Qiongli 2.4.0 — traceable research, substantive writing and Plugin reliability

Current work continues in the October 8 / 2.5.0 increment. Earlier sections retain their historical candidate identities and decisions.

• Status: the maintainer authorizes continued development through release readiness on October 5, then confirms isolated AGY login and remote source synchronization, the required PR, Native CI and four-target CLI/Cargo qualification on October 6. Publication and main cutover remain separate. Subsequent writing-quality feedback selects the bounded content increment recorded below; it does not approve the pending AGY scope proposal. The latest instruction makes source-traceable literature work and writing the main 2.4.0 outcome and authorizes planning plus local implementation. On October 7 the maintainer explicitly requests completion of claim splitting and saved-writing recovery, release preparation and publication-task dispatch, then an end to the conversation without follow-up monitoring. This authorizes the required remote synchronization, reviewed main cutover, tag and release dispatch. The maintainer also explicitly approves the prepared experimental Antigravity scope: retain its failed strict gates for later promotion while keeping Codex, final-source package and upgrade checks mandatory. That release task was dispatched at fa5d1537 without subsequent monitoring. The next bounded request addresses AGY's crowded Skill list; its local fix and checks are recorded below without a new publication or live-session claim.
• Candidate version: 2.4.0, reflecting the additive Antigravity adapter and improvements to existing research workflows. Canonical version inputs are synchronized in e4b05659; this does not establish publication or readiness.
• Local baseline: 186d18751a272c8fffbc0c871b061068093221e6 on 2.x.
• Direction: master roadmap.
• Task state and acceptance: existing ledger.
• Prior observations: October 5 execution record.

Release outcome

A user can retain how literature was found, summarize inspected evidence, write fluent and substantive source-supported prose, and trace a consequential claim back through its evidence records to the exact saved passage and source version. Reviewed work and its bindings survive a fresh session; missing, changed or uninspected evidence stays explicit. Each advertised result has evidence for the actual installed candidate, including background citations and explanatory notes. Codex remains the primary research Host; Antigravity receives a separately qualified local CLI adapter. Existing models and project-write authority remain with their current owners.

The proposed release includes the already implemented AGY adapter (ff62b06a) and baseline evaluator (bcec1b0f). These are integration inputs, not new work to repeat. Their remaining gates are retained alongside the main outcome below.

Current execution priority — source-traceable literature and writing

Start from local 3d83bbf7. The writing-guidance increment is implemented; its synthetic observations do not yet qualify a real manuscript. Existing search logs, notes, reading matrices, claim ledger, Graph, source packets and saved-file read/list services retain ownership. The Graph resolves registered records; that is not a native PDF viewer or proof of source support. No second evidence database, vector index, review-status vocabulary or automatic approval is added.

Order	Deliverable and existing owner	Exit evidence
A — exact passage readback, first implementation	Extend the saved-document reader with an optional JSON pointer into a known saved source packet. Preserve file hash/revision bindings and raw reads; connect the locator to existing note and ledger guidance.	CLI and Full MCP return identical decoded UTF-8 passage windows. Escaped text, repeated passages and array packets retain distinct locations; invalid selectors, stale hashes/revisions and unsafe files refuse.
B — bounded passage discovery	Search text within explicitly selected saved sources through the same project/read ownership. Return inspectable candidates, exact locators and surrounding context, distinguishing no match, multiple matches and incomplete access.	Find an actual phrase despite JSON encoding; preserve every relevant match within declared bounds and continuation. A translated/paraphrased query or absent match cannot manufacture a quotation or establish absence from an unread paper.
C — manuscript-first claim detection, traversal and review	Inspect the actual requested draft, including body sections, captions and notes, and identify independently checkable claims even when absent from existing records. Connect exact manuscript spans through current claim IDs, ledger rows, notes and retained sources; inspect supporting/conflicting evidence separately. Apply the shared prose, explanation and note rules during writing.	Draft/review actual body text and recover its source locations. Distinguish results, synthesis and inference; preserve unmapped claims, missing bindings and identity/version conflicts. Check semantic support separately from explanation, paragraph continuity, language and useful note placement. Tool readback alone does not pass either writing judgment.
D — summaries, synthesis and change tracking	Reuse reading matrices/summaries and manuscript claim maps for cross-paper comparison and writing. Preserve source versions, search/retrieval failures and prior reviews; identify affected claims when material changes.	A summary and LR maintain the same identities through background, analysis and notes. Changed sources trigger bounded re-review; old evidence and unrelated verified work survive.
E — installed journey and final candidate	Exercise search provenance → inspected passages → reviewed notes/synthesis → manuscript claims → reverse lookup → fresh-session recovery through existing installation and write owners.	Frozen public/synthetic inputs, complete actual outputs, exact candidate/source bindings and reviewed support judgments. Requalify final-source packages and retained upgrade/Host gates before readiness.

Implement A first, then B/C on the settled locator interface, followed by D/E. Local A/B and the Host-guided C/D increments are recorded in sequence below. C starts from actual manuscript prose under the maintainer's clarification; its synthetic observations do not establish installed or real-manuscript quality. D extends that path through synthesis and actual changed-source prose revisions. These focused checks do not complete E or the final release gates. For A, json_pointer selects only an observed string field from a content-addressed source packet. Offsets refer to decoded UTF-8 text while SHA-256 still binds the whole saved JSON file. Preserve native page/section/segment metadata in that packet; do not label a JSON byte offset as a PDF page or fabricate printed page numbers. Unknown/malformed pointers and non-string values refuse without fallback. No-selector requests and old response fields retain their existing meaning.

Use source-specific negative cases throughout: abstract-only access, conflicting outcomes/denominators, changed or missing packets, duplicate passages, absent supplements and unverified locations. Review each material claim in the selected scope, including claims absent from a supplied ledger. An exact text match does not itself establish semantic support, source authenticity or search completeness.

The first local slice adds no live search, private-library access, project-data mutation, installed-Host update or model invocation. Subsequent live batches keep their declared public/synthetic scope and current authorization boundaries. One requested gpt-6.1-sol / low verifier handles focused checks and reviews; do not change configured user models. Record checks and remaining work once per integrated increment under CLI-405/410; preserve all task states and accepted evidence. The pending AGY scope decision and publication authority are unchanged.

Starting evidence

Observation	Consequence for this plan
Three installed-Codex cases: structural 2/3, complete reviewed passes 0/3	Establish actual guidance use, fix the short paragraph, and keep fixture changes outside observation windows. This does not mean all three answers were academically wrong.
AGY install/update, Skill entry reads, 35-tool discovery and a native return observed	Preserve those scoped results; capture the full returned payload and finish the Host observation normally before claiming a clean session pass.
AGY validation required several driver corrections; the final Host exited -9 after returning a result	Exercise the driver offline, distinguish tool outcome from driver/process outcome, and retain failed attempts.
Literal Skill section coverage is 70/82	Review the relevant flags in context. The count is not a semantic quality score or a requirement to add boilerplate to every file.

Detailed hashes, candidates, approval scope and failures remain in the prior execution record. This draft does not relabel that evidence or monitor the previous release.

Retained foundation and release slices

1. Make observations repeatable — required

Extend the existing research-journey capture/review owner and Evaluation Truth V1. Keep native installation, Host trust and project preview/approval/CAS with their existing owners; do not introduce a second evaluator or a custom approval API.

• Freeze candidate, content, prompts, input files and fixture state before a run. Keep per-run manifests immutable; do not overwrite an old candidate's manifest.
• Prefer supported structured Host events/results. Capture complete MCP call arguments, returned payload and error state, with matching call identities. A model's account of a result or a terminal's collapsed object is insufficient.
• Record normal completion, denial, timeout and forced termination separately. Preserve configuration/project snapshots and cleanup results even on failure.
• Limit terminal interaction to the necessary normal trust/approval workflow. Test recorded menus, wrapping and completion/cleanup cases offline before a live run; never grant broader permissions to satisfy a test.

Exit evidence: the retained failure fixtures exercise the corrected driver, and one bounded AGY status call has a complete result, normal or explicitly controlled graceful shutdown, and verified cleanup. Unavailable capture capabilities remain explicit gaps. Existing offline work can proceed while live evidence is pending.

2. Improve the three core Plugin tasks — required

Trace each observed defect to its owner before editing. Initial review scope is content/workflow/SKILL.md, content/workflow/workflows/paper-read.md, content/workflow/workflows/academic-write.md, their referenced B/F contracts, and canonical extraction/retrieval Skills under content/skills/B_literature/. Regenerate distribution payloads through the existing materializer after changes.

Task	Required behavior
Explain supplied paper material	Ground central claims and numbers in visible sources; distinguish supplied excerpts from full-paper access, reported findings from interpretation, and allocation units from analysis units.
Write a bounded paragraph	Deliver the requested text, length and format; define the counting convention before review, preserve claim strength and citations, and avoid unsolicited project creation or saving.
Resume reviewed saved work	Recover current revision and receipt-backed document bindings from the project ID; read through available native tools, report changed/missing sources and preserve old history.

Investigate missing guidance evidence before assuming that Skills were not loaded: supported Host injection and explicit file reading can be different mechanisms. Bind whichever mechanism was actually observed to the relevant content version. An unsupported resources/list call does not justify a new resource API merely to turn the test green.

Exit evidence: new captures of all three fixed baseline cases pass their required structural and named answer-review checks, including guidance use. Required unreviewed checks are not passes. Old failures stay in the original denominator; these cases establish a bounded regression result, not broad academic acceptance.

3. Qualify persistence and limited generalization — required

Use one isolated public/synthetic project for an explicit sequence: reviewed reading note → exact write preview and approval → verified persistence → new session → project-ID recovery → source-supported paragraph. Reuse existing storage and revision/CAS services. Test stale revision, source drift, missing files and denied approval; retain existing text and history in every refusal. This persistence journey is separate from direct read-only paragraph requests.

Freeze at least three small held-out cases before execution: limited/abstract-only access, conflicting numerical or unit evidence, and changed-source continuation. Require all declared checks, retain the fixed denominator and review complete answers against supplied sources. Cases used to tune guidance become regression cases; retain fresh held-out evidence before claiming generalization. This small sample cannot establish expert or cross-discipline validity.

Exit evidence: the save/restart journey and held-out required checks pass under their named scope. AGY receives a bounded read/recovery compatibility observation after its status-call capture works; it does not imply simultaneous multi-Host writes or repeat the complete academic matrix on every Host.

4. Deliver the version and preserve upgrades — required

Qualify a frozen candidate with the existing release owner. Include AGY's native Plugin layout, source-retention requirement and trust/fresh-session instructions in release notes and the Host support matrix. Distinguish source export, registration, MCP discovery and an actual successful call in user-facing status.

Check the 2.3.0 → candidate upgrade and retained Codex/Claude/DeepSeek behavior; preserve user models, workflow variants, research data and receipt-backed refusal of unmanaged or changed installations. Diagnose unsupported Host/platform scope explicitly instead of inferring it from a CLI build.

First extend tooling/scripts/native_registry_upgrade_check.py with explicit predecessor selection: its current pip/npm checks select historical 1.17.0/2.1.1 versions and cannot yet establish a 2.3.0 upgrade. Preserve the old defaults and negative cases, bind the selected predecessor and candidate artifacts, and report an unavailable predecessor as an unqualified check rather than silently substituting another version.

Use the existing four-target CLI distribution and archive/npm/wheel/Cargo gates for the final source. Target-native CLI packaging and live AGY qualification are separate claims. Remote qualification, push and publication use their existing authorization boundaries; this plan launches none of them.

Cost, scope and sequencing

One gpt-6.1-sol / low subagent performs bounded independent verification, as requested. Existing Host models remain configured; a verifier model is not a directive to replace AGY's model. No Astra extra-high verification is planned. Use offline tests before live calls, declare each live batch and its limits, and reuse evidence while its inputs remain unchanged. The October 6 maintainer grant authorizes the planned public validation with the existing Codex login. Use an isolated profile and temporary link, remove the link in finally, and never inspect credential contents. Earlier exhausted grants remain historical; do not request the current authority again merely because a prerequisite or batch finishes.

Report actual input/cached/output tokens, tool calls, failures and elapsed time when available. Compare identical tasks and model settings, keeping quality as a condition of any efficiency claim. Do not promise a token reduction percentage or compare different Host/model runs as a controlled benchmark.

Follow the current A–E priority above while retaining these foundation and release obligations and their original failed observations. Prepare release documentation alongside implementation; qualify final artifacts only after the required behavior is stable. Independent development can proceed while a separate external evidence gate waits.

Defer additional Hosts, Desktop expansion, a new Graph or Agent orchestration layer, concurrent multi-Host writing, a broad 82-Skill rewrite, and new provider integrations. These would need a separately selected outcome.

Execution continues under existing CLI-405 (journey/quality), CLI-409 (AGY) and CLI-410 (release) ownership and existing evaluation contracts. This draft adds no task IDs, changes no task state/dependency/accepted evidence, sets no release date, and does not authorize publication. The subsequent maintainer instruction authorizes local implementation through the existing development loop.

Planning-only validation

The requested gpt-6.1-sol / low review passes the seven program-roadmap tests, generated-index consistency and whitespace checks. The ledger is byte-identical to the baseline: all 249 task definitions and 46 accepted records are unchanged. No native build, live Host observation or release check is run for this draft.

October 5 — first authorized implementation increment

Local implementation starts from 2813426f on a feature branch. This increment implements the offline portion of slices 1 and 2; neither slice's live exit gate is declared complete. No task state, dependency or accepted record is promoted.

e167f4bd extends the existing installed-Plugin adapter:

• freeze and seal create new input/final manifests exclusively, checking frozen source/prompt/installation/catalog bytes and refusing drift or overwrite. These local snapshots are not a lock on live fixtures or authenticated dates.
• Actual completed calls retain IDs, event indexes and argument/result/error hashes. Empty/malformed payloads and conflicting error flags cannot satisfy required reads. The installation can bind its exact MCP server name; this does not implement an AGY-to-Codex event converter.
• Tool results remain separate from process/turn completion. Timeout, denial, cancellation, forced exit and incomplete turns retain usable call observations while the case remains unsuccessful. A truncated final JSONL line cannot pass.
• New catalog requirements bind installed guidance snapshots to complete command output or independently retained Host context, plus a separate usage review. Model prose alone cannot establish loading. Context provenance still requires inspection; no unsupported Host export capability is assumed.
• The source paragraph gets an executable whole-answer 250–350 character rule, with non-whitespace Unicode counting and registered anchor-citation exclusions. Semantic review cannot override a failed length check. Historical catalogs, observations and reports retain their original scope and bytes.

f825c60f updates only canonical workflow guidance: use available complete Host guidance or supported installed-file reads; check the final requested prose's length; distinguish sample, allocation, measurement and analysis units; retain source discrepancies and excerpt-only limits. Existing project-ID/binding/read, preview/approval/CAS and configured-model behavior remains with its owners. These instructions address observed risks but do not prove new model behavior.

The requested gpt-6.1-sol / low verifier reports:

Check	Observed result
Focused regression modules	77/77 pass: Plugin baseline 20, journey observations 11, journey cases 3, routing probe 10, V1 evaluation 14, research-standard validator 19.
Original short-paragraph reproduction	Original answer SHA-256 87fc5ef8048b681b30d18a06916e6efae5909f9aa1503be9c9f7f14b74c84b3f counts 227 under the new declared rule and fails 250–350. Original capture/catalog/reports are unchanged.
Capability contract	python3 scripts/validate_capability_contract.py passes.
Content materialization	Existing build_materialize_source and fail_if_symlinks pass; all four changed canonical files match generated portable bytes.
Review	No remaining blocking finding; staged whitespace checks pass.

The materialized package is retained at /tmp/qiongli-quality-portable-content-p7oe7_6f/source/qiongli-workflow; its local verification record SHA-256 is 54eada462ed4561adcb7f1ef2ab1f3b8f59662a861baad551d09d7bb7114a4dc. An earlier full --target plugin materializer invocation selected the retained Lite build and was stopped/reaped with exit 130. Its partial output remains at /tmp/qiongli-plugin-quality-offline-20261005-verifier-01; it is not a passing Plugin package check. The content-only owner subsequently supplies the required bounded evidence without a Rust build. The first regression run also exposed a test expectation error (a shared invalid guidance hash affects all three cases, not one); correcting that expectation did not weaken the production check.

At integration, all seven program-roadmap tests and generated-index consistency pass. All 249 task IDs/states/dependencies and 46 complete accepted records remain unchanged; only CLI-405 gains this progress record and the current plan link.

No new model or Host session, credential reuse, user installation/configuration change, native candidate build or publication is performed. Existing live 2/3 structural and 0/3 complete baseline results remain historical failures/gaps. The next increment is the retained AGY driver's offline permission/wrapping and shutdown fixtures plus full transport-result capture. Then freeze the changed installed candidate and public fixtures for newly scoped live observations, including the three Codex tasks with the declared counting convention. Their evidence enables slice 3's save/restart and held-out cases; release/upgrade qualification remains later work.

October 5 — bounded AGY capture and cleanup increment

The maintainer requests the next step after b60518bf. Implementation 1ae2bbdd, followed by scoring-identity fix 0cac3641, adds evals/research_journey/antigravity_observation.py under the existing journey owner. It prepares one new capture directory for an exact read-only status request, binds installed identities, command, selected Qiongli environment and fixture/configuration snapshots, and spools full raw stdout/stderr to disk. It neither replaces the user's model nor writes trust/permission settings, links credentials, resumes a conversation or retries a denied call.

The adapter consumes AGY's own stream events and uses the existing V1 runner for behavior checks. Matched invocation steps, native envelope bytes and Host/process completion are distinct observations. Full status evidence requires the existing status schema plus matching MCP content/structuredContent; short tool summaries, bare status objects and model descriptions cannot fill missing output. A Host's SUCCESS status or process exit zero cannot erase a denied action.

The old PTY driver lowercased invocation paths, depended on a recent terminal buffer after the final answer and hashed a reset buffer across restarts. A new current-screen checker preserves JSON path case and exact arguments while recognizing the single-use permission choice; it never sends approval keys. The print driver uses one process and hashes its entire saved stream, with SIGTERM-before-wait, bounded SIGKILL fallback and child reaping on timeout or exceptions. Remaining members of its owned POSIX process group are reported; other-session descendants remain outside that guarantee. The temporary old drivers and captures are unchanged, and no repaired live interactive run is claimed.

The requested gpt-6.1-sol / low verifier passes 56 unique focused checks: 22 new AGY observation cases, 20 existing Plugin baseline cases and 14 V1 cases. The final nested-JSON and scoring-identity fixes rerun only the AGY module; unchanged baseline and V1 results are reused. Coverage includes full synthetic envelopes, denied calls with Host success, summaries/missing output, duplicate/foreign/truncated events, wrapped/case-sensitive arguments, actual fake-child normal/timeout/kill/exception cleanup, signal-exit races, missing/drifted snapshots, exact command/environment bindings and refusal to overwrite an existing capture.

Initial validation/review exposed missing-snapshot booleans, false == 0 exit comparison, inconsistent selected environment, nested duplicate JSON keys and missing installation-identity validation when scoring a resealed capture; all now refuse success with regression coverage. A mock's one-shot exception caused a test-only StopIteration and was corrected to model the repeatable process-disappearance race. Final code review has no blocking finding and staged whitespace checks pass. All seven roadmap tests pass; the ledger retains 249 tasks and 46 accepted evidence records without state or dependency changes.

The existing real headless record at /home/hermes/qiongli-codex-continuity-yqk33pu3/agy-session-1jd6tkog/events.jsonl is replayed read-only, SHA-256 31214c12927530d5746ed5976f18558640565570d1b09daffc1e44c1106f9b46. It reports Host SUCCESS and num_turns: 1, but its response is empty, one action is denied, and the matching MCP step has no output. The adapter retains those facts and refuses a pass. Earlier file-read steps also mean this historical session is not the new exactly-one-tool status scope. No historical observation or failed attempt is promoted into a live success.

Installed agy --help and the official headless documentation confirm the structured-output interface, not that the local Host exposes the required full MCP envelope. This turn runs no new model/Host session, permission or login change, native build, installation or publication. The live slice-1 exit gate remains open: a normally authorized actual status invocation must provide complete output and clean shutdown on the named installed candidate. If only a summary is available, retain that capability gap without broadening permission or substituting another result. Independent preparation of the fresh installed-Codex three-case baseline can proceed; its earlier three-call login reuse grant remains exhausted. Save/restart, held-out and upgrade qualification remain later increments. CLI-409 owns this progress; task states, dependencies and accepted evidence remain unchanged.

October 5 — fresh installed-Codex candidate and frozen inputs

The next bounded increment prepares the corrected three-case baseline without starting another model observation. Commit 8618fb44 refreshes only the embedded content lock through the existing native generator. The package still reports 2.3.0: this is a development candidate, not a version bump or release.

Identity	Exact observation
Native source	8618fb44ee43ccc2b9b1380039fb45f0745d8ee2
Content source	7bbcb171914a9515e14372e7d69d76b9a2255d80
CLI SHA-256	cbd45851208c0ccb2afe3d9157f2dea139a347c8b18992041415fea6a6cd88cc
Embedded pack SHA-256	caecff2f211cf7174dfb16ed064dd2329ab6589ef55325e24174ee910e9a126c
Installed Plugin receipt SHA-256	f8c64fbe38315f442b369f0cc5e10875b7959d1afcbbefe4401808ec209bbc04
Frozen input manifest SHA-256	01b799b2e56b7e585847a6c4228bcd3b18ff0f89ba8fc75fa3f3771ed07060b5

The requested gpt-6.1-sol / low verifier regenerates the 446-entry pack and passes the closest lock round-trip/source-drift test. The CLI-only build uses Rust 1.97.0, --profile test --locked --offline, and the exact native source stamp; it finishes in 210 seconds. Native snapshot confirms that stamp. No Desktop, retained Lite package, target-platform distribution or release gate is run. Build logs and the build receipt remain under /tmp/qiongli-codex-quality-next-9rubrmze.

The existing preview/apply owner exports a new Plugin, and Codex 0.160.0's official manager installs/enables qiongli@quality-next under the isolated root /home/hermes/qiongli-codex-quality-next-9rubrmze. Its export, marketplace copy and installed cache match all 468 receipt-listed file bytes and modes; the binary and receipt match too. Lite 15 / Full 35 discovery is directly checked without a model. The three modified workflow/reference files match canonical bytes. The installed root Skill matches the complete native projection: canonical Skill plus the existing Codex adapter and shared Host guidance.

Public fixtures are completed before freezing or any model call. New project prj_0d75b7cffdc8f871ab0f5afe56d6a624 reaches revision 4 through the existing capture intake, exact consolidation preview, model review, dual approval and CAS owners. Its note explicitly labels the reused historical answer; neither that answer nor its old Skill-read failure is a new model result. The original public source packet is unchanged. Only the separately labelled synthetic packet receives the deliberate changed-source marker. Two current documents read back byte-for-byte; changed-source and stale-revision reads refuse, with project/config bytes preserved throughout those negative checks.

The new catalog, installation identity, source registry/packet, complete installed guidance, three prompts, prepared-state/run-scope records and three reviewed local scripts form 16 frozen input files. The paragraph prompt declares the exact whole-answer 250–350 counting rule. Known installed guidance paths are supplied for explicit supported file reads; this does not test automatic Skill discovery. The continuation prompt supplies the new project ID but no current revision, document path/hash or saved body. It permits guidance-file reads while requiring research-document recovery through the native read-only MCP tools. All three cases remain unattempted; there is no final capture manifest, answer, usage measurement or new academic pass.

The temporary driver reuses the tested process-group cleanup owner, keeps full on-disk events/stderr and process/preservation receipts, refuses retries or input and cache drift, and leaves missing guidance evidence unsuccessful. A spawn failure retains a null actual exit code and its process receipt; the existing scorer marks that case unavailable rather than inventing a timeout. These three scripts pass syntax checks and independent static review; the driver has not been exercised with a real model in this increment.

Preparation failures remain in the local logs: an initial check incorrectly compared the projected root Skill to canonical bytes alone; a reused variable reported a byte count instead of 468 cache entries; serializing a Path interrupted the first source-preview binding record after native preview. The checks and metadata are corrected without repeating installation or applied transactions; the original outputs and partial binding are retained. The unsafe shared /tmp ancestor was identified during review before installation, so durable native outputs use a new private home directory under existing path policy.

No authentication file is read, copied or linked, no model is called, and the real user installation/model/configuration is unchanged. The earlier three-call login grant remains exhausted. The next live batch, if newly authorized, is exactly these three public-material cases on gpt-6.1-sol / low, once each and at most 180 seconds per case, with only the three named native read tools approved in the isolated invocation. Temporary login linking and cleanup require that new grant. Preserve the prepared inputs until the decision; failure or unavailable guidance remains in the fixed denominator. The AGY full-output/clean shutdown gate and the later save/restart, held-out and upgrade gates stay open.

At integration, the same verifier independently checks every frozen input, current fixture/config snapshot, exact current-document readback and retained negative result, and confirms the old 24-file capture is unchanged. Seven program-roadmap tests, index consistency and whitespace checks pass. All 249 task IDs/states/dependencies and 46 complete accepted records remain unchanged; only CLI-405's progress text changes. Independent diff review has no blocking finding. These local checks do not promote installation, academic or release acceptance.

October 5 — authorized Codex observations and Host blockers

The maintainer's new temporary-login grant covers the prepared three public cases, once each, at most 180 seconds each on gpt-6.1-sol / low. All three calls are now used; there is no retry or remaining model-call authority in this batch. Codex uses a temporary authentication symlink in the isolated profile. Both wrapper attempts remove it in cleanup; the coordinator and the same lightweight verifier independently confirm the authentication path is absent. The driver and verifier do not inspect, copy or record credential contents. User configuration and all prepared project/configuration snapshots remain unchanged.

The original frozen driver fails before any model call: its preflight passes a UTF-8 string to a bytes-only SHA helper. Preserve that failure and the original captures directory. A new captures-driverfix-1 uses the existing text-hash owner, with unchanged source, prompts, catalog, installation and fixture inputs. Its correction receipt binds the predecessor freeze and zero prior model attempts. The verifier reproduces the original TypeError and exercises the full corrected preflight/capture/seal/load path offline with three fake process results. This includes all 468 installed entries and modes, script hashes and fixture snapshots; no authentication or model is used by that smoke check. The deliberately absent fake guidance is not counted as a pass.

Evidence remains under /home/hermes/qiongli-codex-quality-next-9rubrmze:

Record	SHA-256
Corrected 17-file input freeze, captures-driverfix-1/frozen-inputs.json	e1ceec150bed75812a1cdf02b3abbb506dfa0d15168e92ce9bdfdd1865c5627a
Sealed 42-file capture, captures-driverfix-1/manifest.json	ed52402a78033107ea3bcaf0e08ee99205bbaddec12069e9e2118c3c4e3a428b
Complete answer review, review-completed.json	634cacc8faec58271594e525c0ec54cf082e8996f47762560e857f8e6896388f
Score, offline-score-driverfix-1/summary.json	8e1e669ea2571843229d730608d2851ea4283d0f2206ba968dd86c393e0b4288

The candidate retains the exact source, binary, pack and receipt identities in the preceding section. The initial unreviewed answer record is retained beside the completed review. Reviewer identity is explicitly the requested model verifier, not a human reviewer. Raw events, answers, complete matched call/error payloads, invocation arguments, process outcomes and preservation receipts are bound by the final manifest. Authentication lifecycle receipts remain in logs.

Case	Structural / complete reviewed	Observed result
Paper explanation	fail / fail	Main research claims, units and limitations pass source review; the 265-character recommendation meets its bound. The answer claims 11 supplied anchors where there are 10, and no complete guidance-load evidence is captured.
Source paragraph	fail / fail	Returns only a 153-character failure explanation, not the required 250–350-character research paragraph. Required claims and guidance evidence are absent.
Saved continuation	fail / fail	One matched qiongli_project_read call fails with MCP tool call requires approval, but approval policy is never; no bindings or document bodies are recovered. The answer discloses this and does not substitute the historical note.

Structural and complete reviewed totals are 0/3, retaining all three cases. The two undelivered tasks do not receive substantive source-fidelity passes. Actual Host usage and driver elapsed time are:

Case	Input tokens	Cached input	Output tokens	Reasoning output	Tool calls	Seconds
Paper explanation	36,301	24,576	1,837	93	0	56.46
Source paragraph	35,861	29,952	294	47	0	14.20
Saved continuation	66,848	39,936	790	39	1 failed	25.83

All processes exit zero normally, with no timeout, parsing error or surviving owned process group. Process completion is separate from task success. These incomplete tasks support no token-efficiency claim. There are no command-read events in the captures. All answers describe a bwrap loopback failure, but those statements are model self-reports, not recorded command results. No supported Host injection record supplies the missing complete guidance either. Known installed paths were supplied, so automatic Skill discovery is untested.

Offline diagnosis uses no model, credential link or changed permission policy. Installed Codex's local help/schema and the official Plugin policy documentation identify per-Plugin/server/tool configuration as the existing policy owner. The actual invocation's quoted dotted keys are a possible explanation for the observed read-tool denial, not a confirmed parser defect or effective-policy readback. Both quoted and unquoted app-server probes stop before config/read, reporting that the Linux sandbox needs access to create user namespaces. Separate codex sandbox attempts stop at permission-profile configuration validation; /usr/bin/true never executes. These diagnostic logs establish those startup limits, not a successful command-level reproduction of the model's error. No sandbox restriction is weakened and no speculative product fix is made.

The next bounded increment must establish Host execution prerequisites before another authenticated observation: demonstrate a real read-only command in a supported sandbox and inspect the effective policy for exactly the three native read tools through the supported configuration owner. Exercise that preflight before freezing a new batch; failure must stop before model invocation. Only then request a newly scoped live batch and capture actual guidance use and successful recovery. Preserve this failed batch and review the anchor-count defect without treating undelivered tasks as evidence of a guidance regression. The AGY full-output/clean-shutdown, save/restart, held-out and upgrade/release gates remain open. CLI-405 owns this record; no task state, dependency or accepted evidence is promoted, and no push, publication or release monitoring occurs.

At integration, the same verifier passes all seven program-roadmap tests, generated-index consistency, whitespace and the fast native boundary check. All 249 task IDs/states/dependencies and 46 complete accepted records match 4a59da78; only CLI-405's blocker changes. Independent review verifies the original and corrected freezes, the old 24-file capture, the new 42-file seal, current fixture preservation and login cleanup. The final diff has no blocking finding; these checks validate the evidence record, not the failed live tasks.

October 5 — 2.4 candidate implementation and prerequisites

The maintainer now requests continued development through 2.4.0 release readiness. 13548357 adds a credential-free Codex sandbox preflight under the existing journey/process owner and explicit package predecessor qualification. The preflight creates a separate empty home, disables network, grants only read access to selected public guidance, compares complete output and stops at the first failure. Version, process cleanup, unchanged guidance/configuration and absence of authentication are recorded. It cannot satisfy effective Plugin policy or actual model-guidance evidence and launches no model.

The upgrade owner preserves historical defaults and adds --predecessor-version 2.3.0, using the shared SemVer/PEP 440 projections. It binds selected versions and predecessor/candidate hashes, refuses ambiguous or changed inputs before installation, and retains non-success receipts when a predecessor is unavailable, metadata is wrong or retained fixture bytes change. The four-target workflow adds a separate 2.3.0 check and uploads failure receipts. Review catches and repairs an overbroad duplicate-suffix refusal: multiple Cargo archives remain valid while multiple wheels/npm candidates are ambiguous.

Canonical version/content commit e4b0565992aa259017e7240d7952e6c77272220b sets 2.4.0 through sync_versions.py, adds checked source-coverage guidance, candidate release notes and bilingual development Host matrices. Historical accepted matrices remain unchanged. The generated 446-entry pack binds that content source, content-root hash 51a12b8595402b025bb853f33cf9aee7ab99fbdca3a63b1258c0a3e797f7caec and pack hash 2693f17ff7bd1aeea4576aeecb0554f9c6a22003e49bb3decfb0db909473315f. The candidate is unpublished; these changes do not turn the earlier 0/3 result into a pass.

The same gpt-6.1-sol / low verifier passes 70 focused tests: 11 upgrade, 8 sandbox-preflight, 14 registry/package assets, 20 branch/workflow, 16 version and one native content-lock/source-drift test. Capability validation, the actual v2.4.0 tag/version contract and native formatting pass. Initial missing release notes and stale pack failures are retained, then resolved through their canonical owners; only affected checks are rerun. Fake executable tests exercise actual process execution, failure-stop behavior, content/config drift, isolated environment and timeout/forced-cleanup cases. They establish no live Host pass.

The real no-login preflight at /tmp/qiongli-codex-preflight-real-zu4epp9i/result/preflight.json passes version inspection, then stops at the sandbox command with bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted. Guidance reads never start and authentication remains absent. Earlier direct diagnostics at /tmp/qiongli-codex-readonly-prereq-o2_fjyze also use a valid named permission profile and independently reproduce the failure; effective policy remains unavailable. No old model self-report is retroactively relabelled a tool event.

For package qualification, the previous container's missing crun runtime state prevents exec; an attempted new runroot also conflicts with the existing storage database. Both are retained failures, not reasons to reset old state. A new ordinary rootless container using the established storage/runroot pair successfully reports glibc 2.35, without extra capabilities or credential mounts (/tmp/ql24-podman-paired-o9g_6hex/receipt.json). A separate candidate environment can therefore be prepared while preserving all 2.3.0 artifacts. This probe alone is not a release build, package audit or Codex sandbox pass.

Next qualify the clean 2.4.0 candidate with the existing release owner and the explicit 2.3.0 upgrade check. Separately establish actual Codex sandbox/policy prerequisites before preparing a newly authorized live batch. Installed-Codex regression, save/restart/held-out cases, AGY full-output/clean shutdown and final four-target qualification remain required. No previous credential grant is extended and no remote synchronization or publication is performed.

At integration, seven additional roadmap tests, generated-index consistency, whitespace and the native boundary guard pass. The final independent diff review has no blocking finding. All 249 task IDs/states/dependencies and 46 complete accepted records match the prior 2.x; only CLI-405/410 blocker text changes. The 77 focused test passes qualify these local changes, not the open live Host or release-artifact gates. Subsequent package evidence must bind its own clean native source, separate from the content-source identity above.

Exact runtime access correction

A separate rootless-container probe finds the bundled sandbox helper only when the complete public Codex installation is mounted read-only; mounting its bin directory alone had omitted that helper. The next probe then reports the exact Codex executable unavailable inside the minimal sandbox. The preflight now grants read access to that resolved runtime file as well as the selected public guidance. It does not expose the executable's parent directory, alter network policy or add write permission. Nine focused preflight tests and the boundary guard pass, including an independent parsed-TOML assertion of the exact allowed files. A later standalone nested probe times out before providing successful command evidence; this correction is not declared a live sandbox or policy pass.

Local package qualification starts separately on clean native source 84bc10791e8ee933ccfcba579b20c2976a9bea0d. Its results must keep that identity despite this subsequent observation-helper correction. Large tooling-image copies are stopped without promoting their incomplete output. A separate container uses the existing public tooling rootfs as a read-only overlay lower; new source/output mounts preserve the old release. The repository's disposable Rust incremental intermediates are cleared to restore build space; source, target executables, archived releases, logs and research data are retained.

October 5 — local 2.4 package qualification

The same gpt-6.1-sol / low verifier runs the existing release owner on clean native source 84bc10791e8ee933ccfcba579b20c2976a9bea0d, in the separate Ubuntu 22.04 rootless overlay described above. This is Linux ARM64 evidence, not four-target or final-head qualification. The later 025fe931 correction changes observation tooling/tests and records; it does not change these native or content bytes, and the receipts keep their original source identity.

The successful command is:

./scripts/release_ready.sh --cli-github --version 2.4.0 \
  --staging-dir /tmp/qiongli-2.4-delivery-20261005/linux-arm64-glibc235

It exits zero with 46 CLI and nine MCP tests, strict headless Clippy, formatting, version checks, glibc 2.35 wheel audit/repair, empty-PATH archive smoke checks, isolated npm/wheel installs and aliases. Lite/Full discovery remains 15/35. Codex/Claude native Plugin archives pass their package checks, and the npm DeepSeek projection retains 22 Skill entries and 35 MCP tools. These checks do not run those Hosts' model sessions. The packaged native binary SHA-256 is 604b55828e612d621d8e3efee19ea6efa983b5e24c531dd4d8e9c1eb1da4393a; content source remains e4b05659 and pack 2693f17f as bound above.

Evidence under /tmp/qiongli-2.4-delivery-20261005:

Record	SHA-256
linux-arm64-glibc235/assets/release-manifest.json	30f25882db0ddf7a9b9fdccffd10c4df4abfa660deb727f9e58321f37c772b59
linux-arm64-glibc235/assets/SHA256SUMS	cc21d7aac489ffb68e2938e5d2f5d031e5cfce2f499e327db544f13bac0597ca
linux-arm64-glibc235/install/install-check.json	dd77e41115377dca02e3b21415d009242c753a66d482c7554c2af0e3902ed376
upgrade-2.3.0/registry-upgrade-check.json	37824177c345ec3cebe32674706ed0cebe3274fcbd85056b0e09c62daf7618d9
cargo-source/registry-packages.json	86824e689b448ac5c383a2573f738f46911da0a4d1571093bef32437a67e3318
cargo-install/install-check.json	2f9946732b52f6c598c42e790697ae6ced1217e240462e19087f8952374272a8

The explicit upgrade owner downloads real public pip/npm 2.3.0 packages, verifies the installed predecessor version and upgrades each isolated install to the local 2.4.0 candidate. Both pass native checks and retain all three synthetic research/configuration canaries byte-for-byte. The receipt binds both predecessors and candidate packages; no fallback version is used. This qualifies package replacement and those fixtures, not arbitrary project-format migration.

The archived CLI also performs the native preview/confirmed export into the isolated public directory /home/hermes/qiongli-2.4-qualification-q1xw4df7/packaged-agy-us44741u. Its AGY Plugin has 22 Skill entries; all 467 receipt entries, file bytes and directory/file modes verify. Installation receipt SHA-256 is 2f9b5cb1d16f7009ad69b1af8bc97011a1f2f0abb0ccd9182933583710406459. The exported executable directly completes Full stdio MCP initialization, 35-tool discovery and a matched qiongli_config_status call (ID 3), with full raw output retained. Discovery stdout SHA-256 is da9d75eb4412b369bb67a9d3962541cf6f86ec95e97990a196e89fc215df0974; status-call stdout SHA-256 is e600eaa8471c969ad699e4a026bb21f1f66e5b59cc3bcd77c319cb2b3ac81bd5. Official AGY registration is declined at its separate step. There is no new Host session, authentication reuse, model call or change to the user's profile. This direct native call does not fill the AGY complete-Host-result/clean-shutdown gate; the bilingual development matrix explicitly preserves that distinction.

Earlier container/runtime, rootfs argument-order and interrupted image-copy attempts remain retained failures. The corrected release process is recorded in release-process-corrected.json; no failed attempt or old release output is overwritten or counted as a pass. Cargo source archives/install are recorded by their existing owner: ten archives pass staging and archive validation, then an actual release build/install from those archives passes for both qiongli and ql, with version 2.4.0, invalid-command refusal, Lite 15/Full 35 and the same content-pack digest. The archive compilation takes 6m33s. All five release asset checksums independently verify and the qualification clone remains clean at 84bc1079. Cargo results cover this local target; no registry publication or installation from a published 2.4.0 package is claimed.

Release status remains Not ready. Before another authenticated Codex batch, a supported environment must pass the credential-free sandbox check and expose the effective permissions of exactly the three native read tools. Then obtain a newly scoped login/model grant, freeze the installed candidate and rerun the three required tasks. Save/restart and fresh held-out cases follow their required baseline gate. AGY still needs its bounded complete-result/clean-shutdown and read/recovery observation. The final frozen source also needs the existing four-target distribution and Cargo qualification under separately authorized remote synchronization/CI. No push, tag, publication or announcement occurs.

At integration, the same verifier reports no blocking finding in this six-file record and independently matches all six package receipt hashes above. Seven roadmap tests, generated-index consistency and whitespace checks pass. All 249 task IDs/states/dependencies and 46 complete accepted records match 025fe931; only CLI-409/410 blocker text changes. No unchanged native, package or model checks are rerun merely for the documentation integration.

October 6 — existing login authorized, sandbox prerequisite still blocked

The maintainer explicitly authorizes using the system's existing Codex login for validation. This supersedes the need for a new login grant in the October 5 next-step record. Use an isolated profile and temporary authentication link, without reading, copying or logging credential contents; remove the link after use. The first model batch remains the three public baseline tasks, once each, at most 180 seconds each on gpt-6.1-sol / low. Those operational bounds do not expire the maintainer's authority for the same planned public validation; no repeat login-permission question is needed merely because prerequisites are repaired. Private research, real profile/permission changes, push and publication remain outside this grant.

The same lightweight verifier runs the existing credential-free preflight once from clean 2.x source 9dfad782. Installed Codex remains 0.160.0, executable SHA-256 50b06603bdcdac39b714f5c3e68583c002b8ad8779ebfdaaf4932ff016b379c0. Version inspection passes, but the normal read-only sandbox's /usr/bin/true exits 1 with bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted. Guidance reads and effective Plugin-policy inspection do not run. Both command processes are reaped with their groups gone; guidance and configuration remain unchanged and the isolated authentication path is absent. Zero model calls or authentication links are made. This is a prerequisite failure, not a new failed three-case model batch and not an authentication failure.

Complete commands, stdout/stderr and cleanup are retained at /tmp/qiongli-codex-oct6-preflight-14u3ong_/result/preflight.json, SHA-256 40e26f4b40a80b02600264215590e849e524ced5656edfed573fd5ba5b50c8af. Sibling kernel-clues.json records read-only environment clues, including AppArmor user-namespace restriction enabled and the inspecting process's zero Seccomp/NoNewPrivs flags. These do not establish the cause of the loopback denial. An initial log-read helper used the wrong stderr filename; the verifier then reads the actual stderr.log without rerunning the preflight. All prior evidence is retained and no policy, sysctl or permission is changed.

The next action is a supported Codex sandbox environment or administrator diagnosis of the current execution denial, followed by effective tool-policy readback and the already authorized public batch. Release remains Not ready; earlier Linux ARM64 package evidence and the remaining AGY, save/restart, held-out and final-source four-target gates retain their scope.

At integration, the same verifier finds no blocking issue in this four-file record, matches the new receipt hash and passes seven roadmap tests, index consistency and whitespace checks. All 249 task IDs/states/dependencies and 46 complete accepted records match 9dfad782; only CLI-405 blocker/date changes. No preflight, native package or model check is repeated for this record.

October 6 — repaired sandbox and installed-Codex baseline

After the maintainer repairs the system environment, Codex 0.160.1 passes the credential-free read-only prerequisite and complete public guidance reads. Its executable SHA-256 is fbbaec80443919f86dd63648a0b62759cf6f1d0e09310602fde96885e0bceb3e. This observes a working environment; it does not establish which administrator change or the simultaneous Host upgrade resolved the old 0.160.0 failure. No agent changes system security. The first fresh preflight is retained at /home/hermes/qiongli-codex-repaired-preflight-h8hn_puw/result/preflight.json.

All three cohorts below use official isolated qiongli@quality-24 installation, verified 468-entry native exports/caches, Lite 15 / Full 35, the same ten public source anchors and the same fixed catalog. Each task runs once per cohort with gpt-6.1-sol / low, at most 180 seconds. The effective TOML is read back before execution, including the model-bound configuration: only project read, document list and document read receive explicit approval, the named filesystem profile is read-only, and its command network is disabled. Each cohort independently passes credential-free command/guidance checks and a mocked capture/seal before its temporary authentication link is created. The link is removed in finally; the driver and verifier never inspect, copy or log credential contents. Every actual model process exits normally, its owned group is gone, complete guidance reads are bound to successful command output, and project/configuration bytes are preserved.

Cohort / external directory	Native source / content source	Structural / reviewed	Retained finding
B: /home/hermes/qiongli-codex-24-public-039cxrz1	84bc1079 / e4b05659	3/3 / 2/3	Paragraph adds within-year standardization not specified by the source. Paper explanation honestly reports a failed optional read after guessing the assessor's directory.
C: /home/hermes/qiongli-codex-24-guidance-_pl2zzbr	b8bc6175 / 8889fe73	3/3 / 2/3	Paragraph and Skill paths are corrected. The paper handoff incorrectly claims eleven unique source anchors instead of ten.
D: /home/hermes/qiongli-codex-24-coverage-n_qq8vl1	85758cac / f26ee4a5	3/3 / 3/3	Complete answer review passes all declared checks; prior failures remain unchanged.

8889fe73 gives paper reading the correct installed-root paths for extraction and critical appraisal. The shared writing contract now preserves the source's methodological resolution: a familiar transformation does not establish its unreported grouping, parameters or implementation. f26ee4a5 changes the reading handoff default to identified read/unavailable scope; numerical coverage is only included when requested and derived from enumerated unique sources. Neither change embeds the regression answer. The first change passes 33 affected contract/resource checks, the capability validator and exact portable projection; the subsequent reading-only change passes seven affected checks and exact projection. Unchanged writing/capability checks are reused.

The existing generator creates each 446-entry lock after its canonical content commit. The final local Host candidate is:

Identity	Value
Native source	85758cac79dc1b5248099fe9194529fd789a75df
Content source	f26ee4a591a7fc449b5352540ff226117ce2042e
CLI SHA-256	2aa5079d4b11464dc8e0df093642cc16707413f7f95090475eb050ec82dd3898
Content pack SHA-256	1d84ed12b46eb7153f3ff38b440950e524e4e6834e625cc173acc049cc814397
Plugin receipt SHA-256	cc3bfb8c36d66d2b73cd3e07bdcaf48c0621c47f5f7635c54dfb660c18245ee9
D frozen inputs SHA-256	ba8867e1efc6a299de19d402254012058d4c48bbd04d4a627beaf702ca4cdf58

C and D use pinned Rust 1.97, locked/offline CLI-only test profile builds for Host observation. They do not inherit the earlier 84bc1079 glibc 2.35 release qualification. An initial C build command mistakenly requested a nonexistent cli feature and exited 101 before building; the corrected no-default-features command succeeds. The original command error remains in the build handoff. No unchanged release suite is rerun for these scoped content fixes.

Each directory retains captures/manifest.json, review-completed.json and offline-score/summary.json, respectively bound by:

Cohort	Sealed manifest	Complete review	Score summary
B	c21e587733e7ca424378efb3a627e1e588a1041d0eb349659a0c037d19498611	d5b8445c0e2912d350b733b13ddcd677341e337646934df409c7890ad6a1245c	6e14d41f1ff8ffa41907f3a0078333ed9ec630a6fa5ed921bf2f76ffb8c53a68
C	2592f3c44a3c943d733096936e43ff97b9ac2fa50a2e3c17ce79faf83cb4d826	b0770092204e479c2eb79691a8eb74e6cf5701eae04b27cb617962dd073f233f	4bb35496421b076e06d00ed2b166d2bd86504bd0a8b34baa5baea8c5acfe65d3
D	1267f28d39e6a922c5ed0b901cf2867c97205613ffd036f5c3fd2d02d9622d98	84046abfb0f1825fb76925ba23d3528811549e40d00e1edfcb64ab1224e9f656	b79465780b623026a1150b448c0da9070bc45d9e83d8c22d592abcc546acef71

The same lightweight verifier reviews every substantive answer span against supplied sources. D's recommendation is 277 characters and direct paragraph 266 under their declared rules. Its saved continuation makes four actual native calls, recovers revision 4 and reads the two current bodies (7,117 and 10,308 bytes) exactly; the synthetic changed packet has no usable read arguments and is skipped. Preparation independently rejects changed bindings and stale revision reads without altering fixtures. This uses a prepared historical note, not a new model-note save/restart journey or complete B2 reading.

D task	Seconds	Input / cached / output tokens	Completed calls / failed
Paper explanation	72.646006	70,353 / 49,280 / 2,454	7 / 0
Source paragraph	36.852149	112,830 / 81,664 / 1,267	2 / 0
Saved continuation	57.455549	188,244 / 149,248 / 1,859	7 / 0

Original B/C metrics remain in their score reports. B first permits pure in-memory paragraph counting; D generalizes this to checking supplied material and delivered text without additional file reads, writes or network. This is an operational prompt correction, not a demonstrated cause of C's counting error. The changed content, prompt, Host and candidate identities prevent a controlled performance comparison. Supplied installed guidance paths make this a bounded usage regression, not an automatic Skill-discovery qualification.

Slice 2's fixed installed-Codex regression exit is now observed for D. Next use a newly reviewed actual answer for the separate native save/restart journey, then run the three fresh synthetic cases whose source/request/reviewer criteria are frozen at /tmp/qiongli24-heldout-materials-7ji7r5dq (material manifest SHA-256 651a95679468a0e0f9af0153a58346c56d6fd294f388f4397c364a8b257e0c77). Their cases have not run or supplied guidance-tuning evidence. Final fixture, installation and prompt bindings must be frozen before those observations. AGY complete-output/clean-shutdown/read-recovery and final-source four-target package/Cargo qualification remain open. Release remains Not ready. No push, tag, publication, real profile/model change or acceptance promotion occurs.

At integration, the same verifier matches all nine cohort manifest/review/score hashes and confirms each authentication link is absent. Seven roadmap tests, generated-index consistency and whitespace checks pass. All 249 task identities, states and dependencies, 46 complete accepted records and all existing evidence fields remain unchanged from 2.x; only CLI-405/410 blocker text and CLI-410's date change. No unchanged native, package or model checks are rerun for this documentation integration.

October 6 — new-note persistence and fresh synthetic cases

The unchanged installed-Host candidate 85758cac / content f26ee4a5 / pack 1d84ed12 now passes the separate save/restart journey and three previously unobserved synthetic cases. These reuse the installed-Codex regression's exact CLI bytes, official installation owner, read-only policy, Codex 0.160.1 and gpt-6.1-sol / low. Each model case runs once, for at most 180 seconds; no result, criterion or fixture is changed to obtain a pass. Complete guidance reads, normal process completion, group cleanup, preserved project/configuration bytes and temporary authentication-link removal are verified for all four cases.

Actual reviewed answer saved and recovered

/home/hermes/qiongli24-new-note-restart-lusj0r5h retains a new isolated project, prj_06f5b05814e4b3d0bd0de361d3fa8e43. Reviewed native transactions save the independently reviewed actual D paper-explanation answer verbatim, with its answer/review/manifest provenance, through source capture, exact preview, academic review, approval and revision/CAS. This is an actual answer save, not a claim that the read-only model performed the write. Source and note saves advance the new project to revision 3. Missing-approval attempts for both writes are refused without mutation; temporarily missing source bytes cause read and note-preview refusal, then are restored exactly before a fresh approved preview. Stale revision-2 reads are refused. The original D fixtures remain unchanged.

A fresh session receives only the project ID and installed guidance locations, with no research paths, hashes, revision or body snapshots. Seven successful native calls obtain project/list/read results, including complete byte-matched 8,450-byte note and 10,308-byte packet bodies; duplicate reads remain in the metrics. Three guidance command calls bring the total to ten, with zero failed calls. The 44.230030-second run reports 263,669 input, 197,760 cached and 1,401 output tokens. Its 256-character paragraph passes the declared 250–350 rule and all six independently reviewed answer spans. Structural and reviewed results are both 1/1 through the existing trace/span and Evaluation Truth V1 owners.

Two offline verification mistakes remain retained: an initial helper expected blocked JSON instead of the actual missing-source preview's exit 1; another incorrectly required optional MCP structuredContent despite complete JSON in content. Only the helpers were corrected; no model case was repeated and the source-restoration finally block preserved the original bytes.

Three frozen synthetic cases

/home/hermes/qiongli24-heldout-8os90b1t binds the source/request/reviewer criteria previously frozen at material digest 651a9567, with 35 final input files plus the freeze record and 60 sealed files. Reviewer criteria and the changed-source replacement are withheld from the model. Before final preview/save/freeze, the coordinator removes an extra recovery instruction from the synthetic historical note; the saved note contains provenance, findings and limits. No material or criterion changes during or after the actual batch. The initial preparation's external-file sandbox refusal is retained and corrected using the authorized external write; it is not a model retry.

Case	Reviewed behavior	Seconds	Input / cached / output tokens	Calls / failed
ShiftBreak2026, abstract only	Preserves 46 volunteers, three workplaces and eight days of observational self-reports; does not infer causal support for a fixed-break policy.	31.339207	61,231 / 44,416 / 963	4 / 0
CyclePilot2026, conflicting units	The 314-character paragraph distinguishes six randomized machines from 120 cycles and 58 + 60 valid records; retains −4.2 seconds versus 4.2% as unresolved, with unknown precision.	31.294074	77,549 / 64,384 / 879	2 / 0
StreetShade2026, changed source	Three native calls recover revision 3, bindings and the complete current 1,300-byte note. The changed source has no usable read arguments and is not read; 2.5°C is explicitly historical, while the unseen 0.7°C replacement is not adopted.	38.425721	177,246 / 147,968 / 1,066	6 / 0

Structural and complete independent answer-review results are both 3/3. After saving the original source and note, preparation deliberately replaces only the synthetic packet before freezing the observation. Changed-source and stale- revision refusal checks cause no further mutation. This is one frozen synthetic cohort, not expert, full-paper or cross-discipline acceptance. Having been observed, these cases are now regressions; replaying them cannot establish another fresh held-out result. Supplied installed guidance locations still do not establish automatic discovery. No efficiency comparison against earlier differing tasks is claimed.

Evidence and remaining release scope

Each root retains its complete evidence-summary.json, including exact file paths, source identities, native negative receipts, traces, reviews and metrics. The summaries and principal records are bound here:

Record	New-note save/restart SHA-256	Held-out SHA-256
Evidence summary	2e707d399e5607e4a3eba275e16a6125204d83cb2cf2319c46f7707f21e26532	8bdfb1766c62df1dd2675d48755fa3be292a1391fd1d8236363924f31b5e74de
Frozen inputs	1473439e30f4372969bf071ff1422baaf5b4bba74005a0a83815880a707b3477	f9b2af5a1ba9d62c2a335718c9c1c7425f21fc6d204e4f257c5b1879eadb4480
Sealed manifest	5e10641a49a587112d0cf908e95fd66101e7891daa477f9431994ac23558a8cc	f5512235cdda9f40d1ab508a7bb196179a7fe0f5378a00d6d9c127043f4b3ff3
Complete review	c7ff475e219ff3f9d310550db6f753ed8f71ae8a33ef616358c9e1c1b514d9f7	4de0fff3a7463a817e58143c0814e6351226e697ea0a97ddee8193faf8f6b847
Score summary	ca9c70b9b6d1bcc857dfd2d449443db2501d196d42e274a9e6fe4de0bfbd65c7	69a400fba86c51527fde601092d27522596cf8fea94ef96d805a223cad5bc8c6
Authentication lifecycle	b92a24e7e40a1c82c1bb722d9eb85b47b4ddcbac8ef989c68c18839507cb6a9f	8ff5675987987fff457d7dd1bc286488d5c9f75a7acd8054750eb1554d180c72

Slice 3's scoped Codex save/restart and held-out exit is now observed. Next close AGY's actual complete-result/clean-shutdown status call and bounded read/recovery, and qualify final-source local artifacts before separately authorized four-target remote distribution/Cargo checks. Older 84bc1079 release artifacts retain their original scope; these test-profile observations do not qualify new packages. Release remains Not ready. No push, publication, real profile/model change, new task state or accepted-evidence promotion occurs.

At integration, the same verifier passes seven roadmap tests, generated-index consistency and whitespace checks, matches all twelve principal hashes above and all 32 files referenced by the two evidence summaries, and confirms both auth links are absent. All 249 task IDs/states/dependencies, 46 complete accepted records and 76 nonempty evidence fields match 2.x; only CLI-405/410 blocker text changes. Final review clarifies the deliberate pre-freeze synthetic source replacement and the native transaction actor. Unchanged native, content, package and model checks are reused; this documentation integration adds no acceptance.

October 6 — current-content local packages and AGY 1.3.0

After local integration, a separate clean 2.x clone at native source c2cae7360667ba722d41f2ca2adb8647fbda8090 qualifies Linux ARM64 in the existing rootless glibc 2.35 environment. It binds canonical content f26ee4a5 and pack 1d84ed12, rather than inheriting the earlier 84bc1079 results. No credential mount, extra container privilege, remote synchronization or publication is used. The source clone is /home/hermes/qiongli24-final-source-6l3po_h5/source and new output root /tmp/qiongli24-final-delivery-meywqu48; the old artifacts remain.

The existing release owner passes formatting, strict Clippy, 46 CLI + 9 MCP tests, archive smoke, glibc/wheel checks and actual npm/wheel installs. The 494.638661-second successful process produces five assets whose actual sizes and SHA-256 values all match the manifest. Codex/Claude archives and the npm DeepSeek projection pass, with 22 DeepSeek Skills and 35 Full tools. The archived CLI SHA-256 is 548909b6649291b0e7f28e155a4271d77dfdb9b77bee4e33e1ef0026d0d0bc57; Lite 15 / Full 35 and the current content-pack digest match across installations.

The separate 470.796946-second follow-up passes actual public pip/npm 2.3.0 upgrades without fallback and retains the synthetic canaries through the existing owner. Ten Cargo source archives validate, then actual installation from those archives passes both qiongli and ql, version, invalid-command refusal and MCP/ content checks. The source clone remains clean. These are local target results, not a published-package install or four-target qualification.

Preparation retains the initial insecure /tmp source-location diagnosis and new clone's inherited group-writable directories; no tests start in either condition. Only newly owned real clone directories have group/world write bits removed, without changing tracked bytes or Git file modes. The first owner run then correctly refuses a detached clone before tests/builds. A local 2.x branch at the same frozen source satisfies that existing guard; no guard or source is changed. Its failed receipt remains separate from the successful run.

AGY package transport and actual Host are separate

The archived CLI exports 22 AGY Skill entries into the new isolated /home/hermes/qiongli24-packaged-agy-t6446ljm fixture. Exported executable bytes match the archive; Full stdio discovery returns 35 tools and a matched ID-3 qiongli_config_status call succeeds with complete raw native output. Official Host registration is deliberately declined at its separate confirmation. This qualifies package/native transport, not an AGY model session.

Separately, /home/hermes/qiongli24-agy-next-nhow8box retains an actual isolated AGY 1.3.0 installation of the unchanged Host-test candidate 85758cac / CLI 2aa5079d. The Host executable SHA-256 is b3df69538e3de96f341c2bd12e5354954ecfb94aa93dabc79f695bc05b386302. Native source export and the official plugin install / enable qiongli each receive their own reviewed confirmation. Installation completes normally in 225.527519 seconds; source/cache bytes, allowed modes, receipt identity and registration/enablement match. The Plugin receipt SHA-256 is 20b9a48f8fcfe92fc46dad4dc5d7e76ac21024ab9669f259c6070afa36f46e9f. The initial invalid source-leaf refusal and canceled valid preview remain. A reused temporary PTY receipt misleadingly names a field cancelled_first_write_confirmation; its raw log records both actual approvals. The packaged-export log instead records source approval then registration denial. These retained labels do not override the actual command/confirmation evidence.

Before one status observation, the isolated settings allow only mcp(qiongli_qiongli/qiongli_config_status) and deny model shell/browser/direct file-read/write actions. Only the new public workspace is trusted. Registered MCP configuration has no environment override; the observer selects the isolated Qiongli configuration/workspace for any native child. The authentication failure does not establish that the Host actually started such a child. AGY's rule does not restrict tool arguments; the existing observer fixes and matches the exact cwd instead. The complete capture/score path is mocked offline before execution. The live invocation uses plan mode, sandbox, low effort and at most 180 seconds, with no model override or permission bypass. Credential files are never inspected, linked, copied or logged; only the official Host may use its normal login flow.

The isolated Host does not obtain silent login. It reports authentication required, waits through its normal 60-second login timeout, then exits 1 after 60.787555 seconds. It reports zero model turns/usage and makes zero MCP calls. The V1 score correctly fails the required Host/result gate; the process is reaped, its group is gone and workspace/Qiongli configuration/settings snapshots match. No login URL is opened, fallback login performed or model attempt repeated. The maintained temporary profile is available for the user's normal interactive login; any subsequent login or observation has its own new evidence. This is a missing authentication prerequisite, not an observed MCP implementation failure.

Evidence and next action

The local output's evidence-summary.json binds all thirteen principal records, all five assets, exact source identities, durations and preserved failures. Its SHA-256 is cea37483179bdcbe792e9468cbb615fdd69f9640568c42e9b55beacadc8e9253. Selected underlying records are:

Record	SHA-256
linux-arm64-glibc235/assets/release-manifest.json	db12965e781acca505b9ae9a4f8a026692998870a083dbf23c87a41e3a05f9e6
upgrade-2.3.0/registry-upgrade-check.json	a772c11a33fe2c2204d4e06a79417e5f8e43d60bae542fb9bf3e0facbab5b2ba
cargo-source/registry-packages.json	2cf26e5f71319d440e44152dbaf792c758dc8a99519223b7d839df6868167ce2
cargo-install/install-check.json	211dc8024474a7be4174a74cd8c22e2d0759ac664bb440befedd839cf580a27e
Packaged AGY logs/native-mcp-receipt.json	43688ce4dc3f7276569f035df92c29a5ee37c67fc83f3a4db94084f1736340fe
Isolated AGY installation.json	6735fa78e7068f38548a2e9c3e12dd89cd556c2b4d9b463b42b500217017ac52
Isolated AGY status-capture/manifest.json	126a243f1b57ac486bde724c6808db84645886cb50c0dfe63696e7b8fcacdec7

The bilingual development Host matrix now reflects the current Codex scoped passes, separate AGY install/authentication result and current-content ARM64 package checks; historical accepted matrices remain unchanged. Release remains Not ready pending AGY's authenticated complete-result/normal-completion and bounded recovery observations, plus final-source four-target distribution/Cargo qualification under separate remote authority. No push, tag, publication or acceptance promotion occurs. Unchanged Codex/model/content checks are reused.

At integration, the same lightweight verifier passes seven roadmap tests, generated-index consistency and whitespace checks. It matches the summary, thirteen bound records, seven selected hashes and five assets without accessing the live AGY authentication/settings directory awaiting user login. All 249 task IDs/states/dependencies, 46 complete accepted records and 76 nonempty evidence fields remain unchanged from c2cae736; only CLI-409 progress/date and CLI-410 progress change. Final review distinguishes selected child environment from an actually observed child launch, which this authentication failure cannot prove. No unchanged model, native, package or content check is repeated for integration.

October 6 — authenticated AGY and authorized remote qualification

The maintainer confirms normal login in the retained isolated AGY profile and authorizes remote synchronization, the PR required by existing branch rules, Native CI and four-target CLI/Cargo qualification. This grants no tag, release, publication, announcement, main cutover or remote-rule change. No credential file is inspected, copied, linked or hashed; configured models remain unchanged.

Authenticated status call and capture limitation

On unchanged Host candidate 85758cac, AGY 1.3.0 completes one fresh status call in 12.124649 seconds, exit 0, one turn, no denial and one exact MCP call. The returned native status JSON passes its existing schema. Process reaping, group cleanup and workspace/Qiongli configuration/settings preservation pass. Reported usage is 20,955 input, 12,208 cached, 271 output, zero thinking and 21,226 total tokens. The pre-login failure remains separate and unsuccessful.

AGY exposes the native JSON body as a string in tool_info.output, without the MCP response envelope. The unchanged strict score therefore fails, solely on full_native_result. The exact public session transcript also retains only that body; it is not substituted for wire evidence. Official headless, reference and hook documentation supplies no verified safe full-envelope capture path: final-answer JSON schemas constrain model text, and PostToolUse hooks do not provide the tool result. No generic credential-sensitive logging, injected interception or scoring relaxation is used. A separately scoped projected-body recovery observation can establish read compatibility, but cannot close this strict gate or establish automatic Skill discovery.

The retained root /home/hermes/qiongli24-agy-next-nhow8box binds the new status-after-user-login capture and separate score:

Record	SHA-256
status-after-user-login-evidence.json	6829a2cd631da0c81587a3b3687aee89436c1a4be02a4cd92ce37a957be2fcf6
installation-after-user-login.json	0593d520db403bb5d689ecad08138ca4d2eece444bfacfa152fa936fc3a80e00
status-after-user-login/manifest.json	99bcffd1ac786a8cc2bf90c2d7d5a30bc0b038b3c12577e320a54f41babd8caf
status-after-user-login/capture.json	10e692cdaa82200e4a7ac389b84c6920a33e4ab30a2370a3554e39a2398f5883
status-after-user-login/events.jsonl	60afc25d6bbb48ae6bbc0e3845deeff6b6a81586c2c6ac09d1d8316e8fec729c
status-after-user-login-score/summary.json	722c720d5b5d3ef5e557240d9221554b1c9eef7a26eb475eb355adb6728677e9

Source synchronization and documentation repair

Remote 2.x at c25fb2c1 is an ancestor of local 8a0403c4, 351 commits behind; 325 already belong to released main at 153cb15d. The actual 2.4 increment contains 26 commits across 57 files. Independent scoped review finds no new source-synchronization blocker. The boundary guard passes, and the new 2.4 diff has no whitespace errors. The cumulative remote diff retains an existing trailing space in the published tables-source.md:87 source fixture; immutable bound evidence is preserved.

The authorized branch sync/qiongli-2.4-qualification-20261006 and PR 183 use the existing protected PR route without force, administrator bypass or ruleset changes. Initial Native CI and Evaluation Truth runs bind 8a0403c4, not a later revision. Final-source platform and archive qualification remains separate from PR checks.

The initial local documentation build fails because the maintainer quality contract links outside VitePress's documentation root. Its existing research journey reference now uses the repository's public 2.x URL. The subsequent build passes in 50.873783 seconds, without changing dead-link enforcement, dependencies or package content. Initial Cloudflare Pages reports only a build failure; its unavailable logs do not establish the same cause.

Preserved recovery failure and platform fixture repairs

The frozen external helper at /tmp/qiongli24-agy-recovery-preparation-r2 preserves the original preparation unchanged and adds atomic settings replacement, compare-before-restore cleanup, failed-inspection sealing and exact executable/imported-helper bindings. Eleven parser cases, a fake-process round trip and three cleanup/error cases pass before one actual 180-second-bounded observation. Its freeze SHA-256 is 698dc6418ed5e0e4224d375b1e43f13a2ec615e466dce7c0bcb471ac8ba1f3cc.

The actual observation fails recovery, despite exit 0 and Host SUCCESS in 48.480980 seconds. Ten tool attempts comprise one successful project read, seven invalid document-list calls and two denied file reads. None of the list calls uses the required expected_project_revision; no document body is read and no requested paragraph is produced. Repeated parameter guesses also violate the stop-on-error instruction. Reported usage is 75,292 input, 137,982 cache-read, 1,327 output and 76,619 total tokens; these Host fields are retained as reported, not treated as a controlled efficiency comparison. Process cleanup, public project/configuration preservation and exact settings restoration pass.

The two denied paths are the Host's public project-read schema and the installed Skill entry. Inspection of the three specifically named generated schemas confirms correct native parameter contracts, including expected_project_revision. The observation policy denied every file read and therefore also denied Host tool-metadata access. This is a harness limitation to address in a separately frozen observation, not evidence of a native parser defect or permission to silently retry the failed case. Original raw events and the failed denominator remain in r2/actual-capture; no credential directory is scanned. The CLI permission contract places deny before ask/allow; an exact schema-read allowance cannot override the original blanket denial. Any corrected observation must freeze its explicit metadata-read permissions and retain direct research-file/write restrictions.

Initial PR Native CI 37474974188 exposes a stale three-Host assertion after AGY adds the fourth selection, plus Windows fixture failures in AGY export and saved-document/retrieval-history tests. The bounded repairs assert the four actual Host identities, create AGY test roots/home through the existing Windows owner-only directory API, and canonicalize newly created temporary project bases before deriving registered paths. Production ownership, canonical-path, ACL, revision and refusal guards remain unchanged. The Windows project-registration log reports UnsafeProjectRoot; canonicalization is the targeted fixture repair, not a claim that the log alone proves its precise underlying Windows condition. Fresh platform execution must qualify these changed test sources.

The same macOS run also reports the stale Host assertion and noncanonical project-fixture refusals, then reaches its 30-minute job deadline while still executing the portable archive tests. The preceding artifact and Desktop package tests pass; there is no portable-archive assertion failure in the retained tail. The PR native job budget becomes 60 minutes, with the manual budget unchanged at 120 minutes. Required contexts, test selection and failure propagation stay unchanged. The initial run remains failed/incomplete, not a qualified platform.

Local repair 843766f6 passes formatting, 21 completed affected Rust checks and strict app/project Clippy, plus 20 branch-policy checks. The initial hosted Linux run's four passing bundle cases remain applicable to the unchanged Linux path; the directory-creation change is Windows-only. New hosted execution remains required for that platform. The verifier retains an initial missing-import compile failure (corrected), new isolated fixture directories created as 0775 under umask 0002, and an externally terminated bundle test process (exit 143, cause unestablished). Only newly owned test-directory modes are corrected. Changing the temporary parent alone does not fix the project refusal; a scoped private creation mask does. No production safety check is relaxed. The interrupted case separately completes in 162.64 seconds. Final local receipt /tmp/qiongli24-ci-repair-final-verification.json has SHA-256 cb45628353d925c990e70bb139beb8394681256861d70ff4e53cd1ab579c022d, binding the earlier partial receipt and the completed last case without overwrite.

The final documentation build before this evidence paragraph passes in 78.688734 seconds; receipt /tmp/qiongli24-docs-build-integration/receipt.json has SHA-256 9b6c92b9051118a44f52b0a8aa6fceaa9fe75837cf4901337363f589a54e9cf6. Seven roadmap checks, current generated index, whitespace and all six status capture hashes pass independent verification. All 249 task IDs/states/dependencies, 46 complete accepted records and 76 nonempty evidence fields are unchanged; only CLI-409/410 progress text is extended. Final diff review finds no remaining local blocker. Release is still Not ready pending AGY qualification and fresh final-source platform/package evidence; local integration adds no acceptance.

October 6 — metadata-assisted AGY recovery and candidate CI

Local integration and the existing PR now bind f97b5f7a. Its Evaluation Truth run 37481012601 and Cloudflare Pages check pass. Native CI 37481012794 runs against the repaired source separately from the earlier failed run. These remote actions use the maintainer's existing synchronization/verification grant; publication, main cutover and acceptance remain separate.

One separate recovery observation

The revised external preparation at /tmp/qiongli24-agy-recovery-preparation-r3 adds only the exact three public tool schemas generated by the installed Host to the prompt, explicitly labeling them interface metadata. Research input remains the project ID alone: no body, saved path, revision or file hash is supplied. The driver/parser, three-tool MCP allowlist and blanket direct-file denial remain unchanged from r2. There is no new read grant, schema injection into the Host installation or model override. Eleven parser cases, the fake-process/CAS round trip and three failure/cleanup cases pass before the new single bounded invocation. The old r2 failure remains.

On unchanged Host candidate 85758cac, the run completes in 98.311877 seconds, exit 0 and one Host-success turn. Fourteen completed tool attempts comprise one project read, one document list, eleven document reads and one denied view_file. Twelve native calls retain complete payloads. The initial note-read completion at offset 0 / max 16,384 omits its output from the stream without an error field; the model then attempts to read its own Host step-6 output file and is denied. This is consistent with Host output offload, not proof of a native read error.

Later bounded native windows reconstruct the entire 8,450-byte note and 10,308-byte source packet, with exact whole-file SHA-256 matches. No research body comes from direct filesystem reading. Source-fidelity review passes and the delivered paragraph contains 303 counted characters, within 250–350. Its unsolicited assertion of 294 characters is inaccurate. Complete-session scope and the frozen trace criteria fail on the extra file attempt and omitted result, so structural and whole-answer/V1 results remain 0/1, not a clean recovery pass. No scoring requirement or historical denominator changes.

Reported usage is 75,547 input, 280,581 cache-read, 3,983 output, zero thinking and 79,530 total tokens. These are the Host's fields, not additive or comparable efficiency estimates. Process cleanup, project/configuration preservation and exact settings CAS restoration pass. The driver/verifier neither inspect nor modify credential files; normal authorized authentication remains with the Host. Two offline review-helper enum/format mistakes across r2/r3 remain retained; only the external review inputs are corrected, without repeating either model run or changing source/trace bytes and scoring criteria.

The r3 evidence summary has SHA-256 26e90b182184b3e4220b7c680e72eb4af516eee0f4e70078ac683e89918ff262. The lightweight verifier matches seven capture files, fourteen frozen local inputs and thirteen external bindings, including the three public schemas.

Record	SHA-256
r3/freeze.json	d2a8c68172f38d0649ceeb9fa96b47151c94d0155eed80ea075f17e0e119d469
r3/actual-capture/manifest.json	cbbc03d68a40eded7795179a5eeec5af243a4090a8d0e13a55a4b8861d6fd3c1
r3/actual-capture/events.jsonl	884175b9bf2f3c2cfb2e06a4281840a777519ea69b816d8a7fa4695417920e91
r3/actual-capture/capture.json	84ab3bfdd8713723c739ac97cad4a84702e787026cb1145a980647cbe5b71216
r3/actual-capture/permission-cleanup.json	d82100ca6b0424e3473b221d93e51f5217e3914f1d88f465efd60ea59de65b3b
qiongli24-agy-recovery-review-r3-corrected/summary.json	a60b7ceadf50a3c70fb8c6b7a4003bd47aa832f5d30d0ff836c0646e640dac17

The original strict status score still fails because the retained status stream and exact-session transcript omit the MCP response envelope. Successful native body reconstruction does not change that gate or establish automatic Skill/schema discovery. The coordinator proposes describing AGY as experimental in 2.4, retaining these requirements for later promotion while keeping Codex and package gates mandatory. That material release-scope change awaits the maintainer's decision; the existing required AGY gates remain in force meanwhile.

macOS parallel-fixture collision

On f97b5f7a, the Windows foundation and Evaluation Truth checks pass. The macOS foundation finishes with one failing retrieval-manifest test: its newly exclusive temporary-base creation returns AlreadyExists. Timestamp-only suffixes can collide between parallel fixtures; the other retrieval case and all three CLI saved-document cases pass. The complete failed run is retained. The three affected project fixture helpers now follow the existing CLI/MCP fixture pattern, adding a process-local atomic counter to the PID and timestamp. Exclusive creation and canonicalization remain in place; production path guards and test selection remain unchanged. Hosted qualification of the repair is still required, independently of the earlier Windows pass.

The repair passes all 11 affected cases (two retrieval-history, three CLI saved-document and six project saved-document tests), formatting and strict app/project Clippy. Independent review finds no remaining local issue. Receipt /home/hermes/qiongli24-ci-fixtures-ykckuntt/collision-results.json has SHA-256 dbb94d74d75deb68480140b5bd0b69d54b0789e52a02a36d5b40525e92bde3de. These local results do not replace the required macOS execution.

Before this CI paragraph, the seven-file documentation review passes seven roadmap checks, generated-index consistency, whitespace and evidence bindings. All 249 task IDs/states/dependencies, 46 complete accepted records and 76 nonempty evidence fields remain unchanged. Documentation builds in 51.994152 seconds; /tmp/qiongli24-docs-build-r3-records/receipt.json has SHA-256 f53c04ecac3404ffc4b5ec93f1510384e2f9044cde5e536451ad4cb33b0f2ccc. The final operator-versus-Host credential wording is a reviewed plain-text clarification; it changes no links, build configuration or dependencies.

October 6 — protected synchronization and four-target qualification

The final PR source 1df769f9bc228caf4dd7622e47faf9d0a9b94709 passes Native CI 37487108616: Linux, macOS and Windows foundations, the native change boundary and Lite compatibility. Evaluation Truth 37487108729 and Cloudflare Pages also pass. The macOS execution qualifies the atomic-counter fixture repair. The preceding f97b5f7a run remains cancelled after supersession: Windows passes, macOS fails its single directory-collision case, and Linux is incomplete. Its retained cancellation log contains no observed assertion failure; that partial execution is not a platform pass.

PR 183 merges normally through the existing protected route. The frozen merged source is 8fd774a05f5fc08fd0b61b0857fe869e87cd3af0, with exactly the same tree as the qualified PR head. Local 2.x fast-forwards to it. Subsequent documentation records do not change the source identity of these checks or artifacts.

• CLI distribution 37494107157 succeeds on all four targets: Linux x64/ARM64, macOS ARM64 and Windows x64. Target-native builds and installs, assembly and all four combined-package installation jobs pass. The downloaded packet passes the existing native_release_assets.py verify --require-ci owner for version 2.4.0 and the exact merged source. This includes the successful-run API gate, not only receipt inspection.
• Cargo distribution 37494107269 succeeds in all four qualification jobs. Publication and post-publication registry installation are skipped as required for this branch run.
• Manual Native CI 37494133020 completes on the same merged source with all three foundation jobs, the change boundary and Lite compatibility passing. All three foundation jobs include Desktop consumer tests and the opt-in capacity step. Seven retained Community Alpha/product jobs fail, so the overall workflow is failure; Community Alpha promotion is skipped. These outcomes remain separate from the successful CLI and Cargo distribution lanes.

Independent downloaded-receipt verification confirms all four npm/PyPI installs, Lite 15 / Full 35, pack 1d84ed12, package hashes and Codex/Claude archive bytes. Each target passes both historical and explicitly selected 2.3.0 upgrade checks with three retained synthetic fixtures. Each of the four Cargo receipts reports ten archive installations and both qiongli/ql checks. Cargo receipts contain archive hashes but no source_commit; their source binding comes from the exact GitHub run head, not an invented receipt field.

The external receipt review at /tmp/qiongli24-merge-8fd774a0-receipts/receipt-verification.json binds 42 files and has SHA-256 c7db1e3cb1b02f3c5f54717f2507d0f6fd012f1e6bdbd9df4dc28db320f6b8a6. The release manifest has SHA-256 1e06335c6e80859a0c5be157117fdd9d69c91a08f37b8c532762cbb74a576ed0. The verifier initially misdescribes --require-ci as receipt-only; inspection corrects that explanation to its actual successful-run API requirement. The recorded command succeeds with that flag, and the exact-source workflow is confirmed successful. No extra verification run or artifact rewrite is needed.

The completed manual-run API snapshot and six capacity receipts are separately bound by /tmp/qiongli24-manual-final-37494133020/verification.json, SHA-256 4c05b49fe1c190bfc70c4c55d56f0d85c444a3b0e49a3240f87b7fc346ad4b73. All six receipts match the merged source and run 37494133020 with status observation-only. They establish no performance acceptance. The original 42-file CLI/Cargo review remains unchanged.

Retained Alpha product boundary

All three candidate-lifecycle jobs reject an ephemeral Alpha authority while building stable 2.4.0, reporting native-release-authority-product-version-mismatch. The retained acceptance owner explicitly constructs Alpha identities, update state and notes. All three desktop package jobs report desktop-package-target-unsupported; their owner maps the Alpha identity failure to that general error, so this does not establish an unsupported Linux platform. The macOS packaged-product wrapper reports packaged-product-acceptance-product-build-failed without the inner build error in its retained output; its precise underlying failure remains unestablished.

The existing CLI distribution decision and contributor release instructions separate standalone CLI qualification from App/Community Alpha signing and promotion. This increment does not expand the retained Alpha helpers to stable Desktop, change the embedded production authority or represent the complete manual workflow as passing. Its failures remain visible; they do not replace or invalidate the separately observed CLI package checks. The original required AGY status/recovery gates remain failed, and the proposed experimental AGY release boundary still awaits a maintainer decision. Overall 2.4 release readiness is Not ready under the current plan.

Independent review of the hosted-evidence documentation finds no issue and verifies all 42 bound files. Seven roadmap checks, the generated index and whitespace pass; all 249 task IDs/states/dependencies, 46 complete accepted records and 76 nonempty evidence fields remain unchanged. Before this final result paragraph, the documentation build passes in 54.390599 seconds, including the new local ADR link. Receipt /tmp/qiongli24-hosted-docs-build/receipt.json has SHA-256 4fd0d15d8bcf869a211fef3c6b2aff7d78b655f2ce6b5f807ef6452925805695.

October 6 — prose, literature synthesis, citations and explanatory notes

The maintainer reports awkward prose, shallow literature reviews, incomplete background citations and weak explanatory-note use. The local baseline is 16a9d7c4. Source inspection finds relevant English/Chinese expression guidance concentrated in J2 revision, a generic B4 completion rule, narrower citation coverage and no shared explanatory-note rule. These are instruction-coverage gaps; no supplied user manuscript reproduces the reported real-use defects.

Canonical content b2d52413 addresses the four outcomes through existing owners:

• Stage F applies scholarly voice while drafting and asks for concrete, connected explanation while preserving meaning, technical precision and source limits.
• B4 and the manuscript-writing route compare inspected evidence, explain consequential differences and connect the synthesis to the paper's question or choices. A section request does not trigger a formal systematic review.
• Citation-risk guidance covers source-dependent background, definitions and note claims, with nearby matching support rather than citation-count targets.
• Stage F and proofreading distinguish explanatory/bibliographic notes, preserve identifiers and venue rules, and keep essential evidence and limits in the body.

The separate synthetic evals/research_journey/writing-quality/ packet provides three bounded requests and review criteria. One requested gpt-6.1-sol / low subagent first uses materialized guidance to produce complete A/B/C answers, freezes them, then reads the criteria for self-review. All three complete without a material defect identified in that review. Coordinator inspection corroborates the source comparisons, background coverage, numerical/edit fidelity and note boundaries. This is a forward trial followed by self-review, not an independent blind judge, controlled improvement measurement, expert or installed-Host pass. The synthetic English edit is especially narrow; it does not qualify an entire manuscript. No answer is rewritten or rerun, and no usage metrics are invented.

The existing six-module content/route/resource suite passes all 81 tests; capability validation passes. The existing content materializer produces exact bytes for all eight changed canonical files, no symlinks and no missing resource links. Full original answers, commands, counts and reviews remain at /tmp/qiongli-writing-verifier-mpnpi2wt/; these temporary local observations are not accepted program evidence. review.md has SHA-256 5c67c9558eac3ed1e5a5cd938e06b07ca68fba98346ee91621bb557abe744d78, and hashes.json, binding source/task/changed-guidance bytes, has SHA-256 2d315db694d666d38df8618f66f1ae0619502ac10d22c696cf57372fea50ddc9.

The existing update_qiongli_core_lock Cargo example regenerates the native 446-resource lock in 7d779929, bound to canonical source b2d52413da3afd01ff44f82ec741bfdf03b656d6, content root b1504ec2a5472cd357f4310837d4086d1f277fb88aeee8ee6af02660854face2 and pack be8128fcbb62e16bc40526e7be1655ba4838b6af0ac28606639af92d19e6ba37. Regeneration succeeds offline without editing generated Plugin or installed files.

Native checks retain an environment failure: seven of nine content unit tests pass in the checkout, while two lock cases reject its group-writable ancestors. An exact 7d779929 archive in a private owner-only directory initially reproduces mode failures (lock selection 2/4; atomic materialization 3/10). Correcting only that verifier-owned tree to 0700 and using umask 077 resolves the setup: both focused lock cases and all 39 previously unreached integration tests pass. The 24 crate/workspace/lock inputs hash-match the committed source. No shared directory permissions, production guards or test sources change. The actual app's embedded_pack check is initially interrupted during compilation with exit 143 and unknown cause; one incremental retry passes 1/1. Neither the interruption nor the original permission failures are relabelled as passes. Commands, retained failures and successful results are in native-review.md in the same external evidence directory, SHA-256 9754c2843d0727020d4e7446c6b8196071275a55b723b87f81766bdb2e09a613.

Final canonical/documentation review finds no actionable issue; seven roadmap checks and generated-index consistency pass. All 249 task IDs/states/dependencies, 46 complete accepted records and 76 nonempty evidence fields remain unchanged; only CLI-405/410 progress text changes. The plain-text documentation changes do not rerun or inherit the prior documentation build.

Next qualify the regenerated candidate's installed guidance and, when supplied, review a representative real passage against its research question and source excerpts. The earlier 8fd774a0 four-target artifacts do not qualify this changed content. No new search, credential use, Host installation, research-data write, remote action or publication occurs. CLI-405/410 retain ownership and their acceptance state; the strict AGY gates remain failed and the proposed experimental boundary remains unapproved.

October 6 — first source-traceability implementation

The current A–E priority makes traceable literature summaries and writing the main 2.4.0 outcome. Slice A is implemented in 6970da52, with the CLI test launcher and equivalent validation-style correction in 91a5d02d. This adds the optional selector to the existing CLI/Full MCP reader, teaches exact saved passage readback and retains locations in existing note/ledger records. It does not add a new tool, evidence store, paper-page inference or project write. Raw wire behavior and Full 35 / Lite 15 remain unchanged. Bounded passage discovery (B) is the next implementation, followed by C/D/E under their named exit criteria; a local slice A result does not complete the main release outcome.

Pack commit 5c81e14e binds 446 resources to source 6970da527038a37d95136884a950a775cc8d4465, root a7dbb14b4f0d18e7a516d2af1f22fe6d1191f8b5add2b69337725ded0a8a2854, and pack ed5af23968a00122148a681a5f7975e9af3f2a109bed2e388446f9d50e5450ce. The later fixes change no canonical content, so the pack is not regenerated.

One gpt-6.1-sol / low verifier passes 14 focused tests on the corrected source: ten saved-document tests, three actual CLI/MCP tests and one embedded-pack test. They cover decoded/escaped text, arrays, repeated passages, UTF-8 continuation, legacy wire shape, invalid/ambiguous selectors and retained file/revision/security refusals. Capability validation, materialized resource reachability, formatting, seven roadmap checks and index consistency pass. The project-only strict Clippy check passes. Under Rust/Clippy 1.99.0, the combined project/app strict check fails four unchanged platform locations: one deprecated fetch_update and three chunks_exact_to_as_chunks diagnostics. The same focused check passes allowing only those two diagnostic categories; this filtered result is not a strict pass.

Initial failures remain recorded: fixture registration under umask 002, a resource audit against the unmaterialized workflow layout, incorrect placement of the test launcher's terminal --json, the unavailable pytest runner, and the new nested-if lint repaired in 91a5d02d. Tests use umask 077 without shared permission changes; resource checks use the existing materializer, and roadmap checks use the existing stdlib unittest runner. No production guard is weakened.

Final review finds no remaining actionable diff issue. All 249 tasks, 46 complete accepted records and 76 nonempty evidence fields are preserved; only CLI-405/410 progress text changes. These results establish local native passage readback, not installed-Host, academic-support or final-source release qualification.

Commands, source bindings and retained failures are recorded externally in /tmp/qiongli-traceability-verifier-2026-10-06-r2.md, SHA-256 311daf0af9fd1f59af653bc6116bdefb4a7054ec7da7f367576555990cf5cbc4. The initial frozen report accidentally omitted the first two pack-digest digits; the correction is verified against committed lock 5c81e14e and preserves the original report and its hash. No source/input change or test replay follows that transcription correction. Temporary local verification is not accepted evidence.

October 6 — bounded saved-passage discovery

Starting from local fc0abaef, slice B is implemented in 8da74df2 through the existing checked saved-document owner. CLI adds project document search; Full selects search mode with search_text on qiongli_project_document_read. Raw and selected reads remain compatible, and Full 35 / Lite 15 are unchanged. Strict requests reject mixed read/search controls. There is no new evidence store, project write, directory scan, remote fetch or installed-Host mutation.

The search scans decoded string values in one explicitly bound source packet, one selected string, or raw saved note/retrieval-history text. It retains distinct locations, returns bounded context with exact replay arguments and binds continuation to source/revision/query/pointer/context/page size. Matching is literal, case-sensitive and non-overlapping within each string. Packet metadata is included, so hits require content inspection; no hit cannot establish absence from unread material. Existing reading and evidence-review guidance retains reviewed locators in current note/ledger records and discloses those limits.

Pack commit b4e70b64 binds 446 resources to canonical source 8da74df254a8e7e717ea6fd5197ddfb43eab42ca, content root 008314f7a8e95e2891447948c0c35e7abfd7da90b0bcb8a2c6a0503fffe989b7, and pack 7174bfd715438f49042b7a335604267f9b8564810553c473799f354558bc13fe. Regeneration uses the existing offline update_qiongli_core_lock owner.

One requested gpt-6.1-sol / low verifier passes 21 focused tests: 16 project saved-document tests, four actual CLI/MCP tests and one embedded-pack test. The 14 prior cases are retained. Added coverage includes decoded/escaped Chinese, deterministic repeated matches and pagination, exact context replay, minimum UTF-8 context clipping, metadata and no-hit scope, literal/case/non-overlap limits, changed source/query/page bindings, invalid mode combinations, invalid JSON and locators, source permissions/links/size, and unchanged Lite refusal. Fixtures use umask 077; checks run offline and locked without weakening production guards.

Capability validation, content-only materialization/resource reachability, formatting, seven roadmap checks and generated-index consistency pass. Strict project Clippy passes. Combined project/app Clippy passes with only the two known Rust 1.99 baseline allowances, deprecated and chunks_exact_to_as_chunks; the preceding strict failure remains recorded above and is not relabelled a pass or rerun merely to reproduce it. No new diagnostic category is allowed. Final diff review finds no remaining actionable issue. All 249 task IDs/states/dependencies, 46 complete accepted records and 76 nonempty evidence fields remain unchanged; only CLI-405/410 progress text changes.

Commands, exact source/pack bindings, results and limits are recorded in /tmp/qiongli-saved-passage-search-verifier-2026-10-06.md, SHA-256 bc504b26872dc046d32d371a8dac8f57e450d7b973b34ef1f2e434aa75e659f0. The content-only materialization used an automatically removed temporary directory; the committed resource lock retains its pack identity. This local report is not accepted program evidence.

Next implement C: select an existing claim, traverse its actual ledger/note/source bindings and present supporting/conflicting passages separately for source-support review. Ambiguous identities, missing passages and access limits remain unresolved. Then D connects synthesis and changed-source review, followed by E's installed journey and final-source qualification. The B result establishes local native retrieval behavior, not academic support, installed-Host quality or release readiness. Prior package results, strict AGY gaps and pending scope/publication decisions retain their existing boundaries.

October 6 — manuscript-first claims, explanation and writing quality

The maintainer clarifies that exact sourcing and quality must apply during body writing, not only to reading notes or pre-existing claims. The implementation starts from da3ca8b0. Inspection finds that Stage F already discusses prose, depth and notes, but F4 coverage emphasizes major abstract/introduction/discussion claims and its type examples differ from the ledger vocabulary. There is no explicit shared manuscript-first traversal of unlisted assertions during drafting. The maintainer confirms no original failing passage is available yet; a later supplied manuscript/source pair remains the real-use regression input.

Canonical increment 8e25df35 connects the existing owners:

• The existing evidence-verification reference starts from exact manuscript spans across body sections, captions and notes. Compound assertions, causal bridges, numerical qualifications and unlisted claims receive their own source checks.
• Stage F and both writing workflows apply that route while drafting/revising. Claim maps retain final text locations and compatible ledger type examples; column headers, stable IDs, statuses and project-write owners stay unchanged.
• The Host follows all relevant records, including gaps and conflicting sources, and uses existing Graph reads and saved-passage read/search tools. It preserves note-local versus project-wide identity, version uncertainty and access limits. Native tools do not extract semantic claims from arbitrary manuscript text.
• Writing review separately checks explanations, premises, paragraph continuity, clear language and useful sourced notes. Core reasoning/limits stay in the body; a readable transition or populated citation list cannot replace support/depth.

The frozen synthetic evals/research_journey/manuscript-trace/ packet supplies actual body-writing and complete-claim audit tasks. One requested gpt-6.1-sol / low verifier uses materialized guidance, preserves both original answers and only then reads the separate criteria for self-review. A returns 657 body characters of results/discussion with source-bound comparisons and a resolved glossary note. No material support or flow defect is identified in that bounded review. It omits an explicit statement that the trial did not measure benefit receipt, although the criteria name it and the answer makes no claim about receipt; the omission remains recorded, not relabelled as an all-criteria pass. B identifies the manuscript's unsupported and unmapped assertions, preserves supported proportions, distinguishes incorrect causal/relative-percent wording, and leaves an unbound two-version claim unresolved. These are same-agent forward trials and self-review, not independent blind judgment or full-manuscript validity.

Actual CLI observations use an isolated registered fixture at revision 2. They open both CLM-001 ledger support records and recover both bound Trial2026 strings at /segments/1/text and /segments/2/text through search/read arguments. These are explicit fixture bindings; the empty receipt-backed list is not called failed discovery or a project-ID-only save/restart pass. Changing the isolated packet then reusing the old request refuses with project-revision-conflict; original bytes/reviews are preserved. This is read refusal, not automatic manuscript invalidation or completion of D's change-tracking outcome.

The 29 scoped content tests, capability validator, exact content materialization and resource-link audit pass. The regenerated candidate's embedded-pack test passes 1/1; seven roadmap checks and generated-index consistency pass. No Rust production code changed, so unchanged native suites/Clippy are not replayed. Retained failures/corrections are explicit: the first combined content invocation reaches a Plugin materialization test and is interrupted; the final scoped run excludes that method and uses the existing content-only audit. Copying source directory modes initially makes the synthetic root unsafe; only verifier-owned permissions are repaired. CSV CRLF triggers whitespace failures; 4ffa62fe normalizes only that fixture to LF and updates its manifest digest. Parsed rows, source/draft/task/criteria bytes remain equivalent or unchanged. A separately bound LF native recovery passes; original observations and model answers remain unchanged instead of being silently rebound or rewritten.

Pack 2e154819 contains 446 resources, canonical source 8e25df358e83bf441356b9c422bf8ef4a72da50e, content root 19b6718d63b0b07cf4c492a188ed765e02b3fa7f179af481e1e97953817bbcdc, and pack 195c20a323417ff88882ae241a377a486fc0e25bf6e7f6b5da7baaa2f781f4ec. Original native binary identities and the rebuilt pack check remain separately bound. Consolidated observations are in /tmp/qiongli-manuscript-verifier/self-review.md, SHA-256 59b527d36ea1ceb5752b7679e013267439b7d8219026e6133bce3fc266c3a655; final-artifact-hashes.json in that directory binds the answers, inputs and calls, SHA-256 1519ec9b708cd12aaecfad5c39b21ae8f73ec6b02e19a763c2d0e7563eb968e5. Temporary observations are not accepted program evidence. All 249 task IDs, states/dependencies, 46 accepted records and 76 nonempty evidence fields remain unchanged; only CLI-405/410 progress text changes.

C now has a bounded Host-guided implementation and synthetic/native observations. Next is D: retain these identities through summaries, synthesis and substantive source changes, identifying the affected manuscript claims and preserving old reviews. E still qualifies actual installed behavior and final-source packages. Real manuscript quality, automatic Skill discovery, strict AGY gaps and release readiness are not established by this increment. Publication authority and the pending AGY scope decision remain unchanged.

October 6 — synthesis continuity and source-change impact

D starts from local 3e154f9d. Canonical f469c8e6 connects the existing Stage E, evidence-verification, reading-summary/matrix and writing/handoff owners. A cross-paper conclusion retains its own claim identity and contributing evidence; comparisons explain design, outcome, context and uncertainty in relation to the current paper. The synthesis template removes paper-count consensus cues and distinguishes unknown access, inconclusive findings and comparable contradiction.

Changed-source review compares old/new content before following dependent notes, summaries, synthesis and actual manuscript uses, including paraphrases, background, abstract and notes. It distinguishes corrections, additional access, reserialized bytes, duplicate reports and missing material. Revised prose, unchanged conclusions with reasons and unresolved checks travel together; originals and prior reviews survive. Native Graph/artifact-change reads do not become a semantic dependency engine. Existing IDs, statuses, fields and preview/approval/CAS owners remain.

The frozen evals/research_journey/synthesis-change/ continuation references C's immutable invented sources. One requested gpt-6.1-sol / low verifier writes an initial complete candidate, freezes it, then receives updated sources and writes the continuation before reading separate criteria. The initial/revised LR has 645/654 characters under the recorded counting scope. Actual prose carries the trial's 9-point estimate to the explicit 4-point correction (CI −2 to 10), revises abstract/LR/interpretation/notes, retains the cohort's noncausal 40%/60% result and the outcome distinction, and preserves the missing supplement. Parsed equal JSON with different bytes and a companion report do not add independent evidence.

These are forward trials with same-agent self-review, not blind acceptance. The original outputs retain concrete imperfections: compound claim IDs, an omitted OUT-1 digest inside the initial candidate, and a free-form excerpt label outside the templates' controlled fields. 56ee4916 repairs the demonstrated guidance ambiguity: claim-level full_text body evidence requires an explicit partial-body scope when appropriate, with inspected/missing locations; it never upgrades whole-paper retrieval or coverage. A separate prompted candidate repair splits claims and supplies the bindings. Final inspection also identifies custom map headers, decorated ID cells and range-like pointer shorthand in that first repair. A second prompted repair retains that attempt and produces the existing eight columns, bare IDs, permitted vocabularies and individual locators (29 checked rows). Neither repair is relabelled as an original or independent pass.

Mechanical evidence: 36 focused content tests pass, followed by 12 affected tests after the excerpt repair. Content-only materialization and resource-link audits pass before/after, with five repaired canonical/materialized files byte-identical. The final complete capability validator passes. All manifest input hashes and the 16 frozen C files remain unchanged. The first pytest invocation reports its module unavailable; the verifier uses existing unittest instead, without installing anything. Both intermediate and final embedded-pack checks pass 1/1, with the unchanged activation deprecation warning retained. No broad native/Clippy suite, network, Host installation, login reuse or project save/restart is exercised.

Final pack 5f47649e contains 446 resources, canonical source 56ee4916878336669956f1033f7b293c4efbe872, content root 3f451128cfe5437c4932eae412941dc31a5dc142f517f5aece38d1f08646d7b8, and pack d421f2ee33c31ac062d8b3bcce2aeb01dbf4e108b6820641bd8c1ef8ae62d090. The intermediate f469c8e6 pack/check remains separately identified in the report. Evidence is retained in /tmp/qiongli-synthesis-change-verifier/:

• initial-original.md: SHA-256 198f0008883c77d0f1fa51115dd4f6caacef750b5d31f2f076ef297cc53946c2;
• continuation-original.md: SHA-256 45a52e301ffea0ba04a0ab4770a7a36804387f0ea1f3438838cb51166df51147;
• continuation-repaired-v2.md: SHA-256 2a47b61681ac560829de61f0dfc12073283c76316bb6495a3fd339d09f342cc7;
• final-report-v2.md: SHA-256 122d8cb93c8735a49e7741f8f6479732ffe97f7e5f644444030c709764155a84;
• artifact-hashes-v2.json: SHA-256 762b65cdf10f870de9115f0b77ed1bf094a672908f0783b4a8d56e4368688fb7.

Seven roadmap checks and generated-index consistency pass. All 249 task IDs/states/dependencies, 46 complete accepted records and 76 nonempty evidence fields remain unchanged (198 populated evidence/commit/run fields preserved). Only CLI-405/410 progress text changes; temporary observations are not accepted program evidence. The main Agent reviews the final diff before local integration.

D now has a bounded Host-guided implementation, actual changed-source continuation and separately reviewed prompted repairs. Next is E: use the final installed candidate for the source-to-manuscript-to-recovery journey and requalify its packages/upgrade paths. Real failing manuscript reproduction, automatic discovery, strict AGY gaps and final-source release qualification remain open. Earlier package results do not qualify the new content; the AGY scope decision and publication authority remain unchanged.

October 7 — installed traceability and bounded candidate qualification

E starts from clean local ff6ce4db63f6c46957df771aeb8db826e139ef7c. Product and canonical content remain unchanged: content source 56ee4916, 446 resources, content root 3f451128cfe5437c4932eae412941dc31a5dc142f517f5aece38d1f08646d7b8, pack d421f2ee33c31ac062d8b3bcce2aeb01dbf4e108b6820641bd8c1ef8ae62d090. This increment adds the frozen evals/research_journey/installed-trace/ exercise and corrects evaluation prerequisites, without a native API, content-pack or configured-user-model change. One requested gpt-6.1-sol / low verifier owns actual observations, complete output review and focused checks.

The credential-free preflight initially sees the shared socket directory as mode 0000 inside the outer tool sandbox. A separate TMPDIR hypothesis fails. An authorized read-only host-context check instead sees the existing owner and mode 0700; the same unmodified preflight succeeds there, retaining the inner read-only/no-network profile. No shared-directory chmod or tested-sandbox bypass is performed. Both views and the failed hypothesis remain in the evidence. Native exports also correctly refuse unsafe /tmp and group-writable repository ancestors. The successful installation uses a new private directory under the user home. Helper parsing/readback errors and an initial group-writable cache refusal remain retained; a fresh preparation uses umask 077. No failed frozen cohort is overwritten or quietly relabelled.

The installed Host candidate is a separately extracted test-profile archive, SHA-256 2058890304c5f965774ba861dd14cb854b28da17ce89eb03b29dce8906ff4a52, with CLI ccc69afe884cd8a0ea9a603b49c555866e78addd49ddf08eef8f755a1e01eab7. Official native export and Codex registration retain 468 matching receipt entries; Lite/Full discovery remains 15/35. Codex 0.160.1 uses the requested model/effort, supported effective-policy readback, and exact granted read tools. Guidance locations are explicitly supplied; automatic Skill discovery is not established. Temporary login symlinks are removed after every actual run, without reading, copying or hashing credential contents. Processes complete normally and the original configuration/project snapshots are preserved.

The fixed three-case regression passes structure 3/3 and complete-answer review 3/3. The source paragraph has 256 characters under its established counting rule; fresh saved-note continuation recovers the actual 7,117-byte note and 10,308-byte packet, retaining the changed duplicate and historical count. This cohort has its own frozen manifest and denominator; earlier failures remain under their original candidates. No broad academic acceptance follows.

The additional invented packets, tasks and separate criteria freeze at manifest SHA-256 2feb19481fc1d87fb0717d24ba85a03e48da3b204627e97cc971b4e2ec2ebab8. Their provenance explicitly states supplied synthetic excerpts, without a live search, publisher retrieval, real DOI or complete-paper claim. Native approved source saves precede the actual installed writing task; the task receives only project ID and installed guidance locations, not source bodies or review criteria.

• Original writing check: 0/1 complete pass. The 623-character body, sourced note and source-support review pass; its 35-row map retains exact headers, IDs, versions, packet hashes and six observed JSON pointers. However CLM-035 combines the directly reported multiple-operations fact with the inference about apprentice-level proportions. The frozen independently-checkable-claim criterion fails. One guessed optional guidance filename also fails before the model finds the actual template. The original answer is preserved, not repaired or rerun: e55ec7e343fbb60266f210a36ab3964e706517c0b25b3e54906f1266ddbaae59; full review e7ef27a1334d35575da159b45ba149475c1129c9c1bd2788c9077093330b521a.
• Persistence passes its bounded checks. The reviewed source-supported original writing unit is saved verbatim through the native stage-summary/handoff owner at revision 4, with a separate partial/unaccepted map review. Summary SHA-256 is ba4afd2ba7ec15ee6bb820cc2177e689296a98df3a044b2bed928447fe82aba1. Missing academic approval, stale revision, and changed/missing-source reads and previews refuse without altering retained records. Original source bytes are restored before the final reviewed save. This is a saved writing unit, not native consolidation of F2/F4 manuscript files or stage acceptance.
• Original fresh-session recovery: 0/1 complete pass. Both source packets, literal 3 fewer errors search, exact returned read arguments and broader context inspection succeed. The saved body and original claim IDs are not recovered. Of 12 native calls, 11 succeed; an unapproved artifact-changes call is correctly denied and not retried. The model reports this limitation instead of inventing recovered prose. Complete review SHA-256 is 6959a69c5128ace6dd89f175d7e6074c3499705cec006feb8739ee335a4655c1.

Offline diagnosis corrects the initial assumption that a usable summary route had been provided. The pre-denial project read returns a redacted root label and revision, not an absolute root, state body or summary history; the document list contains the two source packets only. The shared preamble expressly permits command reads for guidance, while the task conditionally mentions Host document reads. Filesystem permission alone does not provide the missing observed binding. This is an incomplete/ambiguous driver-capability prerequisite, not evidence of a native defect or wrongdoing in respecting denial. The top-level journey README now requires a supported, authorized discovery route before freezing such a run. The frozen original fixture, prompt, denial and failure remain unchanged. There is no extra model retry, policy widening or replacement observation this turn.

Separate release-profile qualification uses the same clean product source in an isolated glibc 2.35/Rust 1.97 Linux ARM64 environment. The existing release owner passes strict Clippy, 46 CLI integration tests, nine MCP stdio tests, format/version checks, empty-PATH archive smoke, Codex/Claude Plugin archives, DeepSeek projection and isolated npm/wheel installation. All five asset hashes and sizes match its manifest. Release binary SHA-256 a741603ddcdb0a5c1e15150f5054ea172d291faa2e12c09f8966b14acc5d17da is kept separate from the test-profile installed Host binary. Release manifest SHA-256 is f68e1ee3f3ed98a631541c1b4df99e040a557b8f0c2eddf3d837bb91838acf5f. Actual public pip/npm predecessor 2.3.0 upgrades pass through the existing explicit-predecessor owner; its exit result is checked separately from Cargo. Ten actual Cargo source archives also pass isolated archive-only installation, including qiongli/ql, version, invalid-command refusal, Lite 15/Full 35 and exact content-pack checks. Upgrade report SHA-256 is d4b2a93e89e752b1e70556414bdc3b74f5ec318b7620309396ecf9d46b2997a2; Cargo install report is a2d71890aa2c81f2575d9997adbe093ce9a365a04a118dde223dde9e4171f611. The upgrade proves package replacement and synthetic fixture byte retention, not a project-format migration or live Host update.

The observation roots are /home/hermes/qiongli-e-20261007-zftrb1ao/installed/cohort-r2/, /tmp/qiongli-installed-journey-2026-10-07/, and /tmp/qiongli-e-release-20261007-76dtw1lb/. The consolidated report /tmp/qiongli-installed-journey-2026-10-07/evidence-summary.json, SHA-256 282737eeb1db3ece4f82703ac950aa2d0bb39e943d5fa858b70a08cc6853d696, binds all five actual episodes, complete calls/answers/reviews, save/negative receipts, frozen checkpoints, policy, cleanup and separate artifact/install results. These local temporary observations are not accepted program evidence.

The frozen fixture's seven file bindings, seven roadmap tests, generated-index consistency and whitespace checks pass. All 249 task identities/states/dependencies, 46 complete accepted records, 76 nonempty evidence fields and 198 populated evidence/commit/run fields remain unchanged. Only CLI-405/410 blocker progress and update dates change. No runtime/content suite is replayed for these evaluation and documentation edits; the main Agent reviews the final diff before integration. The scoped verification record, before this result annotation, is /tmp/qiongli-installed-journey-2026-10-07/final-checks.json, SHA-256 aa8a5188dfc812712b825cc647ae476ac7321a05aa026395534bc19d75bc2198.

Readiness remains Not ready. Next resolve independently checkable map rows and establish a supported project-ID-to-saved-writing discovery route through existing read/Host owners, then freeze a separate observation with clear authority. Do not repair the old capture in place or widen permissions after denial. The first E writing/recovery pair is not a complete journey pass. Fresh representative writing, final-source four-target packages/Cargo and strict AGY gates remain unqualified; prior candidates do not supply these results. The real failing user manuscript is still unavailable. Pending AGY scope and publication decisions are unchanged; no push, tag, publication or accepted-evidence promotion occurs.

October 7 — real manuscript diagnosis and literature-review positioning

The maintainer now supplies an actual earlier-version literature-review section. This closes the missing-example gap for text diagnosis, not the missing-original- sources gap: its bibliography, cited full texts and surrounding paper are not supplied. The original attachment and selected-span review stay outside the repository; no manuscript text, subject-specific citation keys or claimed source verdicts are added to the public fixture. Only generalizable failure patterns inform this bounded increment on local baseline 45296eb4.

The requested gpt-6.1-sol / low verifier identifies premature movement from brief findings into contribution ranking, dense feasibility/reporting language, underexplained cross-study comparisons and unverified field-wide practice/data capability assertions. It also retains positive organization and inferential limits. Absence of an explanation in this section does not establish absence from the whole paper; no footnote quota or blanket claim of ungrammatical prose is imposed. Citekeys alone do not verify the reported papers or their findings.

Canonical source 717653135e55c6f083c1e3c11ba2f69279ef651b repairs the existing Stage F and citation-risk owners: readers must be able to understand the actual evidence and unresolved substantive question, rather than infer a contribution from a methods list or statements about what the paper cannot claim. Boundary reviews remain useful drafting inputs, with consequential limits preserved and operational detail placed where it serves the requested section. Comparisons state their compatible or different quantities; literature-wide and dataset capability judgments require matching inspected evidence. The existing claim-map template clarifies that independently checkable findings and inferences need separate claims even when they share a source passage. Qualifiers, stable IDs, headers and project preview/approval/CAS ownership remain unchanged.

The frozen evals/research_journey/lr-positioning/ exercise reuses the prior invented writing packet, without the private manuscript. Manifest SHA-256 is 9975f06acc64ba7f5943c211e3eef1e2623cc2c9b7b4368e203f09efac3cfa35. One original 376-word answer is preserved before the verifier reads the separate criteria. Its complete source-support, comparative explanation, flow and useful sourced-note review passes. This is a targeted regression with diagnostic context and previously observed sources, not blind/held-out, controlled improvement or installed-Host evidence. It does not verify the real manuscript's citations or repair its complete argument. The changed claim-map guidance still needs its separately frozen installed continuation; the earlier compound row remains failed.

Thirteen closest content-contract checks, capability validation, content-only materialization/resource reachability and Skill quick validation pass. The three changed canonical guidance files match their materialized bytes. No new test asserts research quality from a heading or keyword. The original diagnostic report's section-count slip and the initially assumed materialized directory path are retained with explicit correction; neither causes a model retry. Observations are under /tmp/qiongli-real-lr-review-20261007/; the private original diagnostic has SHA-256 31936dd1f25b2543806fb7644b1a3e6f4a3992c1c808b24c61c46e2f0c103b59, and its count correction is erratum.zh.md, SHA-256 5c54d1dc93465454f62a0d4e42302a8ac4fa296afbcf3b0b11aa5cb33f57f597. The synthetic answer SHA-256 is 3f479153303b42531fb40162f96957dcaec34414f7275a173fd94a900bd50c6a; regression/review.json has SHA-256 cef63ffcc6d042d86fe062ec98a520d43b3c159367e4b8718d6afc90ca12dcbd.

The existing Cargo example regenerates the 446-resource lock from source 71765313: content root e7331e78e141b87cc15ea617f4ed1bf4f5b5dc3aa93cf8d7b9587d0bc4171841, pack 8314fbc1600b5390f0174c5c22699ebbafdbbca5e67fabbb20a8c375f1477dd1. The actual app embedded-pack check passes 1/1, retaining the existing unrelated fetch_update deprecation warning. No unchanged broad native suite is rerun. regression/pack-check.json in the private observation root has SHA-256 fd92fb4925c8e0cd7966c0a2bffbfc52664d8ff631f4bd415214cea4f7e5e1dd. The private selected-claim audit uses the existing eight columns, attachment-local IDs and explicit unverified source locations; it is not exhaustive manuscript coverage or a supported-claims ledger. A prompted v2 correction retains v1, clarifies contextual citation attribution and splits one compound interpretation using new local IDs. Its SHA-256 is a08189bf1d5fd6bfdfd6b91fed41ebb0fd60bfffc404441bdc4544ccfc9d77a3. No original paper or data documentation is silently substituted for the missing source, and the supplied manuscript is not rewritten.

Seven roadmap tests, generated-index consistency, frozen-input bindings and whitespace checks pass; final review identifies no actionable finding. All 249 task IDs/states/dependencies, 46 accepted records, 76 nonempty evidence fields and 198 populated evidence/commit/run fields remain unchanged. Only CLI-405/410 progress text changes. The scoped check record before this result annotation is /tmp/qiongli-real-lr-review-20261007/final-integration-checks.json, SHA-256 629d62a681bdfe91ad62ffeb21b6a01ca7190ca9e3c1bc001c8d8f4cc7a814ef.

No native runtime or write API changes; no new login reuse, live source search, installed-user-profile update or publication is performed. Prior ff6ce4db Linux ARM64 release/upgrade/Cargo results retain their original source identity and do not qualify this changed content. Next establish the supported saved- writing discovery path and qualify a separately frozen installed continuation; source verification of the real manuscript requires its actual cited materials. Final-source multi-platform and strict AGY gates remain open. Local observations do not change task acceptance or the pending AGY scope/publication decisions.

October 7 — readable prose and continuity across manuscript sections

The maintainer emphasizes that depth and logical continuity must not be sacrificed for elevated vocabulary, throughout writing rather than only the literature review. On local baseline bc79521f, canonical source c631317750718e3345b8349067bb32e850505fd2 strengthens the existing scholarly-voice, Stage F and academic-write owners. Use the clearest precise wording; retain and explain necessary technical terms. Concision removes empty framing, while keeping the evidence-to-conclusion step, comparison, qualifications and useful explanation. The final continuous read checks actual sentence and paragraph connections and consistent questions, constructs, populations, outcomes and time frames. An unsupported premise remains a gap; polished transitions cannot supply it. No sentence-length score, vocabulary blacklist or extra review process is introduced.

The new evals/research_journey/readable-manuscript/ fixture uses invented evidence about initial guided practice and a separate observational follow-up. It contains no private manuscript or real-paper citations. Manifest SHA-256 is 2b30ad15d530336cca384c4277c60b66c7f474b90cb98d78b658ed818a572e9b. The requested gpt-6.1-sol / low verifier uses materialized guidance and produces each of three answers once, freezing originals before reading separate criteria:

• A: Chinese Results and Discussion, 442 body characters under the fixture rule.
• B: formal English Results and Discussion revision, 179 body words, preserving headings, supported quantities and citations while simplifying the phrasing.
• C: a concise explanation of the missing premises between initial assistance, understanding and later independent completion, without inventing a mechanism.

Complete source-support, expression and continuity reviews pass for all three originals. This is targeted model generation and self-review with supplied synthetic evidence, not a blind/held-out comparison, measured improvement, whole-manuscript judgment or installed-Host observation. No original is repaired or retried after review. Results and per-file bindings are retained in /tmp/qiongli-readable-manuscript-20261007/review.json, SHA-256 19b7fbfddfe608db39bab3213a91f5ace031d6adff6ba59b96bf1b091b13c57a.

Fourteen closest content-contract checks, capability validation, fixture bindings, resource reachability, exact bytes for the three materialized guidance resources and Skill quick validation pass. The first check selection accidentally invokes the broad command/workflow class and its costly distribution owner; it is stopped with exit 130 and retained as incomplete, separately from the successful scoped checks. No broad runtime suite, installed Host run, authentication reuse, real-source search or private-document edit is performed. Configured models and existing write/preview/approval/CAS owners are unchanged.

The existing Cargo lock generator succeeds at source c6313177, retaining 446 resources. Content root is 4d3ffbc6385e606bbc45a13dc08638283cfb0489aa481ee63a6ced3b68fab17c; pack is 4e27832913048111fa7398105d6985945319769b9712e2ee101acb8c20337fa9. The actual app embedded-pack test passes 1/1, with the existing unrelated fetch_update deprecation warning retained. The scoped report is /tmp/qiongli-readable-manuscript-20261007/pack-check.json, SHA-256 ffec4c5bf7e9f7ea1af2ebfb065a509faed541699934a3c2876900b3efad730c.

Seven roadmap tests, generated-index consistency, the four frozen fixture bindings and whitespace checks pass; final review has no actionable findings. Relative to bc79521f, all 249 task IDs/states/dependencies, 46 accepted records, 76 nonempty evidence fields and 198 populated evidence/commit/run fields remain unchanged. Only CLI-405/410 blocker progress changes. The report, before final result annotations, is /tmp/qiongli-readable-manuscript-20261007/final-integration-checks.json, SHA-256 5c6fd8e03cfa7f900bc576f9b11cbe4ee24b6ab9c37b89b2be18e575b1c242c2.

Next establish the supported saved-writing discovery route and separately frozen installed continuation, with full delivered-unit support and readability review. Real-manuscript source verification still requires its cited materials. Earlier release artifacts retain their old source bindings; final-source packaging and strict AGY qualification remain open. This increment does not change acceptance, the pending AGY scope decision or publication authority.

October 7 — complete writing recovery and prepare publication

The maintainer explicitly requests completion of the two remaining writing observations and release-task dispatch. The prepared experimental Antigravity boundary is separately approved: retain its original failed complete-result and recovery checks for later promotion, advertise the limitations in release and installation documentation, and keep Codex and package/upgrade gates mandatory. This supersedes the earlier pending-scope/publication restrictions for 2.4.0; it does not relabel old failures, promote program acceptance, change remote rules or authorize an external Marketplace release or announcement.

The bounded diagnosis confirms that redacted project metadata plus the original three read-tool grants cannot discover saved summaries. The summary already has an immutable document and consolidation receipt, but list/read exclude its class. Source c9748636f1ab8022c0e7d8a7f46a2a06a6f02c55 extends those existing owners: list includes validated stage-summary receipt bindings, and read/search accept only the existing strict context/stage_summaries/STG-*.md path contract. The same revision/digest, storage safety, pagination and no-write checks apply. No absolute root, arbitrary context access, new MCP tool or broader Host permission is introduced. Guidance uses actual returned bindings and retains partial reviews and source fingerprints. Atomic claim guidance from 71765313 remains in force.

The requested gpt-6.1-sol / low verifier passes eight list tests and eighteen saved-document tests; after strengthening the search assertion, only its two summary cases rerun. Seven focused content checks and capability validation pass. The initial fixture run fails at directory safety under inherited umask 002; the corrected process uses umask 077 without changing production guards. An overbroad Python test-class selection is stopped at exit 130 and retained as incomplete. The prerequisite report is /tmp/qiongli-summary-recovery-20261007/focused-prerequisites.json, SHA-256 cebfef44ef21a5ada7bdb7680b50df43bab371aa40e86ba27c39456f40640c87.

Pack commit 54a2a3ee retains 446 resources, content root bf12a5d0eb557304d52327fa2e5bfed6c47f653e48c09ee5779b99fd841d475e and pack bc44f8b59ab0d687edbd75316c29937b98531dd15466140f25580da086a068f2. Five actual CLI saved-document tests, including existing Full MCP parity, and the app embedded-pack test pass. The new summary CLI case compares exact output with the shared owner and refuses a packet-only selector on Markdown.

Before dispatch, freeze a separate installed candidate and new writing/recovery cohort, retain complete original outputs and source-support/atomicity/readability reviews, and verify native approved persistence plus fresh-session recovery. The fixed regression and three newly frozen synthetic boundary cases remain separate denominators. Current-source local packaging and upgrade checks, followed by the immutable-tag four-target publication pipeline, retain their existing owners. Do not monitor after the requested publication-task dispatch or claim completed registry publication from a successful dispatch alone.

Installed completion and release preparation results

Clean candidate 3fa02b17ddf30e37c7168375c15651b6bba18b2c is independently snapshotted for installed and glibc 2.35 release checks. The corrected test-profile binary SHA-256 is 689a3a6da1c71e2db202b9c28b694e8e512c849435f43244e4d05f4563944edc; official export/registration verifies 468 cache entries, Lite 15/Full 35, exact content identity, effective three-read-tool policy and credential-free preflight. The first test binary lacks the explicit source stamp and is refused before any model run; its installation and the preparation-order correction remain retained. No real profile, configured model or tested permission is changed.

The gpt-6.1-sol / low verifier captures ten actual bounded installed episodes, each capped at 180 seconds. Original tasks, criteria and synthetic inputs freeze before execution; the two later review-driven corrections have separate frozen prompts and original records. Complete outputs are reviewed against actual saved sources, with source support, prose and claim structure judged separately:

• Fixed baseline: structure and complete-answer review 3/3; source paragraph 262 characters. A review-annotation correction preserves original answers.
• Original new writing: 0/1 complete pass. Its 650-character body, note and source support pass, but five map rows combine separately checkable claims. The original answer and failed review remain unchanged.
• Explicit reviewed writing correction: 1/1. Five retired IDs map to ten new IDs; twelve unchanged rows, body and note are byte-identical. All 22 final map rows receive independent support/atomicity review. The correction Host asks for an ungranted project-list tool, is denied and does not retry; its disclosure that it did not reread sources is preserved. A separate authorized native audit fully rereads both exact packets before acceptance. No denied call is a pass.
• Native saving retains the reviewed correction verbatim at revision 4; missing approval, stale revision and missing/changed-source cases refuse without losing original bytes. Summary SHA-256 is e08236ed148b8ab7803b1ada88e60b7afdef7704a17998f1383bf9f05928b630.
• Fresh installed recovery: 1/1, 126.48 seconds, 28 tool calls including 13 native MCP calls, without a failed call. Starting with project ID and guidance only, it recovers the complete 13,534-byte saved unit, revised IDs, partial status and source/history bindings. Two literal searches and exact returned read arguments recover source context; complete semantic review passes. This closes the previously missing summary discovery path without exposing a project root or expanding tool permission.
• New synthetic boundary cohort: original 2/3, not a first-pass clean sweep. Abstract-only access and changed-source continuation pass. The original unit- conflict answer accurately reports the conflict but omits the required explicit conversion. A separately frozen, single reviewed correction passes all its criteria in 213 words, including derived unit/interval conversion and the tenfold discrepancy, without selecting either reported estimate as correct.

All required judgments close on the final reviewed units; this establishes the bounded review-and-correction workflow, not universally atomic first drafts, blind generalization or whole-manuscript/expert acceptance. Earlier failures keep their original denominators, including the previous E cohort. Review metadata errata remain separate from source judgments; no original is overwritten. Observations are under /home/hermes/qiongli-final-installed-20261007-qebeee93/installed-r2/ and /tmp/qiongli-summary-recovery-20261007/. The reviewed-correction binding audit has SHA-256 ff4bd0c0bd6996fd14bcfb594defff4482929a5dad27abb84cd347f2c699e649; fresh recovery review is d10e3a66784242e5d54486448a031b6cf4f63a0ded403a29f54034671ca653a8; unit-correction review is 6de40a1638986cff1eacffa696125757af08a6cb64fcc926f7a0794185444040. The consolidated evidence-summary-current.json in the temporary observation root has SHA-256 c50fbdf9c6a68fab6229fc9c114caee91e2d728f5abb960003aab914f862fdae. It binds all ten captures/reviews, the original failures and separate corrections, retained setup/review errata, native save/refusal records and artifact checks. All ten process groups terminate; temporary authentication links are removed, and original configuration/project snapshots are preserved outside approved synthetic native writes. Credentials are never read, copied or hashed.

The independent same-source Linux ARM64 release owner passes strict pinned Clippy, 46 CLI and nine MCP tests, packaging and extracted npm/wheel/Plugin checks. Five asset sizes and SHA-256 values match the manifest. Explicit public 2.3.0 pip/npm upgrades and archive-only installation from ten actual Cargo source archives pass, including qiongli/ql, inventory and pack checks. The independent artifact review at release/independent-artifact-review.json in the temporary observation root has SHA-256 980d297d729436c38d6438ec5970dddcc64784e7a4dd3eea73dde213c54406be. Test-profile Host and release-profile artifacts retain separate identities.

Subsequent integration edits only clarify documentation and record these results. Their final tag must pass the existing four-target exact-source publication pipeline before assets are published; local ARM64 results do not substitute for the other targets. The authorized stopping point is a verified release-task dispatch, not a claim that registry uploads have already completed.

The final seven roadmap tests, generated-index consistency, both retained fixture manifests, whitespace checks and documentation build pass; findings-only review has no remaining actionable issue. Documentation preserves the existing build warnings. Against baseline bd1992ba, all 249 task identities/states/dependencies, 46 accepted records, 76 nonempty evidence fields and 198 populated evidence/ commit/run fields remain unchanged; only CLI-405/409/410 blocker text changes. The check report, before this checks-only annotation, is /tmp/qiongli-summary-recovery-20261007/final-integration-checks.json, SHA-256 3203c0d706e26c90ada1d1e15e3306a92c0ab50a599b3388299a2eb1bbe78939.

October 7 — compact AGY entries after the 2.4.0 release task

The maintainer's screenshot shows the main Skill and every research shortcut in Antigravity's global Skill list. Starting from fa5d1537, the bounded fix changes only the native AGY projection: omit the twenty generated workflow wrappers, retain the qiongli research router and independent no-qiongli reply-only entry, and keep the internal workflows, cards, references, language and variant bytes. The main entry explains internal routing and legacy workflow-name intent. Both terminal export and completion messages describe the compact layout. The shared content pack, MCP inventory, other Host entry policies and receipt schema stay unchanged. ADR 0234 supersedes only ADR 0233's public wrapper layout; historical 22-entry evidence and experimental Host gaps remain historical facts.

The requested gpt-6.1-sol / low verifier runs focused checks against an isolated source copy with the changed native files bound to the working-tree bytes. The four existing AGY integration cases pass; two new cases independently pass after fixture corrections. They cover exactly two public entries against Codex's 22, English/Chinese metadata, a custom variant, every retained internal resource, one MCP server, and verified legacy-wrapper migration with stale-receipt and modified-wrapper refusals. The two new projection/receipt cases use explicit synthetic binary bytes; they do not claim native execution. Five terminal-adapter checks and two shared bundle-owner checks also pass. Strict pinned Rust 1.97 Clippy passes for the affected production and integration-test targets.

Initial runs retain their failures: group-writable workspace ancestors, then synthetic directories created under inherited umask 002, fail before projection. The secure copy and command-local umask 022 resolve that setup without changing real ancestor permissions or weakening validation. The new tests initially use invalid destination leaf names; corrected fixtures use the existing approved names. A mismatched new ADR title is corrected and ADR validation passes. No failed result is counted as a successful behavior check.

The official AGY manager subsequently installs a verified legacy source with 22 Skills and one MCP server into a new disposable profile. It validates the compact export as two Skills and one MCP server, then installs/enables/lists it. The cache now contains only qiongli-workflow and no-qiongli; old wrapper directories are gone and source/cache receipt bytes match exactly. This is an actual manager replacement observation, not a simulated cache copy. No model or authentication operation is performed. GUI display, model routing and complete research sessions remain unverified, and AGY retains its experimental scope.

The initial full terminal flow times out at 240 seconds after legacy source export; an unnecessary interactive update retry is interrupted. Direct official manager commands reuse the verified source and establish the replacement result. Temporary export attempts also retain invalid-leaf and Cargo-binary hardlink refusals; a byte-identical single-link binary copy supplies the valid fixture. No refusal check or production ownership rule is relaxed. The full Codex integration command has no passing outcome and is not counted; the focused shared-owner checks and Codex entry/resource comparison supply compatibility coverage for this adapter-only change. Final formatting and whitespace checks pass; findings-only review has no actionable issue.

Evidence is retained under /tmp/qiongli-agy-entries-20261007/, including final source bindings, real-binary bindings, manager summary and individual test logs. The secure source and disposable manager profile are under /home/hermes/qiongli-agy-entries-20261007/. The ledger records only CLI-409 progress; no task state, dependency or accepted evidence is promoted. This is local development after the 2.4.0 release-task dispatch, not another publication or a change to the user's installed Plugin. The next delivery increment is a separately scoped CLI update carrying this fix, followed by actual GUI and fresh session routing checks. No prior release monitoring is resumed.

Final integration checks pass: seven program-roadmap tests, generated-index consistency, formatting and whitespace. Against fa5d1537, all 249 task identities, states and dependencies, 46 accepted records, 76 nonempty evidence fields and 198 populated evidence/commit/run fields remain unchanged. Only CLI-409's blocker and update date differ. A preliminary pytest invocation lacks that optional module; the existing unittest owner supplies the seven passing roadmap cases without installing dependencies. These checks are reused for local integration.

October 7 — one install entry for all detected clients

The maintainer requests an all-install entry and explicitly confirms its scope: every already-installed supported client gets its Plugin, including Skills and MCP. Starting from 8566055f, the existing Plugin guide gains install all (and update/upgrade equivalents), main menu choice 5 and Host choice 6/all. --target all uses the same read-only CLI detection for Codex, Claude Code, DeepSeek Harness and Antigravity. It reports selected clients and skipped missing CLIs; an empty set returns an actionable error before any install. Explicit client lists remain strict. The full all-Host preset validates options before filtering, preventing a single detected client from accepting a shared destination or unsupported Hook option. No scripted all-install plan or auto-approval is added.

The detected set enters the existing sequential Plugin owners with their current previews, confirmations, source selection, receipts and failure/cancellation behavior. Plugin delivery already includes Skills and MCP, so it creates no extra standalone copies or MCP registrations. The installer does not install client applications, change models or update the Qiongli executable. The menu also drops its stale hard-coded Full MCP count. ADR 0235 supersedes only the unconditional all-selection portion of ADR 0225; bilingual quickstart and installation instructions label the entry as the next update after 2.4.0.

The requested gpt-6.1-sol / low verifier passes seven focused native tests: two detection/selection cases, the new argument matrix, two retained Plugin parser cases, the retained selection case and actual CLI non-terminal refusal. They cover deterministic detection/order, partial/all/no available clients, missing-client messages, strict explicit lists, incompatible/duplicate options, --dry-run refusal and no writes through redirected input. Strict Rust 1.97 Clippy, formatting, ADR validation and findings-only review pass. Only the required help match-arm formatting was corrected; no semantic production fix was needed.

Four isolated terminal observations additionally pass: direct install all, main menu 5 and Host menu 6 each select inert Codex/AGY fixtures, skip missing Claude/DSH and cancel at language selection. No fake client executes and no Home or configuration file is written. An empty-client invocation returns installation-no-hosts-detected before language selection or installation. Initial menu-driver attempts reused fixture directory names and failed before invocation; distinct fixtures correct that setup and the failures remain in the logs. No actual user profile, Host installation, model or authentication is used. This establishes entry wiring and refusal/cancellation, not a new complete four-Host installation or live-session qualification.

Evidence is retained under /tmp/qiongli-install-all-20261007/. Only CLI-402 progress and its link to this plan change in the ledger; accepted records and task states/dependencies remain unchanged. Integrate locally through the existing feature-branch flow. The next delivery increment combines this entry with the preceding AGY compact-entry fix in a separately scoped CLI update. No push, publication or previous-release monitoring belongs to this increment.

Final integration checks pass: seven roadmap tests, generated-index consistency, ADR validation and whitespace. Against 8566055f, all 249 task identities/states/ dependencies, 46 accepted records, 76 nonempty evidence fields and 198 populated evidence/commit/run fields remain unchanged. Only CLI-402's blocker, date and one additional current-plan reference differ; all other task fields are identical. The focused native and terminal results are reused for local integration.

October 7 — Pi coding-agent package and MCP adapter

The maintainer requests Pi support on baseline 26cc94c4. ADR 0236 adds terminal install/update/upgrade plugin --target pi, Host choice 7 and Pi detection in all-install. Existing 3/both and 6/all retain their meanings. Require stable Pi 0.99.0+, the first published native MCP/registerMcpServer API. A distinct local schema-4 receipt reuses the bundle transaction for two public Skills, complete internal resources, locale/variant projection, the native binary and one JavaScript MCP extension. Pi owns transport and models. The stable source path remains bound while staging/backup/quarantine trees are verified. No canonical content-pack bytes, signed target, App plan or child-agent protocol changes.

The adapter honors PI_CODING_AGENT_DIR, resolves relative package declarations, reuses verified local sources and separately confirms source writes and any needed official pi install registration. Unknown/changed files, duplicate Qiongli packages/MCP entries, filtered resources and disabled built-in MCP refuse. Post-registration comparison preserves unrelated packages/model settings. New Unix profile files use a fixed-shell, separate-argv exec with umask 077; existing user permissions remain unchanged. This addresses observed official Pi creation of 0664 settings under umask 002, preserving unsafe-profile refusal. Removal uses pi remove <source> before separately handling retained source files. Bilingual installation help discloses experimental scope and the distinction between session /mcp and shell pi mcp list, which omits package extensions.

The requested gpt-6.1-sol / low verifier passes six adapter cases, three bundle cases, seven CLI selection/parser/non-terminal cases and five retained AGY adapter cases. These exercise exact entry/resource projection, locale and variant preservation, comparison with Codex's 22-entry layout, relative source reuse, configuration/model preservation, explicit approvals, private file creation and literal argv handling. Negative cases retain receipt CAS/drift, foreign/unmanaged sources, symlinks/hardlinks, unsafe permissions, oversized/malformed profiles, unsupported versions, resource filters, duplicate declarations and standalone MCP overrides. Small synthetic binaries cover projection/receipt behavior; actual native execution is recorded separately below.

Published 0.87.1/0.99.0 archives establish the API boundary. Official Pi 0.99.0 and 1.1.0 loaders each observe the two package Skills and one deferred MCP registration without model execution. A real 1.1.0 terminal install using the new native binary exits successfully after two separate approvals under parent umask 002. The custom agent directory is honored, default Home/.pi is absent, and official settings are 0600. Declining the source confirmation creates no source, receipt or settings. A 1.1.0 SDK session connects the actual native Full MCP and returns a successful config-status result without an LLM or credentials; registration and tool invocation remain separate observations.

Evidence is retained in /tmp/qiongli-pi-20261007/, with a new secure source and Host fixture under /home/hermes/qiongli-pi-verification-20261007/. Initial compile failures, disk exhaustion, a disallowed override fixture, omitted managed Pi paths and a missing fixture Node executable are retained alongside corrections. An initial SDK cwd discovers an unrelated ancestor Skill without executing it; a separate isolated-cwd observation resolves that fixture boundary. Two short AGY test filters selected zero cases and are not counted as passes. Local integration does not qualify a model-driven research journey, all operating systems, installed user profiles or publication. Only CLI-409 progress changes; task states/dependencies and accepted evidence retain their existing owners. The next increment is a separately scoped CLI delivery carrying Pi, install-all and compact AGY changes, followed by actual research-session qualification. No push, publication or previous-release monitoring belongs to this increment.

Final Pi observations also pass: declining registration retains the verified source and creates no Pi settings; a separate SDK cwd loads exactly the two package Skills with zero diagnostics/errors, discovers 35 native MCP tools and keeps only the built-in tools plus tool_search active initially. Deferred config-status execution returns status: ok. Two exact retained AGY compact/ legacy regressions and two shared Codex bundle owner cases pass. Strict Rust 1.97 Clippy passes for the changed platform/App and Pi integration surface. source-binding-final.json records byte equality for all twelve changed native inputs between the workspace and the secure test copy. These results are reused for local integration; later documentation/index checks are recorded separately. The final native count is 25 passing tests; zero-match filters are excluded. Cancellation and successful terminal runs all complete within their bounds. Pi mise shims are not resolved by this adapter; use the official executable on PATH. Windows and macOS behavior and model-driven research remain unqualified.

Final integration checks pass: seven roadmap tests, generated-index consistency, ADR validation, formatting, whitespace and scoped findings-only review. Against 26cc94c4, all 249 task identities/states/dependencies, 46 accepted records, 76 nonempty evidence fields and 198 populated evidence/commit/run fields remain unchanged; only CLI-409's blocker differs. The verifier records these invariants in invariant-final.json and retains exact commands in verification-summary.md. The frozen native and isolated Host results are reused for local integration.

October 8 — writing contract alignment and 2.5.0 release

The maintainer requests the reviewed writing corrections, comparison and tests, scoped commits and a new release-task dispatch, then no follow-up monitoring. This authorizes source synchronization, reviewed main cutover, immutable tag and the existing release workflow. It does not authorize announcements, external Marketplace promotion, altered remote rules or a claim of completed publication. Reuse this bounded plan; historical 2.4.0 evidence and acceptance remain intact.

Baseline is c1a05c4d559a07a1362ad235a1563f689e7b1da8. Candidate 2.5.0 includes its accumulated Pi/all-install/compact-AGY changes and the writing corrections. Canonical Stage F remains the shared owner; Discussion and F6 inherit its full scope rules, formal output paths remain compatible, literature maps use corpus-appropriate structure and the generic rubric judges consequential reasoning rather than mandatory mechanisms. Citation support follows the result producer and original inference binds premises; RFS advice carries its official source and does not impose empirical evidence on every theoretical paper.

Independent gpt-6.1-sol / low work owns verification and review. A separately frozen invented two-task cohort exercises a complete English LR and connected Chinese manuscript sections, with reviewer criteria withheld from authors. Source support, argument depth/continuity and expression are separate verdicts; original failures and later corrections keep their own records. No real private manuscript, automatic scientific verification or journal acceptance is claimed.

Before dispatch, retain focused contract/projection checks, reviewed model outputs, current-source Linux ARM64 release/install/upgrade/Cargo evidence and final diff review. The existing immutable-tag workflow gates publication on all four target artifacts. Pi and AGY retain their disclosed experimental boundaries. Results and exact bindings are appended here once available; pending checks are not passes. Program task states, dependencies and accepted records are unchanged.

Writing checks and comparison

Writing commit e6737d74 and version/docs commit 8ffd3f83 integrate at ebf6d4af6359514e8dd459a8742469e11189f88a with the regenerated pack. The pack retains 446 entries, source 8ffd3f8377edae5889e7525c44dff0802f8f27d3, content root d81db0b1eb86dedaaaf35ac2892b4790750b39a900e709153039d064f839ce2a and pack f2f8b22426fc3a8eea0600de7268de76988b6abefbdbe0abc2d81c5712e8eec7. Sixteen Rust 1.97 embedded/writer/loader tests and an independent actual-content binding check pass. Content and model guidance stay unchanged in subsequent release bookkeeping.

Independent final review identifies and closes two remaining conditional-scope conflicts (direct-edit citation reports and mandatory F3 lenses). Fresh affected Python checks pass 19 tests, cross-platform routing/materialization passes all 11, and unchanged downstream results are retained without adding overlapping counts. Strict B-literature and finance overlay audits pass. The original 43-test attempt retains its one version-drift projection failure; the exact-input rerun resolves that failure. Seven roadmap tests, generated-index freshness, 102 relative documentation targets, the documentation build and frozen-source boundary guard pass. Existing highlighting/chunk-size build warnings remain.

The four initial model attempts fail at transport discovery before generation; they remain setup failures. A same-cohort transport retry uses the identical frozen synthetic prompts, nine guidance files per arm and gpt-6.1-sol / low, with 180-second limits, read-only sandbox and no enabled tools. All four retry answers complete; all processes are reaped and temporary login links/profiles are removed. Credentials are never read, copied or hashed. Actual user settings and research data are untouched.

The reviewer receives anonymous answer files and the frozen criteria without arm mapping. Candidate arm 1 passes A/B 2/2; baseline arm 2 passes A/B 2/2 across request scope, continuity, depth, readable language, factual/citation fidelity and inference fidelity. Candidate outputs are 844 English words and 1,222 Chinese characters; baseline outputs are 854 and 1,237 under the documented count procedure. Twenty-four exact answer spans bind the six-dimension reviews. The candidate develops some comparison and magnitude details more explicitly; the baseline develops other distinctions more fully. No pass-count gain or universal writing improvement is inferred. This is supplied-guidance synthetic validation, not installed-Host discovery, private-manuscript repair, whole-field or expert/journal acceptance. The used cohort now becomes regression evidence.

Evidence root: /tmp/qiongli-writing-20261008/. Retry frozen-input SHA-256 is e6f24ee609a19cc418fcb3d0922b6b8b71c6dc050883d90ba65aac86200e66ae; argument-ab-transport-retry/execution-summary.json is e40bfa42f56b6e8eb21f0da1e073c907bfda9600b2e068cf56efa1cfaa4932a2; blind-review/review.json is 557b1263d991de5a36355ddf8d7e6159cb2ed3408cffc2f0c3a030518f632762. The isolated glibc2.35 package run initially refuses a missing v in the release note heading before building; that documentation correction passes the canonical version preflight. Current-source packaging is resumed on a new frozen snapshot, with the original failure retained. Ledger states, dependencies, all 46 accepted records and all prior evidence/commit/run fields remain unchanged.

Package qualification and publication handoff

Clean isolated candidate cfbb897c40b90e300e15be99aafc630081cfb5ec passes the existing CLI release owner under Linux ARM64/glibc2.35 and Rust1.97: strict Clippy/format, 47 CLI and 9 MCP tests, archive extraction, npm/wheel installs and generated Plugin checks. Separate current-pack regressions pass 6 AGY and 3 Pi integration tests; Pi's synthetic fixture is not a live SDK/model session. Actual published 2.4.0 → 2.5.0 npm and pip upgrades preserve the synthetic research/source/model settings. Installation from the checked Cargo archives and both qiongli/ql entrypoints passes. The snapshot's HEAD and clean status remain unchanged throughout the successful qualification.

The independent artifact review passes 46 checks across all five assets: sizes, SHA-256 values, identical executable bytes, 446 canonical content resources, embedded pack and installed/extracted payloads match. The manifest's registry_install field refers to these local installs, not public publication. All scopes remain distinct from the supplied-guidance writing comparison.

Retained failures include the release-note heading mismatch and an initial read-only fixture-directory mount that caused 42/47 CLI tests to fail before the corrected mount yielded 47/47. Production source and checks were unchanged by that mount repair. Inactive local debug incremental compiler cache was removed to recover 4,866,908,160 bytes; source, research and evidence files were preserved. Owned verification containers exited and the manual rootfs mount was released.

Evidence under /tmp/qiongli-writing-20261008/release-verification/:

• final-cfbb897c-r2/verification-summary.json, SHA-256 c7c7ce39bc0c33c822a0b9c76cd89523dc8f9777fec0531843234ee3a4296c55;
• final-cfbb897c-r2/upgrade-2.4.0/registry-upgrade-check.json, SHA-256 4790a32a86f8eea4c719c868df967842649d1b4c216ea5c8847fcea8050926f3;
• final-cfbb897c-r2/cargo-install/install-check.json, SHA-256 0718903c5bb264a9efe7d666c5e6acb5ce5409d5f4594d8c67e0b241203d90e2;
• independent-assets-review-cfbb897c.json, SHA-256 3a17fb33042ae4acbc20c1b6bb7503fd2b0bf4e7e290510f67ab2bb279b708ba.

Final integration changes only this evidence bookkeeping. Reuse unchanged local checks; the final immutable tag must pass its own four-target distribution before publication through release-automation.yml post mode. The maintainer requests ending after an accepted release-task dispatch, without monitoring jobs or asserting that GitHub/registry publication has completed. No announcements, external Marketplace promotion or program acceptance are included. The next writing-quality increment needs a separately scoped real manuscript with its sources and target-venue review; the present synthetic cases are now regressions.

October 8 — automatic Host and source selection

The maintainer requests automatic recognition of installed common clients and matching installation paths after the 2.5.0 release-task handoff. Baseline is 60399ef53772549af3c3ded66cfe174cbac9e48e. This increment is local development; it does not restart release monitoring or authorize another publication.

Reuse the existing executable discovery and sequential Plugin installers for Codex, Claude, DeepSeek, AGY and Pi. Default the main guide to all on Enter and unqualified Plugin commands to all unless a Host-specific option needs selection. Codex/Claude reuse registered or verified legacy sources; fresh exports use separate Host-scoped defaults. AGY recovers a custom path from its verified cache and receipt-bound MCP command. Pi's source resolution and DeepSeek's profile selection remain unchanged. All-detected mode preserves Hook settings (off on first install). Existing previews, separate file/registration confirmations, conflict checks, write guards and cancellation/failure boundaries retain authority. ADR 0237 records the limited default/path compatibility change. No canonical research content, generated pack, model configuration or installed user profile changes are included. Only development-branch documentation claims this behavior.

The requested gpt-6.1-sol / low verifier owns focused native checks and independent review, using isolated files and fake Host commands for terminal observations. Results, retained failures and the next increment are recorded below at integration.

Verification passes 33 focused Rust tests: seven content-guide cases, eighteen Host installer cases, four argument/parser cases and four presentation cases. Coverage includes distinct fresh paths, verified legacy reuse, foreign/unknown files and canary retention, receipt/cache drift, AGY custom-source recovery, Pi settings/model retention, explicit target compatibility, cancellation and stale approval checks. The unchanged expensive automatic-source case is reused; the six other guide cases are rerun after the cancellation fixture correction.

Four isolated terminal cases pass with fake Codex/Claude managers: unqualified Plugin, explicit all and main-menu Enter reach the automatic source preview and decline without any Home writes; no clients returns the expected failure before installation. Only read-only fake manager commands execute. No Host/path/Hook selection menu appears on the automatic routes. These cancellation observations do not claim completed registration or a live five-Host research journey.

Rust 1.97 formatting and CLI/library Clippy with denied warnings, ADR validation, seven roadmap tests, generated-index consistency and whitespace checks pass. Independent gpt-6.1-sol / low review reports no remaining actionable findings. The ledger changes only CLI-402 progress/date; all 249 task states/dependencies and all accepted evidence, commit and run fields retain their original values.

Retained failures: initial workspace fixtures encounter group-writable ancestors; isolated private fixture mounts restore the existing safety preconditions without changing user/repository permissions. An initial container libc mismatch is resolved with a read-only compatible library mount. Two stale test expectations are repaired: the all-Host list omitted Pi, and the old empty-menu cancellation input now enters automatic detection. Initial terminal driver issues (Codex inventory fixture shape, PTY process-exit race and an overbroad Hook-menu assertion) are corrected independently of production behavior. The original logs remain. Private executable copies are stripped to reduce fixture hashing; original binaries remain unchanged. Only inactive debug incremental cache is removed after Cargo stops (3.3 GB), preserving source, binaries and evidence. Owned test containers are removed; unrelated existing containers are preserved.

Evidence: /tmp/qiongli-auto-install-20261008/verification-summary.json, SHA-256 3ba046e0e577c48375aad6a074e61bdae4c1a2f696a00ffcb9e990faee784998. It records final native source hashes, exact check counts, terminal outcomes, limitations and the ledger comparison. This is local Linux ARM64 source verification, not release/package or cross-platform qualification. Integrate through the normal local feature-branch fast-forward; next qualify these native changes for a separately selected delivery. The prior 2.5.0 packages do not establish acceptance for the changed installer. No push, new release, real client-profile update or previous-release monitoring occurs.

October 8 — installation progress, diagnostics and batch recovery

The maintainer reports DSH's generic host-command-nonzero-exit and requests visible progress, continued multi-client installation and a final recovery summary. Baseline is local d715fd35bf353b7f52a9c164cf17355453a612c8. Use the same bounded plan and CLI-402 owner; no release or real user-profile installation is authorized by this source-development increment.

The gpt-6.1-sol / low verifier reproduces the missing-diagnostics defect with an isolated synthetic manager: stdout/stderr and exit 17 disappear behind a unit failure enum. The caller also discards successful command output, while ? propagation stops the entire batch. This identifies Qiongli's reporting and batch-control defects; it does not establish why DSH failed on the user's machine. An optional OS/version/profile clarification remains separate.

ADR 0238 records per-Host continuation, explicit declines as skips, input/output interruption as a stop and final nonzero partial-failure results. Existing source, receipt/CAS, official manager commands, file/registration approvals and model settings remain authoritative. The final summary carries targeted retries; manager diagnostics retain exit codes and known static categories plus the exact command/profile/version. Raw manager output is neither echoed nor saved, and unknown errors stay unknown. Per-Host/command counters and five-second elapsed messages expose progress without inventing download percentages.

The shared process owner preserves its isolated environment, byte limits, legacy reason codes/UTF-8 interface and Pi's private umask. Pipe EOF now shares the command deadline. Normal terminal process-group membership is retained for Ctrl-C; timeouts still terminate the direct child only and may leave descendants. No automatic retry, process-tree termination or rollback is claimed. The native content pack, registry pin and platform support remain unchanged. Verification and integration evidence follows.

Verification passes 39 focused Rust cases: nine content-guide, twenty Host installer/diagnostic, four installation-parser, four presentation and two bounded runner cases. The two runner cases are rechecked after preserving foreground process-group membership. Five isolated terminal cases pass: synthetic DSH ETARGET/exit 17 with five-second progress and no credential echo; a failed Codex step followed by a receipt-verified synthetic DSH installation; explicit decline followed by the next Host; EOF stopping later Hosts; and Ctrl-C terminating both the foreground CLI and its synthetic manager. These use private test profiles and fake managers; they do not establish a live DSH installation or session.

Retained verification issue: the initial Ctrl-C fixture checked its child before Python processed the group signal. A bounded wait and fresh PID marker confirm both processes terminate; the initial observation remains in the evidence. Private stripped binaries reduce hashing cost without altering original build outputs. Final wording changes require only focused help/prompt/diagnostic checks; unchanged behavior tests retain their earlier source-bound results. No model, authentication or real profile data is used. Task-owned containers are removed, with unrelated containers preserved.

Final rebuilt-CLI checks confirm the batch help and DSH skip prompt with no fixture-home writes; Hook skip and dependency-neutral diagnostic wording are present. Rust 1.97 formatting, CLI/library Clippy with denied warnings, ADR validation (seven frozen, 38 current), seven roadmap tests, generated-index consistency (249 tasks) and whitespace checks pass. Independent gpt-6.1-sol / low review reports no actionable findings. Compared with d715fd35, the ledger changes only CLI-402 progress text; states, dependencies, accepted evidence, commit/run fields and dates remain unchanged.

Evidence: /tmp/qiongli-install-resilience-20261008/verification-summary.json, SHA-256 1b7a1da2805e6f3c3291c73a7f3617edb5ae44a2facb7c263e7d862dd789d76c. The summary binds current native source hashes and distinguishes fresh final wording checks from reused behavioral observations. This is local Linux ARM64 verification, not package, cross-platform or live-Host acceptance. Integrate the reviewed feature branch locally after the frozen-source guard; next qualify the changed installer for a separately selected delivery. The user's DSH root cause still needs its actual diagnostics. No push, release, user-profile change or previous-release monitoring is included.

DSH 0.2.0-rc.2 Desktop launcher clarification

The user supplies Qiongli 2.5.0, DSH 0.2.0-rc.2 and desktop file, treated as selection of the desktop profile pending launcher/OS confirmation. After local 14b0ec33, the gpt-6.1-sol / low verifier downloads only public npm metadata, integrity-verified DSH rc.2 and Commander 15 packages into a private test area. It executes the exact published argument parser without invoking the manager or installing dependencies/profiles. Default npm mode rejects the requested argv with profile "desktop" is managed exclusively by the Electron application; Desktop opt-in accepts and forwards the same package/version/registry/flags. Public npm metadata confirms qiongli 2.5.0 exists. This establishes a reproducible launcher restriction, not the cause on a machine whose executable path is still unknown. type -a dsh and OS information are requested separately.

Extend the existing static diagnostic allowlist with that exact restriction and clarify the launcher distinction in both installation guides and the canonical npm README generator. Use Desktop's manager or its installed launcher for the reserved profile; changing to web would target another profile. No automatic launcher/profile switch, authorization bypass, registry change or real user installation is introduced. ADR 0238 retains ownership without a new decision. Focused follow-up verification and integration evidence follows below.

Follow-up checks pass: two Rust diagnostic/command-quoting tests, two existing README/channel and npm archive tests, generated npm 2.5.0 text inspection, formatting, CLI/library Clippy with denied warnings, seven roadmap tests, 249-task index consistency and whitespace. Independent gpt-6.1-sol / low review finds no actionable issue. Relative to 14b0ec33, the ledger changes only CLI-402 progress; all states, dependencies, acceptance, commit/run fields and dates stay unchanged. The prior 39-case and five-terminal behavioral results remain valid for unchanged installer control flow; no live Desktop-manager acceptance is added.

Evidence: /tmp/qiongli-dsh-rc2-diagnostic-20261008/followup-verification-summary.json, SHA-256 1d0083fdd30a84f43b9c805771d9fa34d6d88d3624641d7509a4c99c8b452679. It preserves separate original parser evidence, package integrity checks and source hashes. Integrate by local fast-forward after the frozen-source guard. Next resolve the user's actual launcher path or original manager error; release qualification remains separately scoped. No publication or installed profile change is included.

October 8 — DeepSeek installation step reporting

The maintainer requests complete flow printing because the failed installation stage remains invisible. Baseline is local fa7a87fb. Later user evidence resolves the earlier unknown launcher: macOS DeepSeek Desktop's bundled command was selected, Desktop was fully quit before both attempts, and the identical direct command installed qiongli 2.5.0 successfully. The earlier npm-entry/open-app hypotheses do not explain this case. The source audit confirms Qiongli's existing isolated environment, sorted reconstructed PATH, HOME working directory, null stdin, captured streams and 120-second limit; these are differences, not a confirmed root cause. No speculative environment change or reinstallation is part of this increment.

Under ADR 0238, expose twelve numbered stages with started/completed/skipped/ failed outcomes and elapsed time. Split actual postconditions into registration, package metadata/version, content receipt and language-write stages without weakening them or changing their error codes. Reuse the bounded command owner for version and manager calls; version probes retain both-stream UTF-8 checks. Show actual launcher context, environment key names (not credential values), captured byte counts and static recognized pnpm observations after capture. Retain command heartbeat, exact argv/retry guidance, declined/EOF handling and batch continuation. No raw output persistence, inferred internal failure stage, process/environment changes, new approval flow or live-session claim is added. The existing gpt-6.1-sol / low verifier owns focused checks and isolated terminal failure-stage cases; verification and local integration evidence follows below.

Verification passes 31 focused Rust cases: 21 Host/diagnostic cases, nine guide cases and one bounded-capture/descendant-pipe case. Six isolated terminal scenarios pass: command failure at step 8 followed by the next Host, bad receipt at 11, language CAS conflict at 12, all twelve stages for a fresh successful profile, decline at 5 without manager execution and invalid version at 2 without installation commands. Existing profiles skip initialization at 7. Failure stages retain their reason, subsequent stages do not claim success, and fixture secrets are not echoed. Stage 9/10/11 postcondition negatives are retained in the native test. These are fake-manager Linux ARM64 observations, not live macOS, DSH package/session or user-machine root-cause acceptance.

Formatting, CLI/library Clippy with denied warnings, seven roadmap tests, 249-task generated-index consistency, ledger invariants and whitespace checks pass. Independent gpt-6.1-sol / low change review finds no actionable issue. The final help sentence is checked in a separately rebuilt CLI after the frozen runtime-owner checks; unchanged runtime tests are reused. Only CLI-402 progress text changes in the ledger; task states, dependencies, accepted evidence, commit/run fields and dates are unchanged.

Retained setup/driver failures include rootless-container sandbox setup, a private fixture's initial writable mode, a reused test PID, human-text versus JSON expectations, help extraction/build timing and a fixed-index ledger lookup. Corrections affect only task fixtures/drivers; repository ancestor permissions, user data and original build artifacts remain unchanged. Private executable copies are stripped; task containers exit and the pre-existing container remains.

Evidence: /tmp/qiongli-dsh-step-trace-20261008/verification-summary.json, SHA-256 74cabecdb805768f56fe7323165beb944363fb3027e9ba39efa0e79365b5336a. It binds current runtime/help sources and distinguishes fresh/reused checks. Integrate through the authorized local feature-branch fast-forward after the frozen-source guard. Next qualify a separately selected CLI delivery and collect its stage output if the user's failure recurs. This CLI change requires a new build; reinstalling the existing 2.5.0 Plugin alone does not update its installer. No push, publication, real profile change or release monitoring occurs.

October 8 — local diagnostic CLI packaging

The user requests a locally packaged CLI and installation verification. Freeze runtime/content input at ce2c8d1ed48d5b57cf243f79a974cca9c4fb1aef; retain version 2.5.0 while labeling the output local.ce2c8d1e, explicitly distinct from the published 2.5.0 bytes. Build the native release CLI offline with Rust 1.97.0, locked dependencies, no default features and the embedded native source commit. Export embedded Plugin content through the existing example and package through the canonical portable/npm/Cargo staging owners. No native behavior changes.

An actual ELF inspection finds GLIBC_2.39 requirements, so the first portable/npm READMEs' generic glibc 2.35 claim is invalid for this host-built diagnostic binary. Retain that failed packaging observation; regenerate both packages with accurate Linux ARM64/glibc 2.39 notes. The npm composer gains an optional README argument; its default published-package description and all validation owners are unchanged. The corrected local recipe supplies this argument instead of editing generated payloads. BUILD.json binds the runtime commit, native binary, content pack, packaging script/recipe and three artifact digests. A staged source archive with a pinned CLI-only build helper is available for a separate Apple Silicon Mac build; it is not a prebuilt or verified Mac executable.

Fresh gpt-6.1-sol / low verification passes eleven registry packaging tests and clean offline installation from the corrected archives. Portable and npm CLI checks cover version, help, content, invalid commands, Lite 15/Full 35 local and stdio MCP tools. The npm ql alias and non-TTY postinstall pass without HOME changes. The installed DSH bundle loader exposes 22 Skills for auto/zh/en, rejects traversal and runs its selected Full MCP binary. Source helper shell syntax and staged offline/locked/no-deps Cargo metadata pass; no separate source compilation or macOS run is inferred from those checks.

Six synthetic DSH terminal cases also pass through the actual installed npm launcher: manager failure at stage 8 followed by the next Host, receipt failure at 11, language CAS conflict at 12, all twelve stages succeeding, decline at 5 and invalid version at 2. The existing 31 focused native tests are reused because runtime inputs are unchanged. The actual argv still selects public npm [email protected] with the same registry/ignore-scripts options; this local CLI package changes the installer diagnostics, not the Plugin selected by that command.

Corrected assets reside in /tmp/qiongli-local-cli-ce2c8d1e-20261008/corrected/assets/: portable SHA-256 faa4e142d63043e915046c1d448a99f7852c93fd7bde72033c31cb78ce19a7e7, npm 9f8f938a585e969706796a38f0c417aec7c8e1a37d2641ecffc4471a4465df16, source 57ad1f2010a698bd54111bf4e3df017ddfeda945847599daddb20a280016510a. The runtime binary SHA-256 is 3494a27c7ddae3d4ffa58797d6b68cd98b88518ab67f5ed8b47907f8e2a101a2. Evidence: /tmp/qiongli-local-cli-install-check-20261008/verification-summary.json, SHA-256 0e4a006f292c41b33b72aa2667933c9c33186fec11a75c8a6f32bee42f7edb66. It retains the initial README ABI mismatch and driver-only help-route failures, then binds corrected artifacts, drivers, recipe and reused native evidence.

These are host-local installation/protocol and fake-manager checks. No real DSH install/session, macOS compilation/runtime, release qualification, registry publication or user-machine diagnosis is claimed. Existing installations, profiles, credentials, models and task acceptance remain unchanged. The next increment is a Mac-native build and the user's real DSH retry with stage output; no push, publication or release monitoring is part of this task.

Final independent review finds no actionable issue. Seven roadmap tests, 249-task generated-index consistency, whitespace and ledger invariants pass; only CLI-402 progress text changes, with all task states, dependencies, accepted evidence, commit/run fields and dates preserved. Frozen report, artifact, recipe, packager and runtime hashes match. Integrate the packaging-description option and evidence bookkeeping through the authorized local fast-forward after the boundary guard; unchanged runtime/package results are reused.

October 8 — Apple Silicon diagnostic binary

The user asks for a directly usable macOS binary and confirms Apple Silicon. Freeze source at 66252b29f1d36f7ce8f374bb38a53571dcaa5a16. Cross-compile the CLI on Linux ARM64 using Rust 1.97.0, hash-pinned cargo-zigbuild 0.23.4/Zig 0.16.0 and the SDK 11.3 archive referenced by the upstream adapter's Dockerfile. Retain headers/framework link stubs, excluding unnecessary Swift modules. The locked, offline, release/no-default-features build succeeds in 6m59s; a disk-space guard never fires. Product sources are unchanged. The existing Linux content exporter is reused only after checking that native/content input is identical across ce2c8d1e and 66252b29; verify the actual Mac binary's embedded pack separately.

The first static check rejects the assumed macOS 11.0 package requirement: LC_BUILD_VERSION actually declares minimum 13.0.0 and SDK 26.4.0, despite the configured deployment target 11.0 and extracted framework SDK 11.3. Retain this mismatch and the initial artifacts. Regenerate portable/npm descriptions and BUILD.json for a macOS 13+ local diagnostic without relinking or changing the published release baseline. Record configured values separately from observed load commands. The user's system version is not yet established; ARM64 confirmation alone does not prove that this minimum is met.

Independent gpt-6.1-sol / low static verification passes ARM64_ALL/MH_EXECUTE, bounded load commands, dyld/entrypoint, system-only dylibs and no rpaths. The embedded ad-hoc SHA-256 CodeDirectory verifies all 5,675 code-page hashes and present special slots; this proves byte integrity, not Developer ID trust or Apple notarization. Parser fixtures reject page tampering, foreign architecture and truncated signatures. The exact 2,169,621-byte resource pack occurs once, with SHA-256 f2f8b22426fc3a8eea0600de7268de76988b6abefbdbe0abc2d81c5712e8eec7; the expected native source marker is present. Actual streamed archive contents match the native bytes, with correct executable mode, darwin/arm64 npm metadata, qiongli/ql aliases, 22 Skill files and receipt source/content hashes. No SDK is bundled. These are static checks, not a Mac npm install or loader execution.

Corrected assets: /tmp/qiongli-macos-cli-66252b29-20261008/corrected-assets/. Portable SHA-256: f7656d0c3e0b200b5a99ba42372d7b8061a1e85846e224d844bf24719a5bd8e3. Npm SHA-256: 76b00a172a3101eba4f4f61b3d6eac29935f4ceddd0023a0d8ca07ceed33b9b9. Native SHA-256: c329fa09b6cf6267a28a1b1e6cba8ab94e426f35a79f75ad1968bd7898d5ba01. Frozen report: /tmp/qiongli-macos-cli-66252b29-20261008/verification/verification-summary.json, SHA-256 40f25513baeb326c4fa84125388a1fe1a286530f9c5aba6696cb6038f20bbe0f. The packet retains build/export commands, results, tool/SDK provenance, initial minimum-version mismatch, corrected recipes, artifacts and verification drivers. Task-owned tool/SDK extraction, Zig caches and unpacked npm staging are removed after checks to restore disk space; archives, source SDK archive, metadata, native binary and all evidence remain. No unrelated build cache is deleted.

Ready for a user-run macOS 13+ diagnostic trial only. Mac execution, installation, Gatekeeper, Keychain and real DSH session outcomes remain unrun; the preceding Linux tests are baseline evidence, not Mac acceptance. The installer still requests public [email protected]. Next run the binary on the Mac and capture the real DSH stage outcome with Desktop fully quit. No native behavior change, real profile/credential/model change, publication or release monitoring is included.

Final independent documentation review finds no actionable issue. Seven roadmap tests, generated-index consistency, whitespace and all 249 ledger invariants pass; only CLI-402 progress changes. Retained artifacts, native binary, recipe and report hashes match. Integrate this evidence-only increment by authorized local fast-forward after the boundary guard, reusing unchanged verification.

October 8 — 2.5.1 installation release handoff

The maintainer supplies a successful real Mac installation trace and requests a new release, ending once the release task is dispatched without follow-up monitoring. This authorizes reviewed source synchronization, main cutover, an immutable v2.5.1 tag and the existing release-automation post task. Announcements, external Marketplace promotion and remote-rule changes remain outside scope. Reuse this bounded plan and the existing four-target publication gates.

Baseline is 1c8c1fbaae9183b9d06a412145fba62e584f1d26. Version 2.5.1 delivers the automatic Host/source selection, resilient batch flow, bounded manager progress and twelve-stage DSH diagnostics developed after 2.5.0. Use canonical version synchronization and content-pack generation; writing guidance and research contracts otherwise retain their 2.5.0 behavior. Update current installation and upgrade instructions without rewriting previous release notes or ADR history.

The attached trace reports CLI 2.5.0, DSH 0.2.0-rc.2 and the Desktop-owned launcher on the maintainer's Apple Silicon Mac. Stages 1–6 and 8–12 succeed; stage 7 is skipped for an existing desktop profile. The official manager exits zero in 2.90s, followed by registration, package/entry, receipt and language checks; the final summary is one installed and zero failures. Record only a sanitized observation and raw-log hash, not the user's home paths or full trace in public documentation. This is user-reported real installation/registration success for a diagnostic CLI installing public 2.5.0. The log supplies no executable digest, and explicitly leaves new-session Skills/MCP unchecked. It does not qualify new 2.5.1 bytes or establish the earlier intermittent failure's root cause.

/tmp/qiongli-251-release-20261008/user-install-observation.json retains the bounded observation. Fresh gpt-6.1-sol / low work verifies version-sensitive contracts, generated content and the candidate's Linux ARM64/glibc2.35 packages through the existing release owner. Reuse unchanged focused installer results as behavioral evidence only. Exact-tag four-target qualification remains inside the publication task. Checks, source bindings and remaining gaps are recorded below before dispatch; pending work is not a pass. Program acceptance remains intact.

Candidate checks and handoff

Clean isolated candidate 575b74e2e8004a66990b768f0e41a8e501899732 passes the canonical CLI release owner under Linux ARM64/glibc2.35 and Rust1.97. Fresh checks include version preflight, 22 Python release contracts, strict workspace CLI Clippy/format, 47 CLI and 9 MCP integration tests, archive extraction, offline npm/wheel installations and Codex/Claude Plugin packages. Installed Lite/Full retain 15/35 tools; the npm DSH bundle loader retains 22 Skills. These package checks do not establish a live DSH model/session result. The unchanged 31 focused installer tests remain prior behavioral evidence, separate from this fresh candidate qualification.

The regenerated pack contains 446 canonical entries, source 6b4ded163d5d00b743b65ab53fb258bcfbff6966, content root 2b6c96406ac9101fc7314853c0aa01a16c561a3170b71d3a12c7fcaa696c97e4 and pack digest bc0d7245411a7aa346bdfacfa7e9bda05c42f0a4a56dc362836206499ac74187. Independent archive inspection verifies all five artifact hashes/sizes and identical native payloads, embedded pack/source marker and Plugin receipt bindings. ELF requires at most glibc2.34; the qualified distribution retains its declared glibc2.35 baseline.

Offline npm and pip upgrades from retained, previously qualified 2.5.0 packages at cfbb897c40b90e300e15be99aafc630081cfb5ec to this 2.5.1 candidate pass, preserving the synthetic research/source/model-setting canaries byte-for-byte. The temporary driver substitutes verified local predecessor copies for download only and keeps the canonical install/upgrade/canary checks. It does not establish current public-registry predecessor identity or research-format migration.

Evidence root: /tmp/qiongli-251-release-20261008/:

• verification-summary.json, SHA-256 15341c3e2820359c30e7c1007b27d1b89f3c04b1e3518ef0d98c1456b0e0e07d;
• linux-arm64-glibc235/assets/release-manifest.json, SHA-256 8f9780f58eb17c59a4075559425ad7789a4d213d54e292a83b2d7df00ccccb81;
• artifact-audit.json, SHA-256 ddbfd8d794617f0141c80004e2a5db6f69ab915c9b5f24817313421b31c831c1;
• retained250-upgrade-result.json, SHA-256 4d058251a98d68471cbdb2d479b3e0adae5c8443fc1a602717dc67c91a3584e4;
• user-install-observation.json, SHA-256 41fb89523afa9040608151a312e8d28efa076c10871a8c7e0ba793d20ac733a7.

Initial driver setup mistakes are retained separately from product outcomes. The release owner completes without a product failure. Two unused compiler incremental-cache directories are removed with incremental compilation disabled, recovering about 1.8 GB while preserving source, binaries, artifacts and reports. The isolated source remains unchanged. Final bookkeeping changes only this plan, CLI-402 progress and its generated index; acceptance states and evidence remain unchanged, and unaffected native checks are reused.

The requested next operation is reviewed local main fast-forward, source push, immutable v2.5.1 tag and release-automation.yml post dispatch. Final-tag four-target qualification and registry publication remain workflow-owned gates; the local Linux candidate and user-reported diagnostic Mac run do not replace them. Stop once dispatch is accepted, without release/registry monitoring. An accepted task request is not evidence of completed publication. AGY/Pi remain experimental, live DSH session use remains unchecked, and no program acceptance, announcement or external Marketplace promotion is implied.

October 8 — compact installation display

The maintainer reports that released 2.5.1 installs smoothly but its output is crowded and continuously scrolls. Baseline is local 1f2035494c7febe87e7c5f76c480b144b41d1c43. Use the existing CLI-402 owner and ADR 0239 for this display-only increment; do not monitor the preceding release, publish another version or modify real Host profiles. Official managers, approval/CAS, receipts, error codes, model settings and batch continuation retain their existing behavior.

Independent gpt-6.1-sol / low reproduces the old display with a safe fake DSH and the qualified 2.5.1 binary: success produces 93 lines/6,545 bytes, 12 START lines and three launch-context blocks. The longest line is 458 characters; the rough 80-column row budget is 124. A failed manager plus later-Host attempt produces 82 lines/5,890 bytes and two context blocks. No ANSI redraw is present: repeated append-only diagnostics, rather than cursor manipulation, explain this fixture's scrolling. These are synthetic measurements, not captures from the user's Mac. Evidence is retained under /tmp/qiongli-install-ui-20261008/.

Implement a shared presentation writer over the existing command progress owner. Group Hosts and preview/progress/summary sections; keep full mutation previews, each DSH result and exact failures. Hide duplicate START, successful launch contexts and completed export receipts unless --verbose is selected. Failures automatically expand safe diagnostics and commands. Use one short ASCII waiting line only on supported, sufficiently wide Unix terminals. --plain, verbose, NO_COLOR, CI and unsupported/narrow consoles use append-only output. Installation remains terminal-only; flags never approve a write or alter structured dry-runs. Also correct the stale 33-tool presentation labels to the existing Full35 count.

Design follows the primary-source examples linked in ADR 0239: pnpm terminal vs append-only reporters, Clack task/result separation and GitHub CLI verbosity/ accessible progress controls. Keep native Rust ownership and use only a feature of the already-present rustix dependency for actual terminal width.

Validate compact and verbose PTY journeys against the preserved baseline, actual width/resize and prompt behavior, long waits, failure attribution/privacy, later Hosts, decline/EOF/output errors and redirected refusal. Run affected parser, renderer and installation regressions; preserve fixture/setup failures instead of hiding them. Record results and remaining target-native/manual gaps below once at integration. Local output improvements do not establish live-Host or release acceptance; all task states and accepted evidence remain unchanged.

Implemented result and verification

The shared display writer now keeps one short current-step/elapsed-time line on supported Unix terminals, clears it before prompts/results, and falls back to plain output when width, environment or user options require it. It never enters raw mode, hides the cursor or clears previous output. --verbose retains detailed diagnostics; --plain retains concise append-only output. Official-manager arguments, approval previews/digests and per-Host retry behavior remain unchanged.

Independent gpt-6.1-sol / low reports 43 distinct affected Rust tests passing, including shared Host compatibility and bounded command execution. Eight tests affected by the final current-step label change are rerun; unchanged checks are reused. 21 final terminal/refusal cases pass, covering 80/40-column terminals, resize, plain/verbose modes, unsupported environments, long waits, staged failures, continuation, declined approval, EOF, narrow terminals and redirected input. A process-group SIGINT case exits without reporting success; this does not qualify actual keyboard/foreground-terminal signal routing. An additional fixed profile/executable comparison proves identical approval text and digest across all three display modes, with every preview declined and no manager invoked.

The successful synthetic transcript falls from 93 to 54 persistent lines; the longest line falls from 458 to 129 characters and the estimated 80-column row budget from 124 to 63. These counts interpret CR/erase-line sequences, not a full emulator or a screenshot. Formatter, strict all-target CLI Clippy, four frozen architecture tests and ADR validation pass. Source inspection and unit coverage support fallback behavior; no macOS/Windows runtime, real Host profile, authentication, model/session call or release artifact is qualified here.

Frozen evidence: /tmp/qiongli-install-ui-20261008/verification-summary.json, SHA-256 3b18827e62634d01fcf2fec7c6f12e16022ea5bcb47dd78275926e267a81fe0f. It binds each changed native source to the tested debug binary and complete private stripped copy; this is a working-tree source binding, not a claim that a later bookkeeping commit was compiled. Retained setup failures include fixture reuse/timing/assertions and disk exhaustion. Earlier partial-copy terminal runs are excluded; all 21 final cases use the complete hash-bound binary. Scoped cleanup removes only inactive retained debug caches and the task's partial copy, preserving source, release artifacts, reports and the active build target.

Integrate locally after final ledger/index and diff review. The next delivery increment should qualify these bytes on release targets and collect a real Mac terminal observation. No new release, remote push or preceding-release monitoring is part of this request; program states and accepted evidence stay unchanged.

October 8 — 2.5.2 display release handoff

The maintainer authorizes committing and triggering the next release CI task, then ending the conversation without follow-up monitoring. Prepare stable 2.5.2 from integrated edf1864a, using the existing CLI release and publishing owners. Synchronize canonical versions, generated Skills references and embedded resource pack, freeze release notes, then qualify a clean candidate through ./scripts/release_ready.sh --cli-github --version 2.5.2 --staging-dir <new-external-dir>. Retain full release gates and separate new package qualification from the preceding 43 focused Rust tests and 21 synthetic terminal cases. Use gpt-6.1-sol / low for verification, preserving initial setup failures and remaining runtime gaps.

This release covers installation presentation, verbosity/plain options and the stale Full MCP count correction. Existing approval/CAS, official manager commands, source ownership, models, batch recovery and research schemas remain unchanged. AGY/Pi stay experimental, Mac terminal interaction and live DSH/session behavior remain separate observations, and Full/Lite retain 35/15 tools. Rollback retains the prior executable and Plugin sources/settings; it does not reverse research writes. The existing four-target release workflow owns final-tag qualification, public downloads and registry publication. Do not skip checks, retag a published version, promote program acceptance or modify external Marketplace catalogs.

Record candidate results below once available; pending checks are not a pass. After reviewed local integration, fast-forward main, push the source and immutable v2.5.2 tag, dispatch release-automation.yml at that tag in post mode and stop as soon as the dispatch is accepted. No subsequent release/registry monitoring is requested, and accepted dispatch must not be reported as completed publication.

Candidate checks and handoff

Clean candidate f6c823bfa77eb38e32bec2861f43a33335501b0f passes the canonical release owner under actual Linux ARM64/glibc 2.35 and Rust 1.97. Independent gpt-6.1-sol / low verifies version preflight, 22 Python release contracts, formatter/strict workspace CLI Clippy, 47 CLI and 9 MCP integration tests, archive extraction, isolated npm/wheel installations and Codex/Claude Plugin packages. Installed Lite/Full retain 15/35 tools; the npm DSH bundle loader retains 22 Skills. The unchanged 43 focused native tests and 21 synthetic terminal cases remain prior behavior evidence, separate from this fresh package qualification.

All five actual artifacts have verified sizes/hashes and identical native payloads (41ce49e4b9c0cbb68d760f3c6c2c1f7c230fd50f6492c7ec535c52c1b9caf898). Independent inspection verifies Plugin receipts and embedded source/resource bindings. The pack contains 446 entries, source 5b7c297103c71d9da37728cf9993b9cf4166dc1d, content root e6af690492e1dfb1e5680376d4373f5bd841243b4507805a8a895fa6690e3397 and pack digest 1cc804ed9f4f3ee151c9d51a4cb8066bc91fe4ecb4d170d6af2dfc69f407e270. ELF requires at most glibc 2.34; qualification and wheel metadata retain the published glibc 2.35 baseline.

Offline npm/pip upgrades from retained, locally qualified 2.5.1 packages at 575b74e2e8004a66990b768f0e41a8e501899732 pass and preserve all three synthetic research/source/model-setting canaries. Only the download step uses verified retained bytes; the canonical upgrade/install/canary checks remain intact. This is not verification of the current public predecessor or research-format migration.

Frozen evidence root: /tmp/qiongli-252-release-20261008/:

• verification-summary.json, SHA-256 eccb570c406cf3241e02a3f11e6536ab5c922d1f408ed5f34e93b142f90de15b;
• linux-arm64-glibc235/assets/release-manifest.json, SHA-256 60ff185333eca0c2a6c68c4fffe1f2e2b5473cec3105939cf910d7162c0613e7;
• artifact-audit.json, SHA-256 06fe607cc541605e4a748039f2f1e35fe62f4231bc02fad0f64be3603c12c4c7;
• retained251-upgrade-result.json, SHA-256 a6a873864620d5fde40a8b4893331ac5f024756c61bb16e9a767e8d3e69cafee.

Initial checks racing content-lock generation, an incorrect preflight entry and a detached snapshot refused by the release owner are retained as setup failures; the final clean branch runs pass without bypassing checks. Scoped cleanup removes 216 inactive product compiler cache files (4,071,638,994 bytes), preserving all executables, source, release caches/artifacts, reports, registry and user data. Final bookkeeping changes only this plan, CLI-402 progress and its generated index; program states, dependencies, accepted evidence and commit/run fields stay intact.

The next authorized action is local main fast-forward, source/tag push and the existing v2.5.2 release task. Its final-tag four-target, public-download and registry gates remain mandatory; local Linux qualification does not establish native Mac terminal behavior, Windows/Linux x64 acceptance or live Host/session use. Stop on accepted dispatch and report that handoff only, without follow-up monitoring.

October 9 — DeepSeek latest terminal installation

The maintainer requests the normal dsh plugin --profile desktop add qiongli@<latest exact version> installation and fewer scrolling messages/inputs. Use the current installation owners under ADR 0240: bounded public npm latest lookup before approval, frozen stable version, existing executable/profile CAS, no appended registry/scripts flags, and native DSH terminal/environment handoff. Default to the initialized Desktop profile, allowing explicit web/custom choices; reuse valid stored language or locale for a DSH-only install, with explicit language overrides. Ordinary failures continue the batch; interruptions stop it.

Keep Qiongli output to the approval summary, failures and final result, with full stage details in verbose mode. Clear its progress before DSH owns the terminal; DSH/pnpm controls its own rendering, prompts and download cache. No latest-version cache may silently cause a stale installation. Verify the approved package version and source pack independently of the old CLI's embedded pack. This is source consistency, not registry origin/generated-executable attestation; official DSH owns package download integrity and the release owner retains full projection qualification. Preserve real profiles and model settings during isolated checks.

Public latest metadata read for this request reports 2.5.1. That observation is not monitoring or a diagnosis of the preceding release task. The latest user Mac failure has no new error trace and remains unreproduced. Use gpt-6.1-sol / low for focused tests and review, recording actual results and remaining gaps below once available. Integrate scoped local commits into 2.x; no push, version bump or new publication is requested, and all existing program acceptance states remain intact.

Focused checks and integration

Independent gpt-6.1-sol / low verification passes 23 focused checks: six DSH lookup/approval/content tests, one explicitly run retained real npm bundle test, one explicitly run prompt-driven PTY test, nine installation-guide tests, three manager-diagnostic tests and three renderer tests. The package check uses the retained locally qualified 2.5.2 artifact, not an asserted public download. The PTY confirms inherited terminal input/output, progress cleared before the native prompt, a reply sent only after that prompt, and no competing Qiongli timer. Eight unaffected guide results are reused; the updated duplicate-output assertion passes separately against a refreshed test binary. Strict CLI-library Clippy, final formatter/diff checks and architecture validation (7 frozen/40 current ADRs) pass. Review finds no remaining actionable issue in the scoped behavior.

Initial fixture/implementation checks expose a canonical mapping error for non-workflow resource paths; both now follow the packaging owner's optional prefix removal, and the retained real package passes. The old per-Host duplicate success assertion and missing ADR registry entry are also repaired. These initial failures remain in the report rather than being counted as successful runs.

Evidence: /tmp/qiongli-dsh-latest-20261009/verification-summary.json, SHA-256 1843982a83899b27565ac3b3bd27b261a3723e5ca5ecd22c74e8f524943fcea1; source-bindings.json in the same directory, SHA-256 42cd7aeb0a187131086e03d5db6e124be75b6de433c5e8e0cb3d52479ad47062. The report binds individual logs and source files. No live DSH/Mac installation, new-session tools, registry-origin attestation or release qualification is claimed. The next independent observation is the updated installer on the maintainer's Mac; package/release qualification belongs to a separately authorized release. This increment ends after reviewed local integration into 2.x. Program states, accepted evidence, dependency and commit/run fields remain unchanged.

October 9 — 2.5.3 release handoff

The maintainer authorizes the next patch release from integrated 02b37c2c, source/tag push and execution of release automation, then ending without following its progress. Prepare stable 2.5.3 through canonical version synchronization, resource-pack binding and frozen release notes. A gpt-6.1-sol / low verifier runs fresh candidate checks with the existing release_ready.sh --cli-github owner under Linux ARM64/glibc 2.35, reusing its verified environment/cache. Retain mandatory package, install, receipt, version and upgrade gates. Prior 23 focused behavior checks remain separately identified; no unrun native Mac/DSH session check or registry-origin attestation becomes a pass.

The release changes DSH package installation to approved exact latest-version argv and native terminal interaction, reduces routine output, reuses saved language and removes the running-CLI version/pack binding. Version/profile probes retain their existing safety checks; initialization output stays captured. Research schemas, model choices and other Host execution contracts remain unchanged. Full/Lite retain 35/15 tools, AGY/Pi stay experimental, and the target set remains macOS ARM64, Windows x64 and Linux x64/ARM64 (glibc 2.35+). Preserve previous executables, Plugin sources and research/settings backups for rollback; changing executables does not undo research writes.

After reviewed local integration and candidate qualification, fast-forward local main, atomically push main and immutable v2.5.3, then dispatch release-automation.yml at that tag in post mode with create_release=true. Its four-target qualification, public-download and registry gates remain mandatory. Stop on accepted dispatch without polling runs, releases or package publication. Program task states, accepted evidence and commit/run fields remain unchanged.

Candidate qualification and final handoff

Independent gpt-6.1-sol / low qualification passes against clean candidate cd76e8c1739871bc9ad7b874673feb5cc07352cc with the canonical release_ready.sh --cli-github --version 2.5.3 owner on Linux ARM64/glibc 2.35. The run passes 22 Python release contracts, formatting, strict workspace CLI Clippy, 47 release-profile CLI tests and nine MCP tests. Actual archive, npm, wheel and Codex/Claude Plugin installation checks pass, including empty-PATH archive execution, DSH bundle-loader isolation (22 Skills/35 Full MCP) and receipt/projection checks. The five native payloads share SHA-256 100fd77ec27c806b5859a5b584afaa74f2c5d12454b1314a3846afc201ee0c07. Independent artifact/source/pack/ELF checks pass; the observed highest required GLIBC symbol version is 2.34 and the declared release baseline remains 2.35.

The 446-entry 2.5.3 pack binds content source 8184d476de021aa577e3d19a0b44d3e1b0246da4, content root b1187a17633a1e5d5258d85965b83abade6029e8431b2f61c1baeb4d43684ae0 and pack SHA-256 817a4767f8e9ebbe11c935cbf0a1aab885db429fbd9343bbbb0afb654cce3d86. Retained locally qualified 2.5.2-to-2.5.3 npm/pip upgrades pass using the existing upgrade owner and hash-verified local download bytes. Three synthetic research/source/model-settings canaries remain intact. This does not assert the identity of a current public predecessor download.

Initial setup failures remain recorded: an incorrect unittest module/preflight argument was corrected before the canonical run. The first clone inherited 775 directory permissions and correctly hit three security refusals (44/47 CLI tests passed). Correcting 519 task-clone directories, without changing repository/user ancestors, product source or gates, allowed the complete owner to pass again in a new staging directory. No failed run is counted as a pass or hidden by a skip.

Frozen evidence: /tmp/qiongli-253-release-20261009/verification-summary.json, SHA-256 9ccc822aec2590d6996cb888aa3aeeef85b29f4e93b243780d0d90372d10b496. Its source bindings and individual logs retain the setup observations. Under the same evidence root, artifact-audit.json has SHA-256 9fd127ab4d762be159c2858b28aa2884d36ac42670b40e3574c1c5f5c5e0ebf1 and retained252-upgrade-result.json has SHA-256 6ca6d300061aa099dd636a54d02c2eeeaabbad3114bbbe53ae551230a4c88956. The qualified linux-arm64-glibc235-secure/assets/release-manifest.json has SHA-256 bde19af0bd14348157d1a2a0ff0ad6568a4179827768691d4ba6a8d5d3ea825d.

This establishes local Linux ARM64 qualification only. Real macOS/DSH sessions, authentication/model calls, public downloads and registry publication remain unverified. The preceding 23 focused behavior checks are reused separately. Final bookkeeping changes only this plan, CLI-402 progress and its generated index; program states, dependencies, accepted evidence and commit/run fields stay intact. The authorized next action is reviewed local fast-forward integration, atomic main/v2.5.3 push and the existing post-mode release automation dispatch. Exact-tag four-target/public-download/registry gates remain mandatory. Stop on accepted dispatch without following the run or claiming publication completion.