omp-context/implementation-notes.html at main · KorenKrita/omp-context · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>OMP Context Implementation Notes</title>
  <style>
    :root { color-scheme: light dark; font-family: system-ui, sans-serif; line-height: 1.5; }
    body { max-width: 72rem; margin: 0 auto; padding: 2rem; }
    table { border-collapse: collapse; width: 100%; }
    th, td { border: 1px solid #8888; padding: .6rem; text-align: left; vertical-align: top; }
    th { background: #8882; }
    code { background: #8882; padding: .1rem .25rem; border-radius: .2rem; }
  </style>
</head>
<body>
  <h1>OMP Context Implementation Notes</h1>
  <section>
    <h2>Current OMP 17.1.5 Port Decisions (2026-07-27)</h2>
    <p><strong>Authority:</strong> this section supersedes conflicting host-specific statements in the imported pi-context history below. Older rows are retained as provenance for the upstream behavior, not as current OMP API contracts.</p>
    <table>
      <thead><tr><th>Provenance</th><th>Decision</th><th>Rationale and constraint</th></tr></thead>
      <tbody>
        <tr>
          <td>user-decided</td>
          <td>Promote the exact OMP host contract to <code>17.1.5</code> and replace the old OMP suite with the adapted latest pi-context suite.</td>
          <td>All four <code>@oh-my-pi</code> host packages, root metadata, locks, and the isolated fixture are pinned together. The retired 30/50/70 nudge implementation is intentionally not preserved; the constant dual-needle gauge is the current behavior.</td>
        </tr>
        <tr>
          <td>agent-resolved</td>
          <td>Keep the runtime module graph free of any bare <code>zod</code> import; build all schemas from the injected <code>pi.zod</code>.</td>
          <td>OMP marketplace installs do not install an extension's own <code>dependencies</code>, so a runtime <code>import { z } from "zod/v4"</code> fails to resolve on the host — this made 0.1.2 and 0.1.3 unloadable (<code>Cannot find module 'zod/v4'</code>). Version 0.1.4 removes the top-level Zod import from <code>src/handoff.ts</code> (schemas already build from <code>pi.zod</code> in <code>travel-tool.ts</code>; field descriptions live as plain data in <code>handoff.ts</code>), returns <code>zod</code> to <code>devDependencies</code> for tests only, and adds a contract test asserting no runtime source imports <code>zod</code> and that <code>dependencies</code> is empty.</td>
        </tr>
        <tr>
          <td>agent-resolved</td>
          <td>Map Pi <code>agent_settled</code> delivery to OMP <code>session_stop</code> guarded by <code>isIdle()</code> and <code>hasPendingMessages()</code>.</td>
          <td>OMP emits <code>session_stop</code> only after maintenance and async work are idle and before notification-only <code>agent_end</code>. This is the earliest native boundary that preserves finalized-receipt-before-cutover and avoids replacing an active retry or continuation.</td>
        </tr>
        <tr>
          <td>agent-resolved</td>
          <td>Use injected <code>pi.zod</code> strict schemas and OMP renderer signatures; inject Pi-only tool prompt metadata into <code>before_agent_start.systemPrompt</code>.</td>
          <td>OMP has no Pi-style <code>promptSnippet</code>, <code>promptGuidelines</code>, <code>renderShell</code>, or <code>constrainedSampling</code>. A separate idempotent system-prompt segment preserves the cues. Schemas are built from injected <code>pi.zod</code>; OMP-native <code>strict: true</code> carries them to capable providers.</td>
        </tr>
        <tr>
          <td>user-decided</td>
          <td>Use OMP-native top-level, approval, and scheduling contracts for all ACM tools.</td>
          <td>All three tools declare <code>loadMode: "essential"</code> so the default <code>tools.xdev: true</code> cannot hide them behind the outer <code>write</code> schema; this makes their <code>strict: true</code> schemas provider-visible at a measured recurring cost of about 6.7K schema-and-description characters per request. <code>acm_timeline</code> is approval tier <code>read</code>; checkpoint and travel are <code>write</code>. Travel uses OMP's effective <code>concurrency: "exclusive"</code> contract instead of the ignored Pi-only <code>executionMode: "sequential"</code>. Exact-host adapter tests lock strictness, top-level xdev exclusion, approval tiers, and exclusive scheduling after wrapping.</td>
        </tr>
        <tr>
          <td>agent-resolved</td>
          <td>Do not emulate Pi's tree-summary prompt override.</td>
          <td>OMP <code>session_before_tree</code> can cancel navigation or provide a completed summary but cannot replace native summarizer instructions. Native OMP tree summarization remains authoritative; fabricating a summary without running the model would weaken behavior.</td>
        </tr>
        <tr>
          <td>agent-resolved</td>
          <td>Host-fixture temp dirs never contain an OMP credential database; <code>test/host-fixture/host-temp.ts</code> owns creation and cleanup.</td>
          <td>Windows-only CI failure: five host tests passed their assertions then failed cleanup with <code>EBUSY</code>. Root cause is upstream — <code>SqliteAuthCredentialStore.close()</code> (<code>@oh-my-pi/pi-ai</code> 17.1.5, <code>src/auth-storage.ts:7897</code>) finalizes 26 of its 34 prepared statements, leaving <code>#updateIfMatchesStmt</code>, <code>#deleteCachePrefixStmt</code>, <code>#updateIfMatchesWithLeaseStmt</code>, <code>#deleteIfMatchesWithLeaseStmt</code> and the four <code>*CredentialRefreshLease*</code> statements live, so the trailing <code>#db.close()</code> silently no-ops and <code>agent.db</code>/<code>-wal</code>/<code>-shm</code> stay open for the process lifetime. <code>AuthStorage.close()</code> and <code>AgentStorage.resetInstance()</code> both delegate there, so no public API releases the handles; only GC does, and not while the owner is still referenced. POSIX unlinks open files, which is why Linux and macOS never saw it. Fix avoids the leak instead of closing it: runner tests build the registry over <code>new Database(":memory:")</code>, and the Skills test — where <code>createAgentSession</code> opens <code>&lt;agentDir&gt;/agent.db</code> itself — puts <code>agentDir</code> in a separate best-effort temp dir. Strict cleanup still throws on <code>EBUSY</code> so a reintroduced handle fails the suite.</td>
        </tr>
        <tr>
          <td>agent-resolved</td>
          <td>Preserve provider/native delivery separation with OMP public session-tree APIs and a capability-probed AgentSession adapter.</td>
          <td>Finalized applied receipts authorize provider Context Packet delivery. Native message replacement waits for idle <code>session_stop</code>; failures retain the persisted branch and actionable reload recovery rather than rolling back verified travel.</td>
        </tr>
      </tbody>
    </table>
  </section>
  <table>
    <thead><tr><th>Provenance</th><th>Decision</th><th>Rationale and constraint</th></tr></thead>
    <tbody>
      <tr>
        <td>user-decided</td>
        <td>Migrate the complete canonical ACM architecture and behavior from <code>omp-context</code> to <code>pi-context</code>, preferring public Pi interfaces where available.</td>
        <td>The Pi implementation must preserve observable ACM contracts without mechanically copying OMP-private types or seams.</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>Gate Live Agent Sync only on the runtime capabilities it uses; do not inspect or report the Pi host version.</td>
        <td>If the required <code>AgentSession</code> lifecycle and mutable message-state capabilities are present, synchronization runs. Missing or failed capabilities fall back to the persistent context rebuild and reload recovery path. Version and compatibility labels are intentionally omitted because timeline output enters model context.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Associate live <code>AgentSession</code> instances with <code>SessionManager</code> identity through one idempotent, weakly referenced adapter.</td>
        <td>The adapter probes the <code>getContextUsage()</code> lifecycle seam and each captured session's <code>sessionManager</code>, <code>agent.state</code>, and replaceable <code>messages</code> state. It rebuilds messages from the active SessionManager leaf and never owns tree mutations.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Keep persistent tree mutation in Host Bridge and live-state replacement in a separate compatibility boundary.</td>
        <td><code>appendLabelChange()</code> and <code>branchWithSummary()</code> are public runtime capabilities, while <code>buildSessionContext()</code> is a public <code>@earendil-works/pi-coding-agent</code> package export. Extension tool context exposes only a readonly manager type, so Host Bridge performs guarded mutation access and centralizes package-level context reconstruction; the adapter only synchronizes the matching live session after callers schedule it.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Schedule live synchronization only after a structurally verified travel and apply it from the matching <code>tool_execution_end</code> event.</td>
        <td>The travel tool remains synchronous and truthful about its branch result. Deferring message replacement until the matching tool execution ends preserves the in-flight call/result protocol while preventing failed, indeterminate, or unrelated tool executions from modifying live state.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Preserve a verified traveled branch when live message replacement fails, and surface reload guidance without attempting tree rollback.</td>
        <td>The persistent SessionManager branch and context-event rebuild remain authoritative. A post-travel live-sync failure clears only the matching pending tool operation, records a terminal diagnostic, and emits a warning; rolling back a valid travel would be more destructive than leaving native accounting stale until reload.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Treat each scheduled synchronization as replaceable per <code>SessionManager</code>, and make the resulting persisted branch the only resume authority.</td>
        <td>A later travel supersedes stale pending work only for the same manager. Off-path restoration rebuilds from the newly selected leaf, while process resume opens the persisted tree into a new manager/session association instead of retaining any previous-process <code>AgentSession</code> object.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Scope live synchronization strictly to each <code>SessionManager</code>/<code>AgentSession</code> identity pair, including parent/subagent and duplicate extension registrations.</td>
        <td>The process-wide adapter owns weak session associations and one atomic <code>{ toolCallId, preferredLeafId }</code> pending ticket per manager. Duplicate extension runtimes therefore cannot consume each other's tool completion, lifecycle cleanup addresses one manager only, and no working-directory, model, session-file, or global-current-session matching is used.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Use strict Pi TypeBox schemas rather than recreating the OMP runtime-injected Zod seam.</td>
        <td>Pi exposes TypeBox through <code>@earendil-works/pi-ai</code>. The timeline schema keeps the single-view contract, including omitted <code>view</code> as active mode, without accepting legacy competing booleans.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Make capability observation non-throwing and publish installation state only through a successfully installed wrapper.</td>
        <td>Frozen/read-only host prototypes and throwing session getters are capability failures, not extension-fatal errors. The wrapper carries the process-wide installation marker, observation never prevents the original lifecycle method from running, and current session capabilities are re-probed when synchronization is scheduled and applied.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Verify message replacement by checking that live state retains the rebuilt message sequence, not the caller's array identity.</td>
        <td>Live validation against Pi 0.80.6 exposed that the documented <code>Agent.state.messages</code> setter deliberately stores <code>nextMessages.slice()</code>. Reference identity therefore reports a false failure after a successful replacement. Element-by-element sequence identity accepts the host's top-level defensive copy while still detecting thrown or silently ignored replacement when the rebuilt branch differs.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Retire prototype-only synchronization code only after the production capability matrix proves equivalent behavior.</td>
        <td>The final fixture combines a shrinking travel, a valid in-flight <code>acm_travel</code> call/result pair, provider-context rebuild, archive recovery, and native compaction accounting. Additional fixtures cover unsupported capability, replacement failure, repeated travel, off-path restoration, persistence/resume, lifecycle cleanup, and multi-session/parent-subagent isolation. No prototype runner or duplicated adapter remains.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Keep the independently improved Pi-only <code>/context</code> TUI and route its compaction-aware message reconstruction through Host Bridge.</td>
        <td>The remote implementation depended on a helper removed by the modular ACM migration. Reusing <code>buildSessionMessages()</code> preserves its calibrated token breakdown and <code>Other</code> accounting while keeping SessionManager reconstruction capability access at the repository's single host seam.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Implement semantic rebase as agent-level use of the existing Pi <code>acm_travel</code> contract, with cold start as the hard safety gate.</td>
        <td>The underlying Pi tree mutation is identical to local travel. The runtime therefore reports only factual active/projected summary depth and travel deltas; candidate safety remains a semantic judgment performed from earliest to latest, with root treated as a candidate rather than a default.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Keep Pi-native TypeBox schemas, lifecycle seams, <code>/context</code> TUI, and capability-probed adapter while synchronizing the shared ACM guidance and evidence model.</td>
        <td>The corresponding behavior is adapted to Pi architecture instead of copying OMP-specific package APIs, injected Zod, or host contracts. The extension now always registers its canonical prompt hook because this repository has no integrated-consumer bypass.</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>Refine rebase without weakening checkpoint, local-fold, failed-direction, or task-end behavior.</td>
        <td>The always-on CORE retains every normal transition and a complete local-fold example. Rebase adds a structural-reset criterion alongside cold start rather than replacing the existing fold gate.</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>Improve checkpoint invocation predictability by front-loading a task-start preflight and making the checkpoint tool description trigger-first.</td>
        <td>The prompt follows the user-provided <code>writing-great-skills</code> principles: <code>preflight</code> is the leading word, the first action is explicit, and completion is checkable from the checkpoint tool result.</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>Prioritize reliable model behavior and complete operational contracts over the previous 6,000-character CORE and 300-character checkpoint-description budgets.</td>
        <td>The limits are now loose anti-sprawl guards rather than optimization targets. Vocabulary precision, transition timing, checkpoint naming and target semantics, and preflight failure handling may use the space needed for predictable execution.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Define managed work concretely and make non-ACM tool use an explicit preflight trigger.</td>
        <td>Investigation, planning, delegation, non-ACM tools, file or external side effects, and multi-step reasoning require a completed checkpoint first; only a text-only direct reply requiring none of them stays outside the managed-chain workflow. When finished work is still active, its rebase/fold transition runs first so the new checkpoint lands on the branch that will carry the new goal.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Use one advanced reference at a time and reroute when the observable condition changes.</td>
        <td>This preserves progressive disclosure without trapping archive recovery inside the wrong playbook after a failure. Recovery references now distinguish backup-label rollback from indeterminate branch mutation and use factual refresh/live-sync lifecycle states.</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>Send ACM context-usage reminders through Pi's hidden custom-message channel at 30%, 50%, and 70% usage tiers.</td>
        <td>The reminder must identify itself as ACM-generated and remain invisible in the Pi TUI while participating in model context. The 30% tier is a light opportunity cue, 50% asks the agent to actively look for a safe travel boundary, and 70% is the final and strongest reminder for that context cycle.</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>Keep reminders advisory: prefer low active-context usage, but never force summary, fold, rebase, or travel.</td>
        <td>The agent evaluates whether current task requirements permit a complete and recoverable handoff. Correctness, task continuity, required working state, and recoverability take priority; native compaction remains acceptable for genuinely long tasks.</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>Track the highest reminder tier per context cycle; ordinary usage drops do not rearm tiers, while successful ACM travel and native Pi compaction start a new cycle.</td>
        <td>Within a cycle only a newly reached higher tier produces a reminder, and a single observation that skips tiers emits only the highest one. A new cycle treats its first authoritative post-transition usage as a no-reminder baseline.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Arm reminders from the <code>context</code> lifecycle, deliver at <code>tool_result</code> with <code>steer</code>, and use normal-stop <code>agent_end</code> with <code>followUp</code> as the no-tool fallback.</td>
        <td>This follows Pi's public Channel 2 transport without modifying tool output. After travel or compaction, immediate <code>getContextUsage()</code> may still reflect pre-transition native accounting, so baseline establishment waits for the next real assistant prompt usage captured at <code>turn_end</code>.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Persist the first authoritative post-transition baseline as an <code>acm:context-usage-state</code> custom entry, then restore reminder-cycle state from baseline entries plus delivered reminder messages.</td>
        <td>A delivered reminder alone cannot distinguish “baseline not established” from “baseline established below 30%,” and reload must also preserve a baseline already at 30% or 50%. Pi's public <code>appendEntry()</code> channel keeps the baseline marker on the active branch without adding it to LLM context; reconstruction scans only after the latest ACM travel branch summary or native compaction boundary.</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>Classify ACM reminders against a working budget capped at 400K tokens while preserving hard-window usage as a separate metric.</td>
        <td><code>workingBudgetTokens = min(contextWindow, 400000)</code>: models at or below 400K retain their actual-window 30% / 50% / 70% behavior, while larger windows use 400K and therefore trigger at 120K / 200K / 280K active tokens. Existing persisted levels remain compatible; reminder details, baseline state, and the timeline dashboard expose both hard usage and ACM pressure rather than redefining <code>usagePercent</code>.</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>Give all three ACM tools explicit <code>promptSnippet</code>, <code>promptGuidelines</code>, self-owned shells, and custom call/result rendering.</td>
        <td>The tools must be easier for the model to discover and use correctly while presenting checkpoint placement, timeline evidence, and travel outcomes more clearly in Pi's TUI.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Keep prompt metadata trigger-first and render compact evidence by default, with full raw tool output available only in the expanded view.</td>
        <td>Each flat guideline names its tool as required by Pi. Renderers reuse row components, distinguish success from error or indeterminate outcomes, and remain presentation-only: the LLM-facing <code>content</code>, structured <code>details</code>, and mutation behavior are unchanged.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Neutralize terminal control characters in dynamic ACM tool-renderer text without changing LLM-facing tool results.</td>
        <td>Pi 0.80.6 custom <code>Text</code> components preserve embedded C0/C1 controls, while the default tool renderer strips them. Session snippets, host errors, and streaming arguments can therefore carry cursor-control or terminal-title sequences into the ACM self-owned shells. Shared presentation sanitization now normalizes carriage returns and removes unsafe controls before dynamic values enter <code>Text</code>; tabs, line breaks, structured <code>details</code>, and tool <code>content</code> remain unchanged.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Reserve <code>root</code> case-insensitively across checkpoint and backup aliases, while keeping it exclusively as the structural first-root target.</td>
        <td>Target resolution treats every letter-case variant of <code>root</code> as the structural keyword. Allowing the same spelling as a label creates an alias that can be written but never addressed, so validation now rejects it both at tool entry points and at the Host Bridge mutation boundary.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Contain every guarded SessionManager observation inside typed Host Bridge/coordinator outcomes and report backup-label presence as <code>present</code>, <code>absent</code>, or <code>unknown</code>.</td>
        <td>Host getters and post-mutation reads can fail after a mutation may have landed. Pre-mutation failures remain <code>not_applied</code>; unverifiable post-mutation state is <code>indeterminate</code>. Recovery presence replays the complete global label journal so alias reassignment is honored, and user-facing guidance falls back to the backup history node rather than claiming an unverified alias remains.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Keep npm as the reproducible root installer and Bun as the test/build runtime, with host-fixture dependency resolution isolated behind its own frozen Bun lock.</td>
        <td>Pi 0.80.6 clones git packages and runs <code>npm install --omit=dev</code>, so the root <code>package-lock.json</code> is part of the production installation contract rather than disposable development state. Root <code>bun test</code> excludes <code>test/host-fixture/**</code>; the complete gate runs every root test and then lets the fixture install, build, and test against its exact Pi version independently. CI pins both toolchains and starts from <code>npm ci</code> so stale locks and residue-dependent passes fail.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Require <code>acm_travel</code> to execute alone in its assistant tool batch, force sequential dispatch, and reject a detected mixed batch before any session mutation.</td>
        <td>Pi 0.80.6 persists the assistant tool-call message before dispatch but emits <code>tool_execution_end</code> before persisting each tool result. A successful travel replaces the live/session branch at that event, so sibling results from the removed assistant message can become orphaned and be sanitized away even though their external side effects already occurred. Sequential dispatch makes ordering deterministic; the runtime guard remains the safety boundary for both call orders, while canonical guidance prevents avoidable retries.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Keep <code>/context</code> attribution aligned with Pi's provider-visible payload and native message estimator.</td>
        <td><code>getAllTools()</code> includes source metadata and prompt guidelines that are not part of the provider tool schema; guidelines already contribute through the effective system prompt. The panel therefore estimates only <code>name</code>, <code>description</code>, and <code>parameters</code>, reports zero tool-schema tokens when no tools are active, and splits assistant text/thinking/tool calls with the same character weights as Pi 0.80.6 <code>estimateTokens()</code>. Downward-only calibration and an explicit <code>Other</code> remainder preserve the official total without inventing attribution.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Treat an equivalent branch summary as applied only when the active leaf changes during the current host mutation attempt.</td>
        <td>Summary-content equality alone cannot attribute a mutation: the active leaf may already contain the requested handoff before <code>branchWithSummary()</code> throws or performs no work. Host Bridge now classifies an unchanged equivalent leaf as <code>not_applied</code> while preserving any host error, accepts a changed exact-summary leaf as observed application even if the host return is malformed or throws afterward, and retains <code>indeterminate</code> for failed post-mutation observation.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Treat <code>/context</code> as a TUI-only diagnostic surface, contain host/UI failures, and verify its public contract through the exact Pi <code>0.80.6</code> runner.</td>
        <td>Pi exposes <code>mode</code> specifically to guard terminal-only custom components, while non-TUI hosts may provide a silent <code>ui.custom()</code>. The command now rejects unavailable or non-finite usage, sanitizes host-derived warning text, reports a custom-UI no-op, and keeps failures from escaping normal command execution. The host fixture loads the built extension through the exact <code>ExtensionRunner</code> and renders it with exact <code>pi-tui</code>, so registration, command context, and component compatibility remain regression-tested.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Canonicalize guidance source and generated-output line endings to LF, and enforce LF text checkouts through <code>.gitattributes</code>.</td>
        <td>Windows Git checkouts can convert repository text to CRLF. Without normalization, <code>JSON.stringify()</code> preserves CRLF inside generated runtime strings and the strict generated-guidance check reports a false stale artifact before tests run. The generator now normalizes source and comparison input, while the repository attribute keeps normal working trees deterministic across operating systems.</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>Replace the mandatory ACM preflight, transition table, and gate checklists with compression-as-intelligence doctrine, recognition cues, and default agent autonomy. Supersedes the earlier preflight and transition-table decisions.</td>
        <td>Scripted workflows made weak models copy rituals and strong models route around the tools. The CORE now teaches judgment: the working set carries settled knowledge, honest uncertainty, the hot set, and pointers; compression is continuous while folding is batched between the sediment and thrash failure modes. Fold moments are recognition patterns ("the weighing, not the fold, is what the moment asks for"), never required transitions, and travel is autonomous unless the user explicitly holds it.</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>Split canonical guidance into <code>CORE.md</code> (道 and 度: judgment and cadence) and <code>TOOL-CONTRACTS.md</code> (术: tool descriptions, prompt metadata, result cues, recovery text), both compiled by one generator.</td>
        <td>Tool descriptions and result cues sit at the invocation moment and survive long contexts, so mechanics belong there; the always-on CORE stays small enough to hold attention. Prompt snippets and guidelines now come from the generated module so no runtime string can drift from the canonical source.</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>State a lean-working-set preference — about one third of the working budget as a comfortable cruise — and present rehydrate and fork as first-class moves.</td>
        <td>The preference aligns the doctrine with the 30% reminder tier while remaining subordinate to correctness, task continuity, and cold start. Rehydrate (save, travel to the archive, return with the extract) and fork (save, explore, fold forward or travel back) make travel bidirectional rather than only a retreat.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Remove suffix-driven cue branching from the runtime; checkpoint and travel each emit one canonical cue.</td>
        <td>Selecting cues by <code>-done</code> suffixes made label spelling a hidden state machine, contradicting the contract that names are recovery cues rather than workflow states. The single cues describe the observable outcome and the next judgment without inferring task phase from names.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Advance the exact supported Pi host from <code>0.80.6</code> to <code>0.80.7</code> across dev, peer, and host-fixture pins.</td>
        <td>The user's live Pi installation runs <code>0.80.7</code>, so the verified contract must match the actual runtime. The full fixture matrix — <code>ExtensionRunner</code> registration, <code>/context</code> rendering, adapter capability probing, travel/live-sync ordering, and lifecycle isolation — passes unchanged on <code>0.80.7</code>; <code>navigateTree()</code> remains command-context-only and cannot carry an agent-authored handoff, so the Host Bridge <code>branchWithSummary()</code> path and the capability-probed adapter remain the correct seams.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Treat manual <code>/tree</code> navigation as a first-class context transition: reset volatile ACM runtime state on <code>session_tree</code>, shape plain summarize requests through <code>session_before_tree</code> into the seven-slot handoff, and count every active-branch summary or compaction as a reminder-cycle boundary on restore.</td>
        <td>Manual navigation bypasses <code>acm_travel</code>, so stale refresh targets, live-sync tickets, and reminder baselines could otherwise survive onto the newly selected branch, and native summaries spoke a different vocabulary than travel handoffs. User-authored summarization instructions always win; the extension only replaces the default prompt when the user asked for a plain summary. Restore-boundary detection now matches live behavior, which resets the cycle on travel, compaction, and manual navigation alike.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Make every prompt surface name its concrete next move: the checkpoint cue teaches the checkpoint→travel chain, each reminder tier carries one tool step, and the handoff contract states line-per-slot shape with an immediately executable <code>NEXT</code>.</td>
        <td>Weaker models act on named tools, not abstract advice: "weigh a fold" gives no callable action, while "acm_travel targeting this point folds that process" does. The additions stay advisory — no tier or cue mandates a call — so stronger models keep full judgment while the action gradient still points the same direction at every capability level.</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>Remove fixed prompt, CORE, tool-description, Skill, character, and token ceilings as product constraints; optimize only for observable ACM and task effect.</td>
        <td>This supersedes earlier 6,000/6,500-character and similar anti-sprawl guards. Except for real host or protocol limits, length is diagnostic rather than normative. Content is retained, removed, inlined, or progressively disclosed according to behavioral effect, information hierarchy, and maintainability—not to satisfy an arbitrary budget.</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>Adopt the Effect First ACM Judgment Contract as the canonical source for judgment semantics; CORE becomes its model-facing projection.</td>
        <td>Predictability applies to the judgment process rather than a fixed move. Checkpoints are near-free recovery options and activation footholds; travel is justified by low-attention-value, high-noise material that can be represented much more concisely; successful handoffs are trusted by future self without a verification ritual; correctness is judged through observable operations and task effect.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Separate raw travel backup anchoring from ordinary semantic checkpoint selection and require the immediate pre-travel leaf's projected packet to be protocol-complete.</td>
        <td>The previous meaningful USER/AI resolver skipped completed tool results and could label the preceding assistant tool-call turn. Backup resolution now evaluates the compaction-aware packet at the immediate pre-travel leaf, preserving tool results, model/thinking changes, and other session state; any required repair or invalid/duplicate tool-call identity aborts travel instead of silently falling back to stale history. Ordinary checkpoint semantics remain unchanged.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Preserve unknown checkpoint-candidate message estimates as unknown instead of representing failed context reconstruction as an empty message array.</td>
        <td>The checkpoints view now caches a typed build outcome per entry. Successful empty packets remain distinguishable from build failures; aliases reuse one outcome, and usage estimates are produced only from observed messages.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Keep checkpoint creation free of quotas while grouping the checkpoint catalog by target entry rather than consuming the view limit per alias.</td>
        <td>Each displayed entry names one relevant or latest alias and reports the remaining alias count; filter and search still index every alias. Details preserve legacy matching-alias counts, add entry and total-alias evidence, and render historical alias-only results without invented zero entry counts.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Replace the agent-authored free-form handoff string with a required structured handoff object and let runtime own the canonical durable text.</td>
        <td>Historical evidence showed first-travel failures from header, ordering, duplicate-slot, and multiline grammar rather than missing cognition. The seven semantic fields remain explicit; goal/state/next reject empty or none values, supporting fields require explicit none, multiline content is preserved, verified raw archive aliases are composed deterministically, and the legacy summary interface is not exposed in parallel. A weaker provider was observed serializing the whole nested object as a JSON string, so runtime accepts the exact JSON encoding of the same seven-field object as a mechanical fallback without accepting free-form summary text.</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>All models and thinking levels available through the local Pi installation may be used freely for ACM debugging, controlled experiments, and regression evaluation.</td>
        <td>Model runs must record the model, effort, product commit, environment, and experimental variable. They provide behavioral evidence and do not replace deterministic tests or host-contract verification.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Align normal success cues and context-pressure reminders with the canonical ACM Judgment process instead of turning travel success into a verification ritual or pressure into move permission.</td>
        <td>An applied travel result is read once as the mutation receipt; future self trusts the handoff and executes next. The 30/50/70 tiers now raise the salience of Candidate, Compressibility, Attention effect, Recovery value, and Transition effect while leaving continue/checkpoint/timeline/travel/rebase/rehydrate as judgment outcomes.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Persist a versioned ACM continuation marker with the canonical handoff and project marked branch summaries in place as authoritative hidden custom messages on every LLM-bound context path.</td>
        <td>Pi's default branch-summary conversion frames summaries as archival history, while the travel tool result disappears after live rebuild. Context Packet now owns session rebuild and existing-packet normalization, applies protocol repair, and replaces only summaries whose marker, source, timestamp, and persisted <code>{ kind: "acm_travel", handoffVersion: 1 }</code> provenance all match an active session entry. A successful matching tool result sends one hidden steer only when no later message is pending and the run is not aborted; otherwise the in-place packet alone preserves later-user ordering. The steer restates <code>NEXT</code>, marks prior requests as historical, and keeps Evidence/Recover pointers non-blocking; failed or indeterminate travel sends none.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Remove arbitrary schema ceilings from checkpoint names/targets, timeline queries/result limits, and travel references while retaining real format and minimum constraints.</td>
        <td>The user explicitly rejected fixed upper bounds as semantic product requirements. TypeBox no longer rejects inputs at 64/256/500 characters or timeline limits above 50; semantic alias patterns, non-empty values, strict object shapes, and the default timeline limit of 50 remain. Large timeline requests are not executed without bound: context-derived entry and character budgets limit rebuild/output work, dynamic aliases/queries use bounded presentation with full node IDs first, and details report requested/effective limits plus entry/character truncation evidence. This is operational protection rather than a hidden semantic quota.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Separate eval environments into raw-control, core-only, product-isolated, and full-env, and hard-gate advanced Skill provenance before any model prompt.</td>
        <td>Every run calls <code>get_commands</code> first. Raw-control loads no ACM resource; core-only loads CORE/tools but requires zero <code>skill:context-management</code> commands; product/full require exactly one whose realpath is the current checkout. Invalid infrastructure is recorded and neither the flow nor judge runs. Reports persist model, effort, environment, product commit, paths, command provenance, and Skill availability.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Use outcome-first behavioral evidence rather than activation counts, and calibrate the short mechanism scorer to semantic fact preservation.</td>
        <td><code>acm-outcome-v3</code> treats unfulfilled work at travel time as neutral until continuation outcome is observed; domain errors, failed reads, and tool starts without matching completion are not successes. The controlled handoff matrix requires first-attempt success, exact seven-field semantics, a clean target, direct first useful action, no inspection before REQUIRED NEXT, and preserved facts across ordinary prose/Markdown formatting.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Make advanced routing pointers exact and conditional instead of relying on internal reference titles.</td>
        <td>A shared selector checks Pi's public <code>getCommands()</code> and only emits an exact <code>context-management</code> pointer when that Skill is actually available; core-only receives only base recovery actions. Timeline/rebase, name collision, rollback failure/skipped, indeterminate mutation and refresh exhaustion all reuse it. A corrected 2-model × 2-environment matrix requires completed successful reads: both product cells read router plus reference, both core-only cells made no advanced-guidance probe, and none traveled under unresolved ambiguity.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Validate the structured handoff and continuation mechanics with strong/weak local models before claiming the redesign candidate.</td>
        <td>At commit <code>a170e894</code>, <code>gpt-5.6-sol/high</code> and <code>deepseek-v4-flash/high</code> each passed core-only and product-isolated cells under the corrected completed-call scorer. An intermediate three-run weak replication was 2/3 and motivated exact-NEXT/open-turn/evidence hardening; a contemporary eight-run weak baseline at <code>46cb3ad5</code> then passed 8/8 with zero first-action mismatches. Evidence is stored under <code>eval/evidence/</code>; provider failures are repeated rather than attributed to product behavior.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Persist the structurally observable fact that the user turn triggering travel is still open, without pretending runtime understands the answer semantics.</td>
        <td>When the travel tool batch follows the latest user message and no visible assistant response has occurred, runtime records <code>currentUserTurnOpen</code> in verified summary details. Context Packet, the tool receipt, and the queue-safe steer then state that a visible result is still owed, <code>State</code> is not delivery, and a NEXT that merely waits for another request is insufficient. A visible assistant response before travel suppresses the flag.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Keep production-like flow fossils separate from controlled matrices and judge activation by task outcome.</td>
        <td>Cadence research runs showed all three important shapes: native-window task success with zero ACM; a shrunk-window activation that built a rich handoff but lost the current answer and degraded task outcome; and a complete later 40K run that visibly delivered the answer first, then rebased to root with a named raw backup, reduced context from 59.7% to 37.6% and messages from 16 to 1, completed the final synthesis, and received ordered-transcript outcome-v3 overall 3/3 and task completion 3/3. A prior 40K run whose P6 provider stream failed is explicitly discarded from full-flow scoring. Because context regime and product commit both changed, the artifact is diagnostic progression, not a causal A/B.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Treat provider terminal integrity and raw event order as load-bearing outcome evidence.</td>
        <td>Long-flow turns now fail when the terminal assistant message is missing, <code>error</code>, or <code>aborted</code>; such runs are marked <code>run_error</code> and skip the outcome judge. Judge transcripts are built from ordered assistant-text and tool segments, preserving whether an answer occurred before or after travel instead of grouping every tool ahead of every reply.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Make travel-target hazards first-class facts and reject only the mechanically invalid protocol floor without silently choosing a broader policy.</td>
        <td>Before mutation, runtime records target entry/role/stop reason, assistant tool/text shape, surviving open user turn, packet complete/repaired/invalid status with repairs/defects, branch-summary and off-path facts. The staged policy is deliberately non-breaking: invalid tool-call identity is always rejected with zero mutation; repaired, dangling, assistant-tool-batch, old-summary and off-path conditions apply with explicit warnings; runtime never silently retargets. A same-commit paired product run achieved healthy 3/3 despite repaired/open/tool-batch warnings, providing a concrete counterexample to blanket rejection. Escalation requires replicated causal harm and should prefer repair-subtype-specific rules.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Do not ship a one-shot NEXT action guard without a contemporary failure rate and demonstrated recovery benefit.</td>
        <td>A throwaway weak-model prototype compared eight guard-off and eight guard-on runs at the same product commit. Baseline passed 8/8 with zero first-action mismatches; guard-on passed 7/8, observed zero blocks, and its only failure was incorrect write content that the guard could not fix. The prototype was removed. Reopen only after at least four eligible mismatches in sixteen current baseline runs and a guard arm proves block-then-recovery without task or strong-model regression.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Add a raw-control environment and compare product effect at the same commit, model, task, and context window.</td>
        <td>In the 40K Cadence pair, raw-control completed the task accurately but never activated ACM (overall 1/3, task 3/3). Product-isolated checkpointed and traveled with a structured handoff, reduced context 66.7%→55.1% and messages 26→16, preserved all answers, and scored overall 3/3 with task 3/3. This single stochastic pair is positive mechanism evidence, not a population estimate.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Keep the 3.0 fork GitHub-only and mark the unscoped package private.</td>
        <td>The unscoped npm name <code>pi-context</code> is owned by the upstream project, so publishing this fork under that identity would create provenance and upgrade ambiguity. Git and local Pi installation remain supported; any future registry publication requires a user-chosen scoped or renamed package identity.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Supersede matching <code>tool_execution_end</code> live message replacement with a per-<code>SessionManager</code> <code>agent_settled</code> boundary.</td>
        <td>This supersedes the earlier direct-replacement timing decision while preserving its historical record. A successful travel still schedules persistent rebuild and a capability-probed live-adapter ticket, but the originating assistant run and its automatic retry/tool loop retain native messages until <code>agent_settled</code>. Only then may the adapter rebuild from the latest verified active leaf and replace native <code>AgentSession</code> messages; <code>agent_end</code>, especially an error/aborted terminal, is not a release signal. An <code>indeterminate</code> mutation schedules only persistent observation rebuild because the branch may have landed; it never receives a live-adapter ticket, settled replacement, success receipt/steer, or reminder-cycle reset. A definite failure or <code>not_applied</code> mutation schedules neither. Persistent Context Packet rebuild remains the verification and fallback path, and unavailable/failed adapter application never rolls back verified travel. Controlled A/B evidence moved Opus from 0/3 to 3/3 and Kimi from 0/2 to 2/2; Sol had no valid regression and DeepSeek improved only partially. A wording-only continuation prototype showed no attributable gain, so it is not adopted.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Advance the exact Pi host contract from <code>0.80.7</code> to <code>0.81.1</code> and construct fixture registries through the canonical <code>ModelRuntime</code>.</td>
        <td>Pi <code>0.81.1</code> removes the exported <code>AuthStorage</code>/<code>ModelRegistry.create()</code> setup used by the old fixture. Tests now create an isolated <code>ModelRuntime</code> with a temporary auth path, no models file, and network catalog refresh disabled, then pass <code>new ModelRegistry(runtime)</code> to the exact <code>ExtensionRunner</code>. This keeps host-contract tests deterministic while validating the current compaction, branch-summary retry, settled lifecycle, and live-session capability shape.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Judge pivot recovery by the best usable recovery route rather than requiring a checkpoint or raw backup ritual.</td>
        <td>The pivot scorer now accepts a checkpoint/backup only when the handoff's primary Recover reference names it, and also accepts a complete durable <code>research-brief.md</code> when a pre-travel direct write already carries every required section, or an opaque shell write is followed by a successful pre-travel readback proving those sections; the final workspace file must still remain complete. Evidence/External mentions, nonexistent aliases, source globs, post-travel completion, and incomplete artifacts do not substitute. This corrected two Sonnet false negatives without turning every completed-front pivot into a mandatory checkpoint→travel→backup sequence, while preventing a later overwrite or unrelated shell comment from being misattributed to the travel boundary.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Do not ship the additive pivot/NEXT prompt prototypes from the post-merge optimization search.</td>
        <td>Checkpoint-parking, pivot-backup, pivot-precommit, Recover-artifact, and both long/short NEXT-obligation treatments either failed to improve the target weak-model cohort, duplicated existing authority rails, or introduced cross-model regressions. The paired NEXT matrix kept aggregate NEXT correctness at 17/18 on both arms while moving one failure from DeepSeek to Gemini; the shorter treatment then produced three early Gemini stale-replay failures. The existing <code>currentUserTurnOpen</code> receipt/Context Packet contract remains the delivery floor without adding more global schema sediment.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Clarify rehydrate navigation at the two argument-formation seams without adding a runtime return state machine.</td>
        <td><code>backupCurrentHeadAs</code> is now explicitly a brand-new alias on the exact protocol-complete origin path and never selects the destination; existing checkpoint/archive/return aliases belong in <code>target</code>. A successful off-path result tells bounded rehydration to execute NEXT, carry the extract through the handoff-named return pointer, and not substitute an older fold base. Same-time DeepSeek control versus candidate moved from 0/6 to 3/6 and removed every <code>backup_protocol_incomplete</code>, rejected-travel, and extra-retry branch; the remaining failures were only wrong-base choices. Runtime still never infers, stores, or silently rewrites a semantic return target.</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Accept semantically explicit deferred-wait wording in topology scoring.</td>
        <td>A correct Sol round trip used “Wait explicitly for the next user instruction,” but the evaluator only accepted a contiguous “wait for” phrase. The trigger recognizer now allows the observed adverb while retaining the next-user requirement, so equivalent temporal gating is not mislabeled as a product failure.</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>把真实 global 与 project <code>AGENTS.md</code> 保留在 agents-only 评估中，但只允许当前 <code>pi-context</code> checkout 的 extension 与 Skill 进入候选运行。</td>
        <td>该隔离要保留实际的全局/项目行为约束，而不把环境退化成无 instructions 的 synthetic control。harness 只复制 auth 与 global <code>AGENTS.md</code>，fixture 保留 project <code>AGENTS.md</code>；packages、global extensions/skills、ambient extensions/skills、MCP、prompt templates 和 session-recall 均排除，且运行时审计必须证明它们不存在。</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>以顺序 MVP 后扩展的方式评估 context-window 分歧：先完成同模型的 400K/1M agents-only pair，再按 Opus 4.8 → Terra → Sol 扩展。</td>
        <td>每个 pair 固定 seed、fixture、prompt、model、thinking、Pi 与 checkout resources，只改变 context window；先得到能复核的 outcome，再增加模型或重复次数。full-env 尝试承担 calibration，不得混入此 MVP 的 pair verdict。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>把 fixture 内 deterministic verifier 与外层 ordered-transcript outcome judge 对齐为同一证据链，而不以 travel receipt 代替任务完成。</td>
        <td>内层 verifier 决定 flow 是否有资格被当作完整交付；只有其通过后才执行 Opus 4.8 的 <code>acm-outcome-v3</code> judge。travel receipt 仍单独记录 mutation、backup、handoff 和 context delta，用于证明 mechanics。这样 400K 的 12/14 保留为机制/回归证据但不伪造 comparable judge，而 1M 的 14/14 与 overall 3/3 可共同支撑候选结论。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>对 agents-only 长 dossier pair 采用 outcome-first 解释：判定以 verifier 和有序交付结果为主，调用次数、压缩率和峰值 telemetry 只作诊断。</td>
        <td>两臂均成功执行 <code>acm_travel</code>，因此 “调用了多少 ACM” 或一次 token 降幅都不构成优劣结论。2026-07-22 的 Opus 4.6 MVP 显示 400K 仍有 applied travel，但最终遗漏 R1/R2 perturbation 时序和 README contract；1M 完成 14/14 并得到 strong outcome judge。该解释只声称此 flow 的 material divergence / 1M candidate superiority，明确保留 n=1、顺序执行和跨模型/任务不可外推的边界。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>在 <code>pending_run_settle</code> 阶段只清洗 provider-bound outgoing context clone 中的历史孤儿 tool result。</td>
        <td>评估暴露 <code>branchWithSummary()</code> 后宿主再追加 tool result 时，已折叠调用可能不在同一 provider packet 中。该阶段直接对 outgoing clone 使用 tool-protocol repair：保留结构完整的当前 <code>acm_travel</code> call/result，若只有 result 而没有 call 则同样按 orphan 去除；不重建 persisted Context Packet、不提前替换 native AgentSession messages，并保持 settled delivery gate 未释放。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>在任何 backup label 或 branch mutation 前拒绝 protocol-invalid 的 current active packet。</td>
        <td>Travel target 可以合法，但 target 之后的当前路径仍可能含空或重复 tool-call ID。若允许 mutation，same-run provider packet 将无法安全修复。<code>acm_travel</code> 因此在 current Context Packet rebuild 成功后立即检查 protocol status，返回 <code>current_protocol_invalid</code> 与 defects/target/origin evidence，并保持 label、branch、refresh ticket、deferred delivery 和 reminder cycle 全部未变。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Superseded：不要按字面 <code>active</code> phase 判断 usage authority；以下方 provider-delivery 两阶段决策为准。</td>
        <td>这条历史决策最初用于阻止 originating-run usage 消耗 travel landing seed，但“任何非 active phase 都跳过”会错误排除仍在交付可信 cache 的 <code>cached_exhausted</code>。当前规则由下方条目取代：pending/ready/无可信 packet 的 fallback 跳过；已交付可信 packet 的 <code>active</code>/<code>cached_exhausted</code> 接受真实 provider <code>turn_end</code>；<code>receipt_rejected</code> 则回到当前 provider/native 路径建立新的未 seed baseline。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>把 outcome judge verdict 作为严格版本化 artifact：只接受完整 <code>acm-outcome-v3</code> JSON，且所有质量与总分均为 0–3 整数。</td>
        <td>一次真实 Opus 4.6 judge 回复把 <code>overall.score</code> 写成 9，旧 parser 只做 JSON 语法解析，导致 report 和 aggregate 把无效值显示为 <code>9/3</code>。结构校验与 producer 的当前-rubric gate 分离：新 judge/rejudge 只接受精确 <code>acm-outcome-v3</code>，而消费者按 artifact 声明的已知 <code>acm-activation-v1</code>/<code>v2</code>/<code>v3</code> schema 校验并按 rubric 分组，未知版本标记 <code>RUBRIC-MISMATCH</code>。每个新 v3 verdict 的 perPhase 必须与 flow opportunities 的名称、顺序及数量精确相同；持久化消费者优先用 report 中的 turns 恢复同一约束。校验覆盖每阶段类型、六个维度、归因/等级枚举、非空说明和 1–3 个不重复 top attribution，绝不 clamp 或归一化。初始回复 syntax/schema 无效时，同一 judge session 只允许一条带 field-path errors 的 repair prompt，完整 raw attempts 会写入 verdict/report；RPC、terminal、timeout 或 shutdown failure 也形成结构化失败 artifact，且两次 prompt 共用一个总 deadline。底层 <code>PiRpcDriver.prompt()</code> 同样让 RPC acknowledgement 与 <code>agent_settled</code> 共用 caller timeout：ack 上限为 <code>min(60000, timeoutMs)</code>，非正预算立即失败，并在等待 ack 前为 settled rejection 安装处理器，避免短 deadline 先到时产生 unhandled rejection。每个 settled waiter 接受一个 operation-scoped <code>AbortSignal</code>；prompt 的 request error、ack timeout、<code>success:false</code> 或其他早退都会在 <code>finally</code> 中取消 waiter、清除 timer 并从 registry 移除，避免失败请求在完整 budget 内残留。rejudge 复用这一路径而不重跑 task，aggregate/analyze 对持久化的无效 verdict 显示或记录 <code>JUDGE-ERR</code>，不参与评分。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>把 successful travel 的 provider Context Packet delivery 与 native AgentSession replacement 设计成两个可观察的阶段。</td>
        <td>Mutation applied 后先进入 <code>pending_tool_result</code>。因为 <code>tool_result</code> handler 输出仍可被后置 extension 改写，它不授权 provider cutover；下一次 <code>context</code> 只认 event messages 或 persisted branch 中 matching、non-error、<code>mutationStatus: applied</code> 的 finalized <code>toolResult</code>，再从 latest active leaf 生成 protocol-valid packet。finalized error 或 untrusted receipt 进入 <code>receipt_rejected</code>，取消 persistent refresh 和尚未应用的 native ticket，避免 settled fallback 旁路授权；finalized receipt 缺失或暂时不可读取时则保留 provider/native ticket，不能把不可观察状态当成成功。Context Packet 是唯一 NEXT authority，正常 cutover 不额外发送 steer。native <code>agent.state.messages</code> 仍只在 idle <code>agent_settled</code> 从最新 leaf 替换。缓存使用稳定 source/cached prefix cursor 合并 post-cutover tail；prefix drift/invalid 降级为当前 protocol-valid fallback，不再单独发送旧 cache。persistent rebuild 三次后进入 <code>cached_exhausted</code> 并停止自动读取/warning，但继续接受实际 provider <code>turn_end</code> usage。每次 travel 会先清除上一 provider epoch 的 cached usage；provider-active 阶段的 nudge 只采用实际 provider <code>turn_end</code> usage，native <code>ctx.getContextUsage()</code> 仅作为 estimate 展示。Runtime/HUD 分别报告 provider、cache、usage authority 与 native 状态。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>把 agents-only 的 workspace 隔离从 post-hoc 假设升级为 live-enforced measurement guard，同时保持被测 product 与模型可见 surface 不变。</td>
        <td><code>integrity-guard.mjs</code> 作为唯一、显式、temporary-scope 的 measurement extension 加载；它不注册工具、命令或 prompt 内容，report 将其 path/hash/audit 与 checkout product extensions 分开记录。agents-only 继续关闭 ambient extension/Skill/package discovery、保留真实 global 与 fixture <code>AGENTS.md</code>，并要求 CORE、global heading、project heading 的 prompt provenance。lexical tool gate 只作为可审计的 defense-in-depth：它允许 workspace 相对读写和 checkout Skill 只读访问，拒绝直接 sibling/HOME/absolute 路径、escaped slash、带冒号或无冒号的 parameter-expansion absolute path、multi-slash root、redirection 与 executable/header <code>file:</code> URI；data-only quoted heredoc prose和 benign HTTP(S) URI保持可用。它不整体裁剪 executable body；Node/Bun heredoc 中不跟 <code>.source</code> 的 JavaScript regex literal 先在 terminator 仍可识别的原始 command 上从 path scanner 隐去，再执行 quoted-heredoc masking；<code>/etc\/passwd/.source</code> 等可构造路径的形式继续阻止，且不宣称 lexical matching 完备。Darwin agents-only 的 authoritative model-tool filesystem boundary 分两路：模型控制的 Bash 在 lexical 判定后进入独立 tool Seatbelt，拒绝 shared workspace/run/harness roots、当前 agentDir/runDir/harness 及私有评估状态，只开放当前 workspace；内建 read/write/edit 不能执行动态代码，继续由 canonical path gate 限制到 workspace 与 advertised Skill。Pi host 本身是 trusted runtime，不套 outer Seatbelt，因 macOS 不允许已 sandboxed 进程再次 <code>sandbox_apply</code>；它必须读取 sparse harness/auth 并写 session artifacts。tool profile 与 canonical gate 共同拒绝 <code>~/.pi</code>、Codex sessions/archives/memories、<code>$HOME/.codex/private/pi-context-eval</code>、checkout task-fixture source 和本机 account database；<code>TMPDIR</code> 放到 workspace，outer/tool path/hash/denied roots/source 写入 report。<code>currentRoots</code> 是 tool profile shared-root deny 下经 kernel 实测的当前-workspace allow exceptions；profile 仍为 <code>allow default</code>，所以它不是完整 host allowlist。这是 evaluation-sensitive roots 边界，不是完整 host sandbox。Darwin formal cell 必须 <code>kernel_enforced</code> 且 <code>formalEvidenceEligible=true</code>；非 Darwin 明确以 <code>agents_only_sandbox_unsupported</code> preflight invalid，aggregate/matrix 不接受 false eligibility。agents-only formal run 在 workspace/profile 创建前取得 private-eval 全局 exclusive lock，matrix 对 agents-only 强制 concurrency 1；shared-root deny 也覆盖 profile 生成后出现的 sibling；活 owner 不被抢占，dead PID 可在 recovery claim 下清理，release 以 token 防误删，并由 finally/exit/SIGINT/SIGTERM 释放。每次 run 在 finally 重读 audit 后无条件重新分类，因此 invalid prompt 或 blocked tool 即使伴随 abort/timeout/run error 也成为 primary <code>infrastructure_invalid</code>，原 run error仅作 secondary evidence。tracked replay、fake-Pi audit-only、lock tests 与 Darwin kernel regression固定 historical decisions、wrapper/profile/report/零 prompt、并发边界，以及 dynamic regex/parameter/alias/current-or-sibling-auth 的 kernel denial；真实 Pi audit-only 证明 trusted Pi host 可启动并完成 runtime audit，同时 tool profile path/hash/applied evidence 正确注入 measurement guard；kernel tests 证明 Bash 读取 current/sibling auth 与 shared roots 均被拒绝。四个既有 Opus formal cells exact replay 均为0，可作 post-hoc clean evidence；Terra 400K 仍有2个真实越界，Terra 1M有12个，旧 Terra pair 不进入正式跨-window结论。现有临时 workspace 保留用于审计。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>把 exclusive-lock recovery claim 与 Seatbelt profile serialization 视为正式评测安全边界，而不是普通临时文件。</td>
        <td>Recovery claimant 在写 owner record 前或写完后崩溃都不能永久阻塞后续 formal cell：有 owner 的 dead claim 立即清理，空/损坏 claim 经过短 grace period 后在再次确认仍不可解析时清理。SBPL 路径拒绝 C0/DEL 控制字符并覆盖 <code>/etc</code> 与 <code>/private/etc</code> alias；profile 写入后逐字回读验证。对应 lock、profile 与真实 kernel deny tests 固定这些 fail-closed 行为。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>不要在 eval runner 主进程中直接 import/执行模型写入的 Saffron source module。</td>
        <td>Deterministic verifier 现在通过独立 Node permission subprocess 执行 event gate、policy order 与 dry-run probe，清空 credential-bearing environment、只允许读取 canonical workspace 与 tracked probe script、设置 timeout/maxBuffer；该 post-run verifier boundary 由 Node permission model 独立于模型工具 Seatbelt 执行，避免 shared-root Seatbelt 的 parent-metadata 例外扩大可见面。非零退出、越界读取、缺失 marker 或非法 JSON 都只形成 verification failure，不能影响 runner 主进程。probe script 已加入 matrix pinned-source provenance。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>把固定四模型 Saffron 400K/1M matrix 从 full-env calibration runner 切换为 agents-only formal runner。</td>
        <td>Manifest 的八个 cells 全部使用 agents-only，按 Opus 4.6 → Opus 4.8 → Terra → Sol 的顺序逐模型运行，每个 model pair 先 400K、再 1M，effective concurrency 固定为 1。Pinned provenance 按 arm 固定 sparse harness 的 models/settings/auth/global AGENTS hashes、checkout sources、Pi/Bun runtime 与空 ambient resource trees；source config 只固定 agents-only 实际读取/复制的 <code>models.json</code>、<code>auth.json</code> 与 <code>AGENTS.md</code>，harness settings 是固定生成且单独 hash 的。被 agents-only 明确排除的 source <code>settings.json</code>、thinking presets、subagent config 与 <code>pi.env</code> 变动不得伪装成评测输入漂移。每个完成 cell 还必须证明 <code>kernel_enforced</code>、<code>formalEvidenceEligible=true</code>、lock acquired/released、session-recall absent 和 exact source/model/window/cap/effort。Audit-only preview 已在真实 Pi <code>0.81.1</code> 上完成，零 task/judge prompt，tool profile 从历史 sibling 枚举的约 339KB 降为 shared-root deny + current-workspace exception 的约 1.5KB；Pi host 不应用 outer profile，避免 nested <code>sandbox_apply</code> 在 macOS 上被内核拒绝。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Saffron verifier 必须区分“明确拒绝 stale claim”与“把 stale claim 当作 release permission”。</td>
        <td>Opus 4.8 / 400K 与 1M pilot 按 P6 要求在 evidence ledger 中用 Markdown emphasis、引号或连字符保留原主张并标注 <code>superseded</code>，且在 hold decision 中标注 <code>VOID</code> / <code>does not authorize rollout</code>；旧 verifier 因裸字符串匹配与“只要出现就失败”而产生 false negative。当前 claim 比较使用 Unicode NFKC + lowercase + 字母数字 token normalization，因此展示标记只是分隔符；词本身仍必须一致，且 claim 的每次出现都必须在局部有明确 rejection marker。缺席或明确拒绝可通过，<code>Valid release permission</code> 仍必须失败。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Flow telemetry 以真实 Pi RPC 的 completed lifecycle event 作为 compaction 与 hidden reminder 的唯一计数边界。</td>
        <td>Pi <code>0.81.1</code> 的 native compact 在 RPC stream 中产生 <code>compaction_start</code> / <code>compaction_end</code>，而同一条 custom reminder 会同时出现 <code>message_start</code> / <code>message_end</code>。Telemetry 只在非 aborted、非 retry 且带 summary 的 <code>compaction_end</code> 开启新 cycle（仍兼容 <code>session_compact</code>），并只在完成的 custom message event 记录 reminder，避免漏记 native compaction 或把一次 reminder 重复计数。当 RPC message 本身没有 usage payload 时，reminder details 中 runtime 已计算的 <code>tokens</code> / <code>usagePercent</code> / <code>pressurePercent</code> 作为该周期的 authoritative pressure reading，不得出现“已发 70% reminder 却报告未跨 70%”的自相矛盾。</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>近期评测目标是先跑通 Opus 4.8 与 Sol × 400K/1M 的 2×2 矩阵，四个 cell 均不得含 environment、verifier、judge、provider/run 或 provenance 问题。</td>
        <td>矩阵跑通是为了从真实 Pi session/events/report/telemetry/verdict 中分析 pi-context 产品本身的不足，不是为了修饰分数。每次只运行一个 cell，审计完成并修复通用缺陷后才进入下一个；只有同 commit/seed/model/effort/cap 且唯一变量为 hard context window 的两臂可形成 pair。</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>每个 formal matrix 在创建时固定一份独立配置 snapshot，不得因用户后续修改 live Pi 配置而失效或改变后续 cell。</td>
        <td>Snapshot 仅包含 agents-only task 与 judge 真正使用的 <code>models.json</code>、<code>auth.json</code> 和 global <code>AGENTS.md</code>，存放在 matrix output 的 private <code>.agents-only-source</code> 中；400K/1M 与后续 resume 全部从该 snapshot 构建 harness。用户可自由修改默认模型、provider、thinking、packages 或 live models/auth/AGENTS；已启动 matrix 不重新取样。只有 snapshot 本身漂移才使 provenance 失效，新 matrix 才会采样当时的 live 配置。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Formal checkout 与证据使用持久 private-eval 路径，content-tree fingerprint 仅排除精确 basename <code>.DS_Store</code>。</td>
        <td><code>/private/tmp</code> 会在长跑期间被环境清理，而 macOS Finder metadata 又会在持久 <code>node_modules</code> 内生成 <code>.DS_Store</code>；后者不影响 Pi 执行，却使全树 entry count/hash 漂移。当前规则不使用宽泛 glob，只忽略精确 <code>.DS_Store</code>；任何其他文件、内容、mode 或 symlink 变化仍必须改变 provenance hash。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Integrity guard 区分 shell process-discovery command 与 quoted Python/Node/Bun/Deno heredoc 中的普通标识符。</td>
        <td>Opus pilot 使用 Python <code>Counter</code> 统计 digest topic，<code>dict(top)</code> 中的变量 <code>top</code> 被 shell 级 process-discovery regex 误当成 <code>top</code> 命令。当前 shell header 与 shell heredoc 仍拒绝 <code>env/ps/pgrep/top/lsof</code>；quoted 非 shell interpreter body 不再使用 shell token 匹配，但仍检查 sensitive/whole environment access，并对 Python <code>subprocess</code>/<code>os.system</code>/<code>os.popen</code>、Node/Bun <code>exec</code>/<code>execFile</code>/<code>spawn</code> 与 Deno <code>Deno.Command</code> 的高置信 process-discovery 调用单独拒绝。Lexical gate 仍是 defense-in-depth，kernel tool sandbox 保持 filesystem authoritative boundary。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Flow transition telemetry 的 post sample 必须来自新 cycle 中第一条完成的 assistant <code>message_end</code>。</td>
        <td>最终 2×2 的八次 successful travel 全被旧 collector 记成 pre/post tokens 相等，因为 originating run 的陈旧 <code>turn_end</code> 出现在 boundary 后；Responses compaction 还会先出现 usage-less lifecycle event，导致 post tokens 被记成 0。新规则只接受紧邻新 cycle 中 role=assistant、non-error/non-aborted 的 completed <code>message_end</code>，跳过 originating stale turn、custom reminder、失败 retry 与 message start/update，因此能报告真实 context drop。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>正式 Saffron runner 同时提供 <code>full</code> 与 <code>core-2x2</code> manifest profile。</td>
        <td>用户已把近期目标聚焦到 Opus 4.8 与 Sol × 400K/1M。旧八 cell manifest 即使四个目标 cell 全部完成仍会留下 Opus 4.6/Terra pending，使 artifact 永久显示 partial。<code>core-2x2</code> 只声明四个目标 cell，完成状态与 pair cards 只由该 profile 自己的 cells 决定；<code>full</code> 保留原四模型矩阵。</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>自动 checkpoint 的语义名称必须绑定到调用前最新的 protocol-complete leaf；只有可信 applied ACM receipt elision 可视为安全 normalization。</td>
        <td>最终 2×2 审计发现 16/16 自动 checkpoint 都物理落在 assistant tool-call turn，恢复会合成 42 个虚假 <code>[Interrupted by context travel]</code>；三条矩阵臂的后续 travel 还四次因为上一 applied travel receipt 被当作普通 orphan repair 而丢失新 raw backup。当前实现从 checkpoint assistant batch 之前向前选择最新能原样重建的 prefix，通常是最后一个已完成 tool result；名称继续表达语义状态。孤立 ACM receipt 仅在 packet 中存在唯一完整 message match，且 direct parent summary、entry/origin/target、必需的精确 toolCallId 与 finalized non-error/no-domain-error <code>mutationStatus: applied</code> provenance 全部匹配时安全移除并记录 normalization；同 ID foreign/identical duplicate、untrusted receipt 与任何普通 missing/duplicate/reorder/invalid repair 仍拒绝 raw backup。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Transition telemetry 的 pre/post token sample 只接受相邻 cycle 中正 token 的 assistant <code>message_end</code>。</td>
        <td>新 core-2x2 的两个 Sol session 暴露 compaction 前最后一条 lifecycle reading 可能是 <code>stopReason:length</code> 且 usage=0；旧 collector 因此把实际约 86K/203K 的 pre-context 记为 0，并把压缩误报成扩张。每条 reading/boundary 现记录由 <code>agent_settled</code> 划分的 turn ID；pre 取 boundary 所属 cycle 最后一条正 token、non-error/non-aborted assistant completion，因为 native compaction 可在该 turn settled 后才发事件。Post 才限制在 boundary 同一 settled turn 的下一 cycle内；若第一条 non-error completion 为零 usage则报告 unknown，不跨过 settled/后续用户 phase；custom reminder 同样不算。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>把 transaction backup alias 明确呈现为 raw archive origin，而不是普通 fold/rebase candidate。</td>
        <td>新 Opus 400K session 在 P8 把 <code>evidence-packet-classified</code> raw backup 当 fold base，receipt 显示 115K→301K、messages 43→78、summary depth 1→2；任务仍完成，但这是 anchor-gravity affordance 缺口。Tool schema、canonical guidance 与 advanced target reference 现明确：raw archive alias 只用于 deliberate restore/rehydrate，fold/rebase 必须选择 sediment 之前的 clean ancestor。Timeline 复用 Context Packet 的 trusted ACM transaction collector，只有 canonical/fromHook/full provenance summary 与 unique finalized applied receipt 匹配时才分类 raw；foreign details 不生效。同一 entry 任一 alias 为 raw 时，active/search/tree/checkpoints 都保留节点级 marker，search 优先命中 alias；checkpoint view 额外给出“not a fold/rebase base”说明。Runtime 不硬拒绝，因为合法 rehydrate 本就需要扩大 history。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>把空内容、全零 usage 的 <code>stopReason:length</code> 识别为 provider run error，而不是模型 task failure。</td>
        <td>新 core-2x2 的 Sol 400K/1M 曾被持久化为 task failure，但原始 RPC 事件分别含 4/9 次 <code>content=[]</code>、input/output/cache/reasoning/total 全零且带 responseId 的 length completion；短 <code>directed-checkpoint</code> 复现中一次在首个模型响应发生，一次在成功 checkpoint 后的确认回合发生，证明它不是 Saffron 长任务、16K 正常耗尽或 checkpoint mutation 失败。<code>PiRpcDriver</code> 现在统一拒绝该形态并返回 <code>provider_empty_length_response</code>；long-flow/matrix 分类为 run_error、跳过 verifier/judge，并只允许从 fresh workspace 原样重跑整个 cell。错误携带该 turn 的 raw events，report 在停止前保留 partial tool/assistant evidence，但不执行 after-turn host actions。正常有内容或非零 usage 的 length 仍保留为 outcome-bearing turn。短 directed-checkpoint scorer 还要求 tool result 之后出现可见 checkpoint 确认，避免工具调用成功却缺失交付时误报 PASS。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Flow telemetry 的 active-token 提取（<code>activeTokensFromUsage</code>）必须把首次写入缓存的 prompt（<code>cacheWrite</code>）计入 active context，而不是只算 <code>input + cacheRead</code>。</td>
        <td>SAFFRON smoke（1M 窗口、注入约 235K evidence packet）显示注入包以 cache miss 形式到达：折叠轮 usage 为 <code>{input:2, cacheRead:7692, cacheWrite:332136, output:3409, totalTokens:343239}</code>。旧提取只算 <code>input + cacheRead = 7694</code>，把该轮真实约 340K active prompt 低估成约 7.7K，使遥测把峰值压力报成约 9%（真实约 86% = 343K / 400K working budget），并一度导致误判“包没注入”。修复=求和中加入 <code>cacheWrite</code>（别名 <code>cacheWriteTokens</code>/<code>cacheCreationTokens</code>）。采用该根因修复而非先前 surface 的 <code>usageBeforeTokens</code> 补丁：它可证明正确（<code>2+7692+332136+3409=343239=totalTokens</code>，三项互斥、和即 prompt），对所有高压轮次通用，且仍只用真实 usage 字段、不引入字符估算。新增 flow-telemetry 单测锁定该形态返回 339830。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>解耦“任务正确性”与“ACM 行为评分”：<code>run-flow.mjs</code> 的 judge 门去掉 <code>!verificationFailed</code>，使确定性任务验证失败但 transcript 有效的 run 仍跑 LLM judge 并把 verdict 记入 report；退出码对 <code>verificationFailed</code> 仍为 1。</td>
        <td>SAFFRON smoke（<code>verification_failed</code>、14 次 ACM、真实峰值约 86%）此前被整体跳过 judge，丢掉唯一一次真实高压 ACM 行为的评分。任务失败（exit 1）与 ACM 判断是正交信号，模型榜需要后者即使任务未完成。<code>report.status</code> 仍为 verification_failed → 仍分类 task_failure；<code>aggregate.mjs</code> 只读 <code>report.judge.verdict</code>、不 branch skip-reason，故 verdict 现正常进聚合。commit <code>ac41b712</code>。</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>activation 低压闸门：会话峰值工作预算压力 <strong>&lt; 30%</strong> 时，未使用 ACM 视为合理克制，不得记为 activation 失败（不得 never-activated，activation 不低于 2）。权威峰值由 run-flow 对整条 flow 的原始事件跑 event-based <code>collectFlowTelemetry</code>（<code>peak.pressurePercent</code>）算出，存入 <code>report.telemetry</code> 并经 <code>judgeRun</code> 传入 <code>buildJudgePrompt</code> 闸门。per-phase 压力显示已 deferred（本轮 peak-only）。30% 门限由用户批准。</td>
        <td>两次实现：(1) <code>8babb0f1</code> 首版从 <code>turnRecords.telemetry.before/after.pressurePercent</code> 读峰值——该字段不存在（真实 per-turn 形状是 <code>sessionStats.contextUsage.tokens</code>，且同样漏算 cacheWrite），saffron 峰值被低估成 9.9%，单元 render-check 用手工 fixture 骗过测试但运行时结构不符。(2) <code>a8a8a405</code> 改为 peak-only：run-flow 累积原始事件跑 <code>collectFlowTelemetry</code>（D4 修正、含 cacheWrite）取 <code>peak.pressurePercent</code>，删掉 judge 里坏的 per-turn helper。端到端 smoke 验证：exprlang 峰值 6.5%，judge activation 从 never-activated 翻为 healthy 并明说“6.5% &lt; 30% 合理克制”；saffron 峰值 85.6%（与真实事件重放 85.58% 吻合），activation 3/3。教训：仪器改动必须端到端重跑 smoke，不能只信单元。commit <code>a8a8a405</code>（首版 <code>8babb0f1</code>）。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>证据纪律：每阶段渲染紧凑工具事实汇总（call 数、read/edit、写入文件），rubric 要求任何 data-loss / recoverability / task 受损断言必须对得上该工具记录；无记录支撑的负面断言不得作为扣分依据。</td>
        <td>exprlang smoke 中 judge 幻觉“P3 丢失”，而工具记录并无对应删改。把确定性工具事实喂入语义 judge，落实“确定性优先、LLM 只判语义残差”的仪器设计。与 D1 同一 commit <code>8babb0f1</code>。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Give a mid-sequence checkpoint-rollback failure exactly one full compensation replay before judging the outcome from observed aliases.</td>
        <td>An audit found <code>rollbackCheckpointLabel</code>'s clear-then-replay sequence could stop between <code>appendLabelChange</code> calls, leaving the alias journal partially restored with no recovery attempt. Because the replay converges to <code>priorAliases</code> when every call succeeds, one bounded retry is safe and idempotent; unbounded retries against a failing host were rejected. A compensated retry that verifies clean reports <code>applied</code>; a failed retry stays <code>indeterminate</code> and surfaces both <code>hostError</code> and <code>compensationError</code>, preserving the existing evidence contract.</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>确定性打断器系统：双通道（完整档位提醒留 hidden channel；仪表/burst 以定界后缀追加到普通工具结果）+ 五触发器（仪表 Δ≥8pp、burst ≥8 连读、跨档、新请求、阶段收尾），全部纯句法检测，语义判定留模型。</td>
        <td>用户逐步收敛的决策：（1）「方向被否」无句法代理信号，不做（齐夫长尾留模型自发）；（2）边界 cue 必须对用户零打扰（display:false）且不得每轮必发——最终语义：每周期至多一发，触发即哑火，仅真实 save-point 行动或周期边界重新武装（「提醒不是闹钟贪睡」）；（3）burst 同理收为每 run 至多一发。agent-resolved 细节：「burst 结束后注入」物理不可行（tool_result patch 只能装饰正在定稿的结果），改为阈值穿越就地注入；新请求/阶段收尾共享同一哑火状态（同一「未保护工作」信号的两个出口）；后缀永久沉积在工具结果中是已知交换；阈值（8/8pp/8）是 assay 待测变量。见 AGENTS.md 「确定性打断器」节。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>在 Pi <code>0.81.1</code> 的 awaited <code>session_compact</code> 窄窗口中，修复 automatic overflow retry 的不可续写 assistant 尾部。</td>
        <td>P1 showroom 复现证明：hidden reminder steer 会让窗口边缘 completion 稳定呈现 <code>stopReason=length</code>、output 0；<code>pi-ai</code> 将其判为 overflow 且 <code>willRetry=true</code>，但 host 在 compaction rebuild 后只移除 <code>stopReason=error</code> 的 assistant，随后 <code>agentLoopContinue</code> 抛 <code>Cannot continue from message role: assistant</code>。adapter 只在 host 已决定 retry 且 await handler 的时序中移除 live array 尾部 assistant；session history、tree 与非-retry compaction 均不变，capability unavailable 时提示 resume recovery。端到端 seed 7 / 40K clamp 从稳定 exit 1 变为经过两次 overflow retry 后 exit 0。若 host 修复该 cleanup，应删除 workaround。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Showroom <code>requiredMoves</code> 只以任务结束前是否发生作为 outcome gate；<code>withinToolCalls</code> 与 <code>inTurn</code> 都降为 timing/placement diagnostics，<code>afterReads</code> 仍是语义前缀。</td>
        <td>Haiku 校准中 P2 on 臂在 cue 后较晚 checkpoint、off 臂全程零 ACM，旧 8-call 窗口把真实处理效应误判为 fail；扩容后的 P4 on 臂在新请求前已提前 checkpoint，旧 <code>inTurn: 2</code> 同样把更安全的早响应误判为 fail。新 judge 保留 <code>withinTarget</code> 与 <code>inTargetTurn</code> 事实但不让延迟决定 outcome；不存在 required move 仍 fail。P4/P5 live prompt 均明确逐个 read 12 个普通服务模块，校准达到 P4 on/off 21/19、P5 on/off 13/12 个 turn-1 tool calls；task 文本不暴露 ACM 或触发阈值。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Showroom runner 在进入 arm cwd 之前把 <code>--out</code> 规范化为绝对路径。</td>
        <td><code>run-pair.mjs</code> 会把 <code>PI_CODING_AGENT_DIR</code> 指向 <code>&lt;out&gt;/.harness</code>，随后以 arm 目录作为 Pi cwd。显式传入相对 <code>--out</code> 时，旧实现让该环境变量在 arm cwd 下二次相对解析，导致 harness 中明明存在的模型被报为 <code>Model ... not found</code>；Opus 全量首批五题因此全部是 infrastructure run_error，已作废且不进入 evidence。入口现立即 <code>resolve()</code>，单测锁定参数语义，并用相对 out 的真实 Haiku arm 验证生成的 <code>agentDir</code> 为绝对路径且 completed=true。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>Showroom paired replay 必须把复制后的 session header <code>cwd</code> 重绑定到各 arm 的隔离 workspace；涉及文件修改的 outcome 还必须由 final-workspace assertion 直接判定。</td>
        <td>N1 supplement 暴露旧 runner 虽以 arm workspace 启动 Pi，但复制的 journal header 仍指向 <code>base/workspace</code>：on 实际改写 base，随后 off 从已污染的 base 复制起步；旧 arm 目录分别只有 4/12 与 12/12 个 <code>retryLimit: 3</code>，因此旧 N1 pass/pass 不可采信。<code>run-pair.mjs</code> 现只改复制 session 的 header <code>cwd</code>，保持其余 prefix 不变；judge 对 N1 的 12 个声明文件逐一要求完整配置项 <code>retryLimit: 3,</code>，路径被限制在 arm workspace，声明文件缺失也直接 fail。commit <code>1d429775</code> 的隔离重跑证明 base 保持 4/12，on/off 各自达到 12/12，三份 session cwd 互异，两臂都 completed 且 workspace gate 通过；exact Pi <code>0.81.1</code> host fixture 另行固定 <code>SessionManager.open(path, sessionDir)</code> 在无 override 时采用持久化 header cwd 的 load-bearing 契约。目标保留用户任务声明的 <code>3</code>，不改成初始态从未出现的人工值：初始已有 4/12 正确配置是合法 no-op，assay 应判最终 12/12 的用户 outcome，而不是强迫重写本来正确的文件；其余 8 个非目标初值仍使 cwd 隔离回归稳定失败。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>把 source-selected 的 17 场景 Opus 4.8 merge 作为本轮 showroom 权威校准结果，但不把跨三个 product commit 的拼接伪装成单 commit 因果估计。</td>
        <td>权威 compact artifact 为 <code>eval/evidence/showroom-opus48-calibration-2026-07-25.json</code>，本地展开副本为 <code>eval/.runs/showroom/opus48-authoritative-1d429775/merged-summary.json</code>：未受影响题取 base <code>88f58c62</code>，修复后的 P3/N4/N5 与七个 K 题取 supplement <code>8adacd2e</code>，N1 取隔离重跑 <code>1d429775</code>。17/17 场景、34/34 arms 均 completed、零 run_error；10 个 outcome 中 on=10 pass/0 fail，off=6 pass/4 fail，七个 K 题只作 diagnostics。P4 是 binary ceiling（两臂 pass，但 on 15 tools/turn 1，off 24 tools/turn 2）；K1 在 7→9 reads 显示 treatment burst 边界，K2/K3 受两臂自发 ACM 混淆而不能归因，K4 证明 save-point 会重新武装干预；最终 N1 两臂都正确完成，但 on 62 tools/3 次 travel、off 21 tools/1 次 checkpoint，属于显著 overhead evidence 而非 outcome failure。该单 seed merge 用于校准机制与 judge，不外推为总体效果。</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>评测体系重构五项全做：单 commit 全量编排 → 连续评分向量 → Thrash 自动判据 → 砍 K 系列换难度 → 分档散文降为事实。</td>
        <td>用户对审计提出的五条建议答「全做」，并要求按依赖阶段交付。根因诊断：旧评测的问题不是「LLM 调用太多」（17 题 34 arms 并不多），而是（1）人肉编排产生跳 commit 证据（2）布尔 verdict 在 on 臂 10/10 时失去分辨率。五个原子 commit：<code>cd51cbd7</code>、<code>bdca0f80</code>、<code>de5d36ef</code>、<code>b2af6026</code>、<code>97bdea65</code>。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>全量 sweep 硬拒绝脏工作树，而不是把「commit + 未提交差异」记录为该 commit。</td>
        <td><code>run-all.mjs</code> 的存在理由就是单 commit 因果估计，而脏树使 <code>productCommit</code> 不再描述被测产品。选择硬拒绝而非静默记录；<code>--allow-dirty</code> 仅供本地迭代，但会在 evidence 里置 <code>citable: false</code> 与显式 warning。已验证两个门（脏树、未知场景）均在当前仓库状态下正确报错。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>连续评分向量与 Thrash 判据均为机械量，只报告、不改变 verdict；Thrash 判据放在 run-all（配对层）而非 judge（单臂层）。</td>
        <td>N1 是动机案例（两臂皆 pass，on=62 tools/3 次 travel vs off=21）：过度触发的成本既不应被当作任务失败，也不应只做备注。三个 flag（<code>paired_overhead</code> 比值 ≥ 2、<code>post_fold_reread</code> ≥ 3、<code>repeated_acm_attempts</code>）均需对照臂才有意义，所以必须在配对层计算。两个已知局限：（a）阈值未经分布校准，属 assay 待测变量，与 8/8pp/8 同类；（b）handoff 评分只看七字段的结构存在与 <code>none</code> 实质性，不判断文本质量——故意不引入语义打分。评分向量对 diagnostics 场景也产出，以便 K 题仍能参与 AB。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>新增的三个 hard positive（D1/D2/D3）不以 <code>inTurn</code> 作为裁决依据；K 系列从 7 题砍到 2 题。</td>
        <td>砍 K 的依据来自 2026-07-25 校准自述的失败：K2 高低负载下两臂都行动（无法区分处理），K3 在 7 tools 无臂行动、4 tools 两臂都行动（未夹住边界），K1-7 无臂行动；阈值证据已由 <code>skeleton-params.json</code> 的真实分布（burst P95=8）以近零成本提供。D 系列不用 <code>inTurn</code> 裁决，是因为 commit <code>f1a69c75</code> 已把 placement 降为诊断量（避免把更安全的提前响应误判为 fail）；因此 D 系列的 gate 全部落在 probe/handoff 内容上——只有动作做得差才会摧毁那些信息。场景库 17→15，outcome-bearing 10→13。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>分档提醒保留通道但删除递进散文；三档共用同一段事实文本，70 档不再标 <code>Final reminder</code>。</td>
        <td>审计（<code>docs/acm-guidance-audit.md</code>）已指认 nudge 是事实上的第四个 guidance owner，FM-08 记录了其动作梯度，而 CORE 明确否定「压力即许可」（a preferred outcome, not move authorization）。仪表后缀上线后，分档散文的边际信息量为零，只剩梯度。未选择彻底删除通道：AGENTS.md:212 的强弱分层规则要求弱模型 floor 靠结构面（schema/cue/nudge），删通道会直接抽掉 floor。</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>gate 语义倒置改为新增 <code>outcome_pass_move_missed</code> 词汇，而不是把 required move 全面降为评分量。</td>
        <td>D1/D3 在 probe satisfied 的情况下被判 <code>fail</code>，倒置了 <code>docs/acm-judgment-contract.md</code> 的 gate 顺序（task outcome 先于 ACM diagnostics）。现 outcome 检查（probe/workspace）与 ACM 检查（required/forbidden move、handoff 内容）分两个累加器；任务交付但缺 move 记为 <code>outcome_pass_move_missed</code>，summary 另报 <code>outcomeDelivered</code>。commit <code>1bcfc552</code>。已知代价：verdict 词汇变更，该 commit 之前的 evidence 的 pass/fail 数不再直接可比。</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td><code>post_fold_reread</code> 改为比对被折叠材料的重合度；<code>repeated_acm_attempts</code> 删除。</td>
        <td>2026-07-26 sol-medium sweep 给出判决性证据：13 题中 10 题被 flag，全部是误报。（a）<code>post_fold_reread</code> 只数 fold 后窗口内的读取次数，从不比对读的是什么，于是「fold 完继续干活」与「重读旧料」不可区分——P1 被 flag 时读的是 <code>package.json</code>/<code>Cargo.toml</code>/<code>README.md</code>，与被折叠的日志无关。现记录 fold 前已读 path 集合，只统计重新读到的归档目标，并将 <code>maxReadsAfterFold</code> 单独保留以免 fold 后的正常工作被当作 thrash。（b）<code>repeated_acm_attempts</code> 在 <code>ACM_TRIGGERS_DISABLED</code> 下对照臂 <code>acmCalls</code> 几乎恒为 0，<code>delta.acmCalls ≥ 2</code> 使 N1/N2/N4/P4 仅因「模型真的用了工具」而开火，它测的是产品是否生效而非 thrash，已删。重算两转 sweep：flag 从 10 降到 2（sol P2/D2），且两个幸存者均为真阳性（各自重读了 fold 前已读过的文件）。commit <code>063ae55d</code>。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>强弱两轮 sweep 不重跑模型，只用修复后的 judge/detector 离线重算判决。</td>
        <td>judge 与 detector 都是对 transcript 的纯函数，且 <code>judge.mjs</code> 设计上就保证 re-judging 不重跑模型（commit <code>a80a54d5</code>），所以修完判据后重算既安全又免费，还能直接用真实数据验证误报是否消失（这正是本轮确认 10→2 的手法）。归档于 <code>eval/evidence/showroom-strong-weak-pair-2026-07-26.json</code>（schemaVersion 3，记录 <code>productCommit=9663c5d8</code> 与 <code>rejudgedAt=063ae55d</code> 两个坐标）。结果：sol-medium on 12 pass/1 move_missed/0 fail vs off 9 pass/4 move_missed；dsv4flash-max on 7 pass/3 move_missed/2 fail/1 run_error vs off 6 pass/5 move_missed/2 fail。弱模型 floor 未塔（N1-N5 双臂全 pass），D 系列确实分出强弱（D1/D3 弱模型 move_missed、强模型 pass）。</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>废弃旧 15 场景作为改动正负向的判据，改为先用解析成本模型（<code>eval/cost-model.mjs</code>）算出剧本必须多长才可能显示折叠正向。</td>
        <td>旧场景测的是同义反复：关掉触发器→模型不调工具→判 <code>move_missed</code>→记 on 臂赢；13 个 outcome 场景中 on/off 判决有差异仅 3/13(sol)、2/13(ds)，off 臂 <code>acmCalls=0</code> 占 9/15(sol)、11/15(ds)。更根本的是长度：真实分项单价（<code>~/.pi/agent/models.json</code>，sol input $5/M vs cacheRead $0.5/M；deepseek-v4-flash input $0.14/M vs cacheRead $0.0028/M）使未改动的 prompt 走 cacheRead 近乎免费，而每次 travel 使缓存失效、下次请求整个 prompt 按 input 全价重算。折叠因此是「用一次全量重读换永久更小的 prompt」，两条曲线有可计算的交叉点。实测（C=200K、D=3K/请求、F=15%C）：sol 交叉于第 14 次后续请求、deepseek-v4-flash 交叉于第 59 次；400K 同样交叉于 14（该 shape 下交叉点与上下文规模无关，只取决于折叠留存比与价格结构）。旧场景只有 1–3 轮，全部落在交叉点左侧，因此结构上只可能测到开销。用户据此定剧本长度按 sol 取 20–30 轮：弱模型在该长度上「不折叠」才是正确行为，这反而成为 judge 正确性的检验。commit <code>481e4d25</code>。</td>
      </tr>
      <tr>
        <td>user-decided</td>
        <td>成本模型加入「过早折叠」惩罚项（<code>settledAtRequest</code> + <code>recoveryTokens</code>），第三项因变量取 <code>scoreFoldTiming</code> 的可算偏离量。</td>
        <td>纯计费下最优折叠点恒为第 0 次请求且候选成本严格单调递增（拖延时重读的上下文只会更大），于是模型给出的建议永远是「立刻折叠」，无法区分「及时折叠」与「乱折叠」，与 ACM 语义（须待结论沉淀完毕才能安全折叠）相悖。惩罚项的语义：<code>settledAtRequest</code>(S) 标记结论提取完成的请求序号，在 k&lt;S 折叠时，区间内每个仍需原始材料的请求付一次 <code>recoveryTokens</code> 的 rehydrate，按 input 全价计（recovery 重读的是未缓存前缀）。成本曲线由单调斜坡变为谷底落在 S 的 V 形；同时交叉点被推后（S=8、recovery=60K 时 sol 从第 14 推到第 22 次请求），这是选择 20–30 轮剧本时必须计入的事实。<code>scoreFoldTiming</code> 输出 deviation、excessCost 与 optimal/premature/late/missed/unnecessary 分类；剧本过短以致不该折叠时，「不折叠」记 optimal、deviation=0，因此正确拒绝折叠的弱模型不被惩罚。刻意不为「未恢复的过早折叠」定价 outcome 风险——该项由 outcome 因变量独立承担。commit <code>361e4870</code>。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>长剧本的 <code>settledAtRequest</code> 不再拍值，而是锢在一个可观测产物：第 8 轮写出 <code>ops/reconciliation-plan.md</code>。</td>
        <td>上一条 open 项指出 S 属未校准参数且 <code>scoreFoldTiming</code> 的 optimal 点对它敏感。解法是让剧本自己造出锢点：探索段（1–7 轮）读日志，第 8 轮强制把结论写成磁盘文件，该文件存在与否是二值事实，对所有模型、所有 commit、两个臂完全相同，且语义正确（结论落盘 ⇒ 原始日志成为沉积物，且仍可从文件恢复）。实测确认：deepseek-v4-flash 跑满 30 轮后该文件确实存在且内容含豁免条目。另一条未校准参数 <code>recoveryTokens</code> 的风险同时被消除：单测锁住了它从 20K 到 200K 变化时最优点与 savings 完全不变，它只给「折早了」定价，不参与任何判定基准。commit <code>692fd98a</code>。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>两次低成本冗烟（deepseek，共 $0.08）在上强模型前拦下了一个会污染整轮实验的参数错误，并修正了成本模型的一项假设。</td>
        <td>第一次（3 轮）测到 survey 每轮读 2 个日志时 prompt 每轮涨 <strong>27K</strong>，第 7 轮就会撞破 200K 窗口——在 S 之前触发 native compaction，正是本剧本为避开而建的污染。改为每轮读 1 个日志 + 窗口默认 400K 后，第二次（9 轮）测得 13.4K/轮、S 处 105K。随后跑满 30 轮得到完整曲线：S 处 91.1K、第 30 轮 117.9K，apply 段每轮仅涨 <strong>1.0K</strong>（改三个常量产出的文本就很少），远低于成本模型最初草拟的 3K。关键结构发现：<code>deltaTokens</code> 从 3000 降到 1044，sol 交叉点仍为第 22 次请求不变——每轮增量的 <code>i×D</code> 项对两策略对称，D 只影响绝对金额、不影响交叉位置；交叉点只由折叠留存比、价格结构、S 三者决定。因此「实测 delta 变小会把交叉点推到 30 轮之外」的担心被证伪，30 轮确实落在 sol 交叉点（22）右侧。commit <code>eb8494ad</code>。</td>
      </tr>
      <tr>
        <td>agent-resolved</td>
        <td>弱模型跑满 30 轮全程 <code>acmCalls=0</code>，结算仍判 <code>timing=optimal deviation=0</code>——这是正确行为而非 floor 失败。</td>
        <td>deepseek-v4-flash 自己的交叉点在第 66 次请求（cacheRead 比 input 便宜 50×，折叠的全量重读相对更贵），30 轮剧本对它而言在交叉点左侧，不折叠就是最优策略。这也是上一轮废弃「弱模型先跑验证曲线」计划的原因：弱模型可以验管线正确性与 judge 是否误罚，但无法验证「折叠真的省钱」。弱模型这一轮同时证明了剧本可解：30/30 轮 exit=0、<code>verify.mjs</code> 12 services reconciled、<code>search.poolSize: 40</code> 豁免保住、回归段产出 <code>ops/handover.md</code>，共 $0.0472 / 6m43s。</td>
      </tr>
      <tr>
        <td><span class="label user-decided">user-decided</span></td>
        <td>整体退役跑真实模型的评测装置</td>
        <td>2026-07-27 用户决定：showroom 样板间、longrun 配对、skeleton 骨架提取、cost-model、评测安全件（seatbelt/exclusive-lock/integrity-guard）全部从工作树删除（commit <code>a392f761</code>）。动机：装置维护成本持续超过其信号产出——场景前提反复被校准推翻（D1/D3 窗口假设、P5 cue 时机），且用户判断该迭代流程自己无法持续执行。替代迭代模式：设计讨论 + 用户日常使用体感；deterministic gate（<code>verify:acm</code>）保留为唯一硬性门槛。完整装置与历史证据可经 git tag <code>eval-archive</code>（<code>133ff9b6</code>）恢复；docs 中的 <code>eval/...</code> 证据指针已加归档注。</td>
      </tr>
      <tr>
        <td><span class="label user-decided">user-decided</span></td>
        <td>感知层退役三类措辞 cue，改为常驻双针仪表</td>
        <td>2026-07-27 设计会（宪法第 2 条：感知层=仪表盘，只报数字永不措辞）：删除 read-burst 判断题、run 边界提醒、30/50/70 档位提醒及其持久化 baseline 机制（<code>src/acm-trigger-detector.ts</code>、<code>src/context-usage-nudge.ts</code> 整模块删除）；新增 <code>src/context-gauge.ts</code>（双针仪表 <code>[ctx N% budget · M% window]</code>，里程表节奏=整数位变化即显示）与 <code>src/context-pressure.ts</code>（压力计算平移，无行为变化）。理由：P1 注入即指令——对顺从模型不存在纯事实的措辞，信号要么恒定要么不存在；P2 时机被触发劫持——sol 实验中 burst cue 开火时刻与 premature fold 时刻高度重合。kill switch 从 <code>ACM_TRIGGERS_DISABLED</code> 改为 <code>ACM_GAUGE_DISABLED</code>。</td>
      </tr>
      <tr>
        <td><span class="label user-decided">user-decided</span></td>
        <td>删除 /context TUI 面板</td>
        <td>2026-07-27 用户明确「从来没用过」：删除 <code>src/context.ts</code>、<code>src/utils.ts</code>（其唯一消费者）、两个配套测试与 host-fixture 构建/验证清单条目；<code>pi.extensions</code> 收敛为单入口 <code>./src/index.ts</code>。仓库专注原则：没有不需要存在的东西。</td>
      </tr>
      <tr>
        <td><span class="label user-decided">user-decided</span></td>
        <td>CORE v3 教义重写：提取资格线 + 偏积极的度</td>
        <td>2026-07-27 设计会逐项确认：fold 的 telos 从「清理」翻转为「为前行打包」（用户原话「在合适的时机丢掉一些包袱以方便更高效的继续前行」）；「提取完成」成为折叠资格线（写 handoff 被迫含糊=资格未到），资格线作用于被折叠的那段而非整个任务（用户补充：单次/单轮的无意义路径或高熵信息也可折叠——落为 spent-stretch 条款）；资格线之上偏积极（用户「度」要求：最好效果下尽可能积极使用，遗憾不对称条款「Deferring a fold you have already earned is drag, not caution」）；删除 1/3 预算舒适巡航数字锚点并加负向锁（顺从模型会追数字）；新增「树即答案空间」（重问用户=导航失败）与「边界自认」（cue 已死，边界感是模型职责）；折后信任收敛为有界抽查（bounded spot-check, not a re-derivation）；handoff 存活者人格连续条款（still sound like the same person）。契约文档同步升级 v1；guidance-quality.test.ts 教义锁重写（22→27 test），证据注释改指 eval-archive tag。</td>
      </tr>
      <tr>
        <td><span class="label agent-resolved">agent-resolved</span></td>
        <td>工具面与常驻文本对齐 v1 教义并去重</td>
        <td>travel 描述点名提取资格线与同人格冷启动；travel guideline 从「context hygiene」改为「packs for the road ahead」；七字段描述各携疫苗（state 宣告含糊=资格未到、evidence 授权单次有界抽查、exclusions 存死胡同教训、recover 注明折叠路径一步可达、next 锁即时可执行性）。常驻去重：timeline guideline 换为视图选择导航（原句与 CORE Orient 逐字重复）、travel guideline 删「Read result」句（CORE receipt 段已有）。P5（引导自身征税）的常驻层去重完成。</td>
      </tr>
      <tr>
        <td><span class="label agent-resolved">agent-resolved</span></td>
        <td>测试重塑第一步：删纯字符串镜像测试，补 gauge 行为锁</td>
        <td>用户测试哲学（少而狠的行为契约，不堆 pass 数）落地第一批：删除 <code>test/tool-descriptions.test.ts</code>（6 个测试全部为「源码文本 toContain」形态——锁的是实现字符串不是行为，教义锁已由 guidance-quality 承担）与 <code>test/lib.test.ts</code>（单测试文件，唯一真实行为锁 resolveTargetId off-path 判定并入 <code>travel-target-facts.test.ts</code>）；新增 <code>test/context-gauge.test.ts</code>（3 个测试锁仪表全部用户可见行为：双针/单针渲染与超预算不截断、里程表节奏双向+新周期必显+垃圾读数静默、ACM 豁免与 kill switch）。root 测试 168→165，全部行为承重。</td>
      </tr>
      <tr>
        <td><span class="label agent-resolved">agent-resolved</span></td>
        <td>两轮全仓审计结论与修复</td>
        <td>第一轮（src 逐文件）：lib/handoff/gauge/pressure/tool-protocol/host-bridge/travel-coordinator/三工具/runtime 系无逻辑 bug；travel-tool.ts 的 "unreachable" throw 是刻意的 future-variant 防御守卫（保留）；host-fixture/.acm-build 的 nudge 残留是构建产物（重建即消）。第二轮（test/docs/skills）：删除 docs/acm-redesign-plan.md 与 docs/acm-guidance-audit.md（v0 时代规划/审计快照，大量引用已退役的 eval/nudge/trigger 体系，历史使命完成，git 历史可查）；docs/acm-failure-mechanisms.md 保留为活的失败机制注册表。</td>
      </tr>
      <tr>
        <td><span class="label agent-resolved">agent-resolved</span></td>
        <td>撤销：上游 Pi constrainedSampling 结论对 omp-context 不适用</td>
        <td>上游 pi-context 曾在 Pi 0.82.1 为三个 ACM 工具启用 <code>constrainedSampling: { type: "json_schema", strict: "prefer" }</code>，该决策已在上游撤销：OpenAI strict 要求所有 properties 进 <code>required</code>，而七字段 handoff schema 含 optional 字段，<code>strict:"prefer"</code> 只对模型能力回退、不对 schema 不兼容回退。omp-context 从未使用该 Pi-only 字段：OMP 侧 provider-side strict 由 OMP-native <code>strict: true</code> 表达，宿主的 <code>tryEnforceStrictSchema</code> 会把 optional 属性改写为 nullable-required 后再上线，无法表达时自动降级为非 strict，因此不存在同类 400 风险。此条目替换先前把 Pi 宿主细节写成 omp-context 当前事实的记录。</td>
      </tr>
      <tr>
        <td><span class="label agent-resolved">agent-resolved</span></td>
        <td>修复三处生命周期缺陷并补 OMP-native 模型失效</td>
        <td>2026-07-27 全仓审计确认三个可复现缺陷并修复：(1) <code>travel-tool.ts</code> 在已应用 mutation 之后才建立 refresh ticket，<code>getBranch()</code> 诊断读取抛错会让持久树已 travel 而 runtime 无 ticket（split-brain）——改为 mutation 成功即调度双 ticket，深度读取降级为 warning；(2) <code>session_before_compact</code> 用 <code>findLastMeaningfulEntry()</code> 会把 checkpoint 锚在未闭合的 assistant tool-call 上，恢复时合成假的 <code>[Interrupted by context travel]</code>——改为向后寻找最新 protocol-complete leaf，与显式 <code>acm_checkpoint</code> 同一算法；(3) OMP 没有 Pi 的 <code>model_select</code> 事件，cached provider usage 会在换模型后继续以旧窗口报告压力——cached usage 现携带 <code>provider/id</code> 身份，gauge、<code>turn_end</code> 与 timeline HUD 读取前经 <code>syncUsageModel()</code> 失效。另外 <code>acm_checkpoint</code> 补 <code>concurrency: "exclusive"</code>：它同样通过 label journal 修改 session tree，OMP 默认 <code>shared</code> 会允许兄弟工具与该 mutation 交错。</td>
      </tr>
      <tr>
        <td><span class="label user-decided">user-decided</span></td>
        <td>README 重写为人话版，v0 文档退役</td>
        <td>2026-07-27 用户要求「不要那么多术语，让人简单清楚看明白；文档注重质量而不是数量」。README 从 200 行术语密文重写为 ~100 行人话版（一句话定位「让 Pi agent 自己整理自己的记忆」、compaction=有损压缩 vs pi-context=可逆收纳的对比、交接单人话解释、七字段例子保留）；travel 事务的维护者细节已在 AGENTS.md「Post-mutation persistent observation」段有完整归宿，README 不再重复。docs/ 收敛为两份：acm-judgment-contract.md（判断语义正典 v1）+ acm-failure-mechanisms.md（活的失败机制注册表）。</td>
      </tr>
    </tbody>
  </table>
  <h2>Future evidence and conditional decisions</h2>
  <ul>
    <li><strong>open:</strong> 三个原先的 open 问题已由 2026-07-26 强弱双轮回答（量程部分成功、两个 thrash 判据不合格已修、弱模型 floor 未塔），但两轮 sweep 跑的是 <code>9663c5d8</code>，不含后续的 P5 第二阶段修复（<code>ab08a5f1</code>）、gate 语义修复（<code>1bcfc552</code>）与判据修复（<code>063ae55d</code>）。当前 evidence 的 verdict 与 flag 是离线重算而非原生产出，因此 P5 双臂 <code>move_missed</code> 仍属结构性伪信号。用当前 HEAD 跑一轮干净基线仍是待做项（用户本轮选择暂不重跑）。</li>
    <li><strong>open:</strong> 弱模型的 ceiling 问题未解：<code>firstAcmCallIndex</code> 反复落在最后一次工具调用（N1=32/33、N2=13/14、N4=15/16、P4=23/24、K1-9=9/10）——干完活收尾补一个 checkpoint 交差，响应了 cue 但没用在能改变注意力的位置。这是结构面问题（何时发 cue）而非散文问题。</li>
    <li><strong>open:</strong> 已确诊但未修的三条 gate 缺陷（用户本轮选择先看强模型轮）：D3 required move 的条件依赖（需拆两题）、任务本体失败与 ACM 失败混淆的隔离（弱模型 P1 双臂 <code>toolCalls=1</code> 就交差，现已正确记为 <code>fail</code> 但未单独分类）、单臂 <code>run_error</code> 污染配对统计（弱模型 P3 on=run_error 仍计入 on 统计）。</li>
    <li><strong>open:</strong> 交叉点与最优点仍依赖一个未校准量：折叠后保留比 15%（<code>foldedTokens = 0.15 × contextTokens</code>）。S 已由可观测产物锢定、<code>recoveryTokens</code> 已证不影响判定基准，但保留比直接决定交叉点位置。它应由真实 travel 后的观测 prompt 规模标定；强模型配对跑一旦产生真实折叠，就应用它的 fold 后 prompt 回填该参数并重算交叉点。</li>
    <li><strong>open:</strong> 30 轮在 sol 上的理论收益仅 $0.36（约占 30 轮总额 12%），信号存在但不厚，可被 on 臂额外工具调用的 output 成本吞掉。若需更厚信号需延至 40–45 轮（N=40 省 $0.79、N=60 省 $1.65），代价是强模型成本与时长同比例上升。先跑 30 轮的理由：它先回答「真实模型会不会在 S 附近折叠、outcome 是否仍达成」；若模型根本不折叠或折错时机，延长剧本也救不了，问题在产品侧。</li>
    <li><strong>open:</strong> 成本模型只考虑「至多折叠一次」。真实长剧本可能多次折叠（rebase 会叠加 summary 层），多折叠策略的最优时机序列尚未建模；20–30 轮剧本若出现两次以上 travel，第三项因变量需要扩展而非直接套用。</li>
    <li><strong>future evidence:</strong> Continue measuring spontaneous production Skill invocation and post-travel continuation rates beyond controlled analogues; availability, exact-pointer delivery, a healthy production-like flow and one same-commit raw-control pair are now recorded.</li>
    <li><strong>conditional user decision:</strong> If registry publication becomes desirable, choose a scoped or renamed npm identity for this fork; the current unscoped package remains private and GitHub-only.</li>
  </ul>
  <p>If Pi later exposes an official tool-context interface that atomically navigates the session tree and synchronizes live agent messages, replace and remove the capability-probed AgentSession adapter rather than maintaining both paths.</p>
</body>
</html>