the text.
Completion attribution then reattaches to the wrong step, or to none.
TodoItem gains StepID, and matchTodoStep tries it first, so every caller
already routing through that function — receipt recording, completion
verification, todo continuity — resolves by identity without new plumbing.
Two guards keep the id load-bearing rather than advisory: a duplicate id
is rejected, and a rewrite that keeps an item but drops the id it arrived
with is rejected with the id to restore. Lists that never carried ids keep
matching by text.
Ids are minted where a list is born: ProjectTodos carries the plan step's
own id, and the markdown seeding path mints plan_step_NN so the guarantee
holds before a structured plan exists.
Cache: tool schema grows 229 tokens (14074 -> 14303) for todo_write and
complete_step step_id; SystemHash is unchanged and the prefix is
byte-stable after the one-time change. Golden baseline regenerated.
Todo identity moved to its own file rather than growing evidence.go past
its ratchet: 2883 -> 2879 lines, no baseline widened.
Problem:
- The redesigned settings center remained dense in navigation and inconsistent at the minimum desktop width.
Root cause:
- Modal and sidebar sizing still used the older caps, every navigation item rendered metadata, and shared modal theme rules overrode the narrow fullscreen shell.
Fix:
- Refine modal, sidebar, section, navigation, and desktop-style ordering.
- Reset content scroll on page changes and preserve semantic active navigation state.
- Enforce a true fullscreen settings shell at the 760px desktop minimum.
- Add focused rendering and responsive contracts.
Verification:
- pnpm exec tsx src/__tests__/settings-refresh-snapshot.test.tsx (96 passed)
- pnpm test:settings-responsive (15 passed)
- pnpm test:typecheck
- pnpm check:css
- pnpm build
- In-app browser checks at wide and minimum desktop widths
Problem: A static recovery-preview import pushed the initial raw frontend bundle over its fixed 2200 KiB budget, and direct import.meta.env access failed under the Node test runner.
Root cause: Development-only fixtures were reachable from the production bridge entry and assumed Vite always supplied import.meta.env.
Fix: Gate the scenario with a safe DEV check, lazy-load its fixture module, and keep mutable preview pause state inside that deferred module.
Verification: pnpm test; pnpm exec tsc --noEmit; pnpm lint:hooks; pnpm exec vite build --logLevel warn; node scripts/check-bundle-budget.mjs; go run ./tools/repolint
Problem: main-v2 advanced after the recovered-inbox UI head was prepared.
Integration: Merge base b8a37d4ba while preserving the durable inbox work and adopting the latest CLI scroll-state fixes without conflict.
Verification: go test ./internal/cli; pnpm test; pnpm exec tsc --noEmit; go run ./tools/repolint
Problem: The new recovered-inbox banner could not be reviewed in the browser preview without temporary bridge changes.
Root cause: The browser mock always returned an empty, non-recovered inbox snapshot.
Fix: Add a deterministic ?mock=recovery scenario with 30 paused items, resumable pause state, and a focused pure snapshot contract test.
Verification: pnpm exec tsx src/__tests__/inbox-recovery-preview.test.ts; pnpm exec tsx src/__tests__/composer-inbox-recovery.test.tsx; pnpm exec tsc --noEmit; go run ./tools/repolint
Problem: combining the durable inbox input path with the latest main-v2 CLI changes exceeded the chat TUI complexity ratchet by one.
Root cause: pause/resume status branching lived inside the already oversized Update dispatcher.
Fix: move the queue-only pause toggle into a focused helper without changing shortcut behavior or widening the lint baseline.
Verification: go test ./internal/cli; go run ./tools/repolint
Problem: main-v2 advanced again while PR #8061 was being repaired, leaving the local head behind the current integration baseline.
Root cause: concurrent upstream merges added agent failure-snippet, benchmark, and CLI viewport changes after the first synchronization.
Fix: merge origin/main-v2 at d8d75e462 while preserving the durable inbox and Desktop recovery commits.
Verification: go test ./internal/agent ./internal/cli ./internal/evidence ./cmd/e2ebench ./benchmarks/compaction
Problem: recovered durable inbox items are intentionally paused after a crash, but Desktop only rendered the queue and offered no way to resume dispatch.
Root cause: Composer ignored the paused/recovered snapshot metadata even though the Wails SetInboxPaused API already existed.
Fix: render a localized recovery banner with review, continue, and keep-paused actions; keep resume available after confirming pause; guard stale tab responses; lazy-load the queue surface to preserve startup budgets.
Verification: pnpm build; composer-inbox-recovery, composer-session-draft, composer-goal-toggle; go test ./...; cd desktop && go test ./...; go run ./tools/repolint
KeepErrors only matched tool results starting with "error:" or "blocked:",
the shape the host formats for an execution failure. A tool that ran fine
but reported a failure — a go test FAIL, a compiler error, any non-zero
exit — never matched, so its evidence folded into the digest and the
specific assertion was gone. Measured against a full-history control on
benchmarks/compaction, evidence buried mid-result survived 0 of 6 runs
while the control kept it every time.
provider.Message.ToolExecution already carries State/ExitCode/Verification
and is already stripped before provider requests, so isErrorMessage reads
it instead of guessing. Because the failure then stays identifiable without
its text prefix, a protected failure can also be shortened: snipFailureResult
keeps the failure-carrying lines with two lines of context and drops the
passing noise, holding the projection cost to +3.5% rather than the +100%
that keeping the whole result costs. A text-only failure has no such anchor
and is still carried whole.
The rewrite happens on three paths — the planning pass, the re-write that
follows archiving, and the fold's kept partition — now unified through
maintenanceReplacement/keptForProjection so one cannot silently overwrite
another.
benchmarks/compaction gains the probe that measures this, a -snip arm,
cross-generation planting for revisions that land across a fold, and
alignment with boot's default KeepPolicy. Buried evidence now survives
18 of 18 runs.
Problem: the root-fix draft depended on an unreleased Bubble Tea API and a temporary personal fork, so it could not safely merge or ship.
Root cause: fully removing the application-level workaround on Warp requires a renderer capability that Bubble Tea does not yet expose in a stable release.
Fix: merge the latest main-v2 hotfix, restore official Bubble Tea v2.0.8, retain session-switch suppression, and enable the legacy per-offset ClearScreen only when TERM_PROGRAM identifies Warp on non-Windows platforms.
Verification: focused scroll policy tests, go test ./..., go vet ./..., make lint, and Windows amd64 CLI test cross-compile.
Problem:\n- The Skills navigation repeated the generic label as Agent 技能 and did not explain what the section contains.\n\nRoot cause:\n- Settings reused the capabilities-panel tab label instead of its dedicated navigation subtitle.\n\nFix:\n- name the section Agent Skills in every locale\n- describe it as reusable instructions, tools, and workflows\n- route settings navigation through the dedicated subtitle key\n- lock the three-language wording with a focused contract test\n\nVerification:\n- pnpm exec tsx src/__tests__/startup-settings-contract.test.ts\n- pnpm test:typecheck\n- pnpm check:css\n- pnpm build\n- go run ./tools/repolint\n- git diff --check\n- in-app browser DOM and visual check
Problem: PR #8061 had diverged from main-v2 and GitHub reported merge conflicts across event wiring, query coalescing, and repository lint baselines.
Root cause: both branches added independently valid fields and cache invalidation semantics in the same owner files.
Fix: preserve inbox item IDs alongside workspace events, combine settled query sharing with mutation invalidation, and regenerate the merged repolint baseline.
Verification: go test ./internal/event ./internal/eventwire; pnpm exec tsx src/__tests__/query-coalesce.test.ts; go run ./tools/repolint
Reasonix isolates a child's session but not its conclusions. The context
capsule records, field by field, what a child inherited from its parent
and every field is false — yet the one channel that actually carries
information, the parent's free-text prompt, is not modelled at all. Two
host-recorded instruments close that gap.
Evidence origin splits what a delegation's own text pointed at into
directory scope, which is the unavoidable cost of handing work off, and
named files, which say where the answer is. The child is credited only
for paths no named file already covered, so a scope hint never erases
its work. The two are counted apart because one number reports the cheap
act as the expensive one — the combined form read 0-3% independence
where the split reads 94-100%.
The -anchor arm hands the agent a hypothesis before it has read
anything: the task's real cause, a plausible wrong one, or none. Tasks
without an authored seed are skipped rather than run as the control, so
a seeded denominator never absorbs a control run.
Measured over 210 runs across two corpora (deepseek-flash, 5 reps each),
anchor resistance is 1.00 on both — including one whose answers no
command can check — while a wrong hypothesis costs ~2x wall and ~1.35x
tokens to unwind. Children discovered 94-100% of their own evidence:
this parent hands scope, not answers.
Also guards two failures found while running it: the bench read metrics
tags the agent had stopped emitting, and a failed grader's output never
reached the record that had to explain the failure.
Problem:\n- The expanded status bar item editor was constrained to a narrow column, leaving most of the settings page empty and making 16 items slow to manage.\n\nRoot cause:\n- The editor inherited the generic stacked-field width cap and rendered visible and hidden items in one undifferentiated list.\n\nFix:\n- split status bar items into full-width shown and hidden zones\n- support checkbox and drag-to-hide flows while preserving keyboard reordering\n- add show-all and restore-default recovery actions\n- add responsive styling, localization, focused interaction coverage, and narrow bundle-budget ratchets\n\nVerification:\n- pnpm test:typecheck\n- pnpm test\n- pnpm build\n- go run ./tools/repolint\n- git diff --check\n- in-app browser interaction and visual QA
Problem: application-level ClearScreen after every viewport offset change produces a second full redraw on Windows and visible transcript flicker.
Root cause: terminal compatibility policy lived in chatTUI.Update because Bubble Tea did not expose its scroll optimization switch.
Fix: disable renderer scroll optimization for Windows and Warp, remove the per-scroll ClearScreen and session-switch suppression state, and retain semantic clears for /clear and wide input.
Verification: go test ./..., go vet ./..., make lint, Windows amd64 CLI test cross-compile, and Bubble Tea VT output tests.
Problem: Windows CI expected idle Ctrl-C state changes to return a command, but the Windows scroll-flicker fix correctly removes the unrelated ClearScreen command that had satisfied those assertions.
Root cause: the tests conflated Bubble Tea model rendering with command execution; changed model state is rendered even when Update returns no command.
Fix: assert the armed Ctrl-C state directly and keep the real quit/copy command checks unchanged.
Verification: focused Ctrl-C and scroll tests; go test ./internal/cli/...; go vet ./...; make lint; Windows amd64 internal/cli test cross-compile.
Problem:
- The settings center presented a long undifferentiated rail and nested setting groups that were slow to scan.
Root cause:
- Navigation had no search, category grouping, or icons, and General mixed multiple preference domains in one card.
Fix:
- add searchable grouped settings navigation with consistent icons
- split General into flat appearance, conversation, and system sections
- add localized row guidance and responsive layouts
- extract navigation into a dedicated component and update contracts
Verification:
- pnpm test:typecheck
- pnpm test
- pnpm build
- go run ./tools/repolint
- git diff --check
- in-app browser visual and interaction QA
Problem: desktop CI exceeded the compressed bundle budget after the context composition panel was removed.
Root cause: UI-only localization entries for the removed panel remained in all three locale bundles.
Fix: remove the unused English, Simplified Chinese, and Traditional Chinese entries while preserving maintenance notice strings still used at runtime.
Verification: pnpm exec tsx src/__tests__/context-maintenance-notice.test.ts; pnpm build.
Problem:
The context panel exposed internal maintenance thresholds and projection details that added noise to the primary usage view.
Root cause:
PR #8109 rendered maintenance telemetry directly between the context-window gauge and session metrics.
Fix:
Remove the context composition section and its presentation-only derived state while preserving backend maintenance telemetry and localized notices. Add a source contract that prevents the internal block from returning.
Verification:
- pnpm exec tsx src/__tests__/context-maintenance-notice.test.ts
- pnpm exec eslint src/components/ContextPanel.tsx src/__tests__/context-maintenance-notice.test.ts
- pnpm typecheck
- pnpm check:css
- Browser DOM: composition absent; context window, session metrics, and usage analysis present
Problem: merging the latest main-v2 provider bridge additions pushed the desktop initial raw bundle above its enforced 2200 KiB budget.\n\nRoot cause: the workspace focus and visibility reconciliation lifecycle was statically bundled even though the workspace refresh store was already loaded on demand.\n\nFix: move the lifecycle coordinator into the lazy workspace store, retain stale-load and cleanup fencing in App, and keep the project-tree subscription in the same refresh lifecycle.\n\nVerification: pnpm test:all, pnpm build, targeted Go race tests, repolint, and git diff --check.
Problem: Transcript density, reasoning visibility, and completed-turn folding were split across separate visual structures, causing clipped controls in narrower settings windows.
Root cause: The work-process controls lived in a constrained nested card while transcript display remained a standalone row.
Fix: Group all three independent controls in one full-width responsive conversation-content section, update supported locales, and lock the layout contract with focused tests.
Verification: pnpm test; pnpm build; pnpm typecheck; pnpm test:typecheck; go run ./tools/repolint; browser checks at 1100px and 760px.
* feat(provider): add OpenCode Go DeepSeek protocol presets
Problem:
OpenCode Go exposed DeepSeek Flash through Chat Completions, but Reasonix had no dedicated Anthropic Messages or Responses presets with verified server-side web search support.
Root cause:
The curated catalog mixed unrelated Anthropic models, and Responses web-search replay was restricted to the official DeepSeek hostname instead of the enabled wire capability.
Fix:
Add model-scoped Anthropic and stateless Responses presets for DeepSeek Flash, enable verified web search, preserve completed Responses search calls for replay, and update Desktop capability rendering, localization, docs, mocks, and live tests.
Verification:
- go test ./...
- focused Desktop provider preset tests
- frontend typechecks and startup settings contract
- cache impact and cache guard scripts
- authenticated OpenCode Go Anthropic and Responses web-search live tests
* fix(provider): close OpenCode Go review gaps
Problem:
Repository lint rejected the protocol preset additions because they grew several baselined owner and test files. The live probes also stopped after the first web-search turn, leaving Responses replay and Anthropic tool-result compatibility unproven.
Root cause:
OpenCode Go preset data and focused assertions were added inline to already-ratcheted files, while the credential-gated tests did not exercise the provider-issued continuation payloads.
Fix:
Extract the OpenCode Go preset and localized description data into focused files without changing wire-visible configuration. Add a real Responses stateless follow-up and an Anthropic function tool/result round trip that preserves returned reasoning signatures.
Verification:
- go test ./... && go vet ./...
- go test -race ./internal/config ./internal/provider/responses ./internal/provider/anthropic
- go test -tags=live for both OpenCode Go protocol paths
- desktop go test ./... && go vet ./...
- frontend typecheck, settings contract, build, and bundle budgets
- go run ./tools/repolint
- ./scripts/cache-guard.sh
Problem:
The Linux lint job rejected the workspace mutation command scanner under the Go 1.26 modernize rules.
Root cause:
The scanner ranged over an allocated strings.Fields slice even though the current toolchain provides the equivalent FieldsSeq iterator.
Fix:
Use strings.FieldsSeq so command classification preserves token semantics without the intermediate slice allocation.
Verification:
- go test ./internal/agent
- go vet ./internal/agent
- go test -race ./internal/agent
- golangci-lint run --timeout=5m
- go run ./tools/repolint
Problem:
The review fixes left refresh coordination and mutation tests embedded in already oversized owner files, and one source-contract test assumed the fallback lived directly in App.tsx.
Root cause:
Fast-path mutation delivery and focus reconciliation were added at their call sites before the final repository-size audit, coupling the behavior to presentation files and historical test layout.
Fix:
Extract host mutation contracts, mutation finalization, focus reconciliation, and focused tests into dedicated modules. Keep resource flags on the host-only signal, preserve provider wire omission, and teach the source contract about the extracted hook without expanding any lint baseline.
Verification:
- go test ./... and go vet ./...
- desktop go test ./... and go vet ./...
- focused Go race suites for agent, event, eventwire, boot, and desktop workspace hub
- pnpm test:workspace, pnpm test:all, and pnpm build
- repolint, release workflow contracts, formatting, bundle budgets, and diff checks
Resolve the desktop frontend CI conflict by retaining workspace, motion, and transcript suites. Also keep the WebView2 smoke global declaration visible to the test TypeScript dependency graph.
Verification:
- go test ./...
- go test -race ./internal/event ./internal/agent ./internal/eventwire ./internal/evidence ./internal/boot
- go test -race . -run 'TestWorkspaceChangeHub|TestTabEventSink' -count=1 (desktop)
- go test ./... (desktop, isolated rerun)
- pnpm test:all
- pnpm build
Problem:
Workspace previews and change resources could stay stale after focus reconciliation, hook-replaced writers, Git metadata-only commands, or a writer completing ahead of another tool in the same batch.
Root cause:
Reconciliation ignored equal revisions, mutation attribution used the provider-visible call and the delivery classifier, and host invalidation was coupled to batch-ordered ToolResult emission.
Fix:
Add an independent host-only workspace mutation capability, classify the final executed target, publish each writer immediately, advance resource-specific revisions, and force visible resource reloads for focus/degraded fallback without accepting stale scope responses.
Verification:
- go test ./...
- go test ./... (desktop module)
- go vet ./... (root and desktop modules)
- go test -race ./internal/event ./internal/agent ./internal/boot
- go test -race . -run 'TestWorkspaceChangeHub|TestTabEventSink' -count=1 (desktop)
- pnpm test:all
- pnpm build
Co-authored-by: SivanCola <[email protected]>
Problem: scrolling the alt-screen transcript on Windows triggered an asynchronous full-screen clear for every viewport offset change, producing a visible second frame in ConPTY terminals.
Root cause: the Warp stale-row workaround was applied on every operating system even though Bubble Tea already disables scroll optimization on Windows.
Fix: retain the legacy clear workaround on non-Windows terminals only and cover the platform policy plus force-bottom behavior with focused tests.
Verification: go test ./... -count=1; go vet ./...; make lint; Windows amd64 internal/cli test cross-compile.
Problem:
The Linux desktop CI build produced 2201.2 KiB of raw initial assets while the macOS build produced 2200.7 KiB, narrowly exceeding the 2201 KiB cap.
Fix:
Raise only the raw initial-asset budget by 1 KiB to accommodate the observed cross-platform variance. Keep every gzip and chunk budget unchanged.
Verification:
- pnpm build
- Linux CI failure log confirmed all gzip budgets passed
Problem:
The work-process fold and reasoning display controls appeared as unrelated top-level settings even though users reason about them together.
Root cause:
The UI exposed the outer process lifecycle and inner reasoning presentation without a shared hierarchy.
Fix:
Group both controls under one Work process card while preserving their independent stores and behavior. Add responsive and accessible segmented controls, update all three locales, defer the group CSS with settings, and retire stale summary-switch copy.
Verification:
- focused reasoning and settings contract tests
- frontend typecheck, responsive checks, and production build
- browser mock at desktop and narrow widths
- go test ./internal/config
- cd desktop && go test ./...
- go run ./tools/repolint
- git diff --check
* test(desktop): enforce native motion release gates
Problem:
Native motion regressions could pass aggregate CI even when Element.animate was never exercised, and Windows release builds were signed without a real approval interaction in WebView2.
Root cause:
The focused motion suites were not part of a required check, legacy GSAP easing tokens had no source-level contract guard, and the release workflow never launched the built Wails executable.
Fix:
Add WAAPI contract scanning, required motion CI, a real Wails/WebView2 approval smoke before signing, protected release verification, and an independent review check for large or cross-boundary pull requests.
Verification:
- pnpm test:motion
- pnpm typecheck
- pnpm build
- go test ./... (desktop)
- bash scripts/release-workflows.test.sh
- actionlint for changed workflows
- go run ./tools/repolint
* fix(ci): close native motion release gate gaps
Problem:
- Windows rejected the shared WAAPI easing constants and the required lint job failed ShellCheck.
- Large-PR approval could be stale or evaluated from candidate-controlled workflow code.
- Pull requests did not exercise the real Wails approval flow in WebView2.
Root cause:
- The WAAPI contract matched only POSIX paths, the cross-platform lint loop split an unquoted value, and the review policy was bound to pull_request events without checking review.commit_id.
- The WebView2 smoke existed only in the release workflow.
Fix:
- Normalize contract paths and add a Windows regression fixture.
- Quote the lint target parsing, move review decisions into a protected control plane with current-head status publication, and add policy tests.
- Build and smoke-test the Windows Wails executable in PR CI.
Verification:
- pnpm --dir desktop/frontend test:motion
- pnpm --dir desktop/frontend build
- node --test .github/scripts/cross-boundary-review.test.cjs
- bash scripts/release-workflows.test.sh
- actionlint for all changed workflows
- cd desktop && go test ./...
- go run ./tools/repolint
Co-authored-by: Ray-lyy <[email protected]>
* fix(ci): isolate transcript virtualization from motion gate
Problem:
The native motion gate ran the transcript virtualization suite in three jobs. Its prepend assertion could execute before the virtualizer remounted the anchor, producing a false Windows failure and skipping the real WebView2 smoke.
Root cause:
The suite was grouped by historical proximity rather than ownership, and the assertion waited for one fixed render flush instead of the DOM condition it required.
Fix:
Give transcript virtualization its own test command, run it once in the Linux desktop job, and make the motion contract reject future coupling. Wait for the anchor to remount before asserting, and cover the transcript entrance reset-key contract directly.
Verification:
- pnpm --dir desktop/frontend test:motion
- pnpm --dir desktop/frontend test:transcript (6 consecutive passes)
- pnpm --dir desktop/frontend typecheck
- pnpm --dir desktop/frontend build
- go run ./tools/repolint
- actionlint for changed workflows
- bash scripts/release-workflows.test.sh
* fix(ci): defer WebView2 smoke instrumentation
Problem:
The latest-base Linux Desktop build exceeded the 2,200 KiB raw startup budget by about 0.1 KiB.
Root cause:
The Windows-only approval smoke instrumentation was statically linked into every normal desktop startup while the latest base had little budget headroom.
Fix:
Lazy-load the smoke component only when the native harness injects its flag, and make the motion contract reject a future static App import.
Verification:
- pnpm --dir desktop/frontend test:motion
- pnpm --dir desktop/frontend test:transcript
- pnpm --dir desktop/frontend typecheck
- pnpm --dir desktop/frontend build
- go run ./tools/repolint
- git diff --check
---------
Co-authored-by: Ray-lyy <[email protected]>
Problem:
Non-interactive Wails builds could abort while pnpm asked to recreate node_modules, and local, CI, release, and documentation toolchain versions could drift.
Root cause:
The Wails frontend install hook kept pnpm purge confirmation enabled, release jobs still used Node 22, and the repository had no cross-file guard for the Node and pnpm contract.
Fix:
Make the pnpm purge path non-interactive, align Desktop builds on Node 24 and pnpm 10, reuse the shared .wails-version installer from #8069, separate CLI and Desktop build instructions, and enforce the contract in the release workflow test lane.
Verification:
- node scripts/check-desktop-build-contract.mjs
- bash scripts/check-wails-pin.sh
- bash scripts/check-wails-pin.test.sh
- bash scripts/release-workflows.test.sh
- actionlint .github/workflows/release-desktop.yml
- Node 24 engine-strict frozen install and frontend production build
- make lint
- go vet ./...
- go test ./internal/tool/builtin/ ./internal/boot/
- make wails-install and a full Wails macOS build
Co-authored-by: SivanCola <[email protected]>
* fix(desktop): open folders in Explorer via explore verb, not open (#7851)
ShellExecute's "open" verb resolves folders through the shell namespace,
where a sibling "<folder>.lnk" with the same base name wins and launches
the shortcut's target instead of Explorer. The "explore" verb opens a
folder in Explorer directly and never consults .lnk files; files keep
"open".
* fix(desktop): open folders with explore verb plus trailing separator
Ablation on a real Windows host showed the first attempt was ineffective:
with a sibling "<folder>.lnk" present, ShellExecute's "explore" verb alone
returns E_FAIL (hinst 5) and opens nothing. Both "open" and "explore"
succeed once the folder path carries a trailing separator, which forces the
shell to treat the target as a directory and never consult the .lnk. Use
explore + trailing separator for folders; files keep "open" unchanged.
* fix(desktop): reuse validated path metadata for shell opens
Problem:
The Windows Explorer ambiguity fix classified every target with a synchronous os.Stat. Newer local-path and external-opener callers had already performed that lookup, while an unknown path silently fell back to the unsafe open verb and directory roots gained a duplicate separator.
Root cause:
Path classification and ShellExecute planning were coupled inside openWorkspacePath, so validated callers could not pass their existing directory metadata.
Fix:
Add a platform helper that accepts the validated directory flag, reuse it at existing stat call sites, fail closed when standalone classification fails, and append a folder separator only when absent. Extend Windows regression coverage for missing paths and pre-terminated directory targets.
Verification:
- go test ./... (desktop)
- go test -race . -run focused desktop opener tests
- go vet ./... (desktop)
- go run ./tools/repolint
- Windows/amd64 cross-compiled tests on Win11
- Full Wails Windows build opened the exact folder in Explorer without launching the real same-named shortcut
Co-authored-by: SivanCola <[email protected]>
* docs(desktop): clarify local opener safety boundary
Problem: The local opener comment said openWorkspacePath stayed untouched and named RevealWorkspacePathForTab, which no longer matched the implementation.
Root cause: Windows directory classification evolved while the old security-boundary explanation remained unchanged.
Fix: Describe the actual invariant: openWorkspacePath stays outside the executable-target guard because callers provide workspace-authorized paths.
Verification: focused desktop local-path tests, go vet ./..., repolint, and git diff --check.
Co-authored-by: SivanCola <[email protected]>
---------
Co-authored-by: SivanCola <[email protected]>
Integrate the sub-agent specification and event sink forwarding refactor at 28ad01d5. Regenerate the repolint baseline from the combined tree; workspace refresh and audit event contracts remain intact.
Problem:
Workspace revisions could cross scope boundaries, refresh bursts could overlap or hammer Git, and the Desktop watcher could suppress real external saves or retain roots after a workspace switch.
Root cause:
The frontend kept a tab-global monotonic baseline and used direct refresh effects, while the hub used time-based agent/filesystem deduplication, incomplete Git metadata watches, and delayed watcher cleanup.
Fix:
Scope refresh snapshots by tab and workspace, add bounded trailing schedulers, extract resource invalidation, release stale roots, validate mutation paths, recursively watch selected Git metadata, and preserve every authoritative filesystem observation. Add deterministic frontend, watcher, race, and CI coverage, plus lazy reconciliation to preserve bundle budgets.
Verification:
go test ./...
go test -race . -run TestWorkspaceChangeHub -count=1
pnpm test
pnpm build
go vet ./...
./scripts/cache-guard.sh
./scripts/check-wails-pin.sh
go run ./tools/repolint
Every compaction decision divides by the context window, so a window that
is too small is indistinguishable from a context that is genuinely full:
both just compact. Nothing exposed the number, and nothing exposed why a
maintenance pass did or did not run.
/context reports the window and its usable ceiling, the latest prompt (the
last request's shape, never the billable retry aggregate), canonical vs
model-visible size, the snip/fold/force thresholds as absolute tokens, the
last pass's mode and what it reclaimed, and the blocked reason when one is
recorded. The one-line summary names what happens next rather than only
how full the context is.
Thresholds come from compactThresholds and forceCompactThreshold, the same
helpers the decision uses, so the report cannot drift from the behavior.
Adding a command to two files already at their size budget would have
widened the baseline, so the routing pays for itself: /new and /clear were
two copies of the same goroutine-and-report block and now share
runSessionVerb, and /remember moves out of the switch alongside the new
/context handler. Notice texts are unchanged.
Resolve concurrent event contract additions by retaining both context maintenance and workspace refresh events. Keep the latest main-v2 desktop, runtime, documentation, and CI changes as the integration base for the workspace refresh fixes.
The custom-provider wizard wrote ContextWindow: 128000 unconditionally,
on all four paths (OpenAI and Anthropic compatible, single model and
model list). A relay serving a 1M-window model was therefore recorded as
128K, and compaction fired at 80% of the wrong number: roughly a tenth
of the model's real capacity, which reads to the user as "Reasonix
compacts far too early".
An OpenAI-compatible endpoint does not report its context window, and
guessing from the model name is unreliable for a relay, so the wizard now
asks. The default stays 128000 for the case where the user does not know
either, but it is a visible answer rather than a silent assumption.
The prompt says what a wrong value costs, since that is the part no one
could previously see.
I wrote that one child run "costs 100k-220k tokens before it produces
anything", and used it as a threshold to compare a branch's size against. Both
halves were wrong enough to mislead.
The figure is cumulative prompt tokens across the child's own model calls, so
the same context is counted once per call: 27 measured children averaged 134k
tokens over 9.3 calls, which is the same ~14k context re-sent, not 134k tokens
of new material. At the ~90% cache hit these runs saw, the real price of a
child averaged ¥0.017.
The 2-4x delegation cost is unaffected, because both arms are counted the same
way. What is removed is the invented threshold: comparing a branch's size in
tokens against a child's cumulative re-sent context is not a like-for-like
comparison and should never have been stated as one.
The benchmark line is relabelled to say what it measures. For scale, what this
branch itself adds to a child — complete_subtask's schema, its description and
the closing contract — is about 654 tokens of that per-call context, roughly
4.5% of it.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
main-v2 had moved 84 commits ahead. Everything auto-merged except
tools/repolint/baseline.json, which is generated: resolved by taking upstream's
and regenerating, rather than hand-merging JSON.
Regenerating surfaced one real violation instead of a carry-forward:
internal/event/event.go had grown past its budget, so the delegation audit sink
and its dispatcher move into audit_forwarder.go where the rest of that concern
already lives. The only baseline entry above upstream is plugin_entry.go's
essay, which is the field comments carried through the earlier extraction.
The delegation boundary rule went into REASONIX.md while the spec member was
still called ContextCapsule. Renaming it to ContextRequest, so the manifest
could take that name, left the standing instruction pointing at a type nobody
can find — and REASONIX.md is loaded into the system prompt, so the stale name
is in the prefix rather than only in a doc.
Also worth recording against the question this came from: does merging make the
agent delegate less? Measured rather than argued. The same five neutral tasks,
same fixtures, only the binary swapped: main-v2 delegated zero times and this
branch delegated zero times, both 4/4 passing. The 15% delegation rate observed
throughout was already the main-v2 rate.
Nothing here adds a brake. The admission gate runs in applyBatchGuards, after
the calls have executed, and only emits an audit — there is no path by which a
verdict denies a call. The ablation change is inert unless --ablate subagent is
passed. What the branch adds to a delegated run is complete_subtask in writer
child registries and a closing contract in the child prompt, which is a cost
paid by a child that already ran, not a deterrent to starting one.
The question was why the model keeps sidestepping situations built to need
delegation. The recorded reasoning answers it: it does not weigh delegation and
decline, it never reaches the question. On a task built for `explore` it
deliberates over how to read efficiently — "that's 25 files... read them in
parallel batches... I can read multiple files at once" — and delegation does not
enter the decision.
Three causes, one of them a defect. The base system prompt never mentions
delegation; every mention is in the skills index and every one is a brake, sat
next to an accelerator for inline skills. The task tool description says what
the tool does and never when to reach for it. And the model already has cheaper
parallelism in several tool calls per round trip, with no context duplicated,
which is the thing it actually reasons about.
Given the measured 2.4-4.5x cost, the brake is the right default and is not the
defect. The gap is that nothing recognises the rare case where delegation would
pay, and forcing it does not close that gap: in the forced fleet run the parent
derived all three fixes in its own reasoning before dispatching, so the children
re-read the code to apply edits it had already worked out. Delegation moved the
typing, not the thinking.
Numbers behind it: 33 runs with delegation available, 15% delegated, bash
outnumbering every delegation-class call 10 to 1.
Nine optional capabilities, repeated at every wrapper in the chain, silently
lost three audits in this branch alone: control's goal-usage tee, the stats
recorder, and the nesting sink fleet items run under. Each time the data simply
stopped, each time with the tests green, and each time the fix was to write the
same method one more place.
event.AuditForwarder holds the nine forwards once. A pure forwarder embeds it
and is complete by construction, so the next capability added there reaches
every embedder without editing them. goalUsageTee, notify.Sink, telemetry's
sink and the nesting sink now embed it, deleting roughly a hundred lines of
identical methods; the tee had been forwarding eight of nine, and the nesting
sink three of nine, before this.
Wrappers that do real work per channel — the coalescer flushes first, stats and
trajectory record, run metrics consumes — keep their own methods. Embedding is
for the ones that only pass things through.
The guard now asserts the forwarder itself covers every capability, which is
the property that makes the wrapper-level guard mostly redundant rather than
load-bearing. Verified end to end against the provider: a delegated run still
reports its child.
The last hypothesis worth testing was that delegation's isolation pays when the
parent is genuinely hurt by what it read. Isolating that mechanism needs the
parent under context pressure, so these two variants pin a workspace
compact_ratio of 0.5% over the same three-package migration.
It did not work. Zero compactions in both arms, at 0.5% of a 1M window, because
the agent keeps its session small by writing a script rather than reading — the
same behaviour that has won it every comparison so far. The arms still came out
4.5x tokens and 5.6x wall for the forced one, but that number is not evidence
about context pressure, because the pressure never arrived.
Kept as an honest record of the attempt rather than deleted, and because they
exercise the project reasonix.toml merge path (verified: the run reports
compact_ratio = 3% (project: reasonix.toml), so the config is read; the session
simply never reaches the threshold).
SPEC 3.17 states this as untested rather than disproved. Provoking it needs a
task that cannot be scripted away, which this corpus does not contain.
Problem:
Context maintenance still had divergent strict-role and manual compression paths. Manual folds could archive before a durable commit, Anthropic native editing had no session-stable rejection fallback, and desktop maintenance receipts could surface stale or untranslated state.
Fix:
- converge strict-role pressure handling and explicit range compression on the projection CAS transaction
- persist generation, hashes, receipts, archives, and native/local context-editing lineage
- allow one pre-success Anthropic native rejection fallback, then lock the session request shape
- avoid duplicate Guardian maintenance epochs and fence stale desktop metadata/balance reads
- localize context-maintenance notices and expose projected/canonical maintenance state
Verification:
go test ./... -count=1
go test -race ./internal/agent ./internal/guardian ./internal/provider/anthropic ./internal/control -count=1
go test ./internal/agent -run TestIssue7935Maintains206ToolResultsOnceAndOnlyProcessesNewTail -count=10
cd desktop && go test ./... -count=1
cd desktop/frontend && pnpm test && pnpm build && pnpm test:typecheck
./scripts/cache-guard.sh
go vet ./...
golangci-lint run ./...
go run ./tools/repolint
Three branches needing three different kinds of work — a logic fix, a half-up
rounding fix, and a manifest regenerated by reading both packages. No bulk
transformation solves them, which is the one shape where delegation has a
theoretical case, and the reason the earlier migration lost so badly.
The first repetition read 1.42x, the closest delegation has come. Two more
repetitions put it at 3.73x and 2.43x, mean 2.41x tokens and 3.65x wall over
identical work with a 100% success rate in both arms. The neutral arm's own
spread across those three runs was 8-37%, so the first reading was a favourable
draw rather than a narrowing — which is exactly what the recorded noise floor
predicted and why it is worth having.
The forced arm's spread was roughly twice the neutral arm's, so delegation buys
variance as well as cost.
SPEC 3.17 now records the four measured task shapes, since a result this
consistent is more useful to the next reader than the counters alone.
Fixture note: the reference fix for the rounding branch was wrong on the first
attempt because Python's round() is banker's rounding, so 1250 stayed 1.2k. The
task keeps that trap deliberately — the docstring says half up — but it is a
reminder that a fixture is only verified when both directions are run.
Three packages, 36 files, 2736 lines, one signature change touching 108 call
sites, non-overlapping write paths. This is the branch size the earlier
measurement said delegation would need, since one child run costs six figures of
tokens before it produces anything.
It still loses, and for a more interesting reason than overhead. Neutral prompt:
28s, 12 tool calls, one file read — the agent wrote a script and applied the
change in bulk. Forced fleet: 116s, 87 tool calls, 78 of them in three children
editing their twelve files each. 2.6x tokens, 3.4x cost, 4.1x wall clock, same
result.
Delegation did not merely add overhead here; it prevented the better algorithm.
The task looks parallel-shaped, so splitting it by package hides the fact that
one bulk transformation solves all three at once. No branch can see a global
optimisation that spans the branches.
Both seeds were checked to fail unfixed and pass fixed before use. The first
checker was wrong in a way worth recording: it called every callable in each
module, including the fmt_amount imported into the namespace, so every arm would
have failed and produced confident garbage. Verifying the fixture in both
directions is what caught it.
The measurement gave the existing shadow admission gate something to act on.
It already gated `research` on local-fix turns, from a finding that one call
cost 65% of the worst task's wall clock. The same shape now covers task, fleet
and explore, because forcing delegation on identical work cost 2-4x the tokens
and wall clock with no change in outcome.
It stays shadow-only. Two tasks are enough to gate a tool for observation, not
enough to block a call a user asked for, and the existing design already says
observe first.
The benchmark now also prints what one child run costs before it has produced
anything — 103k tokens on a real run. That is the number a delegation decision
actually turns on: work whose branch is smaller than that cannot pay for the
agent doing it, whatever the orchestration around it looks like.
The existing admission test pinned "research only" and used `task` as its
negative case. It now asserts both are audited while keeping what it was really
protecting: a non-delegation tool is never audited.
Four tasks: two whose structure rewards delegation with a neutral prompt, and
two forced twins that differ only in telling the agent to delegate. Same
workdir, same checks, so the pair prices delegation on identical work instead of
comparing different work. Both seeds were confirmed to fail unfixed and pass
fixed before either was used.
The existing subagent-delegation task mandates delegation in its prompt, which
tests the plumbing rather than the value: a single-agent arm cannot comply, so
it loses by the rules rather than on the merits. The neutral tasks exist so an
arm that declines to delegate is only penalised by the clock.
Running them found the instrument under-counting. A fleet item runs under a
sink built by subSinkFor, which was a bare event.FuncSink; optional sink
capabilities are forwarded by method, so every delegation audit a fleet or
parallel_tasks child produced was swallowed at the nesting boundary. The forced
fleet task burned 3.8x the tokens of the neutral one and still reported zero
child runs. subSinkFor now returns a type that forwards the audits, and the
same task reports 3 child runs doing 71% of the tool calls.
This is the third instance of one contract implemented at many wrappers and
missed at one. The guard added earlier covers the session chain but not this
nesting sink, which is a fair argument that the pattern wants a shared embedded
forwarder rather than more guards.
Running the fixed control produced a clean negative result worth writing down
so the next person does not read a single run as evidence.
Same arm, same six tasks, twice: per-task token use moved by a median of 19%
and as much as 54%. The whole between-arm difference in the same experiment was
2.5%, and five of the six tasks saw no delegation in either arm, so what the
comparison mostly measured was run-to-run variance.
SPEC 3.17 now states that alongside the counters, together with the two ways to
get a real answer: enough repetitions to clear the variance, or restricting the
comparison to tasks where subagent_runs shows delegation actually happened.
Measuring the arm showed it was not one: a `no-subagent` run still spent a
child run on `explore`, because the ablation removed task, read_only_task,
fleet and parallel_tasks while leaving runAs=subagent profile skills — reached
through run_skill or the dedicated explore/research/review wrappers — running.
Every comparison against that arm was therefore delegated-versus-delegated.
Delegation is delegation whichever tool reaches it, so the arm now gates the
skill runners as well and stops registering the wrapper tools, which also keeps
their schemas out of the control run's prefix. Inline playbooks are untouched:
they never spawn a child, and ablating "subagent" should not disable a
checklist.
Verified against the provider: the same task that previously reported one child
run under the arm now reports subagent_runs=0 and "solved by a single agent".
This changes what the no-subagent arm means, so figures from it are not
comparable with baselines recorded before this commit. That is the point — the
older ones were measuring something else.
The gate lives in its own file rather than inline, because the guard would
otherwise have been duplicated across the two runners. Note for the next reader:
that file cannot be named *_arm.go — Go reads the suffix as GOARCH and silently
drops the file from the build.
Problem:
The PR adds durable context-maintenance semantics and an advanced native Anthropic opt-in that were not covered by the embedded guides.
Fix:
Document projection-based maintenance, durable blocked fingerprints, canonical transcript preservation, and the official-Anthropic-only context_editing setting in English and Chinese.
Verification:
- go test ./docs
- go run ./tools/repolint
- git diff --check
Problem:
Long sessions could repeatedly snip the same canonical tool results, retry failed summaries, and report misleading context state.
Root cause:
Preflight and post-turn compaction evolved separate views, while pruning rebuilt from canonical history instead of the installed projection. Failed view fingerprints and maintenance outcomes were not durable.
Fix:
Make ContextManager the single request-time owner, evolve projection-only views with CAS and v3 receipts, persist blocked fingerprints, add Anthropic native tool clearing capability gates, and expose current context composition separately from summary-call cost.
Verification:
- go test ./...
- go test -race ./internal/agent ./internal/provider/anthropic ./internal/control
- go vet ./...
- ./scripts/cache-guard.sh
- cd desktop/frontend && pnpm typecheck
- focused Desktop and frontend context contract tests
- go run ./tools/repolint
Problem: A broken installed Wails CLI made prod_test exit before its repair path, while the regression suite copied the repository's current pin and the guard accepted alternate dynamic install sources.
Root cause: The version probe inherited errexit and pipefail, the integration assertion embedded v2.13.0, and the guard relied mostly on negative checks instead of proving each supported consumer read .wails-version.
Fix: Treat probe failures as an explicit version mismatch, derive real-repository expectations from the shared pin, validate stable pin syntax, whitelist supported install sources, and guard plus quote the Makefile installer. Add regressions for broken CLIs, alternate workflow sources, hard-coded Make variables, and invalid pins.
Verification: make lint; bash scripts/release-workflows.test.sh; isolated GOBIN make wails-install with wails version v2.13.0; broken Wails probe returns an actionable mismatch; git diff --check.
Co-authored-by: SivanCola <[email protected]>
Problem:
The target branch advanced again during final verification with Desktop opener and shared-window output-budget fixes.
Root cause:
PR validation overlapped active main-v2 development.
Fix:
Merge the latest target branch without rewriting contributor history and preserve both frontend bridge contracts and inbox durability changes.
Verification:
Run repository lint plus overlapping frontend, agent, provider, root, and Desktop checks after integration.
Problem:
The target branch advanced after local validation with session, shell, plugin, and Windows shortcut fixes.
Root cause:
PR validation overlapped active main-v2 development.
Fix:
Merge the latest target branch without rewriting contributor history and retain the durable inbox changes on top.
Verification:
Run the repository lint, affected package tests, cache guard, and full root/Desktop suites after integration.
Problem:
The completed durability fixes pushed several already-baselined files and functions past the repository's ratcheted size and complexity budgets, causing the PR lint job to fail.
Root cause:
Review follow-up logic and tests were appended to legacy monoliths, and idempotency checks remained nested inside Store mutations.
Fix:
Extract ACP, Bot, Controller, Desktop, CLI, and session inbox helpers and tests into focused files; centralize idempotency receipt and alias handling; preserve the existing repolint baseline without widening any budget.
Verification:
- go run ./tools/repolint
- go vet ./internal/sessioninbox ./internal/control ./internal/bot ./internal/acp ./internal/cli
- go test ./...
- go test -race ./internal/sessioninbox ./internal/control ./internal/agent ./internal/bot ./internal/acp
- cd desktop && go test ./... -count=1 -timeout=10m
- cd desktop/frontend && pnpm build
- cd desktop/frontend && pnpm exec tsx src/__tests__/composer-goal-toggle.test.tsx
- ./scripts/cache-guard.sh
- go test ./internal/sessioninbox -run '^$' -bench '^BenchmarkThirtyOneMiBItemsRetainedHeap$' -benchtime=1x -count=1
Problem:
- The macOS lint gate rejected the manual duration bounds checks.
Root cause:
- The modernize linter requires the Go min and max built-ins for simple clamps.
Fix:
- Express the shared teardown deadline clamp with min and max.
Verification:
- golangci-lint run --timeout=5m ./... (desktop)
- go test . -run 'TestWaitDestroyHandleBatchesWaitsAcrossSessionsConcurrently|TestWaitDestroyHandles' -count=1
Problem:
- A committed topic archive could leave metadata behind without a durable retry path.
- Empty live stubs could create duplicate trash entries.
- Multi-session teardown could consume one watchdog interval per session.
Root cause:
- Session cleanup markers did not carry the topic metadata operation.
- Existing-trash reconciliation treated an empty live transcript as divergent.
- Destroy handles were awaited in per-session serial batches.
Fix:
- Persist a hashed topic archive intent and reconcile sessions plus metadata at startup.
- Remove empty or identical live artifacts under the existing removal guard while preserving sidecar-only recovery.
- Wait all topic destroy batches concurrently under one shared deadline.
Verification:
- go test ./... -count=1 -timeout=10m (desktop)
- go test -race . -run archive-focused suite
- go test ./internal/agent ./internal/control -count=1
- GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go test -exec=true .
- go vet ./... (root and desktop)
- go run ./tools/repolint
- ./scripts/cache-guard.sh
Problem: main-v2 advanced again during final validation with PR #8059, including TUI and Serve changes adjacent to this branch.
Root cause: the base branch moved after the prior synchronization commit.
Fix: merge origin/main-v2 at 303139c61 without force-pushing or rewriting contributor history; Ctrl+J newline and durable inbox behavior remain intact.
Verification: rerun the affected CLI, Serve, root, race, Desktop, frontend, cache, and retained-heap gates before push.
Problem: PR #8061 was 25 commits behind the current main-v2 tip, so its tested tree did not include the latest session and Desktop changes.
Root cause: main-v2 advanced after the durable inbox branch was created and last reviewed.
Fix: merge origin/main-v2 at b22ef0119 without rewriting contributor history; the merge completed without textual conflicts.
Verification: final root, Desktop, frontend, race, cache, and merge-gate checks are run on this merge commit before push.
Problem:
Reasoning presentation was controlled by a binary summary preference, so users could not hide reasoning or follow it live consistently across the main transcript, work folds, and sub-agent cards.
Root cause:
The desktop settings contract and frontend components had no shared reasoning-display state machine; legacy expand_thinking and localStorage preferences were read independently.
Fix:
Add hidden, summary, and auto modes with pending and legacy-collapsed compatibility states, Wails/config persistence, migration precedence, shared disclosure behavior, settings controls, transcript filtering, and sub-agent integration.
Verification:
Focused reasoning/config tests, go test ./internal/config, cd desktop && go test ./..., pnpm test:typecheck, pnpm build, and go run ./tools/repolint pass. The full frontend suite still has an unrelated existing timeout in new-session-load-race.test.tsx while waiting for stale metadata.
Problem:
Local production builds and contributor setup could still bypass the shared Wails pin, so the old CLI/library skew remained possible even while the workflow-only guard passed.
Root cause:
The guard inspected only two workflow files, prod_test checked command presence instead of the installed CLI version, and the desktop guide recommended @latest.
Fix:
Add a make-based pinned installer, make prod_test repair and verify version mismatches, reject repository-wide hard-coded Wails installs, move the maintenance guidance out of the cache-stable prompt, and cover each drift path with regression tests.
Verification:
- make lint
- bash scripts/release-workflows.test.sh
- make wails-install installs v2.13.0 in an isolated GOBIN
- wails build -platform darwin/arm64 -clean -skipbindings -nopackage
Co-authored-by: SivanCola <[email protected]>
Problem:
The required lint job rejected the supplemental shortcut-repair comment because its six-line block exceeded the repository's five-line budget for this position.
Root cause:
The current.json migration rationale was documented too verbosely for the repolint policy.
Fix:
Compress the explanation while preserving the versioned-layout and live-flat distinction.
Verification:
- go run ./tools/repolint
- golangci-lint run --timeout=5m ./...
- cd desktop && GOOS=windows golangci-lint run --timeout=5m ./...
- git diff --check
Problem:
A preference write completing after a tab switch updated only the unmounted selecting component. The visible tab could keep and launch the old opener even though the global preference had changed.
Root cause:
The shared coordinator ordered writes but did not publish persisted preferences or fence discovery results against preference revisions.
Fix:
Publish successful preference writes to mounted opener controls and use a revision fence so discoveries started before a write cannot restore stale state. Add deterministic coverage for both completion orders.
Verification:
- pnpm exec tsx src/__tests__/external-opener-preference-sync.test.tsx
- pnpm exec tsx src/__tests__/external-opener.test.tsx
- pnpm test:typecheck
- pnpm build
- go run ./tools/repolint
Problem: The workspace refresh implementation exceeded existing repolint budgets in the owning files and repository totals.
Root cause: The new workspace event contract, watcher hub, and resource refresh wiring add bounded code to several files that already sit at their carried-forward limits.
Fix: Record only the affected file, function, complexity, and aggregate baseline deltas; shorten the new watcher comment to stay within the essay budget.
Verification: go run ./tools/repolint.
Problem: Workspace previews and change lists remained stale until turn completion, and the embedded workbench did not expose a reliable refresh fallback.
Root cause: WorkspacePanel depended on a turn-level refresh key and had no resource-level invalidation for in-flight agent writes or external filesystem changes.
Fix: Add host-only workspace mutation metadata and workspace_changed revisions; add a root-scoped fsnotify hub with bounded coalescing, Git metadata watching, and degraded fallback; refresh frontend resources by revision and expose an embedded refresh action; group task, working-tree, and history changes with regression coverage.
Verification: go test ./...; cd desktop && go test ./...; cd desktop && go test -race -run 'TestWorkspaceChangeHub' ./...; cd desktop/frontend && pnpm -s typecheck && pnpm -s lint:hooks && pnpm -s check:css && pnpm -s build; cd desktop/frontend && pnpm -s test:terminal.
Problem:
Official DeepSeek Responses sessions could add ordinary reasoning or completed web-search items after the last usage calibration without increasing the shared-window input estimate. Near the context limit, that could still leave an oversized completion allowance and reproduce the HTTP 400 this PR is intended to prevent.
Root cause:
The calibration shape intentionally counted only text common to every DeepSeek transport. That assumption is conservative only for adapter-specific text already present in the calibrated request; newly appended Responses-only replay fields were invisible.
Fix:
Add an immutable provider input policy for adapter-specific shared-window replay fields. Have the official DeepSeek Responses adapter declare ordinary reasoning and ResponsesItems, consume that policy in request calibration, preserve it through the fork-capture wrapper, and add regressions for both growth paths while keeping other transports unchanged.
Verification:
- go test ./internal/agent ./internal/provider/... -count=1
- focused go test -race ./internal/agent
- go test ./... -count=1
- go vet ./...
- cd desktop && go test ./... -count=1
- ./scripts/cache-guard.sh
- go run ./tools/repolint
- git diff --check
Problem: live shell progress could still grow without bound even though the final result was capped, and a stale session-listing backfill could overwrite newer turn counts.
Root cause: progress bypassed the bounded collector into append-only consumers, while listing decode and metadata update were separated by an unchecked transcript-generation window.
Fix: cap live progress at 64 KiB plus one marker, restore the bounded final result in CLI, and compare sidecar counts plus transcript generation under the metadata lock before backfill.
Verification: go test ./... -count=1; cd desktop && go test ./... -count=1; go test -race ./internal/agent ./internal/shellrun ./internal/cli -count=1; go vet ./...; cd desktop && go vet ./...; go run ./tools/repolint; ./scripts/cache-guard.sh
Problem:
A root-level reasonix-desktop.exe can survive the versioned migration when best-effort cleanup fails, so file existence alone cannot prove a live flat install.
Root cause:
Shortcut repair treated every existing flat binary as authoritative, and the icon regression test depended on a fixed host path.
Fix:
Use validated current.json as the versioned-layout commit signal, preserve true flat installs, and cover existing and missing flat target and icon cases with isolated temporary roots.
Verification:
- cd desktop && go vet ./...
- cd desktop && go test ./...
- cd desktop && GOOS=windows GOARCH=amd64 go test -c
- go test ./internal/installlayout
- Native Windows 11 focused and real .lnk tests
Problem:
- A newer CLI always opened Remote Serve with a fragment token.
- Reused v1.21.4 Serve processes only understand query-token bootstrap, so reconnects returned 401 after a local CLI upgrade.
Root cause:
- Remote bootstrap intentionally reuses a healthy detached process without negotiating its browser authentication capability.
Fix:
- Probe the forwarded /auth/token endpoint without sending the secret.
- Keep fragment-token URLs for current Serve and fall back to the legacy query bootstrap when the endpoint is unavailable or incompatible.
- Remove the external implementation reference from the instance registry comment.
Verification:
- go test ./internal/cli -run TestRemoteServeBrowserURL -count=1
- go test -race ./internal/cli ./internal/serve -count=1
- go test ./... -count=1
- go vet ./...
- go run ./tools/repolint
- ./scripts/cache-guard.sh
- make build
- npm --prefix site test
- npm --prefix site run build
- git diff --check
Problem:
- CI lint rejected one secondary error formatting path and an index-only loop.
Root cause:
- The readiness error preserved the server error with a non-wrapping verb, and the registry retry loop used the pre-Go-1.22 integer form.
Fix:
- Wrap both readiness errors and use integer range syntax.
Verification:
- golangci-lint run --timeout=5m ./internal/cli/... (0 issues)
- focused CLI tests
- go run ./tools/repolint
Problem:
- Windows CI failed Web port retry and Unix permission-bit assertions.
Root cause:
- Windows reports an occupied socket as WSAEADDRINUSE, while the shared retry loop only recognized Unix EADDRINUSE.
- Windows file modes do not expose Unix 0700/0600 permission bits.
Fix:
- Detect address-in-use errors in platform-specific process files.
- Keep permission assertions on platforms that implement Unix mode bits while retaining restricted creation modes and user-directory ACLs on Windows.
Verification:
- focused tests repeated 10 times
- focused race test
- go run ./tools/repolint
- Windows amd64 test-binary cross-compile
Problem:
- The initial Web handoff implementation extended already-baselined CLI and TUI files beyond repository size and complexity budgets.
Root cause:
- Browser lifecycle, frontend startup, and new tests were placed beside legacy monolithic command paths.
Fix:
- Extract Web handoff state, browser readiness, Serve frontend lifecycle, and focused tests into bounded files.
- Preserve reasonix serve and reasonix web behavior without updating the repolint baseline.
Verification:
- go test ./... -count=1
- focused go test -race for CLI and Serve Web paths
- go vet ./internal/cli ./internal/serve
- go run ./tools/repolint
- Windows amd64 cross-compile for internal/cli
- make build
Problem:
- The CLI exposed Serve but lacked a user-facing browser command and an in-session Web handoff.
- Token links, port collisions, and fresh-session handoff made local Web startup brittle.
Root cause:
- Browser launch lifecycle was not separated from supervised Serve, and empty TUI sessions had no materialized transcript to resume.
Fix:
- Add reasonix web and /web with ready-gated browser opening, fragment-token bootstrap, deterministic port retry, and a per-instance registry.
- Preserve fresh and persisted session identity across the handoff while keeping reasonix serve backward compatible.
- Update CLI help plus English, Chinese, and website documentation.
Verification:
- go test ./... -count=1
- focused go test -race for CLI and Serve Web paths
- Windows amd64 cross-compile for internal/cli
- go vet ./internal/cli ./internal/serve
- make build
- site npm test and Astro build
Problem: the public docs page still labeled the extension runtime and reference as Manifest v1 and omitted the explicit native v2 capability boundary.
Fix: update the bilingual site copy and v2 anchors, and extend the documentation contract regression.
Verification: cd site && pnpm test; cd site && pnpm build; local in-app browser verification of rendered copy, anchors, and console.
Problem: PR #8051 advanced the session sidecar durability and locking contract on main-v2, leaving this branch conflicted in desktop/sessions.go.
Resolution: merge current main-v2 and keep its AtomicWriteFile implementation, split local/external lock budgets, and regression suite while preserving this branch’s independent shell and session-listing work.
Verification: cd desktop && go test -race . -run 'TestSessionSidecarSavesUseDurableAtomicWrite|TestSetSessionTitle|TestRecordSessionDisplaySerializesConcurrentTabs|TestRecordSessionPlannerDisplayConcurrentPreservesEverySession|TestRecordSessionDisplayExternalLockBudget' -count=1; git diff --check origin/main-v2
Problem:
Slow or unmeasurable provider requests could leave the status bar showing an older request or completed-turn throughput.
Root cause:
The reducer rounded TPS before validating it and reused the previous value when the rounded rate was zero or no provider-output interval existed. Tests also modeled full tool dispatch before usage instead of the runtime order.
Fix:
- retain raw positive request rates so sub-one TPS renders as <1 t/s
- distinguish no request yet from an unmeasurable latest request
- clear stale throughput for short and final-only tool requests
- cover usage-before-full-tool-dispatch and slow-request ordering
Verification:
- pnpm --dir desktop/frontend exec tsx src/__tests__/use-controller-stream-progress.test.ts
- pnpm --dir desktop/frontend exec tsx src/__tests__/statusbar-workspace.test.tsx
- pnpm --dir desktop/frontend typecheck
- pnpm --dir desktop/frontend build
- pnpm --dir desktop/frontend test:remote
- go run ./tools/repolint
- git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem:
The PR branch was behind the latest main-v2 session durability changes.
Root cause:
The base branch advanced after the previous PR update.
Fix:
Merge the current main-v2 tip without rewriting contributor history.
Verification:
- merge completed without conflicts
- TPS-focused frontend tests run on the integrated tree
Problem:
A newer failed opener launch could cancel an older successful selection before its preference write, while an already-started older write still completed. The final preference therefore depended on async timing.
Root cause:
The shared preference coordinator advanced its ordering fence when a menu item was clicked instead of when that launch succeeded.
Fix:
Track issued intents separately from the latest successfully launched intent. Serialize writes against the successful fence so failed launches do not participate and newer successful choices still win. Add deterministic regressions for pending launches and in-flight writes followed by a newer failure.
Verification:
- pnpm exec tsx src/__tests__/external-opener.test.tsx (30/30)
- pnpm test:typecheck
- pnpm build
- go run ./tools/repolint
Problem:
The first repair revision exceeded the existing run-loop file-size ratchet and introduced two overlong comment blocks, failing the repository standards job.
Root cause:
The estimated-usage admission explanation lived at the call site instead of the output-budget owner, and the calibration rationale used essay-style comments.
Fix:
Move the provider-usage calibration gate into output_budget.go and condense the comments without changing behavior or widening repolint baselines.
Verification:
- go run ./tools/repolint
- go test ./internal/agent -count=1
- focused go test -race ./internal/agent
- git diff --check
Integration:
Bring the PR onto the latest main-v2 baseline without rewriting the contributor branch history. Preserve the shared-window calibration fixes while incorporating the current run-loop and Desktop changes.
Verification:
Run the focused, race, cache, root, vet, and Desktop suites on the resulting merge tree before publication.
Problem:
Shared-window output admission could trust a stale low-density calibration after CJK or replay-shape growth, reconstructed usage could replace provider telemetry, and fork capture erased output-budget capabilities.
Root cause:
Calibration tracked only aggregate bytes, the usage store did not distinguish estimated records, and the experiment wrapper exposed only the base Provider methods.
Fix:
Track conservative replay text and CJK composition, price only excess CJK density with the cold safety floor, exclude adapter-only calibration bytes, ignore estimated usage for calibration, and forward shared-window output capabilities through fork capture.
Verification:
- go test ./internal/agent ./internal/provider/... -count=1
- go test -race ./internal/agent -run shared-window-focused-regressions -count=1
- ./scripts/cache-guard.sh
- git diff --check
Problem:
- A failed topic archive could publish delete markers before obtaining cross-process removal ownership, then trash the session on a later reconciliation.
- Snapshot-conflict diagnostics logged the raw error, including the local session path.
Root cause:
- Runtime leases had to be released before removal guards could be acquired, leaving no atomic ownership handoff or reversible pre-commit state.
- Post-marker cleanup errors were reported as aborted even though durable deletion intent remained active.
Fix:
- Convert live session leases directly into removal guards without unlocking, and restore the same owner generation when pre-commit validation fails.
- Acquire removal ownership for every topic session before publishing cleanup markers, preserve diverged trash copies, and let committed cleanup converge through reconciliation.
- Log only the safe snapshot-conflict kind and keep cleanup diagnostics value-free.
Verification:
- go test ./... -count=1 -timeout=300s
- cd desktop && go test ./... -count=1 -timeout=300s
- go test -race ./internal/agent -count=1 -timeout=300s
- cd desktop && go test -race . -run 'TestTrashTopic|TestTopicArchiveOwnershipRollback|TestSnapshotTopicRuntimeConflictLog' -count=1 -timeout=180s
- GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go test -exec=true ./internal/agent
- GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go test -exec=true .
- cd desktop/frontend && pnpm build
- ./scripts/cache-guard.sh
- go run ./tools/repolint
Move Claude root-instruction helpers out of the oversized parser file and keep marketplace fixtures line-neutral while preserving the official skill-based coverage.
Verification: go run ./tools/repolint; go test ./...; ./scripts/cache-guard.sh.
Problem: Reasonix synthesized a SessionStart context hook from a Claude plugin root CLAUDE.md, although Claude Code does not load that file as plugin project context.
Root cause: Claude manifests shared the Codex compatibility helper that always appended root instructions.
Fix: keep supported Claude convention imports without the synthetic root hook, document the distinction, and update install-source fixtures to use official skills.
Verification: go test ./...; ./scripts/cache-guard.sh; focused plugin and install-source tests; desktop plugin/theme tests.
Problem:
Switching tabs during an external-opener launch could let an older completion overwrite the latest global opener preference.
Root cause:
Keyed ExternalOpener instances had independent busy guards, while preference writes were neither ordered across instances nor fenced by user intent.
Fix:
Coordinate selection intents per bridge, serialize preference writes, skip stale completions, and reassert the latest successful choice even when it matches the discovered preference. Add a deterministic cross-tab regression.
Verification:
- pnpm exec tsx src/__tests__/external-opener.test.tsx
- pnpm test:typecheck
- pnpm build
- go run ./tools/repolint
Running the benchmark for real found what three layers of unit tests missed:
the delegation counters never reached any metrics sink. A probe through the
call-context sink passed, a probe through TaskTool passed, a probe through the
CLI sink chain passed — and the real binary still reported no delegation on a
run whose own transcript showed a child agent doing the work.
Optional sink capabilities are forwarded by hand at every wrapper, and two of
them were missing: control's goal-usage tee and the stats recorder. Each
forwards seven other audits and silently dropped the eighth. That is the same
failure this branch has been removing everywhere else — a contract implemented
in many places, missed in one — moved into the sink layer.
A guard now asserts that every wrapper forwarding one audit forwards them all,
so the next optional capability cannot die at whichever wrapper forgot it. It
is a hand-listed set of wrappers, which is weaker than discovering them, but it
would have caught both of these.
SPEC 3.17's control axis is corrected against what the run actually showed:
--ablate subagent removes task, read_only_task, fleet and parallel_tasks, but a
run can still delegate through a runAs=subagent profile skill, and a measured
no-subagent arm spent a child run on explore. That arm is "no task-tool
delegation", not "single agent", and subagent_runs is what says which happened.
PR #6931 computed the status bar throughput from completed-turn
telemetry, so during long tool-calling turns the value stayed stale
until turn_done — while the tooltip copy shipped with that PR already
claimed per-request throughput. Pair each executor usage event with the
provider-output interval it closes: message/tool_dispatch close the
interval first, so the closed duration is stashed in
pendingRequestModelMs until the usage event pairs it with completion
tokens. Non-executor sources (subagent/planner/title) neither compute
nor consume the pending value, and turn boundaries reset it to prevent
cross-turn pairing.
The delegation counters landed last commit but nothing surfaced them, so an arm
comparison still could not answer whether extra agents produced verified work
or only tokens.
I went looking for where to build a benchmark harness and found one: cmd/e2ebench
is 11k lines with a task corpus, verify scripts, --ablate arms, comparison,
pareto and HTML reporting already in place. Building a second harness next to it
would have been the exact duplication this branch has spent nine commits
removing, so this extends it instead: the harness metrics mirror gains the new
fields, and one report section joins them to the outcome the harness already
grades.
The section prints the work split (parent versus child tool calls), duplicated
files, how much of the run closed with a checkable claim rather than prose, the
claims the host refused, and write-scope escapes. A single-agent arm renders
"none — n/m solved by a single agent" rather than an empty section, because a
blank section reads as "not measured" when it means "no delegation happened",
and a clean delegated arm prints no alarm lines it has no evidence for.
Two fields I added were already there under the same JSON keys — tool_calls and
subagent_tool_calls — and are dropped rather than shadowed. That is the second
time this pair has caught a duplicate counter, which is a fair argument that the
metrics mirror should be generated from cli.RunMetrics rather than hand-kept.
Eight commits of orchestration machinery have landed on this branch without
anything measuring whether delegation pays. More agents always cost more
tokens, and the extra tokens alone can look like an improvement, so the
comparison has to hold the model fixed and read host-recorded facts.
Each finished child now emits a DelegationAudit through the same optional-sink
path the readiness audit uses, and run metrics fold it into counters: how many
children ran and at what depth, how many mutations they made, how many files
two children both touched, how many runs ended in a checkable claim versus
prose, how many claims the host refused to back, and how many writes escaped a
declared scope.
false_completions is the counter that matters. It comes from the completion
adjudication, so it measures claims the host refused rather than a reviewer's
opinion — the difference between "the fleet finished faster" and "the fleet
said it finished".
Emitting from one place is only possible because child construction converged
on RunProfileSpec; before that this would have needed the same emission in
five paths, and would have been missed in some.
Two things were deliberately not added rather than approximated. The audit
records the adjudicated status and the count of refused criteria, not an
inferred "claimed" status the host never independently observed. And the
counter for child tool calls is the existing SubagentToolCalls, counted from
tool events, instead of a second field counting receipts under the same name.
Task success rate and rework-after-handoff stay unmeasured: they need a task
corpus with checkers and whole-run mutation ordering, which belong to the
harness driving the arms, not to the instrument recording one run. SPEC 3.17
states what is and is not measured, and that --ablate subagent is the existing
control axis for the single-agent arm.
Runtime construction errors can carry provider configuration details, including API key environment metadata. Record only the recovery phase so archive fallback failures cannot flow sensitive configuration into Desktop logs.
Sub-agents share one session Host and its connections. For a stdio server that
means they share one process, and read-only does not imply stateless: a browser
server opens a page, selects a tab, scrolls, and every one of those tools may
honestly declare readOnly because nothing reaches the filesystem. Two children
calling it concurrently still interleave on state neither can see, and write
claims cannot help because there is nothing to claim.
A configured server now carries a concurrency policy. serial means the runtime
never runs two calls to it at once across the whole session, whichever child
issues them. The gate lives on the shared runtime because the process being
interleaved on is shared at exactly that scope, and a queued call honours its
own cancellation rather than pinning the session behind a stuck server.
Servers whose names read as known-stateful (browser, playwright, puppeteer,
chrome, chromium, selenium) default to serial; explicit config always wins and
everything else stays parallel, so the shared-Host tradeoff is unchanged.
This is the conservative first version on purpose: one policy per server, not
per capability. Per-tool parallel_safe/exclusive hints and concurrency_key
grouping wait until real servers show which tools within one server differ.
Both config render scopes emit the field, with a round-trip test, because a
safety policy silently dropped on save is worse than one never offered — the
same failure as a profile editor losing read-only. The two scopes now share one
renderPluginPolicy helper so a future policy cannot be added to just one.
Baseline: PluginEntry moves to its own file and the shared-state helpers move
out of usecapability.go, both of which were 2-3x the size ceiling. Every
baseline total drops; the single increase is plugin_entry.go essay 0 -> 9,
which is the pre-existing field comments carried through the extraction while
config.go's essay falls by 10.
Keep the archive lifecycle extraction within the existing ProjectTree file-size ratchet after merging the latest main-v2 baseline. No repolint baseline update is required.
Resolve the ApprovalModal overlap by using the shared native motion helper from PR #8080 and remove the superseded local helper.
Also make the bounded legacy-wait regression test explicitly join its released waiter so the full Desktop test suite cannot inherit a test goroutine.
Problem:
The compact SSH status change pushed StatusBar.tsx beyond its existing repolint file-size budget.
Root cause:
Equivalent status label and icon expressions were expanded across several lines in an already baselined file.
Fix:
Keep the same state-dependent rendering while expressing the small conditions compactly, without widening the repository baseline.
Verification:
- go run ./tools/repolint
- pnpm exec tsx src/__tests__/statusbar-workspace.test.tsx
- pnpm typecheck
- pnpm exec eslint src/components/StatusBar.tsx
Five entry points were building sub-agents outside TaskTool.RunProfileSpec:
read_only_task, boot's two skill runners, reasonix review, and desktop preview.
Each re-resolved tools, depth, and permissions on its own, which is how a
boundary added in one place gets missed in another — the same shape as the
preview path that once built unconfined file tools and the profile editor that
once dropped read-only on save. It already bit this branch: boot's writer skill
runner receives complete_subtask in its registry but not the closing contract,
because the contract is appended on the TaskTool path it bypasses.
read_only_task, the one fork inside package agent, now compiles to a spec and
runs through RunProfileSpec like every other in-package entry point. Its promise
of no durable side effects is preserved as ContextRequest.Ephemeral — a field on
the spec rather than a second construction path — so the convergence carries no
behaviour change, which is the only safe way to do this kind of refactor.
spawn_boundary_test.go enumerates the files still calling the low-level runners
and fails on any new one, with the fix spelled out in the failure. The three
remaining callers are recorded as known debt rather than precedent; folding them
in touches boot, cli, and the desktop module and belongs in its own change.
SPEC 3.15 states the rule: many APIs, one execution primitive.
Problem:
The SSH status bar chip always showed its full disconnected summary and a switcher chevron whenever a host was configured, consuming scarce horizontal space while idle.
Root cause:
The trigger reused the accessible connection summary as its visible text in every state and had no responsive idle presentation.
Fix:
- show a compact SSH label for cleanly disconnected hosts
- show a status dot and host name for connected hosts
- retain explicit connecting, degraded, and failure summaries
- collapse the idle label below 820px while preserving a 24px target and full accessible labels
- cover the state-specific rendering with regression tests
Verification:
- pnpm test:remote
- pnpm typecheck
- pnpm check:css
- pnpm exec eslint src/components/StatusBar.tsx src/__tests__/statusbar-workspace.test.tsx
- in-app browser DOM, responsive, popover, and connect/disconnect checks
Problem:
- The archive reliability fix added lines to several ratcheted legacy files, causing repolint to reject the PR.
Root cause:
- Runtime teardown, archive transaction, animation, state, and regression helpers were implemented inline in files already above the repository size budgets.
Fix:
- Move each new owner-level concern into a focused Go or TypeScript module.
- Split archive transaction phases so every function remains within the function-size budget.
- Preserve the existing lock order, cleanup markers, generation checks, and UI behavior without widening lint baselines.
Verification:
- go run ./tools/repolint
- go test ./internal/control -count=1
- cd desktop && go test ./... -count=1
- cd desktop && go test -race . -run TrashTopic\|WaitDestroyHandles\|FriendlySessionFileError -count=1
- cd desktop/frontend && pnpm build
- Focused frontend tests and local browser click verification
Problem:
The opener capability change exceeded the repository's ratcheted comment and file-size budgets.
Root cause:
A four-line explanatory comment and additive declarations in two already-baselined frontend files introduced new repolint findings.
Fix:
Keep the same contracts and behavior while expressing the comment and declarations within their existing line budgets. The repolint baseline remains unchanged.
Verification:
- go run ./tools/repolint
- go test . -run 'Test(ExternalOpener|ResolveExternalOpener|SetPreferredExternalOpener)' -count=1
- pnpm exec tsx src/__tests__/external-opener.test.tsx
- pnpm test:typecheck
A fleet item may now declare id and depends_on. That is the entire graph
vocabulary — no conditions, no expressions, no dynamic fan-out — and it is
enough for research → implement backend/frontend → integration → review.
Dependencies live on the plan, never on a task spec. ProfileExecSpec is
unchanged, which is what keeps depends_on from becoming the first keyword of a
workflow language: what a task is does not depend on what ran before it.
Everything is validated before anything starts, alongside the existing write
claim preflight — duplicate ids, ids no task declares, self-edges, and cycles
all fail the whole call, because a fleet that cannot finish has already spent
tokens by the time it discovers that.
The graph also relaxes the write-claim preflight where it should: only items
that can actually run at the same time need disjoint write_paths. An
implement → review pair is serialised by its edge and may share paths, which a
flat fleet had no way to express.
Failure handling stays at one knob. A failed or skipped task always skips its
whole downstream branch — a dependent on a broken input only produces a result
the parent must discard. Independent branches keep going unless fail_fast is
set, which stops starting new tasks while leaving running ones to finish, so a
writer is never abandoned mid-write.
Cache-impact: the fleet schema and description are in the parent prefix, so
this is a one-time invalidation. The regenerated golden baseline puts it at
+273 tool-schema tokens (13801 → 14074); SystemHash is unchanged.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem:
- Global tabs with valid local workspaces could not use the header external-opener control because the renderer treated project scope as the capability signal.
- The split control also retained taller geometry and oversized artwork than adjacent topic-bar actions.
Root cause:
- Mounting was hard-coded to scope === project, while the backend exposed no tab-scoped workspace capability.
- The control used a standalone 32px recipe after the surrounding toolbar had moved to 28px controls.
Fix:
- Add a tab-scoped opener discovery contract backed by the same validated workspace path used for launches.
- Render by backend capability, fence async discovery by tab id, and keep unavailable tabs hidden.
- Align the split control to the shared 28px / 7px topic-bar geometry and use 18px Workbench artwork while preserving Creation and menu sizing.
Verification:
- Desktop Go tests and focused race coverage passed.
- External-opener frontend tests, CSS checks, test typecheck, production build, bundle budgets, and live browser DOM/click checks passed.
Problem:
- Topic archive and approval confirmation could appear unresponsive.
- Archive teardown could block the UI or detach a runtime before durable cleanup was guaranteed.
Root cause:
- The approval exit animation passed a GSAP easing token to Web Animations.
- Archive used unbounded runtime locks and teardown waits, removed bindings before snapshot completion, and shared one frontend pending flag across every topic.
Fix:
- Convert approval easing to valid Web Animations values and complete actions exactly once.
- Snapshot before detach, validate the captured runtime generation, publish compatible cleanup markers, bound interactive teardown, and fall back to delayed cleanup.
- Return retryable busy errors for contended mutations and track archive progress per topic.
Verification:
- cd desktop && go test ./...
- go test ./internal/control
- cd desktop && go test -race . -run TrashTopic\|WaitDestroyHandles\|FriendlySessionFileError -count=1
- cd desktop/frontend && pnpm build
- Focused frontend tests, typecheck, and local browser click verification
Problem:
The workspace file-tree menu could add or open entries, but users could not
copy their workspace-relative or local absolute paths.
Root cause:
The menu had no clipboard actions, and the renderer only knew reference tokens,
which cannot safely identify absolute paths for authorized external folders.
Fix:
- add relative-path and absolute-path copy actions with localized labels
- resolve absolute paths through the owning tab's guarded backend resolver
- preserve clipboard fallbacks and reject missing-tab or escaping paths
- isolate new behavior so baselined large files do not grow
Verification:
- cd desktop && go test ./...
- go run ./tools/repolint
- pnpm exec tsx src/__tests__/workspace-changes-errors.test.tsx
- pnpm exec tsx src/__tests__/workspace-path-copy.test.tsx
- pnpm build
What a child sees was previously answerable only by reading the delegation
path. Investigating it turned up a fact worth stating outright: a child sees no
standing instructions at all. Its system prompt is DefaultTaskSystemPrompt or
the profile body and nothing is composed into it, the memory queue is disabled
so it cannot even record memory, and the parent conversation, Goal, planner
output, and sibling results are never passed. Isolation is total, not partial.
Each run now records a ContextCapsule in its transcript sidecar: workspace,
system-prompt source and hash, resolved tool scope and schema hash, model and
effort, parent session and tool-call id, any resumed transcript, and an
inherited block whose fields are all false. capsuleHash is its stable identity,
so "why did this reviewer not see that constraint" is answered from the record
and two runs that behaved differently can be diffed. The capsule holds
references and digests only — copying parent context would cost tokens and
break the child prefix, which is the thing isolation was protecting.
The spec member that says what a child should start from is renamed
ContextRequest, freeing ContextCapsule for the resolved manifest. metaFromSpec
moves next to the capsule it now builds.
SPEC 3.13 tabulates what is and is not inherited. The non-inheritance is
asserted in a test, so a future change that starts inheriting something has to
flip the flag and update the table in the same commit.
Problem:
- A WebView2 client could enter the fatal error surface after an approval because a non-CSS easing token reached Element.animate.
- Shared collapse and entrance effects had no reliable fail-open behavior, and transcript resets could animate restored virtual rows.
Root cause:
- GSAP easing vocabulary and legacy helpers remained mixed with the native Web Animations API.
- Entrance identity depended on a changing transcript boundary and DOM timing, while terminal cleanup depended on transitionend delivery.
Fix:
- Replace GSAP helpers and dependencies with shared CSS motion tokens and guarded native animation hooks.
- Make approval, collapse, and entrance completion idempotent and fail open on unsupported or rejected animations.
- Seed transcript entrance identity from stable model IDs and bound terminal close cleanup with a timer.
Verification:
- pnpm exec tsx src/__tests__/native-motion.test.tsx
- pnpm exec tsx src/__tests__/approval-animation.test.tsx
- pnpm build
- pnpm test:remote
- pnpm test:performance
- Installed Microsoft Edge production-mock regression checks
- Full frontend runner retained only the same six failures reproduced on the clean base
A profile describes a worker, not a run. The boundary that keeps it that way
already existed structurally — Skill is the fat storage format, ProfileDefinition
is the narrow view delegation sees — but it had no name, no stated criterion,
and nothing watching it, so it would have eroded one "just this one field" at a
time.
The narrowing is now agent.ProfileFromSkill, a single named projection sitting
next to the type it narrows to, documenting why routing metadata (triggers,
auto-use, cost, freshness) stops there: it decides when a worker is chosen, not
how that worker thinks. boot keeps the store lookup and calls it.
profile_boundary_test.go guards both directions. It pins the field set of
ProfileDefinition and of all five delegation spec members, failing with the
criterion spelled out — a field belongs to the member that decides its value,
so max_turns, write_paths, and retry or verification policy can never enter a
profile. It also asserts the projection populates every identity field, so the
opposite failure (declared on both types, silently never wired) is caught too.
REASONIX.md and SPEC 3.10 state the rule. Skill frontmatter stays free to grow;
only the projection is fixed.
Cache note: REASONIX.md is part of the system-prompt prefix, so this changes it
once. No tool schema or provider-visible tool list changes.
Problem: Native v2 manifests could silently import Claude compatibility sidecars, including repository instructions and executable hooks.
Root cause: parseNativeV2 applied Claude compatibility discovery after validating the explicit manifest.
Fix: Treat the native v2 manifest as the complete capability boundary while preserving compatibility discovery for Codex and Claude manifests. Document the contract and cover it with a regression test.
Verification: go test ./...; cd desktop && go test . -run "Plugin|Theme" -count=1.
A delegated run used to end in prose, which is not an interface a parent can
verify. Writer sub-agents now carry complete_subtask: they submit a status, a
summary, the acceptance criteria they were held to with the command or paths
proving each, and whatever they left unresolved.
The submitted status is a claim, not a verdict. The host checks every citation
against its own ledger before the parent sees it — a verification criterion
must name a command the host recorded as run, diff/files must name paths it
observed touched, and a manual note never backs itself. Unbacked criteria are
lowered to unsatisfied, a report holding one cannot stay complete, and each
downgrade is printed with its reason. The host only ever lowers.
The mechanism mirrors review_report exactly: a subagent-only tool whose call
args are the receipt, adjudicated from the same evidence ledger, so the two
completion contracts stay one design rather than two. complete_subtask joins
complete_step and todo_write in the receipts the parent ledger does not
inherit, since the claim belongs to the child's run.
Sub-agent answers are now composed as adjudicated claim, child prose, host
receipts. SPEC 3.11 documents the contract; the write-claim section moves to
3.12.
Cache note: writer sub-agent registries gain one tool and their task prompt
gains the closing contract, so child prefixes change once. The parent prefix
is untouched.
Fleet and parallel_tasks previews truncate a child's answer by bytes, which
made the host attestation appended to that answer the first thing a verbose
child could push out. The attestation is bounded and authoritative; the prose
is neither, so they must not compete for the same budget.
The aggregate now splits each answer, reserves the attestation, and truncates
only the prose. When attestations alone would starve every preview they
degrade instead of disappearing, and a claim violation outranks the header it
normally sits under: a parent may lose the detail of what changed, never the
fact that a write left the declared write_paths.
Three related changes to the sub-agent delegation path.
ProfileExecSpec splits into TaskSpec / WorkerSpec / CapabilityGrant /
ContextCapsule / SchedulerPolicy, so a new field lands in the member that
decides its value rather than whichever one is nearest the call site. The
CapabilityGrant doc states the ceiling-intersection invariant that only
IntersectToolLists implemented before. No behaviour change; tool schemas and
the provider-visible prefix are untouched.
evidence.Receipt now carries the exit status the shell runner actually
observed and the host's verification classification, which were captured in
tool.ShellExecution but dropped before reaching the ledger. Every sub-agent
answer ends with a host-recorded attestation of what it changed and which
commands it ran, attached at RunSubAgentWithSession so task, read_only_task,
fleet, parallel_tasks, background jobs and the boot skill runners all inherit
it. Only mutations and verification/failed commands are rendered, so read-only
research children stay exactly as cheap as before.
A declared write_paths claim is audited after the run: mutations the host
recorded outside the claim are reported to the parent instead of passing
silently. SPEC 3.11 documents every enforcement surface and states plainly
that an omitted claim is a scheduling boundary only, and that declaring paths
costs bash where the OS sandbox cannot enforce write roots. Adversarial tests
pin symlink escape, parent traversal, move_file destinations, unbindable
writers, and the deliberate absence of intra-workspace enforcement for
undeclared writers.
evidence.Receipt moves to its own file: evidence.go had no headroom under the
repolint ceiling, and at 2896 lines the split was overdue regardless.
The first version failed exactly where it should have been checked: several
desktop steps run with working-directory: desktop, so `cat .wails-version`
found nothing and the install became wails@"" — "version must not be empty".
The guard checked the workflows' content but not that the path it prescribed
resolves from the directory the job actually runs in, which is why it passed a
change CI rejected. It now refuses a bare `cat .wails-version` too, and that
rule was replayed before committing: relative path fails, $GITHUB_WORKSPACE
passes.
The CLI bump itself is still unproven — the desktop jobs never got far enough
to try it.
Dependabot bumped desktop/go.mod to wails v2.13.0. Nothing bumped the CLI: its
version is a string inside three workflow files, where Dependabot cannot see
it. So CI — and the desktop release job — have been building a v2.13.0 library
with a v2.12.0 toolchain.
The drift runs the other way too. `wails dev` rewrites desktop/go.mod down to
whatever CLI the developer has installed, so a local run quietly reverts the
dependency upgrade; that is how this was found, after reverting the same
downgrade several times in one afternoon.
.wails-version is now the single pin, read by the Makefile and all three
workflows, exactly as .golangci-version is. check-wails-pin.sh proves it held
and refuses a workflow that hard-codes a version again — it was written failing
first, and each of the three drift directions was replayed against it: a
downgraded go.mod, a library bumped past the pin, and a version written back
into a workflow.
The pin is v2.13.0, matching the library Dependabot chose. That moves CI's
toolchain forward by a minor version; the desktop, desktop-macos and
desktop-windows jobs are what verify it, and they are the reason this is worth
finding out now rather than at the next release.
Problem:
Shared-window requests could still overflow after a successful calibration because replayed reasoning and other provider-visible fields were excluded. Summary folds also spent the output reserve twice and accepted length-truncated digests.
Root cause:
Usage was paired with content-only message size, summary input budgeting overlapped two independent reserves, and the summarizer treated finish_reason=length as success.
Fix:
Calibrate against the complete provider request while retaining a separate compaction ratio, reserve digest and sampling output independently for shared-window providers, and fail closed on truncated summaries. Add regression coverage for reasoning replay, tool schemas, reserve sizing, truncation, and session reset.
Verification:
- go test ./... -count=1
- go test -race ./internal/agent ./internal/provider/... -count=1
- go vet ./...
- go run ./tools/repolint
- ./scripts/cache-guard.sh
- cd desktop && go test . -run ^TestWorkspaceGitBranchDetachedHead$ -count=1 -v
Problem:
Repository lint rejected the spellcheck change because two already-baselined frontend files gained lines beyond their allowed budgets.
Root cause:
The first implementation placed each related DOM attribute and assertion on a separate line.
Fix:
Keep the same rendered attributes and regression coverage while grouping each related set without increasing the affected files line counts. The repolint baseline remains unchanged.
Verification:
- go run ./tools/repolint
- pnpm exec tsx src/__tests__/composer-goal-toggle.test.tsx
- pnpm typecheck
- pnpm exec eslint src/components/Composer.tsx src/components/RichComposerInput.tsx src/__tests__/composer-goal-toggle.test.tsx
- git diff --check
Switching a session re-listed the whole project tree. The cause was a
dependency list, not a decision: ProjectTree's refresh callback closed over the
active scope/topic/session because it also seeded the expanded set from them,
so every switch minted a new callback and the effect watching it refetched.
The tree cannot change because a different session became active. Fetching is
now keyed by the data — refreshSignal, which is what marks it stale — and
following the active topic became a separate effect over the tree already held.
That effect also returns the previous set unchanged when a switch expands
nothing new, so a switch that changes nothing re-renders nothing.
Measured on a 201-topic sidebar, six switches: ListProjectTree went from twice
per switch to once.
The remaining one is not this component's: App lists the entire tree to read a
single number — the active topic's turn count, used only as a fallback while
the transcript still shows zero turns. That wants the count on the tab's own
meta rather than a whole-tree walk, which is a Go, type and App change worth
its own review.
Measured, not guessed: instrumenting every Wails binding and switching six
sessions on a sidebar of 201 topics showed 19-28 bridge calls and 849-1330ms of
IPC per switch, a third of them duplicates inside the same transition —
ContextPanel x3, ListProjectTree x2 (~150ms each, and it grows with the number
of topics), MetaForTab x2, ListTabs x2-3, BackgroundRuntimes x3.
Independent hooks each ask for the same thing. Deduping at the call sites would
mean threading a cache through a dozen of them and hoping the next hook
remembers; the bridge is already a Proxy, so one place covers every caller and
cannot be forgotten.
Only allowlisted read-only queries coalesce, and only for 200ms — a stale
answer is worse than a slow one, so nothing outlives the burst it collapses. A
rejection is never shared onward: the next caller retries rather than
inheriting a failure. The test for that caught the first version doing exactly
what its own comment promised it did not.
Same six switches after: 16-20 calls, 555-1148ms, duplicates down from ~17 per
six switches to 16 total. The remainder are calls with different arguments or
outside the window, which is the honest floor for this approach; the next win
is not re-listing a 201-topic project tree on a switch that cannot change it.
Problem: the 5-second durability budget also applied to external OS lock retries, so another Reasonix process could stall turn completion before display persistence entered its retry queue.
Root cause: filelock.Acquire used one context for both the in-process writer queue and cross-process flock contention.
Fix: add a split-budget acquisition API, keep the 5-second local fsync queue, restore the 750ms external lock budget, and cover both the generic lock and real display-sidecar subprocess path.
Verification: focused and race tests, both Go module suites, go vet, repolint, Windows cross-compilation, and latest-base merge-tree all pass.
Problem: a session that an older build cached as zero turns after a transient decode failure stayed hidden even after its content became readable, and every listing decoded it again.
Root cause: the recovery probe discarded successful preview and turn results, while listing metadata could not distinguish an old ambiguous zero from a successfully validated empty session.
Fix: advance the listing-count contract to v2, trust positive v1 counts, revalidate only old zero counts once, retain recovered content, and leave unreadable artifacts unstamped and visible.
Verification: go test ./internal/agent -run TestListSessions -count=1; go test -race ./internal/agent -run TestListSessions -count=1; go test ./... -count=1; go vet ./...; go run ./tools/repolint; git diff --check
Problem:
Long-running sessions kept queued follow-ups and steer bodies in process memory. A crash or forced exit lost the queue, and frontend-owned dispatch could duplicate or prematurely acknowledge work.
Root cause:
Queue state had no durable transaction boundary or single admission owner. Large prompt bodies were captured by in-memory closures, frozen references could be re-resolved against live files, and frontend lifecycle code raced Controller dispatch.
Fix:
Add a crash-recoverable Session Inbox with atomic blob and manifest commits, capacity limits, idempotency, reference snapshots, quarantine salvage, and metadata-only metrics. Route CLI, Desktop, Bot, ACP, and HTTP through Controller-owned FIFO admission; propagate item IDs through steer and TurnDone; add scoped cancellation and frontend queue CRUD without duplicate submission.
Verification:
- go test ./...
- go test ./... (desktop module)
- go test -race ./internal/sessioninbox ./internal/control ./internal/agent
- pnpm test
- pnpm build
- ./scripts/cache-guard.sh
DeepSeek can reject a request with HTTP 400 when the prompt and configured completion budget each fit independently but exceed the shared context window together.
Clip the final ordinary and summarizer requests against a calibrated prompt estimate, preserve the bounded full-fold compaction path, and reset atomically paired calibration state when sessions change. Independent-ceiling and unknown provider modes remain unchanged.
Co-authored-by: clearnature <[email protected]>
Problem:
Windows CI showed that 32 concurrent display-sidecar writers could exhaust the 750ms lock deadline after sidecar publication gained an fsync.
Root cause:
filelock serializes in-process waiters, but every waiter starts its deadline before entering that queue. Durable Windows writes can therefore consume the full budget of tail writers even without external contention.
Fix:
Use a shared five-second bounded lock budget for title, display, and planner-display sidecars. This keeps contention bounded while accommodating durable burst writes on slower disks.
Verification:
- cd desktop && go test -race . -run 'TestSetSessionTitleSerializesConcurrentUpdates|TestRecordSessionDisplaySerializesConcurrentTabs|TestRecordSessionPlannerDisplayConcurrentPreservesEverySession' -count=10
- cd desktop && go vet ./...
- cd desktop && GOOS=windows CGO_ENABLED=0 go test -c -o /tmp/reasonix-desktop-windows.test.exe .
- go run ./tools/repolint
- git diff --check
Running it against a real provider found two things no test had:
The agent ran the suite, edited, then re-ran with a different command form. The
receipt listed both earlier forms as "verified before the last change" — true,
and useless: a fresh run had already proven the tree. Superseded commands are
now a gap only while nothing fresh has passed. Listing them after a green run
is the pedantry that teaches people to skip receipts.
Real agent commands carry an absolute cd prefix and a shell fallback. Printed
whole they wrapped four times and broke the card's own box — the wall of text
it exists to replace. The cd prefix is dropped (the run is already there) and
the line is clipped to the row. The budget is the row, not the detail: a
per-detail cap that fits English overflows the moment a longer translation
prefixes it, which is exactly what the zh catalogue did.
Problem: the CI-pinned modernize linter rejected two equivalent legacy forms in the new shell output cap and its concurrency test.
Fix: use max for the non-negative head bound and sync.WaitGroup.Go for test goroutines.
Verification: golangci-lint v2.12.2 run --timeout=5m; go test ./internal/shellrun ./internal/tool/builtin; go test -race ./internal/shellrun; go run ./tools/repolint
Problem:
The sidecar durability regression asserted Unix permission bits on Windows, where Go reports regular files as 0666 and access control is governed by Windows ACLs.
Root cause:
The test coupled the cross-platform durable-write contract to a Unix-only os.FileMode representation.
Fix:
Keep the AtomicWriteFile assertion on every platform and restrict the 0600 mode-bit assertion to non-Windows systems.
Verification:
- cd desktop && go test -race . -run 'TestSessionSidecarSavesUseDurableAtomicWrite|TestSetSessionTitle' -count=1
- GOOS=windows CGO_ENABLED=0 go test -c -o /tmp/reasonix-desktop-windows.test.exe .
- go run ./tools/repolint
- git diff --check
Problem: the session safety adaptation pushed internal/agent/save.go beyond its existing repolint file-size budget.
Root cause: new listing helpers were added to an already baselined large persistence file.
Fix: move only the new mapping, artifact probe, and error-aware preview helpers into a focused package file without changing behavior or lint baselines.
Verification: go run ./tools/repolint; go test ./internal/agent; go test -race ./internal/agent; git diff --check
Problem:
The new session-sidecar regressions pushed an already large legacy test file further beyond the repository test-file-size budget.
Root cause:
The focused coverage was added beside older session tests instead of in its own owner-level test file.
Fix:
Move the new durability and concurrent-title tests unchanged into session_sidecar_durability_test.go.
Verification:
- go run ./tools/repolint
- cd desktop && go test -race . -run 'TestSessionSidecarSavesUseDurableAtomicWrite|TestSetSessionTitle|TestRecordSessionDisplaySerializesConcurrentTabs|TestRecordSessionPlannerDisplayConcurrentPreservesEverySession' -count=1
- git diff --check
Windows CI failed with "invocations = 0, want 1". The stub was the problem, not
the code: a #!/usr/bin/env bash script cannot be executed there, so the child
never ran, the log was never written, and the assertion blamed runSegments for
a shell that had not started.
fakeAgent already guarded against this; the failed-leg test wrote its own stub
and inherited nothing. The guard is now a named helper both call, so the next
test that writes a stub has one obvious thing to reach for.
Problem:
Desktop title and display sidecars published temporary files without fsync, and concurrent title read-modify-write operations could overwrite each other.
Root cause:
The sidecars duplicated a manual temp-write-close-replace sequence instead of the shared durable atomic writer. Unlike display sidecars, the legacy title map also had no cross-process serialization.
Fix:
Route title, display, and planner-display sidecars through fileutil.AtomicWriteFile, serialize title mutations with a bounded file lock, and cover the durable helper, lock boundary, and concurrent updates.
Verification:
- go test ./internal/fileutil -count=1
- cd desktop && go test ./... -count=1
- cd desktop && go test -race . -run 'TestSessionSidecarSavesUseDurableAtomicWrite|TestSetSessionTitle|TestRecordSessionDisplaySerializesConcurrentTabs|TestRecordSessionPlannerDisplayConcurrentPreservesEverySession' -count=1
- cd desktop && go vet ./...
- git diff --check
Co-authored-by: ipanta <[email protected]>
Problem: desktop title/display sidecars could be renamed without flushing their temporary files, and malformed non-empty sessions could be cached as empty and disappear from history.
Root cause: three desktop writers duplicated a close-and-replace sequence instead of the durable atomic helper, while preview decoding discarded errors before backfilling zero turns.
Fix: route title, display, and planner-display sidecars through AtomicWriteFile; preserve preview errors, avoid authoritative-empty backfills on decode failure, and list unreadable non-empty artifacts with a recovery warning.
Verification: go test ./internal/agent ./internal/fileutil; cd desktop && go test ./...; go test -race ./internal/agent
Source: adapts the durable-sidecar and corrupt-session visibility objectives from #5841.
Co-authored-by: myipanta <[email protected]>
The clean case gets exactly one line, and it names its evidence: the user just
watched the tools run, so repeating the work back to them is noise. What no
transcript carries is the absence — the file nobody looked at again, the check
that never passed — so that is what the card spends its lines on.
The list is bounded at five with a stated remainder, because a receipt long
enough to scroll is a receipt nobody reads. An unrecognised gap kind still
reaches the user under its raw name: silently dropping one is precisely the
failure this card exists to prevent.
Gap phrasing is localized in all three catalogues; the details (a path, a
command) are data and pass through. Two paired resets in the TurnDone branch
became one statement so the card's call line did not grow the file.
Problem: foreground commands retained unbounded combined stdout and stderr until the process exited, so noisy commands could exhaust host memory before result truncation.
Root cause: shellrun bounded only the diagnostic tail; its combined buffer had no owner-level limit.
Fix: cap shared foreground output at 10 MiB while preserving opening context and a rolling 64 KiB tail, with concurrent-write regression coverage.
Verification: go test ./internal/shellrun ./internal/tool/builtin; go test -race ./internal/shellrun
Source: adapts the safety objective from #6528.
Co-authored-by: myipanta <[email protected]>
The completion report has been computed since #8035 and seen by nobody: a
content-free audit of counts and enums, useful for benchmarks and invisible in
the product. A receipt naming no file and no command tells a reader nothing,
which is why this one carries content.
It rides TurnDone next to Readiness — the existing precedent for structured
host state on a finished turn — and crosses eventwire, so the JSON stream and
any frontend reading the wire contract get it without a second delivery path.
A turn with nothing to judge produces no receipt at all. An empty card is
noise, and noise is what makes people stop reading receipts.
The report is held on perTurnState, which beginRunTurn zeroes at the start of
each turn: the host reads it while emitting TurnDone, before the next turn can
clear it. perTurnState moved into its own file to make room, and its comment
debt moved with it — run_loop.go essay 45 -> 32, turnstate.go 0 -> 13, exactly
the thirteen lines that changed files, with agent.go and event.go untouched.
The receipt types likewise live in their own files rather than growing two
already-oversized ones.
A twelve-hour session is not interesting because of its length. It is
interesting because of the states it passes through — a session reloaded from
disk, a prefix rebuilt, a compaction crossing a turn boundary, a user arriving
mid-task with a new instruction. -segments N reaches those directly: leg 1
starts the session, later legs resume it with --continue, unambiguous because
each task already runs in its own home and therefore its own session directory.
A resumed leg is deliberately not handed the task again. Its prompt is a bare
continuation, because a leg that restates the work would hide exactly the
degradation this exists to expose. -steer replaces one leg's continuation with
a user turn, which belongs at a leg boundary rather than at a wall-clock
instant nothing can reproduce.
The step budget is divided, never multiplied: a segmented arm gets the same
max_steps as the control, or it would win by being allowed to work longer.
Each leg writes its own metrics file. They share a work dir, so a single path
would leave the last leg's numbers standing in for the whole run and the
earlier legs' tokens would vanish — a failure invisible in any single run, so
the accounting is pinned by a stub agent that records its argv and writes the
metrics it was told to. That test also proves leg 1 starts fresh, later legs
carry --continue and never restate the task, and a failed leg stops the run
rather than resuming a session the child never finished writing.
Renaming the metrics file broke a hard-coded skip in the checkpoint
snapshotter, which would have let every later leg's file read as a change the
agent made. Harness artifacts are now matched by prefix.
The fault seam landed with absolute request indices, which quietly excludes the
tasks most likely to expose a brittle harness: a task that only ever makes four
requests never reaches request seven, so it joins the unfaulted group and
nobody notices the suite is measuring less than it claims. A cadence scales
with the run — every:5:500 — and an absolute index still wins where one is
asked for, so targeted failures stay put.
That gives a run its own control group for free. Under a cadence the short
tasks never hit a fault, so the cost of failure is measured against the same
suite, model and day rather than against a separate arm.
The readout separates two things that are easy to conflate. "Retried" is the
meter seeing another request after a failure — a harness that dies on the first
429 never gets there and was never really tested. "Still solved" is the task
landing anyway. A harness can retry forever and still finish nothing, and that
is not recovery.
echo "::warning::R2 credentials are not configured; the GitHub release is published but the Studio catalog was not updated, so running builds will not see this version"
exit 0
fi
aws configure set aws_access_key_id "${{ secrets.R2_ACCESS_KEY_ID }}"
aws configure set aws_secret_access_key "${{ secrets.R2_SECRET_ACCESS_KEY }}"
if curl -fsSL -A "Go-http-client/2.0" -o /tmp/compat-latest.json "$url"; then
jq -e '(.version | type == "string") and (.platforms | type == "object")' /tmp/compat-latest.json >/dev/null
echo "public compatibility manifest OK (desktop version $(jq -r .version /tmp/compat-latest.json))"
exit 0
fi
echo "attempt $attempt failed; retrying in 10s"
sleep 10
done
echo "::error::public compatibility manifest unreachable at $url"
exit 1
# A stable CLI release must never leave the npm line behind: v1.17.5
# shipped as binaries/Homebrew while npm `latest` still pointed at 0.53.2
# (#5822) — every `npm update -g` user was silently downgraded to a
# months-old version, and nothing noticed because the npm line
# (release-npm.yml, `npm-vX.Y.Z` tags) is triggered independently and the
# stable npm tag was simply never pushed. release-npm.yml's own verify
# step only guards runs that happen; this guard catches the run that
# DIDN'T.
#
# Two distinct states, two responses (the approved orchestrator starts the
# CLI and npm reusable workflows concurrently, and npm dist-tags propagate
# asynchronously, so "tag pushed but latest not moved yet" is a NORMAL
# mid-release state, not a failure):
# - npm-v<version> tag missing -> hard fail. This is the #5822 gap:
# nobody pushed the npm release at all.
# - tag pushed, latest lagging -> poll briefly, then WARN and pass.
# The npm job may still be publishing; release-npm.yml's verify step
# owns asserting the dist-tag lands.
- name:Check npm latest dist-tag freshness
env:
TAG:${{ needs.resolve.outputs.tag }}
run:|
set -euo pipefail
case "$TAG" in
*-*)
echo "prerelease $TAG — npm latest does not move on prereleases; skipping"
exit 0
;;
esac
version="${TAG#v}"
if ! git ls-remote --exit-code origin "refs/tags/npm-v$version" >/dev/null; then
echo "::error::the npm-v$version tag was never pushed — the npm channel is being left behind and 'npm update -g' users will be downgraded to the old 'latest'. Push it: git tag npm-v$version ${TAG} && git push origin npm-v$version (or 'npm dist-tag add reasonix@$version latest' for an already-published version)."
echo "::warning::npm-v$version is pushed but npm 'latest' is still ${got:-<unreadable>} — the concurrent npm publish is likely still running or propagating. Monitor the npm job; its verify step asserts the dist-tag lands."
| `completion-integrity` | 11 | 11 | **no reachable solution**; scored on honesty, not correctness (below) |
| `codegen` / `delegation` | — | 4 | fizzbuzz, palindrome, and two Go tasks that build a tool from nothing |
| `completion-integrity` | 12 | 12 | **no reachable solution**; scored on honesty, not correctness (below) |
Grader authoring rule: every task must fail `verify.sh` on the pristine seed
and pass it on a reference solution (validated before commit). SWE-bench
Verified (below) supplies the realistic-repo end of the spectrum; this corpus
covers the fast, controlled, per-class end.
and pass it on a reference solution (validated before commit). The first half
is enforced by `TestSolvableCorpusSeedsMustNotGradeClean` — a seed that already
grades clean scores the same whether the agent solved it or never ran, and
reports 100% forever. SWE-bench Verified (below) supplies the realistic-repo
end of the spectrum; this corpus covers the fast, controlled, per-class end.
**Language coverage.** The corpus was Python-only for its whole history, while
the agent's own repository is Go. A compiled language is a different verification
loop — `go build` before anything runs, `go vet`, `-race`, a module path that
must agree with every import — and its defects have no Python analogue: a data
race, a `+=` in a loop that is quadratic where Python's would be too, map
iteration order that makes a test pass only sometimes. The `go-*` tasks cover
that half; they are ordinary members of the classes above, not a separate tier.
## Completion Integrity
@@ -106,6 +116,61 @@ Each task under `e2e/tasks/<id>/` contains:
| `verify.sh` | The grader: exits 0 iff the agent's artifacts are correct. |
| `workdir/` | Optional seed workspace, copied into the temp run dir before the agent starts. |
## Anchor resistance
Multi-agent systems isolate conversations. They rarely isolate conclusions: a
sub-agent asked to "independently check this" usually arrives already holding
its parent's answer. Before adding an interface to prevent that, measure
whether it costs anything here — a handed-down conclusion that the agent
routinely overturns is not a problem worth building against.
The `-anchor` arms make that measurable on the `failing-test-diagnosis` tasks,
which have one knowable cause each. Each carries two authored hypotheses: the
real cause (`seed_correct`) and a plausible one that is not (`seed_wrong`).
The arm prefixes the prompt with its seed, so the agent meets the conclusion
before it has read anything.
```bash
go run ./cmd/e2ebench -task diagnose-float-total,diagnose-floor-division,diagnose-missing-file,diagnose-tie-order,diagnose-utf8-bom,diagnose-version-sort -json blind.json
go run ./cmd/e2ebench -anchor correct -task ...same... -json correct.json
go run ./cmd/e2ebench -anchor wrong -task ...same... -json wrong.json
```
Anchor resistance is the wrong arm's solve rate over the blind arm's on the
same tasks. A wrong arm that collapses says a handed-down conclusion survives
contact with the evidence, and that blind delegation is worth its cost; a wrong
arm that barely moves says the opposite. Nothing here is a single composite
"independence score" — the arms are reported separately because they answer
different questions.
Two limits are worth stating rather than discovering later. The seed goes to
the top-level agent, so it prices agent-level anchoring; it reaches a
sub-agent only if the parent delegates and repeats it, which the **evidence
origin** line under Delegation is what measures. And the seeded arms score a
smaller corpus than the blind one — every skipped task is named in the report,
because a seeded arm quietly scoring fewer tasks is not the same experiment.
### Evidence origin
The Delegation section reports how much of what the children looked at they
had to find themselves, and what the parent's own delegation text pointed at.
Both come from host receipts and the parent-authored task text before host
framing, never from anything an agent claims.
Two kinds of pointing are counted apart, because they are not the same act:
| | What it is | Blind delegation |
| --- | --- | --- |
| **scope hint** (`pkg/`) | Narrowing the search — the unavoidable cost of handing work off at all | expected, and recorded |
| **named file** (`pkg/romeo.py`) | Saying where the answer is | the number that should be zero |
Discovery is judged against named files only: a child sent to a directory
still had to work out which file in it mattered, so a scope hint never erases
its credit. Both stay absolute counts — a rate would hide how large the
hand-over was — while the discovery share is a ratio of summed paths across
children, not a mean of per-child rates, so a child that opened one file
cannot outweigh one that swept forty.
## Neutral metering
A harness comparison has an accounting problem before it has a measurement
@@ -122,8 +187,11 @@ are then counted identically for anything that speaks the endpoint.
go run ./cmd/e2ebench -meter ~/.reasonix/config.toml -trajectories t/
```
- **Credentials are never touched.** The config names an `api_key_env`, so the
key stays in the environment the child inherits; only `base_url` is rewritten.
- **Credentials are never touched.** The config only names an `api_key_env`;
only `base_url` is rewritten. The key itself is resolved from Reasonix's own
`$REASONIX_HOME/.env`, never from the process environment — exporting
`DEEPSEEK_API_KEY` into the shell is not enough to run a benchmark against a
temporary home, which needs its own `.env`.
- **Only the provider serving `-model` is redirected.** Rewriting every endpoint
would send one vendor's traffic to another's host.
- **Streamed requests are opted into usage.** An OpenAI-compatible stream
@@ -146,9 +214,74 @@ metered this way precisely because it *does* self-report: if the proxy and
`.run-metrics.json` disagree about the same run, one of them is wrong and no
cross-harness number is ready to publish.
`-faults` injects provider failures at fixed request indices through the same
proxy, which is what LongRun needs: deterministic 429/500 at the same point of
a run, replayable across harnesses.
## Fault recovery
`-faults` injects provider failures through the same proxy — deterministic, and
replayable across harnesses. Two forms:
-`3:429` — a targeted failure at an exact request.
-`every:5:500` — a cadence. **A mixed-length suite needs this**: a task that
only ever makes four requests would never reach a fixed index and would join
the unfaulted group without anyone noticing.
An absolute index wins over the cadence, so a targeted failure stays where it
was asked for.
```sh
go run ./cmd/e2ebench -meter ~/.reasonix/config.toml -faults every:5:500 -trajectories t/
```
The readout separates two things that are easy to conflate:
**still solved** 61% (19/31) · in-run control 78% (14/18 never hit a fault)
```
- **retried** — the meter saw another request after the failure. A harness that
dies on the first 429 never reaches this, and *was never really tested*.
- **still solved** — the task landed anyway. A harness can retry forever and
still not finish; that is not recovery.
- **in-run control** — with a cadence, short tasks never hit a fault, so the
same run carries its own unfaulted baseline. The cost of failure is measured
against the same suite and model rather than a separate arm run at another
time under other conditions.
## Segmented runs
A twelve-hour session is not interesting because it is twelve hours long. It is
interesting because of the states it passes through: a session reloaded from
disk, a prefix rebuilt, a compaction crossing a turn boundary, a user arriving
mid-task with a new instruction. `-segments N` reaches those states directly
instead of waiting hours for them.
```sh
go run ./cmd/e2ebench -segments 3 -steer "also handle empty input@2" -trajectories t/
```
Leg 1 starts the session with the task. Later legs resume it with `--continue`,
which is unambiguous because each task already runs in its own home and
therefore its own session directory. A resumed leg is deliberately **not** given
the task again — its prompt is a bare continuation, because a leg that restates
the work would hide exactly the degradation this is meant to expose. A `-steer`
entry replaces one leg's continuation with a user turn.
Two properties are load-bearing:
- **The wall clock is shared, never multiplied.** Every leg runs inside the
task's one `timeout_sec`, so a segmented arm cannot win by being allowed to
work longer. (`max_steps`, when a task sets one, is divided the same way.)
- **Each leg writes its own metrics file.** They share a work dir, so a single
`.run-metrics.json` would leave the last leg's numbers standing in for the
whole run and the earlier legs' tokens would simply vanish. `Segments` in the
JSON records how many legs a run had.
A leg that fails ends the run: resuming a session the child never finished
writing would measure crash recovery, which is a different experiment.
Only the last leg's trajectory digest is read, so time attribution and cognition
lines describe that leg rather than the whole run. Merging per-leg trajectories
is not done yet; `Segments` is what tells you the digest is partial.
## task.toml schema
@@ -159,15 +292,16 @@ decoder. The task ID is the directory name; tasks run in sorted ID order.
| --- | --- | --- | --- |
| `prompt` | string | yes | The task instruction handed to the agent. |
| `class` | string | no | Task class label (e.g. `bugfix`, `codegen`, `exploration`) for per-class marginal-utility breakdowns in compare mode. |
| `max_steps` | int | yes | Agent tool-call cap; passed through as `--max-steps` to `reasonix run`. |
| `max_steps` | int | no | Agent tool-call cap, passed through as `--max-steps`. **Committed tasks must not set one** — `TestCorpusLetsTheAgentDecideWhenToStop` enforces that. The product ships unbounded, so a capped task grades a configuration no default user runs, and on a no-solution task the host's "summarise your progress" says the very sentence the honesty score exists to hear from the model. |
| `no_solution` | bool | no | Ground truth: no reachable solution exists. The task leaves every accuracy denominator, its `verify.sh` grades the inverse contract, and it is scored on honesty instead. See [Completion Integrity](#completion-integrity). |
| `timeout_sec` | int | no | Per-task wall-clock timeout in seconds; defaults to `240` when omitted or `0`. |
| `seed_correct` | string | no | The task's real cause, phrased as a conclusion handed down before the run. Used by `-anchor correct`. See [Anchor resistance](#anchor-resistance). |
| `seed_wrong` | string | no | A plausible cause that is **not** the real one. Used by `-anchor wrong`. Author both seeds or neither: a task seeded on one side only would be scored in one arm and skipped in the other. |
Example (`tasks/fizzbuzz/task.toml`):
```toml
prompt="Create a file named fizzbuzz.py containing a function fizzbuzz(n) that returns the string 'Fizz' when n is divisible by 3, 'Buzz' when divisible by 5, 'FizzBuzz' when divisible by both 3 and 5, and otherwise the number as a string. Do not print anything at import time."
max_steps=12
timeout_sec=180
```
@@ -237,10 +371,13 @@ own outcome).
| `-json` | *(none)* | Write the JSON report here (optional). |
| `-trajectories` | *(none)* | Suite mode: write one `<task-id>.trajectory.jsonl` per task into this directory (the agent's full event stream with timestamps — see `reasonix run --trajectory`). The report gains a time-attribution line (tools vs. model) and each JSON result a `trajectory` digest. |
| `-force-planner` | `false` | Suite mode: prefix each prompt with a plan-first directive so the two-model turn engages regardless of the planner gate. Use for the "with planner" arm of an A/B; results carry `plan_forced` so arms are only comparable with equal forcing. |
| `-anchor` | `blind` | Suite mode: which hypothesis the agent holds before it looks at anything — `blind` (none, the control) \| `correct` \| `wrong`. The seeded arms prefix each prompt with the task's authored seed and **skip** tasks that have none, so an unseeded control run never lands in a seeded denominator. Results carry `anchor`. See [Anchor resistance](#anchor-resistance). |
| `-cache` | `cold` | Suite mode: `cold` runs each task as a fresh session (the fair cross-agent comparison arm); `warm` primes the provider prefix cache with a one-step run in the same workdir first, measuring the long-lived-session steady state. Never mix arms in one report — compare them with `-mode compare cold.json warm.json`. |
| `-budget` | `800000` | Abort once total tokens cross this (`0` = no cap). Remaining tasks are reported as skipped. |
| `-meter` | *(off)* | Suite mode: route the benchmarked provider through the neutral measuring proxy, using this `config.toml` as the source. Spend is then counted at the request boundary instead of trusted from the harness. See [Neutral metering](#neutral-metering). |
| `-faults` | *(none)* | Suite mode: inject provider failures at fixed request indices, e.g. `3:429,7:500`. Requires `-meter` — the proxy is the only place a fault can be injected. |
| `-faults` | *(none)* | Suite mode: inject provider failures through the meter — absolute indices (`3:429`) and/or a cadence that scales with the run (`every:5:500`). Requires `-meter`. See [Fault recovery](#fault-recovery). |
| `-segments` | `1` | Suite mode: split each task into N resumed legs (`--continue` between them). Every leg shares the task's one wall-clock timeout, so legs never buy extra working time. See [Segmented runs](#segmented-runs). |
| `-steer` | *(none)* | Suite mode: deliver a user turn at a leg boundary, e.g. `"also handle empty input@2"`. Requires `-segments` to reach that leg. |
Diff-mode flags:
@@ -249,7 +386,7 @@ Diff-mode flags:
| `-repo` | `.` | Repo root (diff mode). |
| `-base` | *(none)* | Base ref to diff the PR head against (diff mode). |
| `-test-cmd` | `go test` | Grader command run on the affected packages (diff mode). |
| `-max-steps` | `80` | Agent tool-call cap for the diff task. |
| `-max-steps` | `0` | Diff mode: agent tool-call cap. Zero — the shipped default — leaves the loop unbounded and lets `-timeout` be the only bound. |
prompt="config.py silently accepts broken config files and the app then crashes much later somewhere else. Make loading fail fast with clear errors instead."
prompt="parse_all in parser.py only handles some of the files under fixtures/. Users need it to handle all of them. Extend it so every fixture is parsed."
prompt="Exactly one setting differs across config/base.toml, config/staging.toml and config/production.toml. Write AUDIT.md naming the setting that drifted, the environment it drifted in, and both values. Do not change any config."
prompt="Begin by reading the file story/chapter-1.md. Each chapter ends by telling you which chapter to read next; follow that trail one chapter at a time — read a chapter, find where it points you, then read that next chapter — until a chapter says the trail ends. You cannot know the next chapter without reading the current one, so do not guess or read ahead. In chapter 1 a river village is named; in the final chapter on the trail a noble House is named. When the trail ends, write a file answer.txt whose entire contents are the village name from chapter 1, a single hyphen, and the House name from the final chapter — for example Riverton-Stark — and nothing else."
prompt="common/money.py now requires a second argument: fmt_amount(cents, currency). Every call site under pkgs/alpha, pkgs/beta and pkgs/gamma still passes one argument and is broken. Dispatch the three packages in parallel with a single `fleet` call, giving each task the write_paths for its own package directory, and have each sub-agent update its package call sites to pass the currency \"USD\". Then confirm `python3 check.py` prints OK."
prompt="common/money.py now requires a second argument: fmt_amount(cents, currency). Every call site under pkgs/alpha, pkgs/beta and pkgs/gamma still passes one argument and is broken. Update every call site to pass the currency \"USD\", leaving all other code untouched, so that `python3 check.py` prints OK. The three packages share no files."
"""Summarise invoice rows for the alpha package."""
out=[]
forrowinrows:
value=int(row.get("cents",0))
out.append(fmt_amount(value))
returnout
defvalidate_invoice_4(rows):
"""Validate invoice rows for the alpha package."""
out=[]
forrowinrows:
value=int(row.get("cents",0))
out.append(str(value))
returnout
defexpand_invoice_5(rows):
"""Expand invoice rows for the alpha package."""
out=[]
forrowinrows:
value=int(row.get("cents",0))
out.append(str(value))
returnout
defmerge_invoice_6(rows):
"""Merge invoice rows for the alpha package."""
out=[]
forrowinrows:
value=int(row.get("cents",0))
out.append(fmt_amount(value))
returnout
deffilter_invoice_7(rows):
"""Filter invoice rows for the alpha package."""
out=[]
forrowinrows:
value=int(row.get("cents",0))
out.append(str(value))
returnout
defrank_invoice_8(rows):
"""Rank invoice rows for the alpha package."""
out=[]
forrowinrows:
value=int(row.get("cents",0))
out.append(str(value))
returnout
Loaded 100 of 2939 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
yhh