diff --git a/.github/required-ci-ruleset.json b/.github/required-ci-ruleset.json
new file mode 100644
index 00000000..8ff7b5cb
--- /dev/null
+++ b/.github/required-ci-ruleset.json
@@ -0,0 +1,33 @@
+{
+  "name": "Require validated pull requests",
+  "target": "branch",
+  "enforcement": "active",
+  "bypass_actors": [],
+  "conditions": {
+    "ref_name": {
+      "include": ["refs/heads/main", "refs/heads/0.3.2", "refs/heads/release/0.4.0"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    {
+      "type": "pull_request",
+      "parameters": {
+        "dismiss_stale_reviews_on_push": false,
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_approving_review_count": 0,
+        "required_review_thread_resolution": false
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "required_status_checks": [{ "context": "CI required", "integration_id": 15368 }],
+        "strict_required_status_checks_policy": true,
+        "do_not_enforce_on_create": false
+      }
+    },
+    { "type": "non_fast_forward" }
+  ]
+}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 016df8d4..f6bfb6b3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,11 +6,9 @@ on:
   # staging branch before the final release PR.
   push:
     branches: [main, 0.3.2, release/0.4.0]
-  # And a pull request has to show its result before it is merged, not after. GitHub reads this
-  # file from the pull request's own head, so listing the release branch here is what makes a
-  # pull request against a release branch run the gate at all.
+  # Every PR needs evidence, including stacked changes targeting a feature branch.
+  # No target-branch or path filter: an omitted run cannot satisfy CI required.
   pull_request:
-    branches: [main, 0.3.2, release/0.4.0]
   # A merge queue builds the queued commits before they reach `main`, and it only accepts a group
   # whose required checks passed there. Without this trigger the workflow simply never runs for a
   # queued group, so enabling a merge queue would silently un-gate every merge.
@@ -37,8 +35,8 @@ concurrency:
   # because a half-built release branch is worse than a queued one.
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
-  # The POSIX legs are the gate: a red Linux or macOS run fails `ci-required` and blocks the merge.
-  # Windows is split into its own, non-blocking job directly below (#316).
+  # The blocking POSIX legs are Linux x64 and macOS arm64: a red one fails `ci-required`.
+  # macOS Intel and Windows are separate non-blocking signals below (#316).
   validate-posix:
     strategy:
       fail-fast: false
@@ -103,6 +101,56 @@ jobs:
           if-no-files-found: error
           retention-days: 7
 
+  # macOS Intel is a signal, not a gate: this leg measured 318 s on the PR run that added
+  # it, past the approved ">300 s -> non-blocking" line (#316). It still runs on every push,
+  # pull request and merge group, and uploads the darwin-x64 artifact for the release job.
+  validate-macos-intel:
+    runs-on: macos-15-intel
+    continue-on-error: true
+    timeout-minutes: 35
+    env:
+      CARGO_BUILD_JOBS: '3'
+      DSH_OPS_SUITE_TIMEOUT_MS: '300000'
+      DSH_OPS_RETRY_TIMEOUTS: '1'
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # The provenance regression verifies exact blobs from the pinned 0.3.1 commit.
+          fetch-depth: 0
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '24'
+      - name: Verify runner identity
+        run: node -e "if(process.platform+'-'+process.arch!=='darwin-x64')throw Error('Unexpected runner'); console.log(process.platform,process.arch)"
+      - name: Set up pinned Rust
+        shell: bash
+        run: rustup toolchain install 1.97.1 --profile minimal && rustup default 1.97.1
+      - name: Reuse exact locked Rust build cache
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            native/target
+          key: ops-031-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('native/Cargo.lock') }}
+          restore-keys: ops-031-${{ runner.os }}-${{ runner.arch }}-
+      - name: Install locked dependencies
+        run: npm ci --ignore-scripts --registry=https://registry.npmjs.org
+      - name: Functional gate (skips, suite inventory, packed artifact)
+        shell: bash
+        run: node scripts/verify-gate.mjs --skip-install
+      - name: Verify native staged closure
+        run: node bin/native-runtime.mjs check --platform darwin-x64
+      - name: Check shell payload platform filtering
+        shell: bash
+        run: node -e "const fs=require('fs');if(process.platform!=='win32'){for(const n of ['bash','pwsh'])if(fs.existsSync('node_modules/@dsh-ops/'+n+'-win32-x64'))throw Error('Windows shell installed on POSIX')}"
+      - uses: actions/upload-artifact@v7
+        with:
+          name: native-darwin-x64
+          path: runtime/darwin-x64/
+          if-no-files-found: error
+          retention-days: 7
+
   # Windows still runs on every push, pull request and merge group — it is never skipped — but its
   # result is a **signal, not a gate**. The job is `continue-on-error: true`, and `ci-required` does
   # not list it in `needs`, so the aggregate neither waits for it nor fails with it. That is what
@@ -238,8 +286,9 @@ jobs:
           retention-days: 7
 
   # The bench smoke: `workflow_dispatch` only, off by default, and informational (like `tools-trial`
-  # above). One platform is enough, because it exercises the harness rather than the platform — the
-  # `validate-posix` matrix is the gate and `validate-windows` its non-blocking counterpart. Both
+  # above). Three host platforms exercise the portable harness; the
+  # `validate-posix` matrix is the gate, with `validate-windows` and `validate-macos-intel` as
+  # non-blocking counterparts. Both
   # sides are the *same* staged worker, so the run
   # proves only what a harness self-check can prove: the corpus builds and is removed, the worker
   # answers identically twice, and every query lands on `MATCH` or a declared `EXPECTED_*`. It cannot
@@ -248,7 +297,20 @@ jobs:
   # **never** run in CI.
   bench-smoke:
     if: ${{ github.event_name == 'workflow_dispatch' && inputs.bench }}
-    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-24.04
+            target: linux-x64
+            worker: dsh-ops-worker
+          - os: windows-latest
+            target: win32-x64
+            worker: dsh-ops-worker.exe
+          - os: macos-latest
+            target: darwin-arm64
+            worker: dsh-ops-worker
+    runs-on: ${{ matrix.os }}
     continue-on-error: true
     timeout-minutes: 30
     env:
@@ -293,7 +355,7 @@ jobs:
       - name: Tool-level comparison, one binary on both sides
         shell: bash
         run: |
-          worker="runtime/linux-x64/dsh-ops-worker"
+          worker="runtime/${{ matrix.target }}/${{ matrix.worker }}"
           mkdir -p bench/runs/smoke/fixtures
           node bench/cli.mjs tools \
             --baseline "$worker" --candidate "$worker" \
@@ -309,7 +371,7 @@ jobs:
       - uses: actions/upload-artifact@v7
         if: always()
         with:
-          name: bench-smoke-report
+          name: bench-smoke-${{ matrix.target }}-report
           path: |
             bench/runs/smoke/**
             bench/runs/*/run.json
@@ -383,7 +445,8 @@ jobs:
   # names in sync — and silently losing the gate when a runner label changes. This job collapses them.
   #
   # It waits **only** on blocking jobs. Every `continue-on-error: true` job — `validate-windows`,
-  # `tools-trial`, `bench-smoke` — is deliberately absent from `needs` and from the loop below:
+  # `validate-macos-intel`, `tools-trial`, `bench-smoke` — is deliberately absent from `needs` and
+  # from the loop below:
   # listing one here would keep the required check pending until that job finished, which is a gate
   # in everything but name. `scripts/check-workflows.mjs` enforces both halves of that rule.
   ci-required:
@@ -410,7 +473,7 @@ jobs:
           done
           # Not in `needs` on purpose: this check must never wait for them, so their result is not
           # available here. Read them on their own jobs; a red one is a signal, not a merge blocker.
-          echo "validate-windows, tools-trial, bench-smoke: non-blocking (continue-on-error), not waited on by this check"
+          echo "validate-windows, validate-macos-intel, tools-trial, bench-smoke: non-blocking (continue-on-error), not waited on by this check"
           if [ "$failed" != 0 ]; then
             echo "::error::a blocking job did not succeed; read the failing job above"
             exit 1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 92c486af..81787446 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,8 +26,8 @@ name: Release
 # checksum manifest (docs/PROVENANCE.md), not a second, unmaintained mechanism, and an
 # attestation would need `id-token: write` / `attestations: write` on the repository.
 #
-# SCOPE: exactly the three declared targets in lib/ptc/runtime.js — win32-x64,
-# linux-x64, darwin-arm64. Intel macOS, Windows arm64 and Linux arm64 are outside the
+# SCOPE: exactly the four declared targets in lib/ptc/runtime.js — win32-x64,
+# linux-x64, darwin-arm64 and darwin-x64. Windows arm64 and Linux arm64 are outside the
 # matrix; `bin/native-runtime.mjs` refuses them, and `bin/check-release.mjs` fails the
 # run if any other target appears under `runtime/`.
 on:
@@ -57,6 +57,7 @@ jobs:
           - { runner: windows-latest, target: win32-x64, triple: x86_64-pc-windows-msvc }
           - { runner: ubuntu-24.04, target: linux-x64, triple: x86_64-unknown-linux-gnu }
           - { runner: macos-latest, target: darwin-arm64, triple: aarch64-apple-darwin }
+          - { runner: macos-15-intel, target: darwin-x64, triple: x86_64-apple-darwin }
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 45
     env:
@@ -166,6 +167,11 @@ jobs:
           name: native-darwin-arm64
           path: runtime/darwin-arm64
 
+      - uses: actions/download-artifact@v8
+        with:
+          name: native-darwin-x64
+          path: runtime/darwin-x64
+
       - name: Prepare the host worker for functional suites
         # Boundary suites intentionally resolve their checkout-local host build.
         # This build is test-only; the staged release runtimes remain the cold matrix artifacts.
@@ -184,7 +190,7 @@ jobs:
         # Publishing must not start before this step is green — it is the only reason
         # the `publish` job sits behind `needs`. `verify:release` is
         # `validate-manifest` + the full repository suite + `bin/check-release.mjs`,
-        # which demands all three declared targets, matches every receipt hash against
+        # which demands all four declared targets, matches every receipt hash against
         # the staged bytes, and re-checks the Windows IPC binary and source digests.
         # A partial download, a foreign-architecture binary, a stale receipt or a
         # manifest/target disagreement fails here instead of shipping.
diff --git a/README.en.md b/README.en.md
index 0123cde1..2a41ea39 100644
--- a/README.en.md
+++ b/README.en.md
@@ -25,6 +25,9 @@ OPS adds bounded file and document tools to DSH. Native mode returns compact, li
 PTC code receives typed Outcome values from the same one-shot Rust worker. Host integration is
 strict TypeScript, compiled to the existing JavaScript package paths.
 
+Supported: Windows x64, Linux x64, and macOS 13+ on Apple Silicon or Intel
+(`darwin-arm64`, `darwin-x64`). See [macOS](docs/macos.md).
+
 > [!IMPORTANT]
 > This branch is the **0.4.0 release candidate**, not a published release. Approved acceptance requires
 > at least 40% less BM-01 output than OPS 0.3.x; the official reader is a separate comparison.
@@ -97,6 +100,10 @@ A regular DSH CLI cannot manage the reserved `desktop` profile; do not confuse i
 
 #### Update
 
+Host compatibility is declared for DSH **0.2.0-rc.2 and 0.2.1-rc.2**. See
+[host versions and display metadata](docs/usage.md#host-compatibility-and-display-metadata)
+for component icon exports, profile refresh and config/schema checks.
+
 Re-run the same `npx --yes dsh-ops@latest install --profile ...`, or use the official CLI `add dsh-ops@latest`. Reload when the app asks; restart the app when replacing code that is already loaded.
 
 #### Uninstall and status
@@ -166,4 +173,4 @@ Versions before 0.3.2 bundled and distributed [yc-duan](https://github.com/yc-du
 
 ## Star trend
 
-[![Star trend chart](https://api.star-history.com/svg?repos=T-Auto/dsh-ops&type=Date)](https://star-history.com/#T-Auto/dsh-ops&Date)
\ No newline at end of file
+[![Star trend chart](https://api.star-history.com/svg?repos=T-Auto/dsh-ops&type=Date)](https://star-history.com/#T-Auto/dsh-ops&Date)
diff --git a/README.md b/README.md
index ad77e185..ccf70dc3 100644
--- a/README.md
+++ b/README.md
@@ -75,6 +75,10 @@ dsh plugin --profile dsh-tui add dsh-ops
 
 #### 更新方法
 
+宿主兼容范围明确声明为 DSH **0.2.0-rc.2 与 0.2.1-rc.2**。
+组件图标导出、profile 刷新及配置/schema 检查见
+[宿主兼容范围与展示元数据](docs/使用指南.md#宿主兼容范围与展示元数据)。
+
 重新运行相同的 `npx --yes dsh-ops@latest install --profile ...`，或用官方 CLI `add dsh-ops@latest`。按应用提示重载；替换已加载代码时重启应用。
 
 #### 卸载与查看状态
diff --git a/README.zh.md b/README.zh.md
index 1e8bfa6e..7eb4fe02 100644
--- a/README.zh.md
+++ b/README.zh.md
@@ -23,6 +23,8 @@
 
 OPS 为 DSH 增加有界文件与文档工具。Native 模式返回紧凑、带行号的文本；PTC 代码从同一个按调用启动的 Rust worker 获取类型化 Outcome。宿主集成使用严格 TypeScript，编译后保持已有 JavaScript 包路径。
 
+支持：Windows x64、Linux x64，以及 macOS 13+ 的 Apple Silicon 与 Intel（`darwin-arm64`、`darwin-x64`）。见 [macOS](docs/macos.zh.md)。
+
 > [!IMPORTANT]
 > 本分支是 **0.4.0 发布候选**，尚未发布。已批准的验收范围为：BM-01 相比 OPS 0.3.x 输出减少至少 40%，官方读取另列对照；BM-03 对文件/发现 schema 执行 400 token 上限，同时保留 Bash 启动常驻并单列完整总数。最终实测证据与功能 CI 缺一不可。
 > 详情见[发布状态与限制](docs/0.4.0发布候选.md)。下方 `@latest` 命令安装已发布版本；评估候选版本需自行构建本检出目录并打包。
@@ -77,6 +79,10 @@ dsh plugin --profile dsh-tui add dsh-ops
 
 #### 更新方法
 
+宿主兼容范围明确声明为 DSH **0.2.0-rc.2 与 0.2.1-rc.2**。
+组件图标导出、profile 刷新及配置/schema 检查见
+[宿主兼容范围与展示元数据](docs/使用指南.md#宿主兼容范围与展示元数据)。
+
 重新运行相同的 `npx --yes dsh-ops@latest install --profile ...`，或用官方 CLI `add dsh-ops@latest`。按应用提示重载；替换已加载代码时重启应用。
 
 #### 卸载与查看状态
diff --git a/bench/README.md b/bench/README.md
index 1718ae85..1db50ff4 100644
--- a/bench/README.md
+++ b/bench/README.md
@@ -1,262 +1,104 @@
-# bench
+# Benchmark Manual
 
-轻量、零依赖、自包含的测量工装:一套入口、两种测量模式、一份数据契约。它**只在仓库里跑** —— 不随
-npm 包发布、不参与构建、不进 `verify:release` / `release.yml`,也从不成为默认门禁(设计议题 #205)。
+## 测试前的准备
 
-本套收编了两份来源:**#103(@OldLigant)** 的无模型工具级确定性对比,和 **#183(@Richeir)** 的模型
-驱动 token A/B 骨架;口径对齐 **#173** 的意图 —— 本地性能测量只作人类证据,不进 CI。归属记录见
-`docs/CHANGELOG.md`。
+Linux / macOS：使用当前平台构建的 worker；`setup --dry-run` 会说明跳过 Windows PowerShell pin、PSModulePath、Windows Bash IPC 和随包 Windows shell 检查的原因。当前 shell 行已支持各平台，不要再从早期 Windows-only 默认值推断配置。模型 sweep 仍需自己的 OpenAI 兼容服务与凭据；`tools` 自检不调用模型。
 
-## 三种入口形态
+Linux / macOS: build the worker for the current host. `setup --dry-run` explains skipped Windows-only checks. `ab`, `compare`/`report`, `panel` and `tools` use the same entry point on every platform. A model sweep needs your own OpenAI-compatible endpoint; the tools self-check needs no model. Every sweep now fingerprints the composed profiles even without `--seal`, recording platform and component configuration in the arm summaries. `enabled` is a configuration fact, not proof of tool readiness; unresolved expressions remain `unknown`.
 
-| 形态 | 命令 | 用途 |
-| --- | --- | --- |
-| 唯一跨平台入口 | `node bench/cli.mjs <command>` | 全部子命令: `setup \| ab \| report \| panel \| tools` |
-| npm scripts | `npm run bench:ab` 等 | 日常使用;装包后 `bench/` 不存在,脚本给出明确报错而不是 ENOENT |
-| 底层单脚本 | `node bench/setup.mjs` / `bench/compare.mjs` / `bench/report/panel.mjs` / `bench/tools/index.mjs` | 排障与单步重跑;`ab` 只是按顺序把 runner 与 compare 连起来 |
+`compare` 默认拒绝不同平台（或已知/未知平台）混配，退出码为 2；诊断时可加 `--allow-cross-platform`，报告会明确标记差异不是插件效应。旧数据两侧都缺平台时仍可读取，显示 `unknown`，不能据此声称同平台。CI 的可选 tools-only smoke 覆盖 Linux / Windows / macOS，各自上传 artifact；不运行模型 sweep，不产出跨平台结论。
 
-`node bench/cli.mjs --help` 列出全部子命令,`<command> --help` 给出该命令自己的旗标。任何路径都从
-模块位置解析(在哪个工作目录下调用都一样),且**不经过 shell** —— `.cmd`/`.ps1` shim 无法被 Node 管道,
-而 shell 会重新解释每个参数。
+`compare` rejects mismatched platforms with exit 2. `--allow-cross-platform` is an explicit diagnostic override and adds a “not a plugin effect” warning. Both-unknown legacy archives remain readable. The optional, non-blocking tools smoke runs on Linux, Windows and macOS with separate artifacts.
 
-## 退出码
+```console
+npm ci --ignore-scripts
+npm run build && npm run build:ptc     # lib/ + 原生 worker
+```
 
-| 码 | 含义 |
-| --- | --- |
-| `0` | 正常;或一个**弃权**的成本门(噪声底未知 ⇒ 不读方向) |
-| `1` | 失败:`report` 的判决门失败 · `tools` 出现被接受状态之外的项 · `setup` 的某个检查或步骤失败 |
-| `2` | 用法/输入错误:未知命令、未知旗标、缺值、越界参数;装包后缺 `bench/` 也走这里 |
-| `3` | **已声明但尚未接线**:目标文件不存在,或存在但没导出 `main(argv, io)` —— 打印所属切片与目标路径,绝不静默成功 |
+### 再准备 dsh + 两个 profile
 
-`report`(以及 `ab` 的最后一步)的退出码**就是裁决**:`1` 表示门禁失败;一个没能跑起来的成本门
-(噪声底未知等)弃权并退 `0`。
+```console
+npm i -g @deepseek-ai/dsh
+node bench/cli.mjs setup              # 会自动添加 2 个 headless profile（base、dsh），然后在 dsh 上面安装本地代码 build 出来的插件
+```
 
-## 两种测量模式(以及各自不该断言什么)
+### 配 LLM 链接
 
-| 模式 | 入口 | 用模型 | 断言什么 | 不该断言什么 |
-| --- | --- | --- | --- | --- |
-| 成本 A/B | `bench ab` → `bench report` | 是 | **通过率先行**(任一任务 ✅→❌ 就是回归);只有**两侧都通过**的配对参与成本统计;方向必须超过 A/A 噪声底 | 时间;落在噪声带内的 Δ;没有噪声底时的任何方向 |
-| 工具级确定性对比 | `bench tools` | 否 | 只有 `MATCH / EXPECTED_DIFFERENCE / EXPECTED_REJECTION` 算通过,其余状态(含 `MISMATCH` / `UNSTABLE`)都退 `1` | 时间;同二进制两侧的"提速";任何性能结论 |
-| 本地性能(#173 的意图) | 各命令打印的 median | 否 | **什么都不裁决** —— median 只作人类证据 | 进 CI、进门禁、进任何性能回归判定 |
-
-三者共同的一条:**永不裁决时间**。
+跑 `node bench/cli.mjs setup` 会在自动创建；也可以手动创建（会覆盖已有的）：
 
-### 成本 A/B 的口径
+```console
+cp bench/llm.patch.example.yml bench/llm.patch.yml           # bash
+```
 
-1. **通过率先行**:`--fail-on both`(默认)先判通过率,任一任务从 ✅ 变 ❌ 即失败;`--fail-on pass-drop`
-   只判通过率,`regression` 只判 token,`none` 只出报告;
-2. **配对**:按 `task × repeat` 配对;`--regression-scope task|total|both` 决定 token 回归判每个任务、
-   判总量还是两者都判;`--tolerance-pct N`(默认 `2`)是回归容忍带;
-3. **只有两侧都通过的配对参与成本统计** —— 一侧失败的配对连 token 一起被排除,并在报告里单列;
-4. **A/A 噪声底**:没有噪声底时,所有成本方向弃权(`noise-floor-unknown`),报告只给测到的 Δ。
+填 `bench/llm.patch.yml`：
 
-### 工具级确定性对比的口径
+- `baseURL`：服务器地址，如 `https://host/v1`
+- `<model-id>` ：模型 id，两处必须一致
+- `apiKeyEnv`：放密钥的环境变量名，如 `BENCH_SERVER_API_KEY`
+- `contextWindow` / `maxTokens`：模型真实窗口 / 单次输出上限（默认最大 256K 上下文，单次最大 32K 输出）
 
-- `tools/measure.mjs` 的 `compare()` **判断顺序本身就是语义**:`TIMEOUT → ERROR → UNSTABLE →
-  (!sameAsBaseline ? (expectedDifference ? EXPECTED_DIFFERENCE : MISMATCH)) → expectedError 命中 ?
-  EXPECTED_REJECTION → (!eligible ? WORKER_ERROR) → MATCH`。其中"两侧返回同一个 error 信封"若不在
-  任务里显式声明为 `expectedError`,必须落 `WORKER_ERROR`,**不能**当成 `MATCH`(否则一次崩溃会被报告成提速);
-- `speedup` 只在 `MATCH` 且 candidate median > 0 时才有意义;任一轮超时或不稳定,整项不给方向;
-- 夹具在**计时之外**用 `mkdtemp` 生成,跑完删除;删除**之前**先整树盘点,遇到不是自己创建的内容就报错并保留现场;
-- 报告**独占创建**(`flag: 'wx'`):重跑不覆盖上一次的证据,而是退 `1` 并提示 `Refusing to overwrite`;
-- 每次调用都显式带 `outputMode`(native 默认是 content):省略参数两侧就不可比。
+密钥只放在 `~/.dsh/.credentials.yaml` 的 `ref` 节点下面的环境变量里面，这样避免出现在项目源文件、对话的上下文
 
-## 子命令
+## 怎么跑全量
 
-| 子命令 | 目标 | 做什么 |
-| --- | --- | --- |
-| `setup` | `bench/setup.mjs` | 自检 + 幂等准备两侧 profile(`bench-base` / `bench-ops`),打印跑 sweep 的那一条命令 |
-| `ab` | `bench/run.mjs` → `bench/compare.mjs` | 先基线、再候选、再比较,三步共用**一个** `bench/runs/benchmark-test-NN` 组目录 |
-| `report` | `bench/compare.mjs` | 从已封存的 `run.json` 渲染报告(`DSH-OPS Benchmark Report <UTC>.md`) |
-| `panel` | `bench/report/panel.mjs` | 生成/打开一个只读 `run.json` 的 `panel.html` |
-| `tools` | `bench/tools/index.mjs` | 无模型的工具级确定性对比 |
+```console
+node bench/cli.mjs ab
+```
 
-### `setup`
+## 怎么跑单个 task
 
-`--base-profile` / `--cand-profile` / `--template`(默认 `headless`),`--pin-shell <path>` / `--no-pin`,
-`--permission-mode <mode>` / `--no-permission-mode`(`danger-full-access`(默认)/ `workspace-write` /
-`read-only` / `none`),`--plugin <spec>`(`local` 默认装本 checkout 的本地构建 / npm spec / `none`),
-`--reinstall`,`--dsh-home <dir>`,`--dsh <path>`,`--force`,`--dry-run`,`--no-build-check`。
+```console
+node bench/cli.mjs ab --task csv-sum
+```
 
-顺序是故意的:先跑 preflight(权限组合、`PSModulePath`、本地构建),**检查失败就在碰 profile 之前拒绝**;
-一套配置一旦会被写成"量的是权限模式"或"跑的是旧构建",改 profile 也修不好,只会在下一次运行里让报错更难读。
-`--dry-run` 打印每一步写入与命令,什么也不改。
+## 结果在哪看
 
-`setup` 会把 `bench/llm.patch.example.yml` 复制成 `bench/llm.patch.yml`(仅当后者不存在),之后的每次 dsh
-调用都以 `--patch` 带上它;把服务器、模型 id 与 `apiKeyEnv` 填进副本即可,**密钥只放环境变量或
-`~/.dsh/.credentials.yaml`,绝不写进这个文件**。副本是操作员的,存在就一字不改。
-
-### `ab`
+- 在 bench/runs 文件夹里面可以看到
+- 文件夹名称格式为 `benchmark-YYYY-MM-DD-NN`（按当天日期编号，从 `-00` 起）
+- 跑完自动在组目录写 `DSH-OPS Benchmark Report <UTC>.md`
 
-`--task <id>`(可重复)、`--repeat <N>`、`--folder <name>`、`--base <label>` / `--cand <label>`
-(默认 `bench-base` / `bench-ops`)、`--show`,其余旗标原样交给 runner。
+## 成本 A/B 的条件 / A/B measurement conditions
 
-每次 dsh 调用默认带上 `bench/llm.patch.yml`:换文件用 `--llm-patch <path>`,确实不要 overlay(两侧各跑
-各自 profile 自带的路由)用 `--no-llm-patch`,sweep 会把"两侧不共享任何路由"这句说出口。默认 overlay
-不存在、又没给 `--no-llm-patch` 时,runner 在 spawn 之前退 `2` 并点名文件和两条出路 —— 静默换一条路由
-开跑的代价是:两臂一模一样,报告里根本看不出来。默认 overlay 是隐式选中的,所以归档的 `argv` 会把
-`--llm-patch <path>` 补进去,免得一份说不清走了哪条路由的 summary 被当成证据。
+```console
+node bench/cli.mjs ab --model DeepSeek-V4.1-Flash --reasoning-effort high --seal
+node bench/cli.mjs ab --model model-a --model model-b --reasoning-effort low --reasoning-effort high --seal
+node bench/cli.mjs report --matrix bench/runs/benchmark-YYYY-MM-DD-NN
+```
 
-`--show` 打印将执行的三条命令并立刻退出(纯函数,不写任何东西、不跑任何会话)。组号在这里**只分配一次**:
-如果每侧各自按时间戳分配目录,两侧会落进不同的组,最后什么都配对不上。
+`--model` 会真实改变两臂路由；`--reasoning-effort` 只接受 `off|low|high|max`。Provider 默认取 LLM overlay 中的字面值，也可用 `--provider` 指定；请先在 overlay/provider 配置中声明要测试的模型。条件补丁作为最后一个 `--patch` 同时传入两臂，不修改原来的 `llm.patch.yml`。每臂保留实际 `dump-config.txt`，`--seal` 将同源 `{provider, model, reasoningEffort}` 写入 `run.json` 的 `meta.condition`。未指定思考等级且 overlay 也没有该值时，记录 `null`（宿主默认值未固定）。
 
-### `report`
+重复的模型与档位形成笛卡尔积，每个条件位于独立的 `condition-NNN` 目录；根目录的 `matrix.json` 指向各组证据。多组报告逐条件展示，**跨条件不可比，不合并 Δ**。不同条件（含已知与未知）交给 compare 会退 `2` 并列出两侧条件。不传这些旗标时仍使用原有 overlay，条件标为 `unknown`；旧 run 缺少该字段仍可读，旧 `meta.model` 标签不作为路由证据。
 
-两侧各自可以是 label(`bench/runs/*-<label>`,含一层组目录,最新时间戳优先)、一个 run 目录、或一个
-`run.json` / 旧版 `summary.json` 路径。`--folder` 限定组,`--runs` 换根,`--aggregate median|min`,
-`--json` 输出比较文档而不是报告,`--out <file>`(`-` 只到 stdout)。默认落点是**当次跑的组目录**,
-文件名带写入时刻:一次 `bench/runs/<组>/<stamp>-<label>` 里的跑,报告写成
-`bench/runs/<组>/DSH-OPS Benchmark Report <UTC>.md`(UTC 与目录名同形,冒号换横线,如
-`2026-10-20T12-36-38Z`),所以 `full-sweep-4` 的报告就在 `bench/runs/full-sweep-4/`,不在某个 arm 目录里;
-重跑一次就是一份新报告,不覆盖上一份。不在组目录下的跑(直接挂在 `bench/runs/` 下)没有可上提的组,
-报告留在自己的 run 目录里。
-
-### `panel`
+Model flags set the actual shared route, with the condition patch applied after the provider overlay. Both arms archive their composed configuration. Repeated models and reasoning levels form independent Cartesian groups; `report --matrix` renders one section per condition and never combines deltas. Cross-condition comparisons exit 2, naming both conditions. Without new flags, routing is unchanged and the condition is `unknown`; historical labels do not prove routing. An omitted reasoning level remains `null` unless the overlay pins it. All examples are optional model-driven runs, outside CI.
 
-`panel --out <dir> <run.json>` 写 `panel.html`;`panel --serve <dir> [--port <n>]` 起一个零依赖
-`node:http` 静态服务(只绑 `127.0.0.1`,默认端口 `0` 由系统分配)。只读:不发请求、不写 `~/.dsh`、
-不常驻、不注册 DSH 插件。`file://` 双击时浏览器的 `fetch` 会被 CORS 拦下,页面用文件选择/拖拽回退。
+### 组件开关 / Component switches
 
-### `tools`
+```console
+node bench/cli.mjs setup --switch hide-official=all --switch ptc --switch panel=false --dry-run
+node bench/cli.mjs setup --switch hide-official=read,grep --switch discovery --switch shell
+```
 
-`--baseline` / `--candidate`(两个 worker 可执行文件)、`--out`(报告路径,**必须不存在**)、
-`--temp-dir`、`--scale`、`--timeout-ms`(这套旗标沿用 #103 的参数面,随接线片一并落地)。预热 1 次 +
-5 轮交替配对,同二进制两侧时它只证明"harness 没坏、输出可重复",**不是**性能基准。
-
-## 如何读报告(`DSH-OPS Benchmark Report <UTC>.md`)
+`--switch` 可重复，支持 `hide-official`、`ptc`、`panel`、`discovery`、`shell`；省略值等同 `true`，普通开关也接受 `false`。`hide-official=all` 只选择已有替代实现的 `read,glob,grep`，也可指定不重复的子集或 `false`。只修改 candidate 的 `cordis.patch.yml`；baseline 不写入组件行。每次 setup 只改明确指定的开关，不自动搜索组合。
 
-按这个顺序读,不要跳(报告正文与标题都是英文,小节名照英文读):
+写入幂等；本地已有相反值需 `--force`，继承的字面配置键会保留。动态表达式、非映射配置、重复行和无法安全编辑的目标形态需手工处理，`--force` 也不会猜测。`--dry-run` 打印请求的行和值，不启动宿主、不修改 profile。
 
-1. **`Per-task pairs`**:`task | base | cand(Δ%) | steps base→cand(Δ%) | tool calls base→cand(Δ%) | tool errors | pass`;
-   数值单元格自带括号 Δ%,不单列;steps / tool calls 取该侧全部 repeat 的中位数(`--aggregate min` 时取最小值),
-   tool errors 与 pass 统计全部 repeat,配对可用数/排除数不再进这张表(它们留在 JSON 与门禁理由里);
-   表格以 `TOTAL` 行收尾,没有单独的 geomean 行(几何均值仍在 JSON 里);
-2. **`Tool calls (per-side overlap counts)`**:紧跟第一个表 —— 每个工具一行,`base` / `cand` 是整轮合计,
-   后面每个 task 一列,格子写成 `base → cand`;`ops_*` 工具计数上升标绿、下降标红,
-   其它工具相反(下降绿、上升红);两侧都没调用的格子写 `—`,相等不标色;
-3. **`Per-task bucket detail`** / **`usage split`** / **`steps and tool calls`**(都是诊断,不改判决):
-   按 input / output / cacheRead 分桶看 Δ,或给出每任务的步数与工具调用数;
-4. **`Warnings`**与**`Evidence`**:前者列出无法支撑结论的行(如某侧丢了 `step_end.usage`),后者给出 `run.json` 与
-   归档路径;
-5. **`Conclusion`**(报告的最后一段):通过率、配对 token Δ、噪声底、方向、门禁与判定理由,顺序就是判决顺序。
+实跑先读合成配置，写入后再核验配置并执行一次有超时的最小 headless turn；这可能调用已配置模型。没有已完成 turn、宿主错误或 `READINESS_BLOCKED` 都会让 setup 失败并指向 [#207](https://github.com/T-Auto/dsh-ops/issues/207)，不会启动 benchmark sweep。这个探测不代替 Desktop 重启后的人工验证。
 
-标题下没有汇总行:判决只写在结尾的 **`Conclusion`** 里,标题之后直接进数据。
-
-所有百分数按方向着色:**小于等于 0 绿、大于 0 红**(与 `panel.html` 同一套色,写成行内 `style`)。
-着色只是包一层 `<span>`,数字本身不被改写;GitHub 会剥掉 `style`,在那边退化成纯文本。
-
-**工具调用**表的颜色看"采用方向",不是数字本身的涨跌:`ops_*` 工具计数上升是绿(插件工具接住了),下降是红;
-其它工具上升是红(候选仍在伸手够插件没覆盖的工具),下降是绿。计数相等不标色,两侧都没调用写 `—`。
+实际配置写入摘要及封存 `run.json` 的 `arms.cand.switches`，报告头和 panel 显示 candidate 开关。baseline 的空集合与 candidate 的非空集合属于正常 A/B；两份运行的 candidate 集合不同则 compare 退出 `2`，列出差异，不合并 Δ。未求值配置记录 `null`，旧数据缺失开关元数据仍可读取为未知；这些字段是配置事实，不证明组件已经发布到会话。
 
-## 面板怎么读(五个标签)
+Repeat `--switch` to set candidate components. Values default to `true`; booleans also accept `false`. `hide-official=all` expands only the implemented `read,glob,grep` replacements, or select a unique subset. Setup edits only the candidate patch, preserves inherited literal configuration, and changes only named switches. Conflicting local values require `--force`; dynamic or unsafe shapes require manual edits even with force. Dry-run prints the requested values without launching the host or writing profiles.
 
-| 标签 | 内容 |
-| --- | --- |
-| 概览 | 结论条 + 每任务配对表 + 噪声带 + token 归因 |
-| 对话 | 左 base / 右 cand 同任务同 repeat 并排,标出首个分歧点 |
-| 轨迹 | 时间线:`tool_call` / `tool_result` / 里程碑 / 心跳 / stall |
-| 判卷 | verifier 明细:检查项 / 期望 / 实际 / 证据路径 |
-| 原始 JSON | 只读视图 + 复制 + 下载 |
+Real setup verifies composed configuration and runs one bounded headless readiness turn, which may call the configured model. Missing successful completion, host errors and `READINESS_BLOCKED` fail setup with the #207 diagnostic before a sweep starts. This does not substitute for Desktop validation. Summaries and sealed `arms.cand.switches` retain effective configuration; report headers and the panel show it. Comparisons reject different candidate switch sets with exit 2, while the baseline's empty set is expected. Unevaluated configuration and historical missing metadata remain unknown, without implying publication readiness. Switch combinations are selected explicitly and are outside the CI gate.
 
-页面**从不内联数据**:它只带数据文件的*名字*,在查看时 `fetch` 同目录的 JSON;每个值都用 `textContent`
-写入,所以 transcript 里的 `<script>` 会被显示而不是解析,勾选「纯文本模式」可把任何标签降级成纯文本。
-面板只认 `schemaVersion 1`,遇到未知版本直接拒绝而不是猜。
+## 任务一览
 
-## A/A 噪声底、配对口径与"永不裁决时间"
+六个任务各自压一种能力，`ops_*` 工具名来自 `publicToolName()`。每个任务的期望值都由夹具生成器现算（`derive*`），判卷在 `bench/lib/verify.mjs`。
 
-- A/A 噪声底是"基线与自身对照"得到的区间。**默认未知** ⇒ 成本门弃权,报告只给 Δ、不给方向;
-- 要给噪声底,二选一:`--noise-floor-pct N`(固定一个已测量的半宽)或 `--noise <base> <cand>`
-  (用两次基线运行现测);
-- 成本**只统计两侧都通过的配对**:一侧通过、另一侧失败的配对既不能证明变快也不能证明变慢;
-- 任何模式都**不裁决时间**:共享 runner 上的时间不可比,时序只打印、只作人类证据。
-
-## 任务编写语义
-
-任务文件是 `bench/tasks/*.task.json`,字段白名单是 `id` / `title` / `prompt` / `fixture` / `verify` /
-`repeat` / `timeoutMs`(多一个字段就是拼写错误,直接报错并点名文件与字段)。`prompt` 是模型唯一看到的东西,
-不能以 `-` 开头(headless launcher 会把它当选项)、不能以空白开头、不能含 NUL;`timeoutMs` 默认 900000
-(15 min),合法区间 `1000 .. 86400000`;`repeat` 是每任务预算,`1 .. 100`,runner 的 `--repeat N` 仍可覆盖。
-
-判卷(`lib/verify.mjs`)里几个容易写错的语义:
-
-- `fileEquals` **两侧都 `trim()`**(行尾换行不算差异);`fileLines` 逐行 `trim()` 且丢掉空行、折叠 CRLF;
-- `countFiles` **递归**计数,可按 `prefix` / `suffix` / `extension` 过滤;
-- `contentHashes` **只看直接子项**(不递归),逐个比对名字与原字节的 sha256,并拒绝任何多出来的文件;
-  它是"改名而不是重写"的判据 —— 删掉重建或截断再写能骗过 `countFiles`,骗不过它;
-- `expect` 命名的是 fixture 导出的期望值;键写错会直接抛 `fixture exports have no key "..." (known: ...)`,
-  不是静默失败;
-- `fileContains` 对**空文件恒失败**(`actual !== ''` 是前置条件),即"读不到内容"不等于"包含"。
-
-## 两套语料的分工
-
-| 语料 | 位置 | 产出 | 谁用 |
+| 任务 | 工作量 | 主要测什么 | 相关工具 |
 | --- | --- | --- | --- |
-| 模型任务语料 | `bench/lib/fixtures/**`(`csv` / `log` / `tree` / `symbol` / `corpus` / `deep` / `repair`) | 每个生成器建一个任务工作区,并以 `derive*` 重新算出期望值 | `bench ab`(模型驱动) |
-| 工具级尺寸边界语料 | `bench/tools/index.mjs`(`createToolFixtures`,`SEED = 870016`) | 固定尺寸边界:`33 MiB` 拒绝、`8 MiB` hex 窗口、`1 MiB` 行边界 | `bench tools`(无模型) |
-
-两套不要混:`tools/` 的语料靠着它喂养的那次运行,`lib/fixtures/**` 是另一个目录,产出的是任务工作区。
-`--scale` 只缩放**文件数**(small / deep / dense),尺寸边界永远保留,所以 `--scale 0.01` 仍能冒烟到每一条边界。
-真要搬家,必须保持 `SEED` 与五个夹具族逐字节不变,否则比较就丢了基线。
-
-## run.json 契约
-
-`runs/<stamp>-<label>/run.json` 是**唯一数据源**:写入期事件追加为 NDJSON(崩溃安全),封存时归并
-进它,面板/报告/比较都读它,不额外落 CSV 或散文件。本表被 `test/bench-cli.test.mjs` 交叉校验。
-
-| 字段 | 含义 |
-| --- | --- |
-| `schemaVersion` | 契约版本号,`1`;读者遇到未知版本必须拒绝 |
-| `meta` | 采集环境事实:harness 版本、模式、平台、node、dsh、模型、git sha/branch、命令行、起止时间,以及两侧 arm 的标签与 profile 指纹 |
-| `arms` | 两侧 arm 的完整描述:label、profile、profileHash(单变量校验的指纹)、dsh 路径/版本、环境覆盖 |
-| `results` | 每 `task`×`repeat`×`arm` 一行:该行 metrics(exit / steps / toolCalls / durationMs / usage 分桶)、verify 逐检查项、events 引用 |
-| `verify` | 全量检查项汇总:checks / passed / failed / degraded(是否出现无法支撑成本结论的行)、notes |
-| `events` | 事件归档方式:写入期 NDJSON、封存时归并;含文件清单、事件数、哈希与合并时间 |
-| `archive` | 归档清单:每个文件的相对路径、字节数、sha256 与 role |
-
-三条数据纪律(硬边界 #205 §1):
-
-1. **数据只存 JSON**:原始数据只落 `run.json`,不内联、不额外落 CSV/散文件;
-2. **轨迹落独立文件**:事件与 stderr 是 `results/<task>-r<n>.events.ndjson`、`.stderr.ndjson`,
-   轨迹是独立的 `results/<task>-r<n>.trace.ndjson`,只在 `archive[]` 里登记 —— 它们不进 `run.json` 的正文;
-3. **HTML 不内联数据**:`panel.html` 只是"读同目录 JSON 的查看器"。
-
-## 有界兜底(P7)
-
-单发会话的两道超时都是有界的,坏掉的子进程不会把 sweep 挂死:`spawnErrorGraceMs` 默认 `1000`(spawn 立刻
-失败时,等 1 s 让 close 事件落地再结算,而不是把"没有 pid"当成没跑过);`killGraceMs` 默认 `5000`(kill 之后
-最多等 5 s 收尸,超时就从已归档的文件里记录这一行)。两者都可被调用方覆盖。
-
-## 状态名对照
-
-本议题 #205 曾把工具级对比的不匹配写作 `UNEXPECTED_DIFFERENCE`,代码里的名字是 **`MISMATCH`**。完整集合:
-`MATCH` / `MISMATCH` / `EXPECTED_DIFFERENCE` / `EXPECTED_REJECTION` / `UNSTABLE` / `TIMEOUT` / `ERROR` /
-`WORKER_ERROR`;只有 `MATCH`、`EXPECTED_DIFFERENCE`、`EXPECTED_REJECTION` 是"预期结果",其余都退 `1`。
-
-## CI 里怎么跑
-
-- **默认不跑**:`push` / `pull_request` / `merge_group` 里没有 `workflow_dispatch` 的 `inputs`,bench 作业
-  整段跳过,这些运行逐字节不变;
-- **opt-in**:手动触发时给一个布尔输入 `bench`(默认 `false`)才跑 `bench-smoke`;
-- **同二进制两侧**:CI 跑的是 `bench/cli.mjs tools --scale 0.01`(保留全部尺寸边界),两侧同一个二进制,
-  所以绿只说明"harness 还能驱动真实 worker、worker 两次答得一样",**不构成任何性能结论**;
-- **不阻塞**:该作业 `continue-on-error: true`,不进必需状态检查,聚合门禁不计它;
-- **artifact**:证据以 `bench-smoke-report` 上传(沿用 `tools-trial-report` 的命名),含 `bench/runs/smoke/**`
-  以及存在时的 `run.json` / `DSH-OPS Benchmark Report <UTC>.md` / `panel.html`;
-- **模型驱动的 sweep 绝不在 CI 跑**:它要断言成本方向,那是本地的人类判断。
-
-## 为什么 bench 不随包发布
-
-硬边界(设计议题 #205):**数据只存 JSON**、**HTML 只是读 JSON 的查看器**、**测试期可用但构建期不
-构建**。因此 `files` 不含 `bench/`,也不新增构建步骤;装包之后 `npm run bench:*` 会先检查 `bench/`,
-不存在就打印 "bench 只存在于仓库,不随包发布" 并以退出码 `2` 结束。
-
-## 接线现状
-
-声明了但没接线的子命令**从不静默**:目标文件不存在,或存在但没导出 `main(argv, io)`,都以退出码 `3`
-点名所属切片与目标路径。因此切片可以一个一个并入,而 CLI 的 tripwire 始终说真话:
-
-- `setup` / `report` / `panel` / `tools` 已接线,`--help` 退 `0`;
-- `ab` 已接线:整次 sweep 在**一个**子进程内完成,两臂按 `(task, repeat)` 的奇偶 **AB/BA 交错**
-  (奇数轮 base→cand,偶数轮 cand→base);`--show` 只打印逐对计划,不 spawn 任何会话;
-- 目前只剩"声明了但目标文件还没落地"这一种 pending 形态,它退 `3` 并点名切片与目标路径 ——
-  切片一个一个并入时,这条 tripwire 始终说真话。
+| `api-rename` | 12 个模块 + `core.js`（另生成 `check.mjs`），把 `parsePayload` 改名为 `decodePayload` | 符号级改名而非文本替换：定义、import、调用点一个不能漏；诱饵 `parsePayloadLegacy` / `parsePayloadAsync` 和完全不碰该符号的文件必须原样保留；判卷是 `src/` 全部文件的字节级 SHA-256 全等 + `node check.mjs` 退 0 | `ops_grep`（+`ops_glob`）搜调用点；`ops_read_files` 读文件；`ops_edit_file` / `ops_replace` 改名 |
+| `big-file-paging` | 4200 行单文件 `src/pipeline.js` | 分页读取：定位 `auditLimit('staging')` 所在行段，只读需要的两段而不是整读文件；文件里埋了过期注释和被取代的 `LEGACY_LIMIT_TABLE`，grep 一次仍要判断；`answer.txt` 等于该常量的整数 | `ops_grep` 定位；`ops_inspect_local_file`（或 `ops_read_files`）带 `offset`/`limit` 只读两段；`ops_write_file` 写答案 |
+| `config-hunt` | 3 层配置目录 + 12 个 `packages/*/config.json` 诱饵 | 层级查找与优先级判断：先 glob 出配置层，再 grep key，最后按 README 的优先级取 `MAX_UPLOAD_MB` 的有效值；只 grep key 就停下有 1/4 概率拿错答案 | `ops_glob` 找层；`ops_grep` 找 key；`ops_read_files` 读优先级文档与三层配置；`ops_write_file` 写答案 |
+| `csv-sum` | 8000 行 CSV，汇总 EU 区 `amount` 列 | 上下文控制：把聚合交给 shell 而不是把 8000 行读进上下文，`answer.txt` 只写整数和 | `ops_bash` 聚合；`ops_read_files` 只看表头确认列；`ops_write_file` 写答案 |
+| `gate-repair-loop` | 12 个 stage 模块（每个约 70 行）+ `check.js` | 迭代修复循环：门禁停在第一个坏 stage，每个 stage 只错一处绑定常量、契约写在模块自己的注释里，跑→修→再跑直到退 0；`check.js` 字节不变是 invariant | `ops_bash` 跑门禁；`ops_read_files` 读 stage；`ops_edit_file` 按契约修常量；`ops_write_file` 写 `answer.txt` |
+| `noisy-test-triage` | 2400 个测试、恰好一行 `not ok` | 精确提取：跑测试重定向到文件，在日志里只捞那一行失败测试名写入 `failure.txt`（必须精确匹配），且 runner 仍退 1 是 invariant | `ops_bash` 跑并重定向；`ops_grep` 只捞那一行（如 `^not ok`，可配 `outputMode: summary/content`）；必要时 `ops_read_files`；`ops_write_file` 写结果 |
diff --git a/bench/cli.mjs b/bench/cli.mjs
index 439e1b09..853f765c 100644
--- a/bench/cli.mjs
+++ b/bench/cli.mjs
@@ -69,7 +69,7 @@ export function abUsage() {
     '                            [--base <label>] [--cand <label>] [--show] [runner flags...]',
     '',
     'Runs the baseline side, the candidate side, then the comparison, all inside ONE',
-    'bench/runs/benchmark-test-NN group: the number is allocated once here because a',
+    'bench/runs/benchmark-YYYY-MM-DD-NN group: the name is allocated once here because a',
     'per-process default would put each side in a different group and leave nothing to pair.',
     'Flag meanings are in `--help`; the group is created by the runner (P7/P8) and the',
     'comparison by P11.',
@@ -114,15 +114,16 @@ export function parseAbArgs(argv) {
  * sharing the one group folder allocated here. Pure: it reserves the name but writes
  * nothing, so `--show` and a real run report the same plan.
  * @param {string[]} argv - the `ab` arguments, parsed by {@link parseAbArgs}.
- * @param {{runsDir?: string, repoRoot?: string}} [options] - where group folders live and
- *   the checkout the three commands run in; injectable so a suite allocates nothing real.
+ * @param {{runsDir?: string, repoRoot?: string, now?: Date}} [options] - where group folders live,
+ *   the checkout the three commands run in, and the clock the auto folder name stamps
+ *   (injectable so a suite allocates nothing real and asserts exact names).
  * @returns {{base: string, cand: string, tasks: string[], repeat: string|null, folder: string, show: boolean, extra: string[], help: boolean, allocated: boolean, commands: {label: string, target: string, args: string[], argv: string[]}[], repoRoot: string}} the plan.
  */
 export function planAb(argv, options = {}) {
   const { runsDir = RUNS_DIR, repoRoot = REPO_ROOT } = options
   const parsed = parseAbArgs(argv)
   const allocated = parsed.folder === null
-  const folder = parsed.folder ?? nextFolderName(runsDir)
+  const folder = parsed.folder ?? nextFolderName(runsDir, options.now)
   const shared = parsed.tasks.flatMap((task) => ['--task', task])
   if (parsed.repeat !== null) shared.push('--repeat', parsed.repeat)
   shared.push('--folder', folder, ...parsed.extra)
diff --git a/bench/compare.mjs b/bench/compare.mjs
index 2c4bf3d5..aac13e4a 100644
--- a/bench/compare.mjs
+++ b/bench/compare.mjs
@@ -15,18 +15,14 @@
  * the two sides, calls it, and renders what it returned. With no noise floor the
  * report says so and abstains from every cost direction (`noise-floor-unknown`).
  *
- * The report opens with its fixed title and then the evidence a reviewer works
- * through — the per-task paired table, the pairs a failed side forced out of the cost
- * statistics, the A/A band, and the diagnostic sections #183 carried (per-task bucket
- * detail, the usage-bucket split and the token attribution), which say *why* the
- * number moved (a bigger per-request prompt is a tool-schema cost, extra steps are a
- * model-behaviour cost, fatter tool results are a context cost; the fixes are
- * opposite, so the report has to say which one it was) — and closes with the conclusion:
- * pass rate, paired token Δ, the noise band, whether a direction is readable and the
- * gate. None of the diagnostics can change the gate.
+ * The report opens with its fixed title and then the data a reviewer works
+ * through — the per-task paired table, the tool table and the diagnostic sections
+ * (per-task bucket detail, per-request overhead) which say
+ * *why* the number moved. It prints no verdict prose and no side paths: the gate's
+ * verdict travels through the exit code and the comparison document, not the markdown.
  *
- * Time is evidence only: the comparison never reads `durationMs`, and nothing here
- * turns a duration into a verdict.
+ * Durations are displayed like any other metric (the per-task table's time column);
+ * the verdict's cost basis remains paired tokens.
  *
  * @module dsh-ops/bench/compare
  */
@@ -34,10 +30,11 @@
 import fs from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { describeCondition } from './lib/condition.mjs'
+import { matrixComparisons, renderMatrix } from './lib/matrix.mjs'
 
 import {
   AGGREGATES,
-  COMPARE_FORMAT,
   FAIL_ON,
   REGRESSION_SCOPES,
   compareSummaries,
@@ -45,6 +42,7 @@ import {
   percentChange,
 } from './lib/compare-core.mjs'
 import { RUNS_DIR } from './lib/next-folder.mjs'
+import { environmentLines } from './lib/environment.mjs'
 
 /** The sealed contract document inside a run directory. */
 const SEALED_RUN = 'run.json'
@@ -52,8 +50,8 @@ const SEALED_RUN = 'run.json'
 const LEGACY_SUMMARY = 'summary.json'
 /** The summary document's format tag. */
 const SUMMARY_FORMAT = 'dsh-ops-bench-summary-v1'
-/** The report's fixed title; the two sides are named in Evidence, not in the heading. */
-const REPORT_TITLE = '# DSH-OPS Benchmark Report'
+/** The report's fixed title, marked (beta); the two sides are named in Evidence, not in the heading. */
+const REPORT_TITLE = '# DSH-OPS Benchmark Report (beta)'
 /** The file name stem: the title's words, so the artifact is recognizable in a folder listing. */
 const REPORT_STEM = 'DSH-OPS Benchmark Report'
 /** The panel's palette: the report and `panel.html` must agree on what green and red mean. */
@@ -67,6 +65,7 @@ const RED = '#f85149'
 export const EXIT = { ok: 0, failure: 1, usage: 2 }
 
 const USAGE = `usage: node bench/compare.mjs <base> <cand> [options]
+       node bench/compare.mjs --matrix <group-directory> [options]
 
   <base> <cand>      each side is one of:
                        <label>   a run label, matched against bench/runs/*-<label>
@@ -83,6 +82,7 @@ const USAGE = `usage: node bench/compare.mjs <base> <cand> [options]
   --noise-floor-pct N   pin the A/A noise floor; without a floor every cost
                      direction is withheld (noise-floor-unknown)
   --noise <a> <b>    measure the A/A noise floor from two baseline runs
+  --allow-cross-platform  diagnostics only: allow different platforms, with a warning
   --json             print the comparison document as JSON instead of the report
   --out <file>       where the rendered artifact goes (default: the sweep's group
                      folder, named "DSH-OPS Benchmark Report <UTC>.md" — a run with no
@@ -120,6 +120,7 @@ export function parseArgs(argv) {
   const options = {
     base: null,
     cand: null,
+    matrix: null,
     folder: null,
     runsDir: RUNS_DIR,
     aggregate: 'median',
@@ -148,7 +149,10 @@ export function parseArgs(argv) {
         if (index >= argv.length) throw new Error(`${name} needs a value`)
         return argv[index]
       }
-      if (name === '--json') {
+      if (name === '--allow-cross-platform') {
+        if (inline !== null) throw new Error('--allow-cross-platform takes no value')
+        options.allowCrossPlatform = true
+      } else if (name === '--json') {
         if (inline !== null) throw new Error('--json takes no value; the comparison document goes to stdout and --out names a file')
         options.json = true
       } else if (name === '--aggregate') options.aggregate = take()
@@ -164,6 +168,7 @@ export function parseArgs(argv) {
       } else if (name === '--out') options.out = take()
       else if (name === '--folder') options.folder = assertFolderName(take(), '--folder')
       else if (name === '--runs') options.runsDir = path.resolve(take())
+      else if (name === '--matrix') options.matrix = path.resolve(take())
       else throw new Error(`unknown option "${name}"`)
       continue
     }
@@ -178,6 +183,10 @@ export function parseArgs(argv) {
     throw new Error('--noise-floor-pct must be a non-negative number')
   }
   if (options.help) return options
+  if (options.matrix !== null) {
+    if (positional.length || options.folder !== null || options.noise !== null) throw new Error('--matrix takes its groups from matrix.json; do not pass side labels, --folder or --noise')
+    return options
+  }
   if (positional.length !== 2) throw new Error('expected exactly two sides: <base> <cand>')
   options.base = positional[0]
   options.cand = positional[1]
@@ -343,17 +352,6 @@ function signed(value) {
   return `${rounded > 0 ? '+' : rounded < 0 ? MINUS : ''}${Math.abs(rounded).toLocaleString('en-US')}`
 }
 
-/**
- * Paint every percent inside a string the core produced. Gate reasons and warnings are
- * quoted verbatim — the digits stay the core's, only the colour is added — so they read
- * in the same two colours as the percents this module formats itself.
- * @param {string} text - the core's string.
- * @returns {string} the same text, percents wrapped.
- */
-function paintPercents(text) {
-  return text.replace(/[+-]?\d+(?:\.\d+)?%/g, (whole) => color(whole, Number.parseFloat(whole)))
-}
-
 /**
  * Paint one rendered value: a drop (or no change) is green, a rise is red — the same
  * two colours `panel.html` uses, inline because a markdown file cannot carry a
@@ -373,69 +371,6 @@ function percent(value) {
   return color(`${value > 0 ? '+' : value < 0 ? MINUS : ''}${Math.abs(value).toFixed(1)}%`, value)
 }
 
-/**
- * A percent the core stated as a bare number — a band half-width, a tolerance, a share
- * of the delta. Printed verbatim (no sign is invented) and painted like every other
- * percent in the report.
- * @param {number|null} value - the number, with `%` appended as-is.
- * @returns {string} the painted text.
- */
-function rawPercent(value) {
-  if (value === null || value === undefined || !Number.isFinite(value)) return 'n/a'
-  return color(`${value}%`, value)
-}
-
-/**
- * The direction sentence — the one place the three noise outcomes are worded.
- * The core's conclusion names travel verbatim so the report and the JSON cannot drift.
- * @param {object} cost - `verdict.cost` from the comparison.
- * @returns {string} the sentence.
- */
-function directionSentence(cost) {
-  if (cost.conclusion === 'incomparable') {
-    return 'Direction: no pair passed on both sides with complete usage ⇒ cost is incomparable; no direction is read'
-  }
-  if (cost.conclusion === 'noise-floor-unknown') {
-    return `Direction: Δ ${percent(cost.pct)}, but the noise floor is unknown ⇒ abstaining, no direction is read (noise-floor-unknown); supply one with --noise-floor-pct N or --noise <base> <cand>`
-  }
-  if (cost.conclusion === 'within-noise') {
-    return `Direction: Δ ${percent(cost.pct)} sits inside the noise band ±${rawPercent(cost.noiseFloorPct)} ⇒ interval only, no direction is read (within-noise)`
-  }
-  if (cost.conclusion === 'cheaper' || cost.conclusion === 'costlier') {
-    return `Direction: Δ ${percent(cost.pct)}, beyond the noise floor ±${rawPercent(cost.noiseFloorPct)} ⇒ readable direction: ${cost.conclusion}`
-  }
-  return `Direction: Δ ${percent(cost.pct)}, no readable direction (${cost.conclusion ?? 'no-change'})`
-}
-
-/**
- * The conclusion that closes the report: pass rate, paired token Δ, noise floor, direction
- * and gate, in that order, plus the reasons the gate gave. It ends the document, so a
- * reviewer meets the verdict after the evidence instead of before it.
- * @param {object} comparison - the comparison structure.
- * @returns {string[]} the section lines.
- */
-function verdictSection(comparison) {
-  const { gate, totals, verdict, noiseFloor } = comparison
-  const passes = `${totals.basePasses}/${totals.baseRuns} → ${totals.candPasses}/${totals.candRuns}`
-  const pairs = `${gate.usablePairs}/${gate.usablePairs + gate.excludedPairs}`
-  const tokenLine = gate.tokensComparable && gate.costComparable
-    ? `💰 tokens (paired ${pairs}): ${number(totals.baseGrandTotal)} → ${number(totals.candGrandTotal)}, Δ ${percent(totals.grandTotalPct)}`
-    : `💰 tokens: incomparable (${gate.tokensComparable ? `no pair passed on both sides, ${gate.excludedPairs} pair(s) excluded` : 'usage incomplete on at least one side'})`
-  const gateLine = gate.fail ? `🚦 failed (${gate.primary})` : '🚦 passed'
-  const lines = [
-    '## Conclusion',
-    '',
-    `- pass rate: ${passes}${gate.passDropFailed ? ' (drop; decided before cost)' : totals.candPassRate > totals.basePassRate ? ' (up)' : ' (flat)'}`,
-    `- ${tokenLine.replace('💰 ', '')}`,
-    `- noise floor (A/A): ${noiseFloor.comparable ? `±${rawPercent(noiseFloor.pct)}, method \`${noiseFloor.method}\`` : 'unknown (noise-floor-unknown)'}`,
-    `- ${directionSentence(verdict.cost)}`,
-    `- gate: ${gateLine} · \`--fail-on ${gate.failOn}\` · regression scope \`${gate.regressionScope}\` · tolerance ${rawPercent(gate.tolerancePct)} · cost basis \`${gate.costBasis}\``,
-    `- basis: ${comparison.aggregate} · profile ${comparison.base.profile ?? '?'} → ${comparison.cand.profile ?? '?'} · model ${comparison.base.model ?? '?'} → ${comparison.cand.model ?? '?'}`,
-  ]
-  for (const reason of gate.reasons) lines.push(`- reason: ${paintPercents(reason)}`)
-  return lines
-}
-
 /**
  * The per-task paired table: cost, the behaviour behind it (steps, tool calls, tool
  * errors) and the pass migration, all on the row a reviewer reads first.
@@ -445,25 +380,28 @@ function verdictSection(comparison) {
 function taskSection(comparison) {
   const { totals } = comparison
   const useMin = comparison.aggregate === 'min'
-  const keys = { steps: useMin ? 'stepsMin' : 'stepsMedian', toolCalls: useMin ? 'toolCallsMin' : 'toolCallsMedian', toolErrors: useMin ? 'toolErrorsMin' : 'toolErrorsMedian' }
+  const keys = { steps: useMin ? 'stepsMin' : 'stepsMedian', toolCalls: useMin ? 'toolCallsMin' : 'toolCallsMedian', toolErrors: useMin ? 'toolErrorsMin' : 'toolErrorsMedian', duration: useMin ? 'durationMsMin' : 'durationMsMedian' }
   // The change rides inside the cell it belongs to (`1,050 (+5.0%)`, `4 → 3 (−25%)`):
   // one number per row, with its Δ% in parentheses rather than a column of its own.
   const candCell = (value, pct) => `${number(value)}${Number.isFinite(pct) ? ` (${percent(pct)})` : ''}`
   const deltaCell = (baseValue, candValue, pct) => `${count(baseValue)} → ${count(candValue)}${Number.isFinite(pct) ? ` (${percent(pct)})` : ''}`
   const countCell = (baseValue, candValue) => `${count(baseValue)} → ${count(candValue)}`
+  // Time renders like every other metric: same aggregate, same direction colouring.
+  const seconds = (ms) => (Number.isFinite(ms) ? `${(ms / 1000).toFixed(1)}s` : '—')
+  const timeCell = (baseMs, candMs, pct) => `${seconds(baseMs)} → ${seconds(candMs)}${Number.isFinite(pct) ? ` (${percent(pct)})` : ''}`
   const passCell = (side) => `${side.base.passed}/${side.base.repeats}→${side.cand.passed}/${side.cand.repeats}`
   const lines = [
     '## Per-task pairs',
     '',
-    '| task | base | cand (Δ%) | steps base→cand (Δ%) | tool calls base→cand (Δ%) | tool errors | pass |',
-    '| --- | --- | --- | --- | --- | --- | --- |',
+    '| task | base | ops (Δ%) | steps: base→ops (Δ%) | tool calls: base→ops (Δ%) | time: base→ops (Δ%) | tool errors | pass |',
+    '| --- | --- | --- | --- | --- | --- | --- | --- |',
   ]
   for (const task of comparison.tasks) {
     const pair = task.paired
-    const name = task.inBase && task.inCand ? task.id : `${task.id}${task.inBase ? '(base only)' : '(cand only)'}`
-    lines.push(`| ${name} | ${number(pair.baseValue)} | ${candCell(pair.candValue, pair.pct)} | ${deltaCell(task.base[keys.steps], task.cand[keys.steps], task.delta.stepsPct)} | ${deltaCell(task.base[keys.toolCalls], task.cand[keys.toolCalls], task.delta.toolCallsPct)} | ${countCell(task.base[keys.toolErrors], task.cand[keys.toolErrors])} | ${passCell(task)} |`)
+    const name = task.inBase && task.inCand ? task.id : `${task.id}${task.inBase ? '(base only)' : '(ops only)'}`
+    lines.push(`| ${name} | ${number(pair.baseValue)} | ${candCell(pair.candValue, pair.pct)} | ${deltaCell(task.base[keys.steps], task.cand[keys.steps], task.delta.stepsPct)} | ${deltaCell(task.base[keys.toolCalls], task.cand[keys.toolCalls], task.delta.toolCallsPct)} | ${timeCell(task.base[keys.duration], task.cand[keys.duration], task.delta.durationPct)} | ${countCell(task.base[keys.toolErrors], task.cand[keys.toolErrors])} | ${passCell(task)} |`)
   }
-  lines.push(`| **TOTAL** | ${number(totals.baseGrandTotal)} | ${candCell(totals.candGrandTotal, totals.grandTotalPct)} | ${deltaCell(totals.baseSteps, totals.candSteps, percentChange(totals.baseSteps, totals.candSteps))} | ${deltaCell(totals.baseToolCalls, totals.candToolCalls, percentChange(totals.baseToolCalls, totals.candToolCalls))} | ${countCell(totals.baseToolErrors, totals.candToolErrors)} | ${totals.basePasses}/${totals.baseRuns}→${totals.candPasses}/${totals.candRuns} |`)
+  lines.push(`| **TOTAL** | ${number(totals.baseGrandTotal)} | ${candCell(totals.candGrandTotal, totals.grandTotalPct)} | ${deltaCell(totals.baseSteps, totals.candSteps, percentChange(totals.baseSteps, totals.candSteps))} | ${deltaCell(totals.baseToolCalls, totals.candToolCalls, percentChange(totals.baseToolCalls, totals.candToolCalls))} | ${timeCell(totals.baseDurationMs, totals.candDurationMs, percentChange(totals.baseDurationMs, totals.candDurationMs))} | ${countCell(totals.baseToolErrors, totals.candToolErrors)} | ${totals.basePasses}/${totals.baseRuns}→${totals.candPasses}/${totals.candRuns} |`)
   return lines
 }
 
@@ -477,9 +415,9 @@ function bucketSection(comparison) {
   const keys = { input: useMin ? 'inputMin' : 'inputMedian', output: useMin ? 'outputMin' : 'outputMedian', cacheRead: useMin ? 'cacheReadMin' : 'cacheReadMedian' }
   const cell = (baseValue, candValue) => `${number(baseValue)} → ${number(candValue)} (${percent(percentChange(baseValue, candValue))})`
   const lines = [
-    `## Per-task bucket detail (${comparison.aggregate})`,
+    '## Per-task bucket detail',
     '',
-    '| task | input base→cand (Δ%) | output base→cand (Δ%) | cache read base→cand (Δ%) |',
+    '| task | input: base→ops (Δ%) | output: base→ops (Δ%) | cache read: base→ops (Δ%) |',
     '| --- | --- | --- | --- |',
   ]
   for (const task of comparison.tasks) {
@@ -493,53 +431,33 @@ function bucketSection(comparison) {
 }
 
 /**
- * The usage split: how the TOTAL delta divides between uncached input, output and
- * cache reads, with each bucket's share of the delta. The gate judges the total.
+ * The per-request overhead table: the first request of a run carries no history, so its
+ * delta is the fixed cost a tool surface or prompt policy adds, paid on every request.
+ * Archives without `metrics.prompt` cannot separate that request, so the section says
+ * so instead of inventing numbers.
  * @param {object} comparison - the comparison structure.
  * @returns {string[]} the section lines.
  */
-function usageSplitSection(comparison) {
-  const buckets = comparison.totals.buckets
-  const lines = [`## usage split (TOTAL, ${comparison.aggregate})`, '']
-  if (!buckets.comparable) {
-    lines.push('Skipped: at least one side lost `step_end.usage`, so per-bucket Δs would present a lower bound as a measurement.')
+function overheadSection(comparison) {
+  const lines = ['## Per-request overhead (what every request costs before any work)', '']
+  const prompted = comparison.tasks.some((task) => Number.isFinite(task.base.firstRequestPromptMedian) || Number.isFinite(task.cand.firstRequestPromptMedian))
+  if (!prompted) {
+    lines.push('Skipped: neither side recorded `metrics.prompt`, so the first request cannot be separated from the run.')
     return lines
   }
-  const row = (label, bucket) => `| ${label} | ${number(bucket.base)} | ${number(bucket.cand)} | ${signed(bucket.delta)} (${percent(percentChange(bucket.base, bucket.cand))}) | ${rawPercent(bucket.sharePct)} |`
+  const firstCell = (task) => {
+    const base = task.base.firstRequestPromptMedian
+    const cand = task.cand.firstRequestPromptMedian
+    if (!Number.isFinite(base) || !Number.isFinite(cand)) return 'n/a'
+    return `${number(base)} → ${number(cand)} (${signed(task.delta.firstRequestPromptAbs)}, ${percent(task.delta.firstRequestPromptPct)})`
+  }
   lines.push(
-    '| bucket | base | cand | Δ (Δ%) | share of Δ |',
-    '| --- | --- | --- | --- | --- |',
-    row('uncached input', buckets.input),
-    row('output', buckets.output),
-    row('cache read', buckets.cacheRead),
-    row('**TOTAL**', buckets.grandTotal),
+    '| task | first request: base→ops |',
+    '| --- | --- |',
   )
-  return lines
-}
-
-/**
- * The behaviour behind the token delta: steps and tool calls, per task and summed.
- * The extra-steps term in token attribution is this table's Δ steps at the baseline's prompt
- * size, so a cost move can be read against the behaviour that produced it. Neither
- * count can change the gate.
- * @param {object} comparison - the comparison structure.
- * @returns {string[]} the section lines.
- */
-function stepsSection(comparison) {
-  const useMin = comparison.aggregate === 'min'
-  const keys = { steps: useMin ? 'stepsMin' : 'stepsMedian', toolCalls: useMin ? 'toolCallsMin' : 'toolCallsMedian' }
-  const cell = (baseValue, candValue, pct) => `${count(baseValue)} → ${count(candValue)} (${percent(pct)})`
-  const lines = [
-    `## steps and tool calls (${comparison.aggregate})`,
-    '',
-    '| task | steps base→cand (Δ%) | tool calls base→cand (Δ%) |',
-    '| --- | --- | --- |',
-  ]
   for (const task of comparison.tasks) {
-    lines.push(`| ${task.id} | ${cell(task.base[keys.steps], task.cand[keys.steps], task.delta.stepsPct)} | ${cell(task.base[keys.toolCalls], task.cand[keys.toolCalls], task.delta.toolCallsPct)} |`)
+    lines.push(`| ${task.id} | ${firstCell(task)} |`)
   }
-  const totals = comparison.totals
-  lines.push(`| **TOTAL** | ${cell(totals.baseSteps, totals.candSteps, percentChange(totals.baseSteps, totals.candSteps))} | ${cell(totals.baseToolCalls, totals.candToolCalls, percentChange(totals.baseToolCalls, totals.candToolCalls))} |`)
   return lines
 }
 
@@ -575,7 +493,7 @@ function toolSection(comparison) {
     }
     return { id: task.id, counts }
   })
-  const lines = ['## Tool calls (per-side overlap counts)', '']
+  const lines = ['## Tool calls', '']
   if (totals.size === 0) {
     lines.push('Skipped: neither side recorded `toolCallsByName`.')
     return lines
@@ -589,7 +507,7 @@ function toolSection(comparison) {
   const cell = (name, counts) => (counts ? `${number(counts.base)} → ${cand(name, counts)}` : '—')
   const rows = [...totals.entries()].sort((left, right) => (Number(own(right[0])) - Number(own(left[0]))) || (right[1].cand - left[1].cand) || left[0].localeCompare(right[0]))
   lines.push(
-    `| tool | base | cand | ${comparison.tasks.map((task) => task.id).join(' | ')} |`,
+    `| tool | base | ops | ${comparison.tasks.map((task) => task.id).join(' | ')} |`,
     `| --- | --- | --- | ${comparison.tasks.map(() => '---').join(' | ')} |`,
   )
   for (const [name, counts] of rows) {
@@ -599,52 +517,30 @@ function toolSection(comparison) {
   return lines
 }
 
-/**
- * Every warning the core recorded (model mismatch, incomplete usage, one-sided
- * tasks, pairing leftovers) — nothing measured is allowed to disappear quietly.
- * @param {object} comparison - the comparison structure.
- * @returns {string[]} the section lines.
- */
-function warningSection(comparison) {
-  if (comparison.warnings.length === 0) return ['## Warnings', '', 'No warnings.']
-  return ['## Warnings', '', ...comparison.warnings.map((warning) => `- ${paintPercents(warning)}`)]
-}
-
 /**
  * Render the comparison as the report document — the text `reportFileName` names and
  * `main` writes.
  *
- * Pure: same comparison and sources in, byte-identical text out. No timestamps are
- * written, so the report is reproducible and diffable.
+ * Pure: same comparison in, byte-identical text out. No timestamps are written, so the
+ * report is reproducible and diffable.
  * @param {object} comparison - the structure from `compareSummaries`.
- * @param {{base?: object, cand?: object}} [sources] - the two resolved sides.
  * @returns {string} the report text (no trailing newline).
  */
-export function renderReport(comparison, sources = {}) {
+export function renderReport(comparison) {
   const lines = [
     REPORT_TITLE,
     '',
+    `Condition: ${describeCondition(comparison.condition)}`,
+    `Candidate switches: ${JSON.stringify(comparison.switches ?? null)} (null means unknown)`,
+    '',
+    ...environmentLines(comparison.environment),
     ...taskSection(comparison),
     '',
     ...toolSection(comparison),
     '',
     ...bucketSection(comparison),
     '',
-    ...usageSplitSection(comparison),
-    '',
-    ...stepsSection(comparison),
-    '',
-    ...warningSection(comparison),
-    '',
-    '## Evidence',
-    '',
-    `- base:${sources.base?.file ?? '?'}(spec \`${sources.base?.spec ?? '?'}\`,${sources.base?.kind ?? '?'})`,
-    `- cand:${sources.cand?.file ?? '?'}(spec \`${sources.cand?.spec ?? '?'}\`,${sources.cand?.kind ?? '?'})`,
-    `- document: format \`${comparison.format}\` · aggregate \`${comparison.aggregate}\` · tolerance ${rawPercent(comparison.tolerancePct)}`,
-    '',
-    `Time fields are evidence only: the cost basis of this report is paired tokens, and the comparison does not read duration into the verdict (${COMPARE_FORMAT} carries no time statistics).`,
-    '',
-    ...verdictSection(comparison),
+    ...overheadSection(comparison),
   ]
   return lines.join('\n')
 }
@@ -732,6 +628,17 @@ export async function main(argv, io = {}) {
     out(USAGE)
     return EXIT.ok
   }
+  if (options.matrix !== null) {
+    try {
+      const comparisons = matrixComparisons(options.matrix, options, { resolveSide, compare: compareSummaries })
+      const payload = options.json ? JSON.stringify({ format: 'dsh-ops-bench-matrix-report-v1', comparableAcrossConditions: false, comparisons }, null, 2) : renderMatrix(comparisons, renderReport)
+      out(payload)
+      const target = options.out ? path.resolve(options.out) : path.join(options.matrix, reportFileName(now()))
+      fs.writeFileSync(target, payload + '\n')
+      err(`compare matrix: wrote ${target}`)
+      return comparisons.some(value => value.gate.fail) ? EXIT.failure : EXIT.ok
+    } catch (error) { err(`compare matrix: ${error.message}`); return EXIT.usage }
+  }
 
   let base
   let cand
@@ -747,21 +654,22 @@ export async function main(argv, io = {}) {
     return EXIT.usage
   }
 
-  const comparison = compareSummaries(base.doc, cand.doc, {
+  let comparison
+  try { comparison = compareSummaries(base.doc, cand.doc, {
+    allowCrossPlatform: options.allowCrossPlatform,
     aggregate: options.aggregate,
     tolerancePct: options.tolerancePct,
     failOn: options.failOn,
     regressionScope: options.regressionScope,
     noiseFloorPct: options.noiseFloorPct ?? undefined,
     noise: noise ?? undefined,
-  })
-  const sources = {
-    base: { spec: options.base, file: base.file, kind: base.kind },
-    cand: { spec: options.cand, file: cand.file, kind: cand.kind },
+  }) } catch (error) {
+    err(`compare: ${String(error?.message ?? error)}`)
+    return EXIT.usage
   }
   const payload = options.json
     ? `${JSON.stringify(comparison, null, 2)}\n`
-    : `${renderReport(comparison, sources)}\n`
+    : `${renderReport(comparison)}\n`
   out(payload)
 
   const target = reportPath(options, cand, now())
diff --git a/bench/lib/compare-core.mjs b/bench/lib/compare-core.mjs
index 736eada4..96a3f947 100644
--- a/bench/lib/compare-core.mjs
+++ b/bench/lib/compare-core.mjs
@@ -33,6 +33,9 @@
  */
 
 import { CORE_BUCKETS, median, minValue, pairMetrics } from './aggregate.mjs'
+import { assertSameCondition } from './condition.mjs'
+import { compareEnvironment } from './environment.mjs'
+import { assertSameSwitches } from './switches.mjs'
 
 export { median, minValue }
 
@@ -228,6 +231,10 @@ export function aggregateTask(metricsList = []) {
   const steps = numeric((metrics) => metrics?.steps ?? 0)
   const toolCalls = numeric((metrics) => metrics?.toolCalls ?? 0)
   const toolErrors = numeric((metrics) => metrics?.toolErrors ?? 0)
+  // Wall-clock per repeat, aggregated like steps. A failed row records 0 ms (it never
+  // ran), which drags the median down exactly the way a 0-steps row does — the pass
+  // columns are what tell the reader which rows actually measured something.
+  const durations = numeric((metrics) => metrics?.durationMs ?? 0)
   // The prompt shape: the first request (no history yet — system prompt + tool
   // schemas + task text) is the per-request fixed cost, and the per-step average
   // says how much context each subsequent request re-sent. Older archives predate
@@ -282,6 +289,8 @@ export function aggregateTask(metricsList = []) {
     stepsMin: minValue(steps),
     toolCallsMedian: median(toolCalls),
     toolCallsMin: minValue(toolCalls),
+    durationMsMedian: median(durations),
+    durationMsMin: minValue(durations),
     toolCallsByName,
     toolErrorsMedian: median(toolErrors),
     toolErrorsMin: minValue(toolErrors),
@@ -368,6 +377,7 @@ function statisticKeys(aggregate) {
     toolsKey: useMin ? 'toolCallsMin' : 'toolCallsMedian',
     errorsKey: useMin ? 'toolErrorsMin' : 'toolErrorsMedian',
     firstPromptKey: useMin ? 'firstRequestPromptMin' : 'firstRequestPromptMedian',
+    durationKey: useMin ? 'durationMsMin' : 'durationMsMedian',
     promptTotalKey: useMin ? 'promptTotalMin' : 'promptTotalMedian',
     inputKey: useMin ? 'inputMin' : 'inputMedian',
     outputKey: useMin ? 'outputMin' : 'outputMedian',
@@ -474,6 +484,9 @@ export function classifyExcluded(pairs, taskId = null) {
  * @returns {object} the noise-floor document; `pct: null` when nothing could be paired.
  */
 export function noiseFloor(baseA, baseB, options = {}) {
+  assertSameSwitches(baseA, baseB)
+  assertSameCondition(baseA, baseB)
+  compareEnvironment(baseA, baseB, options)
   const aggregate = AGGREGATES.includes(options.aggregate) ? options.aggregate : 'median'
   const merged = pairMetrics(normalizeResults(baseA), normalizeResults(baseB))
   const usablePairs = merged.pairs.filter((pair) => passed(pair.base) && passed(pair.cand))
@@ -540,7 +553,9 @@ export function resolveNoiseFloor(options = {}, base = null, cand = null) {
   }
   const noise = options.noise
   if (noise && typeof noise === 'object' && !Array.isArray(noise) && (noise.base || noise.cand)) {
-    return noiseFloor(noise.base ?? base, noise.cand ?? base, { aggregate: options.aggregate })
+    assertSameCondition(base, noise.base ?? base)
+    assertSameCondition(base, noise.cand ?? base)
+    return noiseFloor(noise.base ?? base, noise.cand ?? base, { aggregate: options.aggregate, allowCrossPlatform: options.allowCrossPlatform })
   }
   return {
     format: NOISE_FORMAT,
@@ -695,6 +710,11 @@ export function formatNumber(value) {
  * @returns {object} the comparison structure, including the gate and the verdict.
  */
 export function compareSummaries(base, cand, options = {}) {
+  const switches = assertSameSwitches(base, cand)
+  if (options.noise) assertSameSwitches(base, options.noise.base)
+  const condition = assertSameCondition(base, cand)
+  const environment = compareEnvironment(base, cand, options)
+  if (options.noise) compareEnvironment(base, options.noise.base, options)
   const aggregate = AGGREGATES.includes(options.aggregate) ? options.aggregate : 'median'
   const tolerancePct = isNumber(options.tolerancePct) ? options.tolerancePct : 2
   const failOn = FAIL_ON.includes(options.failOn) ? options.failOn : 'both'
@@ -745,6 +765,7 @@ export function compareSummaries(base, cand, options = {}) {
         stepsPct: percentChange(baseSide[keys.stepsKey], candSide[keys.stepsKey]),
         toolCallsPct: percentChange(baseSide[keys.toolsKey], candSide[keys.toolsKey]),
         toolErrorsPct: percentChange(baseSide[keys.errorsKey], candSide[keys.errorsKey]),
+        durationPct: percentChange(baseSide[keys.durationKey], candSide[keys.durationKey]),
         passRateAbs: candSide.passRate - baseSide.passRate,
       },
     }
@@ -845,6 +866,9 @@ export function compareSummaries(base, cand, options = {}) {
 
   return {
     format: COMPARE_FORMAT,
+    switches,
+    condition,
+    environment,
     base: { label: sideLabel(base, 'base'), profile: sideProfile(base, 'base'), model: baseModel, dshVersion: sideDshVersion(base, 'base') },
     cand: { label: sideLabel(cand, 'cand'), profile: sideProfile(cand, 'cand'), model: candModel, dshVersion: sideDshVersion(cand, 'cand') },
     aggregate,
@@ -874,6 +898,8 @@ export function compareSummaries(base, cand, options = {}) {
       candToolCalls: sumStat(tasks, (task) => task.cand[keys.toolsKey]),
       baseToolErrors: sumStat(tasks, (task) => task.base[keys.errorsKey]),
       candToolErrors: sumStat(tasks, (task) => task.cand[keys.errorsKey]),
+      baseDurationMs: sumStat(tasks, (task) => task.base[keys.durationKey]),
+      candDurationMs: sumStat(tasks, (task) => task.cand[keys.durationKey]),
       basePasses,
       baseRuns: baseRunsCount,
       candPasses,
diff --git a/bench/lib/condition.mjs b/bench/lib/condition.mjs
new file mode 100644
index 00000000..91f7b5db
--- /dev/null
+++ b/bench/lib/condition.mjs
@@ -0,0 +1,82 @@
+/** Explicit, reproducible model routing; unknown historical conditions stay unknown. */
+import fs from 'node:fs'
+import path from 'node:path'
+import { parse, stringify } from 'yaml'
+
+export const REASONING_EFFORTS = Object.freeze(['off', 'low', 'high', 'max'])
+export class ConditionError extends Error {}
+const literal = value => typeof value === 'string' && value.trim() !== '' && !/[\x00-\x1f]/u.test(value)
+
+export function reasoningEffort(value) {
+  if (!REASONING_EFFORTS.includes(value)) throw new ConditionError(`--reasoning-effort must be one of ${REASONING_EFFORTS.join(', ')}; got ${JSON.stringify(value)}`)
+  return value
+}
+
+export function conditionOf(run) {
+  const value = Object.hasOwn(run?.meta ?? {}, 'condition') ? run.meta.condition : run?.condition ?? null
+  if (value === null) return null
+  if (!literal(value.provider) || !literal(value.model)
+    || value.reasoningEffort !== null && !REASONING_EFFORTS.includes(value.reasoningEffort)) {
+    throw new ConditionError(`Invalid recorded condition: ${JSON.stringify(value)}`)
+  }
+  return { provider: value.provider, model: value.model, reasoningEffort: value.reasoningEffort }
+}
+
+export function describeCondition(value) {
+  return value === null || value === undefined ? 'unknown' : JSON.stringify(conditionOf({ condition: value }))
+}
+
+export function assertSameCondition(base, cand) {
+  const left = conditionOf(base), right = conditionOf(cand)
+  if (JSON.stringify(left) !== JSON.stringify(right)) {
+    throw new ConditionError(`Conditions differ; base=${describeCondition(left)}; ops=${describeCondition(right)}. Cross-condition pairing is refused.`)
+  }
+  return left
+}
+
+/** Refuse to spend tokens when the composed host profile did not apply the requested route. */
+export function assertEffectiveCondition(text, expected) {
+  if (expected === null || expected === undefined) return
+  const rows = parse(text, { customTags: [{ tag: 'tag:yaml.org,2002:js', resolve: value => ({ expression: value }) }] })
+  const entries = Array.isArray(rows) ? rows.filter(row => row?.id === 'agent-default-model' && row.disabled !== true) : []
+  const actual = entries.length === 1 ? entries[0].config : null
+  if (!actual || actual.provider !== expected.provider || actual.model !== expected.model
+    || expected.reasoningEffort !== null && actual.reasoningEffort !== expected.reasoningEffort) {
+    throw new ConditionError(`Composed agent-default-model route does not match requested condition ${describeCondition(expected)}; nothing was run.`)
+  }
+}
+
+/** The overlay's literal route supplies omitted CLI fields; no expression is evaluated. */
+export function planConditions(options, patch, read = file => fs.readFileSync(file, 'utf8')) {
+  if (!options.models.length && !options.reasoningEfforts.length && options.provider === null) return [null]
+  let route = {}
+  if (patch !== null) {
+    const rows = parse(read(patch), { customTags: [{ tag: 'tag:yaml.org,2002:js', resolve: value => ({ expression: value }) }] })
+    if (!Array.isArray(rows)) throw new ConditionError('The LLM overlay must be a list of patch entries')
+    for (const row of rows) if (row?.id === 'agent-default-model') route = row.config ?? {}
+  }
+  const provider = options.provider ?? route.provider
+  const models = options.models.length ? options.models : [route.model]
+  const efforts = options.reasoningEfforts.length ? options.reasoningEfforts : [route.reasoningEffort ?? null]
+  if (!literal(provider)) throw new ConditionError('Explicit conditions need a literal provider in the LLM overlay or --provider <id>')
+  if (models.some(model => !literal(model))) throw new ConditionError('Explicit conditions need --model <id> or a literal model in the LLM overlay')
+  for (const effort of efforts) if (effort !== null) reasoningEffort(effort)
+  return [...new Set(models)].flatMap(model => [...new Set(efforts)].map(reasoningEffort => ({ provider, model, reasoningEffort })))
+}
+
+/** Both arms receive the identical final patch after the original provider overlay. */
+export function writeConditionPatch(dir, condition) {
+  if (condition === null) return null
+  const { provider, model, reasoningEffort } = conditionOf({ condition })
+  fs.mkdirSync(dir, { recursive: true })
+  const target = path.join(dir, 'condition.patch.yml')
+  const text = stringify([{ id: 'agent-default-model', config: {
+    provider, model, ...(reasoningEffort === null ? {} : { reasoningEffort }),
+  } }])
+  fs.writeFileSync(target, text, { flag: 'wx', mode: 0o600 })
+  return target
+}
+
+export function patchArgs(llmPatch, conditionPatch) {
+  return [llmPatch, conditionPatch].filter(Boolean).flatMap(file => ['--patch', file])
+}
diff --git a/bench/lib/environment.mjs b/bench/lib/environment.mjs
new file mode 100644
index 00000000..f5629b91
--- /dev/null
+++ b/bench/lib/environment.mjs
@@ -0,0 +1,49 @@
+import { parse } from 'yaml'
+
+const COMPONENTS = ['shell', 'file', 'ptc', 'discovery', 'panel', 'tui', 'hide-official']
+
+/** Read configuration facts, never evaluate an expression or infer publication readiness. */
+export function componentFacts(text) {
+  const facts = Object.fromEntries(COMPONENTS.map(name => [name, 'unknown']))
+  let rows
+  try { rows = parse(text) } catch { return facts }
+  if (!Array.isArray(rows)) return facts
+  for (const name of COMPONENTS) {
+    const found = rows.filter(row => row?.id === `dsh-ops-${name}`)
+    if (!found.length) facts[name] = 'absent'
+    else if (found.length === 1) {
+      const row = found[0]
+      if (row.disabled === true || row.config?.enabled === false) facts[name] = 'disabled'
+      else if ((row.disabled === undefined || row.disabled === false) && (row.config?.enabled === undefined || row.config.enabled === true)) facts[name] = 'enabled'
+    }
+  }
+  return facts
+}
+
+export function platformOf(run) {
+  const value = run?.meta?.platform ?? run?.platform
+  return typeof value === 'string' && value.trim() ? value : 'unknown'
+}
+
+/** Old unknown/unknown archives remain readable; a known/unknown pair needs the override too. */
+export function compareEnvironment(base, cand, options = {}) {
+  const platforms = { base: platformOf(base), cand: platformOf(cand) }
+  const crossPlatform = platforms.base !== platforms.cand
+  if (crossPlatform && options.allowCrossPlatform !== true) {
+    throw new Error(`platform mismatch: base=${platforms.base}, cand=${platforms.cand}; use --allow-cross-platform only for diagnostics (not a plugin effect)`)
+  }
+  return { platforms, crossPlatform, components: {
+    base: base?.components ?? base?.arms?.base?.components ?? null,
+    cand: cand?.components ?? cand?.arms?.cand?.components ?? null,
+  } }
+}
+
+export function environmentLines(environment) {
+  if (!environment) return []
+  return [
+    `Platform: base=${environment.platforms.base}; cand=${environment.platforms.cand}.`,
+    ...(environment.crossPlatform ? ['WARNING: cross-platform diagnostic; differences are not a plugin effect.'] : []),
+    `Component rows (configuration, not a readiness receipt): base=${JSON.stringify(environment.components.base)}; cand=${JSON.stringify(environment.components.cand)}.`,
+    '',
+  ]
+}
diff --git a/bench/lib/matrix.mjs b/bench/lib/matrix.mjs
new file mode 100644
index 00000000..8adfcc8b
--- /dev/null
+++ b/bench/lib/matrix.mjs
@@ -0,0 +1,59 @@
+/** Separate condition groups; there is deliberately no cross-condition aggregate. */
+import fs from 'node:fs'
+import path from 'node:path'
+import { describeCondition, assertSameCondition } from './condition.mjs'
+
+export const MATRIX_FORMAT = 'dsh-ops-bench-matrix-v1'
+export const MATRIX_FILE = 'matrix.json'
+
+export async function runMatrix({ conditions, root, argv, options, io, run }) {
+  const out = io.out ?? console.log
+  const manifest = { format: MATRIX_FORMAT, groups: [] }
+  if (!options.show) {
+    fs.mkdirSync(root, { recursive: true })
+    fs.writeFileSync(path.join(root, MATRIX_FILE), JSON.stringify(manifest, null, 2), { flag: 'wx' })
+  }
+  let exit = 0
+  for (const [index, condition] of conditions.entries()) {
+    const directory = `condition-${String(index + 1).padStart(3, '0')}`
+    const group = { directory, condition, base: null, cand: null, exitCode: null }
+    manifest.groups.push(group)
+    out(`[matrix] ${index + 1}/${conditions.length}: ${describeCondition(condition)}`)
+    const code = await run(argv, { ...io, conditionOverride: condition, groupOverride: path.join(root, directory),
+      onResult(result) {
+        for (const side of ['base', 'cand']) if (result.summaryFiles?.[side]) group[side] = path.relative(root, result.summaryFiles[side]).split(path.sep).join('/')
+        io.onResult?.(result)
+      },
+    })
+    group.exitCode = code
+    if (!options.show) fs.writeFileSync(path.join(root, MATRIX_FILE), JSON.stringify(manifest, null, 2) + '\n')
+    if (code !== 0) exit = code === 2 ? 2 : exit || 1
+    if (code === 2 || io.interrupt?.stopped) break
+  }
+  out('[matrix] Cross-condition results are not comparable; no combined delta is computed.')
+  return exit
+}
+
+export function matrixComparisons(root, options, { resolveSide, compare }) {
+  const dir = path.resolve(root), manifest = JSON.parse(fs.readFileSync(path.join(dir, MATRIX_FILE), 'utf8'))
+  if (manifest.format !== MATRIX_FORMAT || !Array.isArray(manifest.groups) || !manifest.groups.length) throw new Error('Not a populated benchmark matrix')
+  const side = file => {
+    if (typeof file !== 'string') throw new Error('Matrix group has no completed side summaries')
+    const target = path.resolve(dir, file), relative = path.relative(dir, target)
+    if (path.isAbsolute(relative) || relative.startsWith(`..${path.sep}`) || relative === '..') throw new Error('Matrix summary escapes its group root')
+    return resolveSide(target, options).doc
+  }
+  return manifest.groups.map(group => {
+    const base = side(group.base), cand = side(group.cand)
+    assertSameCondition(base, { condition: group.condition })
+    assertSameCondition(cand, { condition: group.condition })
+    return compare(base, cand, options)
+  })
+}
+
+export function renderMatrix(comparisons, render) {
+  return ['# Benchmark condition matrix', '', 'Cross-condition results are not comparable. Each section is independent; deltas are never combined.', '',
+    ...comparisons.flatMap((comparison, index) => [`## Condition ${index + 1}: ${describeCondition(comparison.condition)}`, '',
+      render(comparison).replace(/^# [^\n]*\n\n/, '').replace(/^Condition: [^\n]*\n\n/, '').replace(/^## /gm, '### '), '']),
+  ].join('\n')
+}
diff --git a/bench/lib/next-folder.mjs b/bench/lib/next-folder.mjs
index 59892e27..4f7b41e3 100644
--- a/bench/lib/next-folder.mjs
+++ b/bench/lib/next-folder.mjs
@@ -1,17 +1,18 @@
 #!/usr/bin/env node
 /**
- * Allocate the next free `benchmark-test-NN` group directory under `bench/runs/`.
+ * Allocate the next free date-stamped group directory under `bench/runs/`.
  *
- * `ab` allocates this **exactly once per sweep** and hands the answer to both sides
- * and to the comparison: letting each process default on its own would put the
- * baseline in `benchmark-test-01` and the candidate in `benchmark-test-02` (that
- * group exists by then), and the comparison would have nothing to pair.
+ * The default name is `benchmark-YYYY-MM-DD-NN` — the local calendar date, numbered
+ * from `-00` — and `ab` allocates it **exactly once per sweep**, handing the answer
+ * to both sides and to the comparison: letting each process default on its own would
+ * put the baseline and the candidate in two different groups, and the comparison
+ * would have nothing to pair.
  *
  * The scan is read-only and non-exclusive on purpose: two sweeps started in the same
- * instant can both see `benchmark-test-01` free, and the failure mode is two runs
- * landing in one group — visible in the report, never lost data. A number is skipped
- * when *any* entry has that name, so a leftover empty directory from a failed sweep
- * is skipped rather than reused.
+ * instant can both see `-00` free, and the failure mode is two runs landing in one
+ * group — visible in the report, never lost data. A number is skipped when *any* entry
+ * has that name, so a leftover empty directory from a failed sweep is skipped rather
+ * than reused.
  *
  * @module dsh-ops/bench/next-folder
  */
@@ -24,10 +25,23 @@ import { BENCH_DIR } from './env.mjs'
 /** Where `run.json` archives land, one directory per sweep. */
 export const RUNS_DIR = path.join(BENCH_DIR, 'runs')
 /** The group prefix both the CLI help text and this scan agree on. */
-export const FOLDER_PREFIX = 'benchmark-test-'
-/** Zero-padded to two digits; numbers past 99 simply grow (`benchmark-test-100`). */
+export const FOLDER_PREFIX = 'benchmark-'
+/** Zero-padded to two digits; numbers past 99 simply grow (`benchmark-2026-10-24-100`). */
 const WIDTH = 2
 
+/**
+ * The local calendar date of `now` as `YYYY-MM-DD`.
+ * @param {Date} [now] - the instant to stamp (default the current time).
+ * @returns {string} the zero-padded local date.
+ */
+export function dayStamp(now = new Date()) {
+  return [
+    String(now.getFullYear()).padStart(4, '0'),
+    String(now.getMonth() + 1).padStart(2, '0'),
+    String(now.getDate()).padStart(2, '0'),
+  ].join('-')
+}
+
 /**
  * The group names already present under the runs root, lower-cased so the answer
  * holds on a case-insensitive filesystem (Windows) as well as a case-sensitive one.
@@ -45,14 +59,17 @@ export function takenFolders(runsDir) {
 }
 
 /**
- * The first `benchmark-test-NN` nobody is using yet.
+ * The first `benchmark-YYYY-MM-DD-NN` nobody is using yet.
  * @param {string} [runsDir] - the runs root to scan (default {@link RUNS_DIR}).
- * @returns {string} the free group name, zero-padded to two digits.
+ * @param {Date} [now] - the instant whose local date names the group (default now);
+ *   injectable so a suite can assert exact names instead of patterns.
+ * @returns {string} the free group name, numbered from `-00` on that date.
  */
-export function nextFolderName(runsDir = RUNS_DIR) {
+export function nextFolderName(runsDir = RUNS_DIR, now = new Date()) {
   const taken = takenFolders(runsDir)
-  for (let number = 1; ; number += 1) {
-    const name = `${FOLDER_PREFIX}${String(number).padStart(WIDTH, '0')}`
+  const prefix = `${FOLDER_PREFIX}${dayStamp(now)}-`
+  for (let number = 0; ; number += 1) {
+    const name = `${prefix}${String(number).padStart(WIDTH, '0')}`
     if (!taken.has(name.toLowerCase())) return name
   }
 }
diff --git a/bench/lib/switches.mjs b/bench/lib/switches.mjs
new file mode 100644
index 00000000..a7e35234
--- /dev/null
+++ b/bench/lib/switches.mjs
@@ -0,0 +1,46 @@
+import { parse } from 'yaml'
+
+export const SWITCH_ROWS = Object.freeze(Object.fromEntries(['hide-official', 'ptc', 'panel', 'discovery', 'shell'].map(name => [name, `dsh-ops-${name}`])))
+export const ACTIVATION_KEYS = Object.freeze({ discovery: 'enabled', panel: 'capture', shell: 'publishBashTool' })
+export const parseRows = text => parse(text, { customTags: [{ tag: 'tag:yaml.org,2002:js', resolve: value => ({ expression: value }) }] })
+
+/** Configuration facts only; readiness is established separately by setup's host probe. */
+export function switchesFromDump(text) {
+  const rows = parseRows(text)
+  if (!Array.isArray(rows)) return null
+  const switches = {}
+  for (const [name, id] of Object.entries(SWITCH_ROWS)) {
+    const matches = rows.filter(row => row?.id === id)
+    if (!matches.length) continue
+    if (matches.length !== 1) throw new Error(`Ambiguous component row ${id}`)
+    const row = matches[0]
+    const knownConfig = row.config === undefined || (row.config !== null && typeof row.config === 'object'
+      && !Array.isArray(row.config) && !Object.hasOwn(row.config, 'expression'))
+    const activation = row.config?.[ACTIVATION_KEYS[name]]
+    const enabled = row.disabled === true || activation === false ? false
+      : knownConfig && (row.disabled === undefined || row.disabled === false) && (activation === undefined || activation === true) ? true : null
+    switches[name] = { enabled }
+    if (name === 'hide-official') switches[name].replaceTools = Array.isArray(row.config?.replaceTools)
+      && row.config.replaceTools.every(value => typeof value === 'string') ? [...row.config.replaceTools].sort() : null
+  }
+  return switches
+}
+
+function canonical(value) {
+  if (Array.isArray(value)) return value.map(canonical)
+  if (value && typeof value === 'object') return Object.fromEntries(Object.keys(value).sort().map(key => [key, canonical(value[key])]))
+  return value
+}
+
+export function candidateSwitches(run) {
+  return run?.candidateSwitches ?? run?.arms?.cand?.switches ?? null
+}
+
+/** Both summaries in one A/B carry the same candidate set; baseline {} is not compared to it. */
+export function assertSameSwitches(base, cand) {
+  const left = candidateSwitches(base), right = candidateSwitches(cand)
+  if (JSON.stringify(canonical(left)) !== JSON.stringify(canonical(right))) {
+    throw new Error(`Candidate switches differ: base=${JSON.stringify(left)}; cand=${JSON.stringify(right)}; incompatible sweeps cannot be paired`)
+  }
+  return left
+}
diff --git a/bench/llm.patch.example.yml b/bench/llm.patch.example.yml
index 9162da48..424feadd 100644
--- a/bench/llm.patch.example.yml
+++ b/bench/llm.patch.example.yml
@@ -1,44 +1,20 @@
-# dsh-ops benchmark —— LLM 路由 overlay 模板
-#
-# 用法（详见 bench/PLAN.md §8、bench/README.md）：
-#   1) 复制本文件为 bench/llm.patch.yml（已在 .gitignore，不进仓库）；
-#   2) 填写你的 OpenAI 兼容服务器与模型 id（下面所有 <...> 占位符）；
-#   3) 设置 apiKeyEnv 指向的环境变量（如 BENCH_SERVER_API_KEY），
-#      密钥只放环境变量或 $DSH_HOME/.credentials.yaml，**绝不写进本文件**；
-#   4) node bench/run.mjs 会自动把它以 --patch 传给每次 dsh 调用
-#      （含 dump-config 存档）→ bench-base / bench-ops 两侧
-#      provider/model 一致性由构造保证（PLAN §2.7）；
-#      换别的 overlay 用 --llm-patch <path>；确实不想用 overlay（两侧各跑
-#      各自 profile 自带的路由）用 --no-llm-patch，sweep 会把"两侧不共享
-#      任何路由"这句话说出口。文件不存在又没给 --no-llm-patch 时，
-#      runner 在 spawn 之前就拒绝（退 2），不会静默换一条路由开跑。
-#
-# 注意：
-#   - 路由名 bench-server 可自定，但 llm-pi-ai 与 agent-default-model
-#     两处必须一致；
-#   - api 按服务器协议选择，自托管（vLLM / sglang / llama.cpp 的
-#     OpenAI 兼容端点）用 openai-completions；
-#   - 服务器必须在流式响应里回报 usage（stream_options.include_usage），
-#     否则 harness 拒绝给出 token 结论（PLAN §2.6）；
-#   - contextWindow 要按模型真实窗口填：现有语料里最长的题峰值 prompt 约 2 万 token，
-#     这个值不影响它们；但填小了仍会让 compaction-basic（0.8 × contextWindow）
-#     提前触发压缩，想跑长上下文任务时尤其要注意；
-#   - patch 语义是"整段替换 config"：llm-pi-ai 的 config 只有 providers
-#     一个字段、agent-default-model 只有 provider/model，直接照抄结构即可。
+- insert:
+    - id: credentials-local
+      name: "@deepseek-ai/dsh-credentials-local"
 
 - id: llm-pi-ai
   config:
     providers:
       bench-server:
-        baseURL: https://<你的服务器>/v1
-        apiKeyEnv: BENCH_SERVER_API_KEY
+        baseURL: https://<your-server>/v1
+        apiKeyEnv: DSH_API_KEY_ENV_NAME
         api: openai-completions
         models:
-          - id: <模型id>
+          - id: <model-id>
             contextWindow: 262144
-            maxTokens: 16384
+            maxTokens: 32768
 
 - id: agent-default-model
   config:
     provider: bench-server
-    model: <模型id>
+    model: <model-id>
diff --git a/bench/report/panel.mjs b/bench/report/panel.mjs
index a90d83cf..59dfbc25 100644
--- a/bench/report/panel.mjs
+++ b/bench/report/panel.mjs
@@ -375,6 +375,13 @@ function renderConclusion() {
     : '噪声底(A/A)±' + SUMMARY.noise.pct.toFixed(1) + '% → ' + (SUMMARY.readable ? '超过噪声 ⇒ 可读方向' : '落在噪声内 ⇒ 只报区间,不报方向')
 }
 function renderOverview(node) {
+  const condition = obj(RUN.meta).condition
+  node.appendChild(el('p', 'mono', 'Candidate switches: ' + j(obj(obj(RUN.arms).cand).switches || null)))
+  node.appendChild(el('p', 'mono', 'Condition: ' + (condition === undefined || condition === null ? 'unknown' : j(condition))))
+  const environment = el('div', 'card')
+  environment.appendChild(el('h3', null, 'Platform / component configuration'))
+  environment.appendChild(el('pre', null, JSON.stringify({ platform: obj(RUN.meta).platform || 'unknown', components: Object.fromEntries(Object.entries(obj(RUN.arms)).map(([key, arm]) => [key, obj(arm).components || null])) }, null, 2)))
+  node.appendChild(environment)
   const keys = pairKeys()
   const taskRows = SUMMARY.tasks.map((task) => {
     const base = task.arms[keys[0]]
diff --git a/bench/run.mjs b/bench/run.mjs
index c6e66b34..cae36179 100644
--- a/bench/run.mjs
+++ b/bench/run.mjs
@@ -8,9 +8,14 @@
  * `bench/run/schedule.mjs`. It does not spawn a child, does not aggregate and does not
  * judge: scheduling is `run/schedule.mjs`, one session is `run/session.mjs` (P7),
  * aggregation is `lib/aggregate.mjs` (P6), the verdict is `lib/compare-core.mjs`
- * (P11a), and sealing is the **injected** `io.seal` callback — `bench/run/seal.mjs`
- * (P8a) is not imported here, deliberately, so this slice lands while P8a is still in
- * flight; the wiring supplies it.
+ * (P11a), and sealing is opt-in: `--seal` writes the schema-validated `run.json` through
+ * `bench/run/seal.mjs` (P8a), while every sweep keeps each arm's `results/` and
+ * `summary.json` either way. A finished sweep also renders the markdown report from its
+ * own verdict (`compare.mjs`'s `renderReport`) into the group folder — `--no-report`
+ * skips it, and an interrupted sweep writes none, because a partial run is not a
+ * comparison. An injected `io.seal` supplies the document an embedder
+ * wants; the CLI spawns this entry as a child and cannot inject one, so the flag has to
+ * select the real seal rather than a missing slice.
  *
  * Why one process for both arms: the pre-#205 shape spawned one runner per arm, so
  * every baseline run happened before every candidate run and the machine's drift
@@ -26,17 +31,24 @@
 
 import fs from 'node:fs'
 import path from 'node:path'
+import { createHash } from 'node:crypto'
 import { spawnSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
 
 import { EXIT, UsageError, planAb } from './cli.mjs'
-import { LLM_OVERLAY, REPO_ROOT, resolveDshEntry } from './lib/env.mjs'
+import { LLM_OVERLAY, REPO_ROOT, resolveDshEntry, spawnPlan } from './lib/env.mjs'
 import { TASKS_DIR, loadTasks, selectTasks } from './lib/tasks.mjs'
 import { RUNS_DIR } from './lib/next-folder.mjs'
 import { DEFAULT_REPEAT, armOrder, createInterrupt, planPairs, planSessions, repeatsById, runSweep } from './run/schedule.mjs'
+import { sealRun } from './run/seal.mjs'
+import { renderReport, reportFileName } from './compare.mjs'
+import { reasoningEffort, planConditions, writeConditionPatch, patchArgs, describeCondition, assertEffectiveCondition } from './lib/condition.mjs'
+import { runMatrix } from './lib/matrix.mjs'
+import { componentFacts } from './lib/environment.mjs'
+import { switchesFromDump } from './lib/switches.mjs'
 
 /** The runner-only flags that take a value; `--task`/`--repeat`/`--folder`/`--base`/`--cand` are parsed by the CLI. */
-const VALUE_FLAGS = ['--sleep-ms', '--out', '--heartbeat-ms', '--stall-ms', '--timeout', '--dsh', '--llm-patch', '--model']
+const VALUE_FLAGS = ['--sleep-ms', '--out', '--heartbeat-ms', '--stall-ms', '--timeout', '--dsh', '--llm-patch', '--model', '--reasoning-effort', '--provider']
 /** The integer-valued flags, by option name. */
 const INTEGER_FLAGS = { '--sleep-ms': 'sleepMs', '--heartbeat-ms': 'heartbeatMs', '--stall-ms': 'stallMs', '--timeout': 'timeoutMs' }
 /** The string-valued flags, by option name. */
@@ -58,7 +70,7 @@ export function abUsage() {
     '  --base <label>       baseline arm label, also its profile name (default bench-base)',
     '  --cand <label>       candidate arm label, also its profile name (default bench-ops)',
     '  --aa                 A/A mode: run the baseline twice and measure the noise floor; --cand is ignored',
-    '  --folder <name>      group directory under bench/runs (default: the next benchmark-test-NN)',
+    '  --folder <name>      group directory under bench/runs (default: the next free benchmark-YYYY-MM-DD-NN)',
     '  --out <dir>          the sweep directory outright; not with --folder',
     '  --sleep-ms N         fixed pause between pairs (default 0)',
     '  --heartbeat-ms N     per-session "still running" line (default 15000; 0 = off)',
@@ -69,21 +81,34 @@ export function abUsage() {
     '                       (default: bench/llm.patch.yml, the file `setup` creates)',
     '  --no-llm-patch       run on the profiles\' own routes instead of the overlay;',
     '                       the two sides then share no route and the sweep says so',
-    '  --model <id>         model id recorded for the run',
+    '  --model <id>         actual model route for both arms (repeatable)',
+    '  --reasoning-effort E off | low | high | max (repeatable; Cartesian model × effort matrix)',
+    '  --provider <id>      override the overlay provider for explicit conditions',
     '  --keep               keep each temporary workspace',
     '  --verbose            narrate every event line',
     '  --show               print the pair-by-pair plan and exit without running',
-    '  --no-seal            run without the injected seal callback (no run.json; said out loud)',
+    '  --seal               also seal the sweep into the schema-validated run.json (default:',
+    '                       every arm keeps results/ and summary.json, nothing else)',
+    '  --no-seal            explicit off; this is already the default, kept for old command lines',
+    '  --no-report          skip the markdown report a finished sweep writes into the group',
+    '                       folder (default: written; an interrupted sweep never writes one)',
     '  -h, --help           this text',
     '',
-    'Exit codes: 0 ok · 1 a failed sweep · 2 usage error · 3 sealing is not wired yet',
-    '(the caller injects P8a\'s sealRun as `io.seal`; without it, and without --no-seal,',
-    'nothing is spawned so no token is spent on an unsealable sweep).',
+    'Exit codes: 0 ok · 1 a failed sweep · 2 usage error',
+    'A finished sweep writes each arm\'s results/ and summary.json, the group folder\'s',
+    '"DSH-OPS Benchmark Report <UTC>.md", and --seal adds the schema-validated run.json',
+    'on top. `bench report` re-renders that report from the archives at any later time.',
   ].join('\n')
 }
 
 /** Apply one runner-only flag with a value to the parsed options. */
 function applyRunFlag(options, flag, value) {
+  if (flag === '--model') { options.models.push(value); options.model = value; return }
+  if (flag === '--reasoning-effort') {
+    try { options.reasoningEfforts.push(reasoningEffort(value)); return }
+    catch (error) { throw new UsageError(error.message) }
+  }
+  if (flag === '--provider') { options.provider = value; return }
   if (Object.hasOwn(INTEGER_FLAGS, flag)) {
     const number = Number(value)
     if (!Number.isInteger(number) || number < 0) throw new UsageError(`${flag} needs a non-negative integer, got ${value}`)
@@ -109,7 +134,8 @@ export function parseRunArgs(argv, context = {}) {
     aa: false,
     verbose: false,
     keep: false,
-    noSeal: false,
+    seal: false,
+    noReport: false,
     noLlmPatch: false,
     sleepMs: 0,
     out: null,
@@ -119,19 +145,22 @@ export function parseRunArgs(argv, context = {}) {
     dsh: null,
     llmPatch: null,
     model: null,
+    models: [], reasoningEfforts: [], provider: null,
   }
   for (let index = 0; index < plan.extra.length; index += 1) {
     const flag = plan.extra[index]
     if (flag === '--aa') options.aa = true
     else if (flag === '--verbose' || flag === '-v') options.verbose = true
     else if (flag === '--keep') options.keep = true
-    else if (flag === '--no-seal') options.noSeal = true
+    else if (flag === '--seal') options.seal = true
+    else if (flag === '--no-seal') options.seal = false
+    else if (flag === '--no-report') options.noReport = true
     else if (flag === '--no-llm-patch') options.noLlmPatch = true
     else if (flag === '--label' || flag === '--profile') {
       throw new UsageError(`${flag} named one arm of a per-process run; \`ab\` runs both arms itself — use --base/--cand`)
     } else if (VALUE_FLAGS.includes(flag)) {
       const value = plan.extra[index + 1]
-      if (value === undefined || value === '') throw new UsageError(`this flag needs a value: ${flag}`)
+      if (value === undefined || value === '' || value.startsWith('--')) throw new UsageError(`this flag needs a value: ${flag}`)
       applyRunFlag(options, flag, value)
       index += 1
     } else if (flag.startsWith('-')) {
@@ -192,6 +221,78 @@ export function resolveLlmPatch(options, context = {}) {
   return { path: overlay, implicit: true }
 }
 
+/**
+ * The default profile fingerprint probe: the composed configuration `dsh` reports for one
+ * profile. `setup` reads the same tree back to prove a pin really landed, so hashing it
+ * records what each arm ran rather than what its file was called.
+ * @param {{file: string, kind: 'js'|'exe'}} entry - the resolved dsh launcher.
+ * @param {string} profile - the profile name to dump.
+ * @param {{run?: Function, cwd?: string, env?: Record<string, string|undefined>}} [context] - injectable probe, directory and environment.
+ * @returns {string} the command's stdout and stderr.
+ * @throws {Error} when it cannot start or exits nonzero: an arm with no fingerprint is not evidence.
+ */
+export function dumpProfileConfig(entry, profile, context = {}) {
+  const plan = spawnPlan(entry, ['--profile', profile, ...patchArgs(context.llmPatch, context.conditionPatch), '--dump-config'])
+  const result = (context.run ?? spawnSync)(plan.command, plan.args, {
+    cwd: context.cwd ?? REPO_ROOT,
+    env: context.env ?? process.env,
+    encoding: 'utf8',
+    timeout: 60_000,
+    windowsHide: true,
+    stdio: ['ignore', 'pipe', 'pipe'],
+  })
+  if (result.error) throw new Error(`could not run "dsh --profile ${profile} --dump-config": ${String(result.error.message ?? result.error)}`)
+  if (result.status !== 0) {
+    const detail = String(result.stderr ?? '').trim().split('\n').filter(Boolean).pop() ?? ''
+    throw new Error(`"dsh --profile ${profile} --dump-config" exited ${String(result.status)}${detail === '' ? '' : `: ${detail}`}`)
+  }
+  return String(result.stdout ?? '')
+}
+
+/**
+ * Fingerprint both arms: the SHA-256 of each profile's dumped configuration, which
+ * `bench/run.schema.json` records in `arms[]` and `sealRun` requires before it will seal.
+ * @param {{side: string, profile: string}[]} arms - the two arms of the sweep.
+ * @param {{entry?: object, dump?: (entry: object, profile: string, context: object) => string, env?: object}} [context] - the launcher and the injectable probe.
+ * @returns {Record<string, string>} the hex digest of each side's composed configuration.
+ * @throws {Error} when a dump prints nothing, naming the arm that has no fingerprint.
+ */
+export function profileFingerprints(arms, context = {}) {
+  const dump = context.dump ?? dumpProfileConfig
+  const hashes = {}
+  for (const arm of arms) {
+    const text = dump(context.entry, arm.profile, context)
+    if (typeof text !== 'string' || text.trim() === '') {
+      throw new Error(`"dsh --profile ${arm.profile} --dump-config" printed nothing, so the ${arm.side} arm has no profile fingerprint`)
+    }
+    assertEffectiveCondition(text, context.condition)
+    hashes[arm.side] = createHash('sha256').update(text).digest('hex')
+    if (context.dirs?.[arm.side]) {
+      fs.mkdirSync(context.dirs[arm.side], { recursive: true })
+      fs.writeFileSync(path.join(context.dirs[arm.side], 'dump-config.txt'), text, { mode: 0o600 })
+    }
+    arm.components = componentFacts(text)
+    arm.switches = switchesFromDump(text)
+  }
+  return hashes
+}
+
+/**
+ * The default seal: adapt the sweep's seal context to {@link sealRun}.
+ *
+ * The callback is handed the two arm directories as a `{base, cand}` map, while `sealRun`
+ * folds a list of sweep directories into one document and places `run.json` in their
+ * common parent (the group folder). Handing the map straight to `sealRun` fails on
+ * `dirs.map` — which no injected double could catch, because a double never inspects it.
+ * @param {{dirs: {base: string, cand: string}|string[], arms: object, meta?: object}} context - the seal context.
+ * @param {(options: object) => object} [seal] - the sealer, injectable so a suite can read what it is handed.
+ * @returns {object} the seal receipt.
+ */
+export function sealSweep(context, seal = sealRun) {
+  const dirs = Array.isArray(context.dirs) ? context.dirs : [context.dirs.base, context.dirs.cand]
+  return seal({ ...context, dirs })
+}
+
 /** The `<UTC stamp>-<label>` run directories, one per arm, under the sweep's group. */
 export function prepareDirs(options, arms, context = {}) {
   const runsDir = context.runsDir ?? RUNS_DIR
@@ -269,14 +370,46 @@ function printResult(out, err, result, options) {
     : `[ab] noise   : ${noise === null ? 'not measured (no --aa); cost direction withheld' : `±${noise.pct}% (${noise.method})`}`)
   if (result.compare?.gate?.fail === true) err(`[ab] verdict : FAIL — ${result.compare.gate.reasons.join('; ')}`)
   else out('[ab] verdict : pass (pass-rate gate)')
-  out(`[ab] sealed  : ${result.sealed?.path ?? (result.sealError ? `FAILED (${result.sealError})` : 'no — run.json was not written')}`)
+  out(`[ab] sealed  : ${result.sealed?.path ?? (result.sealError ? `FAILED (${result.sealError})` : 'no — not requested (--seal writes run.json)')}`)
+}
+
+/**
+ * The sweep's own report: the verdict it just computed, rendered through
+ * `compare.mjs`'s `renderReport` and written beside the arm directories — the group
+ * folder, or the `--out` sweep directory a custom one named. This is the `bench report`
+ * artifact produced without a second command; `bench report` still re-renders it later
+ * from the same summaries.
+ *
+ * An interrupted sweep writes none: the comparison of a partial run is not evidence, and
+ * a report-shaped file that looks complete while the sweep says PARTIAL would lie to a
+ * reviewer who opens it without the console.
+ * @param {object} result - the sweep result (`compare`, `arms`, `dirs`, `summaryFiles`,
+ *   `interrupted` as `runSweep` returned them).
+ * @param {{now?: Function, writeFile?: Function, mkdir?: Function}} [context] - the clock
+ *   the file name stamps and injectable sinks; defaults to the wall clock and `fs`.
+ * @returns {{target: string|null, skipped: string|null}} where the report landed, or why
+ *   it was skipped (`target: null`).
+ * @throws {Error} when rendering or writing fails — `main` reports that without turning
+ *   it into a sweep failure.
+ */
+export function sweepReport(result, context = {}) {
+  if (result.compare === null) return { target: null, skipped: 'no comparison ran' }
+  if (result.interrupted) return { target: null, skipped: 'a partial sweep is not a comparison' }
+  const now = context.now ?? Date.now
+  const write = context.writeFile ?? fs.writeFileSync
+  const mkdir = context.mkdir ?? fs.mkdirSync
+  const target = path.join(path.dirname(result.dirs.base), reportFileName(now()))
+  mkdir(path.dirname(target), { recursive: true })
+  write(target, `${renderReport(result.compare)}\n`, 'utf8')
+  return { target, skipped: null }
 }
 
 /**
  * Run the sweep. Every dependency is injectable through `io` so a test never spawns,
  * never reads `~/.dsh` and never touches a model: `io.seal`, `io.runSession`,
  * `io.sweep`, `io.observe`, `io.resolveEntry`, `io.now`, `io.sleep`, `io.kill`,
- * `io.tasksDir`, `io.runsDir`, `io.env`, `io.interrupt`, `io.profileHashes`.
+ * `io.tasksDir`, `io.runsDir`, `io.env`, `io.interrupt`, `io.profileHashes`,
+ * `io.dumpProfileConfig`.
  * @param {string[]} argv - the arguments after `ab`.
  * @param {object} [io] - the wiring and the sinks (`out`, `err`).
  * @returns {Promise<number>} the exit code.
@@ -300,8 +433,9 @@ export async function main(argv, io = {}) {
     out(abUsage())
     return EXIT.ok
   }
-  // Resolved before the seal guard and before any spawn: both are conditions under which a
-  // sweep would measure, or record, something other than what the operator asked for.
+  if (io.groupOverride) options.out = io.groupOverride
+  // Resolved before any spawn: a contradictory or absent overlay is a condition under which
+  // the sweep would measure something other than what the operator asked for.
   let patch
   try {
     patch = resolveLlmPatch(options, { overlay: io.llmOverlay, exists: io.overlayExists })
@@ -318,11 +452,21 @@ export async function main(argv, io = {}) {
     }
     patch = { path: null, implicit: false, refused: error.message }
   }
-  if (!options.show && options.noSeal !== true && typeof io.seal !== 'function') {
-    err('bench ab: sealing is not wired in this slice yet — P8a\'s bench/run/seal.mjs must be injected as io.seal.')
-    err('Nothing was spawned and no token was spent. Pass --no-seal to run an unsealed sweep (no run.json), or --show to just print the plan.')
-    return EXIT.pending
+  let conditions
+  try { conditions = Object.hasOwn(io, 'conditionOverride') ? [io.conditionOverride] : planConditions(options, patch.path, io.readOverlay) }
+  catch (error) { err(`bench ab: ${error.message}`); return EXIT.usage }
+  if (conditions.length > 1) {
+    const root = options.out === null ? path.join(io.runsDir ?? RUNS_DIR, options.folder) : path.resolve(options.out)
+    try { return await runMatrix({ conditions, root, argv, options, io: { ...io, interrupt: io.interrupt ?? createInterrupt() }, run: main }) }
+    catch (error) { err(`bench matrix: ${error.message}`); return EXIT.failure }
   }
+  const condition = conditions[0]
+  options.model = condition?.model ?? null
+  // Sealing is opt-in: a sweep always writes each arm's `results/` and `summary.json`, and
+  // `--seal` adds the schema-validated `run.json` on top. The CLI spawns this entry as a
+  // child and cannot inject a callback, so "sealed" means the flag plus either the injected
+  // `io.seal` (an embedder's own document) or the real seal in `bench/run/seal.mjs` (P8a).
+  const seal = options.seal !== true ? undefined : (typeof io.seal === 'function' ? io.seal : sealSweep)
 
   let tasks
   try {
@@ -332,8 +476,7 @@ export async function main(argv, io = {}) {
     return EXIT.usage
   }
   const repeats = repeatsById(tasks, { repeat: options.repeat, repeatExplicit: options.repeatExplicit })
-  const hashes = io.profileHashes ?? {}
-  const arms = buildArms(options).map((arm) => ({ ...arm, profileHash: hashes[arm.side] ?? null }))
+  const arms = buildArms(options)
   const { sweepDir, dirs } = prepareDirs(options, arms, io)
   const pairs = planPairs({ tasks, repeats })
   const sessions = planSessions({ tasks, repeats, arms })
@@ -341,6 +484,7 @@ export async function main(argv, io = {}) {
   out(`[ab] base    : ${arms[0].label} (profile ${arms[0].profile})`)
   out(`[ab] cand    : ${arms[1].label} (profile ${arms[1].profile})${options.aa ? '  [A/A: the baseline run twice]' : ''}`)
   out(`[ab] patch   : ${patch.path ?? 'none (--no-llm-patch) — the two sides share no route'}`)
+  out(`[ab] condition: ${describeCondition(condition)}`)
   out(`[ab] pairs   : ${pairs.length} pair(s) = ${sessions.length} session(s), serial, AB/BA-interleaved${options.repeatExplicit ? ` (--repeat ${options.repeat})` : ' (per-task repeat budgets)'}`)
   if (options.out === null) out(`[ab] group   : bench/runs/${options.folder}${options.allocated ? ' [auto]' : ''}`)
   out(`[ab] out     : ${sweepDir}`)
@@ -362,8 +506,28 @@ export async function main(argv, io = {}) {
     return EXIT.failure
   }
 
+  // Before any session: an arm whose composed configuration cannot be read has no
+  // fingerprint, and a sweep that cannot be sealed is not evidence. Refusing here costs
+  // nothing; refusing after the sweep would have spent the tokens first.
+  let hashes = io.profileHashes ?? null, conditionPatch = null
+  if (condition !== null || hashes === null) {
+    try {
+      conditionPatch = writeConditionPatch(sweepDir, condition)
+      hashes = profileFingerprints(arms, { entry, dump: io.dumpProfileConfig, env: io.env,
+        llmPatch: patch.path, conditionPatch, condition, dirs })
+    } catch (error) {
+      err(`bench ab: ${String(error?.message ?? error)}`)
+      err('nothing was spawned and no token was spent; run "node bench/cli.mjs setup" if the profiles are not prepared yet. Configuration facts are required even without --seal.')
+      return EXIT.failure
+    }
+  }
+  for (const arm of arms) arm.profileHash = hashes?.[arm.side] ?? null
+  if (seal !== undefined) {
+    out(`[ab] profile : ${arms.map((arm) => `${arm.profile} ${arm.profileHash === null ? 'n/a' : arm.profileHash.slice(0, 12)}`).join('  ')}`)
+  }
+
   const interrupt = io.interrupt ?? createInterrupt()
-  const uninstall = (io.installSignals ?? true) === false ? () => {} : installSignals(interrupt, err, io)
+  const uninstall = (io.installSignals ?? true) === false ? () => { } : installSignals(interrupt, err, io)
   const log = (level, line) => (level === 'warn' ? err : out)(line)
   // The recorded command line names the overlay when the operator did not: a summary that
   // cannot say which route ran is not evidence of anything.
@@ -379,11 +543,12 @@ export async function main(argv, io = {}) {
       folder: options.out === null ? options.folder : null,
       entry,
       llmPatch: patch.path,
+      conditionPatch, condition,
       timeoutMs: options.timeoutMs,
       model: options.model,
       argv: recordedArgv,
     }, {
-      seal: options.noSeal === true ? undefined : io.seal,
+      seal,
       runSession: io.runSession,
       observe: io.observe,
       now: io.now,
@@ -405,6 +570,20 @@ export async function main(argv, io = {}) {
     uninstall()
   }
   printResult(out, err, result, options)
+  io.onResult?.(result)
+  let report = { target: null, skipped: '--no-report' }
+  if (options.noReport !== true) {
+    try {
+      report = sweepReport(result, { now: io.now, writeFile: io.writeFile, mkdir: io.mkdir })
+    } catch (error) {
+      // The verdict is already computed and the summaries already written; a report that
+      // could not land is a loud note, not a failed sweep.
+      err(`[ab] report  : FAILED — ${String(error?.message ?? error)}`)
+      report = { target: null, skipped: null }
+    }
+  }
+  if (report.skipped !== null) out(`[ab] report  : not written (${report.skipped})`)
+  else if (report.target !== null) out(`[ab] report  : ${report.target}`)
   return exitFor(result)
 }
 
diff --git a/bench/run.schema.json b/bench/run.schema.json
index 494ee664..f5f9c01a 100644
--- a/bench/run.schema.json
+++ b/bench/run.schema.json
@@ -17,6 +17,9 @@
         "node": { "description": "Node.js version the runner ran on, e.g. v24.21.0.", "type": "string" },
         "dsh": { "description": "Version of the dsh launcher both arms were measured with, or null when unknown.", "type": ["string", "null"] },
         "model": { "description": "Model id both arms used, or null for the model-free mode.", "type": ["string", "null"] },
+        "condition": { "description": "Explicit shared routing condition; absent/null means unknown for historical or unconfigured runs. Null reasoning effort means the host default was not pinned.", "type": ["object", "null"], "additionalProperties": false, "required": ["provider", "model", "reasoningEffort"], "properties": {
+          "provider": { "description": "Configured provider identifier shared by both arms.", "type": "string" }, "model": { "description": "Configured model identifier shared by both arms.", "type": "string" }, "reasoningEffort": { "description": "Pinned reasoning level, or null when the host default was not explicitly pinned.", "enum": ["off", "low", "high", "max", null] }
+        } },
         "gitSha": { "description": "Commit the checkout was on, or null when it could not be read.", "type": ["string", "null"] },
         "gitBranch": { "description": "Branch the checkout was on, or null when it could not be read.", "type": ["string", "null"] },
         "argv": { "description": "The command line that produced this document, one array element per argv entry.", "type": "array", "items": { "type": "string" } },
@@ -73,6 +76,8 @@
   "$defs": {
     "arm": { "description": "One arm of the comparison: what it was called, which profile contents it ran, and how it was launched.", "type": "object", "additionalProperties": false, "required": ["label", "profile", "profileHash"],
       "properties": {
+        "switches": { "description": "Effective component switches from the composed profile; null for unknown legacy records.", "type": ["object", "null"], "additionalProperties": { "type": "object", "required": ["enabled"], "properties": { "enabled": { "type": ["boolean", "null"] }, "replaceTools": { "type": ["array", "null"], "items": { "type": "string" } } }, "additionalProperties": false } },
+        "components": { "description": "Component states read from composed configuration, not a publication/readiness receipt. Null for older or injected records.", "type": ["object", "null"], "additionalProperties": { "type": "string", "enum": ["enabled", "disabled", "absent", "unknown"] } },
         "label": { "description": "Arm label, also the profile name it ran, e.g. bench-base.", "type": "string" },
         "profile": { "description": "Profile name whose resolved configuration was measured.", "type": "string" },
         "profileHash": { "description": "SHA-256 in hex of the arm's dumped configuration, the single-variable fingerprint.", "type": "string" },
diff --git a/bench/run/schedule.mjs b/bench/run/schedule.mjs
index 210d4f87..409d7c55 100644
--- a/bench/run/schedule.mjs
+++ b/bench/run/schedule.mjs
@@ -41,7 +41,7 @@ export const SUMMARY_FORMAT = 'dsh-ops-bench-summary-v1'
 /** The sweep document tag this module returns; the seal step turns it into run.json. */
 export const SWEEP_FORMAT = 'dsh-ops-bench-sweep-v1'
 /** Repeats per task when neither `--repeat` nor the task's own `repeat` field says. */
-export const DEFAULT_REPEAT = 3
+export const DEFAULT_REPEAT = 1
 /** The two sides an arm may play. `--aa` uses `base` twice, with distinct labels. */
 export const SIDES = ['base', 'cand']
 
@@ -186,6 +186,7 @@ function sessionOptions(arm, pair, spec, options, ctx) {
     entry: spec.entry,
     profile: arm.profile,
     llmPatch: spec.llmPatch ?? null,
+    conditionPatch: spec.conditionPatch ?? null,
     workspaceRoot: spec.workspaceRoot,
     timeoutMs: spec.timeoutMs ?? null,
     keep: options.keep === true,
@@ -204,11 +205,17 @@ function sessionOptions(arm, pair, spec, options, ctx) {
 /** One arm's summary: the shape `bench/compare.mjs` reads as a side. */
 function buildSummary(arm, rows, ctx) {
   return {
+    meta: { platform: ctx.spec.meta?.platform ?? `${process.platform}-${process.arch}` },
+    profileHash: arm.profileHash ?? null,
+    components: arm.components ?? null,
+    switches: arm.switches ?? null,
+    candidateSwitches: ctx.spec.arms?.find(item => item.side === 'cand')?.switches ?? null,
     format: SUMMARY_FORMAT,
     label: arm.label,
     profile: arm.profile,
     aa: ctx.spec.aa === true,
     model: ctx.spec.model ?? null,
+    condition: ctx.spec.condition ?? null,
     argv: ctx.spec.argv ?? [],
     dir: ctx.dirs[arm.side],
     startedAt: ctx.startedAt,
@@ -237,6 +244,8 @@ function noiseFor(spec, summaries, arms) {
 /** The arm descriptor the seal step (P8a) lifts into `run.json`'s `arms`. */
 function descriptor(arm) {
   return {
+    switches: arm.switches ?? null,
+    components: arm.components ?? null,
     label: arm.label,
     profile: arm.profile,
     profileHash: arm.profileHash ?? null,
@@ -259,6 +268,7 @@ function sealContext(result, spec, summaryFile) {
       ...(spec.meta ?? {}),
       mode: 'ab',
       model: spec.model ?? null,
+      condition: spec.condition ?? null,
       argv: spec.argv ?? [],
       startedAt: result.startedAt,
       endedAt: result.endedAt,
@@ -450,7 +460,7 @@ export async function runSweep(spec = {}, options = {}) {
       observer.note('warn', `sealing failed: ${result.sealError} — the per-row archives and summary.json are on disk, but run.json was not written`)
     }
   } else {
-    observer.note('warn', 'no seal callback was injected: this sweep has results/ and summary.json, but no run.json')
+    observer.note('info', 'sealing was not requested: this sweep has results/ and summary.json, and no run.json')
   }
   observer.dispose?.()
   return result
diff --git a/bench/run/seal.mjs b/bench/run/seal.mjs
index c29c1785..79076427 100644
--- a/bench/run/seal.mjs
+++ b/bench/run/seal.mjs
@@ -37,6 +37,7 @@ import path from 'node:path'
 import { createHash } from 'node:crypto'
 import { aggregateLines } from '../lib/aggregate.mjs'
 import { REPO_ROOT, platformTag } from '../lib/env.mjs'
+import { conditionOf } from '../lib/condition.mjs'
 
 /** The four per-row archive files the session driver writes, by suffix. */
 export const ROW_SUFFIXES = {
@@ -533,6 +534,7 @@ function buildMeta(options, arms, results, sealedAt) {
     node: typeof provided.node === 'string' ? provided.node : process.version,
     dsh: textOrNull(provided.dsh),
     model: textOrNull(provided.model),
+    condition: conditionOf({ meta: provided }),
     gitSha: textOrNull(provided.gitSha),
     gitBranch: textOrNull(provided.gitBranch),
     argv: Array.isArray(provided.argv) ? provided.argv.map(String) : [],
diff --git a/bench/run/session.mjs b/bench/run/session.mjs
index b31f9c02..47666598 100644
--- a/bench/run/session.mjs
+++ b/bench/run/session.mjs
@@ -27,9 +27,12 @@ import { verifyWorkspace } from '../lib/verify.mjs'
 import { createObserver } from '../lib/observe.mjs'
 import { spawnPlan } from '../lib/env.mjs'
 import { DEFAULT_TIMEOUT_MS } from '../lib/tasks.mjs'
+import { patchArgs } from '../lib/condition.mjs'
 
 /** The five token buckets `run.schema.json $defs/usage` requires, in its order. */
 const USAGE_BUCKETS = ['inputTokens', 'outputTokens', 'cacheReadTokens', 'cacheWriteTokens', 'reasoningTokens']
+/** The buckets a step re-sends to the model: its prompt size. */
+const PROMPT_BUCKETS = ['inputTokens', 'cacheReadTokens', 'cacheWriteTokens']
 
 /** Cap on the stdout-close barrier; it matters only for a spawn that left a stream open. */
 const DEFAULT_STREAM_FLUSH_GRACE_MS = 1_000
@@ -136,9 +139,10 @@ export function toVerifyChecks(outcome) {
 /**
  * A streaming fold of the event stream into the schema's `metrics` fields, deliberately
  * narrow: steps, tool calls, tool errors, the five usage buckets, the all-or-nothing
- * `usageReported` and the last turn's end reason. Prompt-shape analysis belongs to the
- * aggregate slice; this keeps its invariant — one step without usage makes the totals a
- * lower bound.
+ * `usageReported`, the prompt shape the report's per-request overhead table reads, and
+ * the last turn's end reason. This keeps the aggregate invariant — one step without
+ * usage makes the totals a lower bound, and one step without a prompt size makes the
+ * prompt summary incomplete.
  * @returns {{push(line: string): void, finish(): object}} the fold.
  */
 function createFold() {
@@ -149,6 +153,14 @@ function createFold() {
     toolErrors: 0,
     toolCallsByName: Object.create(null),
     usage: emptyUsage(),
+    // `promptSizes` is every step that reported a size, in order; `firstPrompt` is set
+    // only by the run's **first** step, so a run whose step 1 lost its usage reports an
+    // unknown first request instead of silently promoting step 2's smaller, already-warm
+    // prompt to "the request with no history".
+    promptSizes: [],
+    firstPrompt: null,
+    firstStepSeen: false,
+    turnFirsts: [],
     turnEndReason: null,
   }
   return {
@@ -164,7 +176,20 @@ function createFold() {
       if (event.type === 'status') {
         if (event.phase === 'step_end') {
           state.steps += 1
-          if (addUsage(state, event.usage)) state.stepsWithUsage += 1
+          const firstStep = !state.firstStepSeen
+          state.firstStepSeen = true
+          if (addUsage(state, event.usage)) {
+            state.stepsWithUsage += 1
+            const size = promptTokens(event.usage)
+            if (size !== null) {
+              state.promptSizes.push(size)
+              if (firstStep) state.firstPrompt = size
+              const turn = stepIndex(event.turn)
+              if (turn !== null && !state.turnFirsts.some((entry) => entry.turn === turn)) {
+                state.turnFirsts.push({ turn, tokens: size })
+              }
+            }
+          }
           return
         }
         if (event.phase === 'turn_end') {
@@ -190,6 +215,14 @@ function createFold() {
         toolCallsByName: { ...state.toolCallsByName },
         usage: { ...state.usage },
         usageReported: state.steps > 0 && state.stepsWithUsage === state.steps,
+        prompt: {
+          reported: state.steps > 0 && state.stepsWithUsage === state.steps && state.promptSizes.length === state.steps,
+          firstStep: state.firstPrompt,
+          median: state.promptSizes.length > 0 ? medianSize(state.promptSizes) : null,
+          max: state.promptSizes.length > 0 ? Math.max(...state.promptSizes) : null,
+          total: state.promptSizes.length > 0 ? state.promptSizes.reduce((sum, value) => sum + value, 0) : null,
+          perTurn: state.turnFirsts,
+        },
         turnEndReason: state.turnEndReason,
       }
     },
@@ -212,6 +245,43 @@ function addUsage(state, usage) {
   return true
 }
 
+/**
+ * One step's prompt size: the buckets re-sent to the model (input + cacheRead +
+ * cacheWrite), falling back to `totalTokens - outputTokens` when a provider reports
+ * only a total, and `null` when nothing usable is there.
+ * @param {object} usage - the `step_end` event's usage object.
+ * @returns {number|null} the prompt token count, or null.
+ */
+function promptTokens(usage) {
+  let sum = 0
+  let seen = false
+  for (const bucket of PROMPT_BUCKETS) {
+    const value = usage[bucket]
+    if (typeof value !== 'number' || !Number.isFinite(value)) continue
+    sum += Math.max(0, Math.round(value))
+    seen = true
+  }
+  if (seen) return sum
+  const total = usage.totalTokens
+  const output = usage.outputTokens
+  if (typeof total === 'number' && Number.isFinite(total)) {
+    return Math.max(0, Math.round(total) - (typeof output === 'number' && Number.isFinite(output) ? Math.round(output) : 0))
+  }
+  return null
+}
+
+/** A numeric event field as a number, or null. */
+function stepIndex(value) {
+  return typeof value === 'number' && Number.isFinite(value) ? value : null
+}
+
+/** The median of the step prompt sizes (the midpoint of an even count halves). */
+function medianSize(sizes) {
+  const sorted = [...sizes].sort((left, right) => left - right)
+  const mid = Math.floor(sorted.length / 2)
+  return sorted.length % 2 === 1 ? sorted[mid] : (sorted[mid - 1] + sorted[mid]) / 2
+}
+
 /**
  * Run one task × repeat: fixture → one headless session → archive → verdict.
  *
@@ -363,7 +433,7 @@ export async function runSession(spec, options = {}) {
     observer.note('detail', `workspace ${workspace} — ${fixture.files.length} fixture file(s) written`)
 
     const args = ['--profile', options.profile]
-    if (options.llmPatch) args.push('--patch', options.llmPatch)
+    args.push(...patchArgs(options.llmPatch, options.conditionPatch))
     args.push('--json', task.prompt)
     const plan = spawnPlan(entry, args)
     const fold = createFold()
@@ -490,6 +560,7 @@ export async function runSession(spec, options = {}) {
       toolErrors: counted.toolErrors,
       usage: counted.usage,
       usageReported: counted.usageReported,
+      prompt: counted.prompt,
       toolCallsByName: counted.toolCallsByName,
       turnEndReason: counted.turnEndReason,
       // Identity and archive pointers the seal step lifts into `results[]` / `archive[]`.
diff --git a/bench/setup.mjs b/bench/setup.mjs
index fcadabc8..824960c0 100644
--- a/bench/setup.mjs
+++ b/bench/setup.mjs
@@ -29,13 +29,14 @@ import { fileURLToPath } from 'node:url'
 import { REPO_ROOT, resolveDshEntry, spawnPlan } from './lib/env.mjs'
 import { USAGE as PROFILE_USAGE, dshHomeFor, nextStepLines, parseArgs, prepareProfiles, spawnInvoker } from './setup/profile.mjs'
 import { EXTRA_FLAGS, USAGE_EXTRA, closingLines, preflight } from './setup/preflight.mjs'
+import { SWITCH_USAGE, extractSwitches, configureSwitches } from './setup/switches.mjs'
 
 /** Exit codes: 0 prepared, 1 a check or a step failed, 2 usage. `bench/cli.mjs`'s own
  * `EXIT.pending` (3) never applies here — this module exists, so `setup` is implemented. */
 export const EXIT = { ok: 0, failure: 1, usage: 2 }
 
 /** The whole help: `profile.mjs`'s flags plus setup B's own. */
-export const USAGE = `${PROFILE_USAGE}\n${USAGE_EXTRA}`
+export const USAGE = `${PROFILE_USAGE}\n${USAGE_EXTRA}\n${SWITCH_USAGE}`
 
 /**
  * The injectable half of `main`. `bench/cli.mjs` passes `{out, err}`; a suite passes the
@@ -69,8 +70,12 @@ export const USAGE = `${PROFILE_USAGE}\n${USAGE_EXTRA}`
 export async function main(argv, io = {}) {
   const out = io.out ?? ((line) => console.log(line))
   const err = io.err ?? ((line) => console.error(line))
-  let options
-  try { options = parseArgs(argv, EXTRA_FLAGS) } catch (error) {
+  let options, switches
+  try {
+    const extracted = extractSwitches(argv)
+    switches = extracted.switches
+    options = parseArgs(extracted.argv, { ...EXTRA_FLAGS, platform: io.platform })
+  } catch (error) {
     err(`${error.message}\n\n${USAGE}`)
     return EXIT.usage
   }
@@ -122,6 +127,8 @@ export async function main(argv, io = {}) {
     err(`\nsetup is not finished: ${prepared.problems.join('; ')}`)
     return EXIT.failure
   }
+  try { configureSwitches(options, { home, log, invoke, prefix: plan.args, overlay: io.overlay }, switches) }
+  catch (error) { err(`component switches: ${error.message}`); return EXIT.failure }
   out('\n— next —')
   for (const line of closingLines(options)) out(line)
   out(options.dryRun ? '\n[dry-run] everything above is a plan; nothing was changed.' : '\nsetup complete.')
diff --git a/bench/setup/preflight.mjs b/bench/setup/preflight.mjs
index a77486da..0f516df5 100644
--- a/bench/setup/preflight.mjs
+++ b/bench/setup/preflight.mjs
@@ -434,12 +434,15 @@ export function preflight(options, context = {}) {
   else if (permissions.ok) log(`  both sides will pin ${pairText(permissions.expected)}`)
 
   log('\n— preflight: PSModulePath —')
-  const modulePath = inspectModulePath({ modulePath: env.PSModulePath, windows: env.SystemRoot, isDirectory: context.isDirectory })
-  outcomes.modulePath = modulePath ? 'poisoned' : 'clean'
+  const modulePath = platform === 'win32' ? inspectModulePath({ modulePath: env.PSModulePath, windows: env.SystemRoot, isDirectory: context.isDirectory }) : null
+  outcomes.modulePath = platform !== 'win32' ? 'skipped' : modulePath ? 'poisoned' : 'clean'
   if (modulePath) {
     log(`  ✗ ${modulePath.entry} is ahead of the in-box 5.1 module directory`)
     log(`  search order: ${describeModulePath(env.PSModulePath, modulePath.entry)}`)
     warnings.push(modulePath.warning)
+  } else if (platform !== 'win32') {
+    log('  skipped: Windows PSModulePath ordering does not apply on this platform')
+    log('  skipped: Windows Bash IPC proxy and bundled Windows shell payload checks do not apply')
   } else {
     log('  clean: no Core module root ahead of the in-box Windows PowerShell 5.1 directory')
   }
diff --git a/bench/setup/profile.mjs b/bench/setup/profile.mjs
index ddb6ca75..da447a8f 100644
--- a/bench/setup/profile.mjs
+++ b/bench/setup/profile.mjs
@@ -152,12 +152,13 @@ export function defaultShellPath() {
 
 /** The defaults, before any flag is read.
  * @returns {Options} the defaults. */
-function defaultOptions() {
+function defaultOptions(platform = process.platform) {
   return {
     baseProfile: 'bench-base', candProfile: 'bench-ops', template: 'headless',
     // There is no Windows PowerShell to pin off Windows, and `dsh-pwsh-sandbox` is
     // Windows-gated in the composition anyway, so the default is "no pin" there.
-    pinShell: process.platform === 'win32' ? defaultShellPath() : null,
+    pinShell: platform === 'win32' ? defaultShellPath() : null,
+    platform,
     permissionMode: 'danger-full-access',
     // The candidate measures the working tree: the default install is this checkout, so a
     // sweep prepares itself from the code under edit without a publish or a version bump.
@@ -175,7 +176,7 @@ function defaultOptions() {
  * @returns {Options} the options.
  */
 export function parseArgs(argv, extra = {}) {
-  const options = defaultOptions()
+  const options = defaultOptions(extra.platform)
   const values = { ...VALUE_FLAGS, ...extra.value }
   const booleans = { ...BOOLEAN_FLAGS, ...extra.boolean }
   for (let i = 0; i < argv.length; i += 1) {
@@ -200,7 +201,7 @@ export function parseArgs(argv, extra = {}) {
     }
   }
   if (options.baseProfile === options.candProfile) throw new Error('--base-profile and --cand-profile must differ')
-  if (options.pinShell && process.platform === 'win32' && !path.isAbsolute(options.pinShell)) {
+  if (options.pinShell && options.platform === 'win32' && !path.isAbsolute(options.pinShell)) {
     throw new Error(`--pin-shell must be an absolute path, got "${options.pinShell}"`)
   }
   if (!PERMISSION_MODES.includes(options.permissionMode)) {
@@ -590,7 +591,9 @@ function ensureProfile(name, context) {
  */
 function pinBaselineShell(options, context) {
   if (!options.pinShell) {
-    context.log('  --no-pin: nothing was touched. The baseline then hits the PATH pwsh alias, so both sides run PowerShell 7')
+    context.log(options.platform !== 'win32'
+      ? '  skipped: Windows PowerShell pin is inapplicable on this platform; the host selects its configured shell'
+      : '  --no-pin: nothing was touched; the host selects its configured shell')
     return 'skipped'
   }
   const file = path.join(context.home, 'profiles', options.baseProfile, 'cordis.patch.yml')
diff --git a/bench/setup/switches.mjs b/bench/setup/switches.mjs
new file mode 100644
index 00000000..01fc2622
--- /dev/null
+++ b/bench/setup/switches.mjs
@@ -0,0 +1,131 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { OFFICIAL_REPLACEMENTS } from '../../lib/official-tool-catalog.js'
+import { LLM_OVERLAY, planEntryPatch } from './profile.mjs'
+import { ACTIVATION_KEYS, SWITCH_ROWS, parseRows, switchesFromDump } from '../lib/switches.mjs'
+
+export const SWITCH_USAGE = '  --switch <name>[=value] candidate only; repeat hide-official=all|read,glob,grep|false, ptc, panel, discovery, shell (booleans true/false)'
+
+export function extractSwitches(argv) {
+  const rest = [], switches = {}
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] !== '--switch' && !argv[i].startsWith('--switch=')) { rest.push(argv[i]); continue }
+    const spec = argv[i] === '--switch' ? argv[++i] : argv[i].slice(9)
+    if (!spec || spec.startsWith('--')) throw new Error('--switch needs a name')
+    const equal = spec.indexOf('='), name = equal < 0 ? spec : spec.slice(0, equal), value = equal < 0 ? 'true' : spec.slice(equal + 1)
+    if (!Object.hasOwn(SWITCH_ROWS, name)) throw new Error(`Unknown switch ${name}; available: ${Object.keys(SWITCH_ROWS).join(', ')}`)
+    if (Object.hasOwn(switches, name)) throw new Error(`Duplicate switch ${name}`)
+    if (name !== 'hide-official') {
+      if (!['true', 'false'].includes(value)) throw new Error(`${name} requires true or false`)
+      switches[name] = { enabled: value === 'true' }
+    } else {
+      const names = Object.keys(OFFICIAL_REPLACEMENTS)
+      const selected = ['all', 'true'].includes(value) ? names : value === 'false' ? [] : value.split(',')
+      if (selected.some(item => !names.includes(item)) || new Set(selected).size !== selected.length) throw new Error(`hide-official requires all, false or a unique list from ${names.join(', ')}`)
+      switches[name] = { enabled: value !== 'false', replaceTools: [...selected].sort() }
+    }
+  }
+  return { argv: rest, switches }
+}
+
+function literal(value) {
+  if (typeof value === 'number' && !Number.isFinite(value)) throw new Error('Non-finite config needs a manual patch')
+  if (value && typeof value === 'object') {
+    if (Object.hasOwn(value, 'expression')) throw new Error('A dynamic component config needs a manual patch; refusing to rewrite it')
+    for (const child of Object.values(value)) literal(child)
+  }
+  if (value !== null && !['object', 'string', 'boolean', 'number'].includes(typeof value)) throw new Error('Unsupported config value')
+  return JSON.stringify(value)
+}
+
+function configMapping(value) {
+  if (value === undefined) return {}
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('Component config requires a literal mapping; edit it manually')
+  literal(value)
+  return value
+}
+const escapePattern = value => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+
+/** Line-local, atomic planning. Unsupported inline/aliased/multiline target shapes are refused. */
+export function planSwitchPatch(text, switches, { force = false, composed = [] } = {}) {
+  let next = text
+  for (const [name, wanted] of Object.entries(switches)) {
+    if (!Object.hasOwn(SWITCH_ROWS, name)) throw new Error(`Unknown switch ${name}`)
+    const id = SWITCH_ROWS[name], rows = parseRows(next)
+    if (!Array.isArray(rows)) throw new Error('Candidate patch must be a plain top-level list')
+    const own = rows.filter(row => row?.id === id)
+    if (own.length > 1) throw new Error(`Duplicate row ${id}`)
+    const inherited = composed.filter(row => row?.id === id)
+    if (inherited.length > 1) throw new Error(`Ambiguous composed row ${id}`)
+    const row = own[0]
+    if (row?.disabled !== undefined && row.disabled !== !wanted.enabled && !force) throw new Error(`${id}.disabled conflicts; use --force`)
+    if (row && row.disabled !== undefined && typeof row.disabled !== 'boolean') throw new Error(`${id}.disabled requires a manual patch`)
+    const config = { ...configMapping(inherited[0]?.config), ...configMapping(row?.config) }
+    const changes = name === 'hide-official' ? { replaceTools: wanted.replaceTools } : ACTIVATION_KEYS[name] && wanted.enabled ? { [ACTIVATION_KEYS[name]]: true } : {}
+    for (const [key, value] of Object.entries(changes)) {
+      if (row?.config?.[key] !== undefined && JSON.stringify(row.config[key]) !== JSON.stringify(value) && !force) throw new Error(`${id}.${key} conflicts; use --force`)
+      config[key] = value
+    }
+    // Setting config replaces that entry's config in the host. Preserve every inherited key.
+    for (const [key, value] of Object.entries(config)) {
+      if (JSON.stringify(row?.config?.[key]) === JSON.stringify(value)) continue
+      const lines = next.split(/\r?\n/)
+      const start = lines.findIndex(line => line === `- id: ${id}`)
+      if (row && start < 0) throw new Error(`${id} requires a plain block row; edit it manually`)
+      const end = start < 0 ? -1 : lines.findIndex((line, i) => i > start && /^- /.test(line))
+      const body = start < 0 ? [] : lines.slice(start, end < 0 ? lines.length : end)
+      if (body.some(line => new RegExp(`^\\s+${escapePattern(key)}:\\s*(?:#.*)?$`).test(line))) throw new Error(`${id}.${key} uses a multiline value; edit it manually`)
+      const plan = planEntryPatch(next, { id, config: { [key]: literal(value) } }, { force: true })
+      if (!['write', 'noop'].includes(plan.action)) throw new Error(plan.note)
+      next = plan.text
+    }
+    if (!parseRows(next).some(item => item?.id === id)) next = `${next.replace(/^\s*\[\]\s*$/m, '').trimEnd()}\n- id: ${id}\n`
+    const lines = next.split(/\r?\n/), start = lines.findIndex(line => line === `- id: ${id}`)
+    if (start < 0) throw new Error(`${id} requires a plain block row; edit it manually`)
+    let end = lines.findIndex((line, i) => i > start && /^- /.test(line)); if (end < 0) end = lines.length
+    const disabled = lines.findIndex((line, i) => i > start && i < end && /^  disabled:/.test(line))
+    if (disabled < 0) lines.splice(start + 1, 0, `  disabled: ${!wanted.enabled}`)
+    else if (parseRows(next).find(item => item?.id === id).disabled !== !wanted.enabled) lines[disabled] = `  disabled: ${!wanted.enabled}`
+    next = lines.join('\n')
+  }
+  parseRows(next)
+  return { text: next, changed: next !== text }
+}
+
+export function configureSwitches(options, context, switches) {
+  if (!Object.keys(switches).length) return
+  const file = path.join(context.home, 'profiles', options.candProfile, 'cordis.patch.yml')
+  const before = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '[]\n'
+  const args = [...context.prefix, '--profile', options.candProfile]
+  const overlay = context.overlay ?? LLM_OVERLAY
+  if (fs.existsSync(overlay)) args.push('--patch', overlay)
+  const dump = () => {
+    const result = context.invoke([...args, '--dump-config'])
+    if (result.status !== 0) throw new Error('Candidate --dump-config failed; no sweep was started')
+    const rows = parseRows(result.stdout)
+    if (!Array.isArray(rows)) throw new Error('Candidate dump is not a component list')
+    return { rows, switches: switchesFromDump(result.stdout) }
+  }
+  const composed = options.dryRun ? [] : dump().rows
+  const plan = planSwitchPatch(before, switches, { force: options.force, composed })
+  context.log(`  candidate switches: ${JSON.stringify(switches)}`)
+  if (options.dryRun) {
+    context.log(`  [dry-run] would merge effective component config into ${file}; baseline has no switch writes`)
+    context.log('  [dry-run] would verify --dump-config and run a bounded headless readiness turn (may call the configured model)')
+    return
+  }
+  if (plan.changed) fs.writeFileSync(file, plan.text, 'utf8')
+  const effective = dump().switches
+  for (const [name, wanted] of Object.entries(switches)) {
+    if (JSON.stringify(effective[name]) !== JSON.stringify(wanted)) throw new Error(`Composed switch ${name} differs from requested value`)
+  }
+  const result = context.invoke([...args, '--json', 'Reply only READY. Do not call any tools.'])
+  const output = `${result.stdout ?? ''}\n${result.stderr ?? ''}`
+  const events = String(result.stdout ?? '').split(/\r?\n/).flatMap(line => { try { return [JSON.parse(line)] } catch { return [] } })
+  const turns = events.filter(event => event.type === 'status' && event.phase === 'turn_end')
+  if (result.status !== 0 || /READINESS_BLOCKED/.test(output) || events.some(event => event.type === 'error')
+    || !turns.length || turns.some(event => event.reason?.kind !== 'completed')) {
+    throw new Error('Candidate readiness probe failed; no sweep was started. Check host diagnostics and https://github.com/T-Auto/dsh-ops/issues/207 (READINESS_BLOCKED).')
+  }
+  context.log('  candidate readiness probe completed; no benchmark task was run')
+}
diff --git a/bench/tasks/api-rename.task.json b/bench/tasks/api-rename.task.json
index 09a59a2a..5f9fb4d2 100644
--- a/bench/tasks/api-rename.task.json
+++ b/bench/tasks/api-rename.task.json
@@ -1,15 +1,15 @@
 {
   "id": "api-rename",
-  "title": "Rename one exported symbol across a 60-module tree using file tools only",
+  "title": "Rename one exported symbol across a 12-module tree using file tools only",
   "prompt": "In src/core.js the exported function parsePayload has to be renamed to decodePayload: its definition, every import of it, and every call site. parsePayloadLegacy and parsePayloadAsync are different functions and keep their own names. Change no behaviour, add or remove no file under src/, and leave check.mjs alone. Use the file tools to make every change; do not modify files with a shell command such as sed or a script. When you are done, node check.mjs must exit 0.",
   "fixture": {
     "generator": "symbolTree",
-    "params": { "seed": 31, "files": 60 }
+    "params": { "seed": 31, "files": 12 }
   },
   "verify": [
     { "type": "contentHashes", "dir": "src", "expect": "final" },
     { "type": "command", "command": "node", "args": ["check.mjs"], "exitCode": 0 }
   ],
-  "repeat": 2,
+  "repeat": 1,
   "timeoutMs": 1800000
 }
diff --git a/bench/tasks/big-file-paging.task.json b/bench/tasks/big-file-paging.task.json
index b14e74dc..d842c2a5 100644
--- a/bench/tasks/big-file-paging.task.json
+++ b/bench/tasks/big-file-paging.task.json
@@ -7,6 +7,6 @@
     "params": { "seed": 23, "lines": 4200, "env": "staging" }
   },
   "verify": [{ "type": "fileEquals", "path": "answer.txt", "expect": "answer" }],
-  "repeat": 2,
+  "repeat": 1,
   "timeoutMs": 900000
 }
diff --git a/bench/tasks/config-hunt.task.json b/bench/tasks/config-hunt.task.json
index 2ab684b9..7770aed8 100644
--- a/bench/tasks/config-hunt.task.json
+++ b/bench/tasks/config-hunt.task.json
@@ -7,6 +7,6 @@
     "params": { "seed": 21, "packages": 12, "env": "production" }
   },
   "verify": [{ "type": "fileEquals", "path": "answer.txt", "expect": "answer" }],
-  "repeat": 2,
+  "repeat": 1,
   "timeoutMs": 900000
 }
diff --git a/bench/tasks/csv-sum.task.json b/bench/tasks/csv-sum.task.json
index df862667..a96570f8 100644
--- a/bench/tasks/csv-sum.task.json
+++ b/bench/tasks/csv-sum.task.json
@@ -7,6 +7,6 @@
     "params": { "seed": 7, "rows": 8000, "targetRegion": "EU", "regions": ["EU", "US", "APAC", "LATAM"] }
   },
   "verify": [{ "type": "fileEquals", "path": "answer.txt", "expect": "sum" }],
-  "repeat": 2,
+  "repeat": 1,
   "timeoutMs": 900000
 }
diff --git a/bench/tasks/gate-repair-loop.task.json b/bench/tasks/gate-repair-loop.task.json
index a0caec2d..f2ac64d3 100644
--- a/bench/tasks/gate-repair-loop.task.json
+++ b/bench/tasks/gate-repair-loop.task.json
@@ -1,16 +1,16 @@
 {
   "id": "gate-repair-loop",
-  "title": "Repair a 24-stage release gate that stops at the first broken stage",
+  "title": "Repair a 12-stage release gate that stops at the first broken stage",
   "prompt": "check.js is a generated release gate. It loads the stage modules in gates/ (gates/gate_00.js, gates/gate_01.js, and so on) in order, validates each stage against fixed golden values, and stops at the first stage that disagrees; exit code 0 means every stage passed. Run it, find the failing stage, and repair the stage modules in gates/ until the gate passes. Each stage module documents its own contract; make the code agree with it. Do not change check.js or package.json, and do not add or remove files. When the gate exits 0 it prints the pipeline's final value; write that integer, and nothing else, into answer.txt.",
   "fixture": {
     "generator": "gatePipeline",
-    "params": { "seed": 53, "gates": 24, "probes": 40, "linesPerGate": 70 }
+    "params": { "seed": 53, "gates": 12, "probes": 40, "linesPerGate": 70 }
   },
   "verify": [
     { "type": "command", "command": "node", "args": ["check.js"], "exitCode": 0 },
     { "type": "fileEquals", "path": "answer.txt", "expect": "answer" },
     { "type": "fileEquals", "path": "check.js", "expect": "checkSource", "invariant": true }
   ],
-  "repeat": 2,
+  "repeat": 1,
   "timeoutMs": 2400000
 }
diff --git a/bench/tasks/noisy-test-triage.task.json b/bench/tasks/noisy-test-triage.task.json
index 16ac5694..c1b366fb 100644
--- a/bench/tasks/noisy-test-triage.task.json
+++ b/bench/tasks/noisy-test-triage.task.json
@@ -10,6 +10,6 @@
     { "type": "fileEquals", "path": "failure.txt", "expect": "failingName" },
     { "type": "command", "command": "node", "args": ["runner.js"], "exitCode": 1, "invariant": true }
   ],
-  "repeat": 2,
+  "repeat": 1,
   "timeoutMs": 900000
 }
diff --git a/bin/dsh-ops.mjs b/bin/dsh-ops.mjs
index f4c8ac56..52d80252 100644
--- a/bin/dsh-ops.mjs
+++ b/bin/dsh-ops.mjs
@@ -44,6 +44,8 @@ Usage:
   dsh-ops settings-profile --profile-dir <dir> --host-anchor <host package.json> [--dsh-home <dir>] [--offline --yes]
                                   Preview or explicitly enable the optional browser settings carrier
   dsh-ops build-ptc              Build the independent native Rust worker (all platforms)
+  dsh-ops review snapshot --repo <owner/name> --prs <1,2> [--base main] [--checkout <path>]
+                                  Collect bounded PR/CI evidence; optionally probe local commit objects
   dsh-ops uninstall [--yes] [--purge-fastctx]
                                   Report files older versions left under <DSH_HOME>/dsh-ops and,
                                   with --yes, remove them; --purge-fastctx also removes leftover
@@ -96,6 +98,7 @@ const REMOVED_COMMANDS = Object.freeze({
  * @returns {Promise<number>} the exit code.
  */
 async function main() {
+  if (process.argv[2] === 'review') return (await import('../lib/review/cli.js')).commandReview(process.argv.slice(3))
   const { values, positionals } = parseArgs({
     args: process.argv.slice(2),
     allowPositionals: true,
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index ecde18e1..1cbf8f61 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -7,14 +7,67 @@ this package adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+- Isolate PTC and discovery presentation probes by inheritance family so an unanswered host hook cannot block unrelated roots. Cancel obsolete probe waits on supersession, disposal and unload; reject late publication while preserving atomic family overlays and live authority checks (#359).
+- PTC 与 discovery 的呈现探测按继承族隔离，宿主 hook 未返回时不阻塞无关根会话；探测被取代、销毁或卸载时取消旧等待并拒绝迟到发布，同时保留继承族原子叠加层与实时权限检查（#359）。
+
+- Defer and coalesce Bash lifecycle publication until session event delivery completes, preserve live authority checks for retained callbacks, and cancel queued publication on unload (#386). Accept text-only prompt presentation hooks without weakening complete PTC assembly checks (#387). Add a delayed-discovery first-prompt regression for the readiness fix already integrated in #366 (#375).
+- Bash 生命周期发布延后到会话事件分发结束后并合并通知，保留旧回调的实时权限校验，卸载时取消待发布任务（#386）；兼容纯文本提示词呈现 hook，同时保留完整 PTC 装配检查（#387）。为 #366 已合入的就绪修复增加延迟 discovery 首轮回归（#375）。
+
+- Reuse discovery presentation decisions with live context/session/policy inputs and explicit prompt, configuration and service invalidation; keep pre-step and execution checks fresh. Avoid empty Native provider notifications (#345, #333).
+- discovery 按实时 context/session/policy 输入复用呈现判定，并在 prompt、配置和服务变化时失效；pre-step 与执行检查保持新鲜。不为空 Native provider 发送通知（#345、#333）。
+- Publish PTC projections by affected inheritance family, merge superseded requests and track hidden Native provider changes. Attribute OPS-owned tool changes locally so independent sessions keep their definitions and cached probes; unknown external changes remain conservative (#333).
+- PTC 投影按受影响继承族发布，合并被取代的请求并跟踪隐藏 Native provider 变化。OPS 工具变化在本地记录作用域，使独立会话保留定义与缓存探测；未知外部变化仍保守处理（#333）。
+- Retain unchanged Bash layers and inherited restrictions; explicitly refresh definitions when shared jobs or executor services change. Add real-host bounded-probe/event and definition-identity regressions (#333).
+- 保留未变化的 Bash 层与继承限制，仅在共享 jobs 或执行器服务变化时显式刷新定义；增加真实宿主探测/事件有界和定义身份回归（#333）。
+
+- Read the tool names the tooling sections render through the scope view instead of the schema projection. `visibleTools` (the `tooling:shell`/`tooling:file` prompt section and the host-shell denial gate) asked `tools.schemas()` and kept only the names, so every prompt assembly paid one deep copy of every visible definition: 34.2 ms for 258 tools at the issue's own surface shape on the published 0.2.1-rc.2 runtime, against 0.043 ms through `tools.view()` — about 800x for the same name list in the same order, verified against `schemas()` for a scoped key and for the global layer. Cost tracks nested schema nodes, not payload bytes: the same host spends 16.5 ms on 811 KB of flat string fields but 34.2 ms on 705 KB carrying eight nested groups per tool, so the fixture is pinned to the issue's measurement (705,008 bytes of `parameters` against the recorded 691,714). The discovery pre-step probe is deliberately left alone: its per-step assembly is the path by which a presentation that flips without the names moving corrects itself, so memoizing it there trades a measured cost for a correctness regression (#369).
+- 工具区段取工具名改用 scope 视图，不再走 schema 投影。`visibleTools`（`tooling:shell`/`tooling:file` 提示词区段与宿主 shell 拒绝门）之前问 `tools.schemas()` 后只保留名字，于是每次提示词装配都要把所有可见定义深拷贝一遍：已发布的 0.2.1-rc.2 运行时上，按 issue 自身的表面形状造 258 工具要 34.2 ms，而走 `tools.view()` 只要 0.043 ms——同一份名字、同一顺序下约 800 倍，并在 scoped key 与全局层两种形态下逐一对照 `schemas()` 验证一致。代价取决于 schema 的嵌套节点数而非 payload 字节：同一宿主上 811 KB 的扁平字符串字段只要 16.5 ms，而 705 KB、每工具八组嵌套对象要 34.2 ms，因此 fixture 按 issue 的度量固定（`parameters` 合计 705,008 字节，issue 记录值 691,714）。discovery pre-step 探针刻意不动：它每步的那次装配正是「呈现已翻转但工具名未变」这类 scope 自我纠正的路径，在那里加备忘等于用实测成本换正确性回归（#369）。
+- Read the per-publish surface from the scope's derived view instead of its wire schemas, and carry the definition identity in the key. `surfaceOf` asked `tools.schemas()` for the names it memoizes, and that projector rebuilds one deep copy of every visible parameter schema per call: on the published 0.2.1-rc.2 tool runtime a single 258-tool read costs 24.58 ms against 0.094 ms for one view read naming the same surface, so the memo key cost more than the prompt assembly it was meant to skip — measured end to end with 1/2/4/8 agents the probe ran 6.5/14.3/32.8/58.2 ms before and 25.9/47.4/94.6/198.4 ms after, i.e. 2.9–4.0x the work it saves. Names now come from `tools.view(scope).visible`, which resolves the same visible map without projecting it; `schemas()` is kept as a fallback for a runtime that does not expose a view. The key pairs each name with a `WeakMap` identity for the definition the view holds, because a names-only key returns a stale hit when a scoped registration shadows a global of the same name — the shadow is what a publish captures, so missing it publishes nothing on the change that owed a republish. Identity costs one lookup against an object already in hand rather than the `tools.get()` pairing that would rebuild the whole view per name and turn the key into O(names²) (#368, #369).
+- 每次发布的工具快照改为读取 scope 的派生视图，不再读取其 wire schema，并让键携带定义身份。`surfaceOf` 之前用 `tools.schemas()` 取名当备忘键，而该投影每次调用都会把所有可见工具的参数 schema 深拷贝一遍：在已发布的 0.2.1-rc.2 工具运行时上，一次 258 工具读取要 24.58 ms，而读取同一份表面的单次视图只要 0.094 ms，于是这个备忘键比它想省掉的那次提示词装配更贵——端到端实测 1/2/4/8 个 agent 时，探针改动前为 6.5/14.3/32.8/58.2 ms，改动后为 25.9/47.4/94.6/198.4 ms，即多做了 2.9–4.0 倍的功。现在工具名取自 `tools.view(scope).visible`，它在不投影的前提下解出同一份可见映射；保留 `schemas()` 作为运行时未暴露视图时的回退。键为每个名字配上该视图所持定义的 `WeakMap` 身份，因为只含名字的键在 scoped 注册遮蔽同名全局定义时会返回陈旧命中——被遮蔽的那份定义才是发布实际捕获的对象，漏掉它就会在该重新发布的变化上什么都不发。身份只需对已持有的对象查一次表，而非改用 `tools.get()` 逐名配对（后者会为每个名字重建整份视图，把键的代价变成 O(名字数²)）（#368、#369）。
+- Keep the per-agent re-probe from retiring live registrations or stranding an unpublished surface. `reconcile` advanced its epoch on every call, so the passes the new `targets` argument turns into no-ops still invalidated every published `execute` guard and every Native shadow, which then answered `POLICY_DENIED` for a scope that was still authoritative; and a probe recorded its surface on the entry before the republish that consumes it ran, so a pass a later reconcile superseded left the next pass reading that surface as already published and returning early forever, which is how a PTC verdict could never take effect. A separate `published` counter now moves only when a pass actually republishes, the guards compare it, and probed surfaces stay pending until that republish commits them. `discovery` compares `published` for the same reason its probe cannot: assembling the prompt reconciles other scopes. A departure's empty target set is also a probe-free pass now, instead of being normalized to "no restriction" and re-probing every survivor, and the per-publish snapshot reads tool names through one shared `surfaceOf` rather than a copy per plugin (#368).
+- 让逐 agent 重探针不再作废仍有效的注册，也不再把未发布的结果留在 entry 上。`reconcile` 每次调用都推进 epoch，于是新增 `targets` 参数变成空转的那些 pass 仍会作废所有已发布的 `execute` 守卫与 Native 影子工具，它们随后对仍然有效的 scope 返回 `POLICY_DENIED`；探针还会在消费它的那次重发布执行之前就把 surface 记到 entry 上，被后一次 reconcile 取代的 pass 由此让下一个 pass 把该 surface 当作已发布而永远提前返回，PTC 判定因此始终无法生效。现在单独的 `published` 计数器只在某个 pass 真正重发布时推进，守卫改为比较它，探针结果保持待提交直到那次重发布写入。`discovery` 同样比较 `published`：它的探针要装配提示词，而装配会 reconcile 其它 scope。离开 agent 时的空目标集合现在是真正的免探测 pass，不再被归一化成“无限制”而对全部幸存者重探；每次发布的工具快照改由共享的 `surfaceOf` 读工具名，不再每个插件各存一份（#368）。
+- Stop re-probing every tracked agent on each PTC publish. `ptc` and `discovery` both assembled the entire prompt once per agent per reconcile, so a new session paid for every session still tracked: on Windows x64 with 38 bundles the same `session/create` took 264 / 308 / 396 / 475 / 590 / 681 / 748 / 947 ms over eight rounds. Each agent now memoizes its presentation verdict against the tool names it publishes and re-probes only when that set changes, `reconcile` accepts the agents a change actually touches, and the per-publish tool snapshot reads names instead of rebuilding a scope view per tool. The same eight rounds now measure 195 / 226 / 270 / 260 / 295 / 329 / 358 / 373 ms (#333, #359).
+- 不再在每次 PTC 发布时重新探测全部已跟踪 agent。`ptc` 与 `discovery` 都在每次 reconcile 里对每个 agent 完整装配一次提示词，因此新建一个会话要付出所有仍在跟踪的会话的代价：Windows x64、38 个 bundle 下，同一个 `session/create` 八轮为 264 / 308 / 396 / 475 / 590 / 681 / 748 / 947 ms。现在每个 agent 按自己发布的工具名缓存呈现判定、只有该集合变化时才重新探测，`reconcile` 接受「本次真正受影响的 agent」，每次发布的工具快照只读工具名而不再为每个工具重建一次 scope 视图。同样八轮实测为 195 / 226 / 270 / 260 / 295 / 329 / 358 / 373 ms（#333、#359）。
+- Summarize large intact JSON spills for successful Native foreground Bash calls, with bounded samples and a full-output path. Preserve canonical/PTC values, stderr, exit status, host spill ownership and fallback rendering; add no command rewriting or runtime dependency (#297).
+- 成功的 Native 前台 Bash 调用可将大型完整 JSON 溢出输出显示为有限样本和完整输出路径；规范/PTC 数据、stderr、退出状态、宿主溢出存储及降级展示保持不变，不重写命令、不增加运行依赖（#297）。
+
+- Present `ops_bash` through the host's terminal-card contract with multiline commands, cwd, captured output and durable exit/signal facts. Background jobs retain their collection guidance; older UIs retain generic rendering (#32).
+- `ops_bash` 通过宿主 terminal card 契约展示多行命令、工作目录、已捕获输出和持久化退出码/信号；后台任务保留收集指引，旧 UI 保留通用展示（#32）。
+- Add opt-in `exactTotal: false` to grep for bounded prefix queries. Stop after the requested matching rows, report lower bounds without stable continuation, and preserve exact totals by default and for summaries. Keep invalid encoding as an explicit coverage gap instead of inventing a complete total (#384).
+- grep 新增可选 `exactTotal: false`，按所需匹配行数提前停止，返回下界且不提供稳定续页；默认查询和 summary 保留完整扫描。无效编码仍明确标为覆盖缺口，不伪造完整总数（#384）。
+- Derive discovery names, file mutation/rendering classes, retrieval continuations, read observations, PTC residency and browser replacement choices from shared catalogue facts. Check all component declarations and explicit bundle defaults against runtime definitions, cover every worker tool in the Rust dispatch boundary, and expose missing shell/discovery settings fields with explicit compatibility exclusions (#315).
+- 从共享目录定义派生发现工具名、文件变更渲染分类、读取续页、读取观察、PTC 常驻状态及浏览器替换选项。将各组件声明和 bundle 显式默认值与运行时逐项校验，覆盖全部工具的 Rust 分派边界，并补齐 shell/discovery 设置字段、明确兼容字段的排除项（#315）。
+- Declare DSH 0.2.0-rc.2 and 0.2.1-rc.2 consistently in engines/peers, export every
+  component icon, and validate bundle composition with the host patch API (#200).
+  中英文兼容范围、组件图标导出与升级检查同步更新；宿主 patch 校验拒绝丢失目标的 override。
+
+- Add macOS Intel (`darwin-x64`) as a first-class native target on macOS 13+: accept it in the resolver and profile commands, declare it in every component row, ship its Mach-O worker with a receipt, and add a non-blocking `macos-15-intel` CI leg plus the fourth release artifact. The Intel leg measured 318 s, so it follows the >300 s non-blocking rule. macOS 12 is not part of this support: its kernel lacks `CLONE_ACL`, so the write path fails closed; that fallback is a separate follow-up. See [macOS](macos.md).
+- 将 macOS Intel（`darwin-x64`）作为 macOS 13+ 的一等原生目标：解析器与 profile 命令接受它，所有组件行声明它，发布其 Mach-O worker 与收据，并新增非阻塞的 `macos-15-intel` CI leg 与第四个发布 artifact。Intel leg 实测 318 秒，因此按 >300 秒规则作为非阻塞信号。macOS 12 不在本次支持范围内：其内核缺少 `CLONE_ACL`，写路径会 fail closed；该回退是独立后续项。说明见 [macOS](macos.zh.md)。
+- Add candidate-only benchmark component switches with conservative patch editing, composed-config verification and a bounded readiness turn. Archive effective switches, show them in reports, and reject comparisons across different candidate switch sets (#296).
+- 为 benchmark 增加仅作用于 candidate 的组件开关，保守编辑补丁并核验合成配置及有时限的就绪 turn；归档实际开关、在报告中展示，并拒绝不同 candidate 开关集的混配（#296）。
+
+- Make benchmark model/reasoning selections actual shared routing conditions, archive composed configuration, and record the condition in sealed evidence. Repeated selections produce separate condition groups and reports; cross-condition pairing is refused, while historical runs remain readable as unknown (#294).
+- 将 benchmark 的模型与思考档位选择用于两臂实际路由，归档合成配置并在封存证据中记录条件。重复选项生成独立条件组和分组报告，拒绝跨条件配对；历史运行仍可按未知条件读取（#294）。
+- Make benchmark setup skip Windows-only checks explicitly on POSIX, preserve platform/component configuration in summaries and sealed arms, reject cross-platform comparisons by default, and expand the optional tools smoke to Linux, Windows and macOS (#295).
+- 基准准备在 POSIX 上明确跳过 Windows 专用检查，普通摘要和封存数据保留平台及组件配置，默认拒绝跨平台混配，可选 tools 自检覆盖 Linux、Windows、macOS（#295）。
+- Document the owned Bash restriction boundary and publication switch (#380),
+  provider tool-change error ownership (#367), and scoped discovery troubleshooting (#346).
+- 说明 Bash 自有工具的掩码边界与发布开关、提供商工具变更错误的职责边界及 discovery 作用域排查方法。
+- Run CI on every PR target branch, including stacked feature branches; provide a checked ruleset payload and explicit administrator acceptance steps for required checks (#303). Repository enforcement still requires admin application.
+- CI 覆盖所有 PR 目标分支（包括堆叠功能分支），提供校验过的规则 JSON 与管理员验收步骤（#303）；仓库强制保护仍需管理员实际应用。
+
 - Stop `dsh-ops-hide-official` from blocking a `run_code` (PTC) scope when `replaceTools` is set. That scope presents one program entry, and the selected counterparts are SDK functions rather than owned native providers, so readiness could never be proven and every PTC session failed prompt assembly with `READINESS_BLOCKED` as soon as one tool was selected. Readiness is now judged on the assembled surface: a scope that really kept a selected official tool still fails closed, while a collapsed scope's transport is not gated and the selected official names stay refused there.
 - 修复 `dsh-ops-hide-official` 在设置 `replaceTools` 后阻塞 `run_code`（PTC）作用域的问题。该作用域只呈现一个程序入口，所选替代工具是 SDK 函数而非已拥有的 native provider，就绪状态永远无法成立，只要选择了一项工具，每个 PTC 会话的提示词组装都会以 `READINESS_BLOCKED` 失败。现在改以装配出的表面判定：真正保留了所选官方工具的作用域仍然失败闭合；折叠作用域的 transport 不再被门禁阻塞，所选官方工具在该作用域内仍被拒绝。
+- Name the bytes each published checksum covers (#300): `SHA256SUMS` is authoritative for the released tarballs, and every tarball records its native worker's digest in `runtime/<target>/provenance.json`; the Release body defines neither. The 0.3.1 notes headed that table `Target | SHA-256` and listed the worker digest, while 0.3.2 kept the heading and listed the ZIP digest, so anyone comparing archive against worker saw a false mismatch. The troubleshooting guides now carry the in-package check (`node package/bin/native-runtime.mjs check --root package --platform <target>`), which needs no platform-specific hashing tool, and `docs/PROVENANCE.md` records the historical mismatch. Published Release bodies are left as they were.
+- 说明已发布的摘要到底覆盖哪些字节（#300）：`SHA256SUMS` 是发布 tarball 的权威，每个 tarball 在 `runtime/<target>/provenance.json` 里记录自带 native worker 的摘要，两者都不由 Release 正文定义。0.3.1 的正文把 `Target | SHA-256` 填成 worker 摘要，0.3.2 在同样表头下填成 ZIP 摘要，比对归档与 worker 的人因此看到假的不匹配。排查文档新增包内校验命令（`node package/bin/native-runtime.mjs check --root package --platform <target>`），不依赖平台专有的哈希工具；`docs/PROVENANCE.md` 记录这段历史口径。已发布的 Release 正文保持原样。
 - Make the Windows CI leg non-blocking while keeping it running on every event (#316): split `validate` into blocking `validate-posix` (Linux x64, macOS arm64) and `continue-on-error` `validate-windows`, and keep `ci-required` from depending on any `continue-on-error` job, so the aggregate neither waits for nor fails with the slowest leg. On `main` after #307 the Windows leg takes 527 / 529 s — up from 482 s before #307, because `npm ci` now downloads the 411 MB Windows Bash payload — against 136–139 s (Linux) and 168–182 s (macOS). `scripts/check-workflows.mjs` now enforces "every blocking job in the aggregate, no non-blocking job in it" and that the aggregate's failure loop names exactly the blocking jobs, so a job cannot stay in `needs` but escape judgement; the Windows result is a signal to act on, not a merge gate.
 - 将 CI 的 Windows 腿改为非阻塞、但仍每次触发都运行（#316）：把 `validate` 拆成阻塞的 `validate-posix`（Linux x64、macOS arm64）与 `continue-on-error` 的 `validate-windows`，并让 `ci-required` 不依赖任何 `continue-on-error` job，聚合既不等待也不随最慢的一腿失败。`main` 在 #307 合入后实测 Windows 腿 527 / 529 秒（#307 之前 482 秒，因为 `npm ci` 现在要拉 411 MB 的 Windows Bash 载荷），Linux 136–139 秒、macOS 168–182 秒。`scripts/check-workflows.mjs` 现在强制“每个阻塞 job 都在聚合里、聚合里没有非阻塞 job”，并要求失败判定循环里的 job 集合与阻塞集合完全相等，避免 job 留在 `needs` 却逃过判定；Windows 结果是待处理的信号，不是合并门禁。
 - Bound each `ops_replace` output to the same 32 MiB UTF-8 byte ceiling as file writes. Check expansion with overflow-safe arithmetic for the entire plan before constructing replacement content or publishing any file, including dry runs; an over-limit target returns `OUTPUT_LIMIT` with no file changes (#330).
 - 将 `ops_replace` 的每个文件产出限制为与文件写入相同的 32 MiB UTF-8 字节上限。在构造替换内容或发布任何文件前，使用检查溢出的算术核验整个计划，dry-run 使用相同口径；任一目标超限即返回 `OUTPUT_LIMIT`，不修改任何文件（#330）。
 - Anchor a POSIX-style absolute `workdir` on Windows sessions (#318). bash itself writes `/d/…` for `D:\…` and models follow that spelling, but the `/`-rooted form slipped past the `driveRooted` escape in `sessionWorkdir` and reached the executor unchanged, where Node's `fs` read it against the *host process's* current drive: with no such directory there, a path that exists was reported as `must be an existing directory`; with a decoy directory there, the command ran in the wrong tree with exit 0. The drive-letter form (`/d/x`, `/d`) is now mapped onto `D:\x` and anchored and validated like any other absolute path; a drive-less POSIX absolute (`/`, `/tmp/x`) is refused with the reason and the accepted spellings, so nothing silently falls back to an unrelated drive. Forward-slash UNC (`//server/share`) keeps its passthrough, `\child` and `D:child` keep their #180 anchoring, and POSIX sessions are unchanged.
 - Windows 会话上的 POSIX 风格绝对 `workdir` 现在正确锚定（#318）。bash 自身把 `D:\…` 写作 `/d/…`，模型也沿用这种写法；但 `/` 开头的形态躲过了 `sessionWorkdir` 里为 `\child` 设的 `driveRooted` 分支，原样到达执行器后被 Node 的 `fs` 按**宿主进程当前盘**解读：那里没有目录时，明明存在的路径被报成 `must be an existing directory`；那里恰有同名目录时，命令会在错误的目录里 exit 0 静默执行。现在带盘符的写法（`/d/x`、`/d`）会映射为 `D:\x`，与其它绝对路径走同样的锚定与校验；无盘符的 POSIX 绝对路径（`/`、`/tmp/x`）被显式拒绝并说明原因与可接受写法，不再静默落到无关盘符。正斜杠 UNC（`//server/share`）维持原样透传，`\child` 与 `D:child` 保留 #180 的锚定语义，POSIX 会话行为不变。
+- Preserve caller-installed tool precedence after the required private MSYS `usr/bin`, before optional bundled `ucrt64/bin` and `cmd` programs (#364). Clarify that `script_path` always uses Bash. Supply empty stdin through a closed pipe instead of Windows NUL, retaining EOF semantics while avoiding the reported MSYS fd-0 device initialization condition (#372).
+- 保持用户自行安装工具的优先级：仅必要的私有 MSYS `usr/bin` 在前，可选的 `ucrt64/bin` 和 `cmd` 排在用户 PATH 后（#364）。明确 `script_path` 始终使用 Bash。空 stdin 改用立即关闭的管道，保留 EOF 语义并避免报告中的 MSYS fd-0 设备初始化条件（#372）。
 - Add concise, field-level help to discoverable core file-tool input schemas, including quoted glob-array examples, regex/literal distinctions, search defaults and preview semantics. Keep resident `read_files`, validation constraints and runtime behavior unchanged; improved guidance does not guarantee model-generated JSON correctness (#328).
 - 为按需发现的核心文件工具输入 schema 补充简短字段说明，包括带引号的 glob 数组示例、正则与字面量的区别、搜索默认值和预览语义。常驻 `read_files`、校验约束和运行时行为不变；改善指引不代表保证模型生成的 JSON 一定正确（#328）。
 - Report unsupported update locks as `LOCK_UNSUPPORTED` instead of a misleading `REVISION_CONFLICT`; actual writes on filesystems without the required lock support remain refused (#326).
@@ -35,6 +88,11 @@ this package adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 - Relicense the current distribution as MIT. FastCtx was removed in 0.3.2, so the composite `MIT AND Apache-2.0` statement no longer describes the code; earlier releases keep their own notices, and FastCtx's Apache-2.0 text and required attribution remain in `licenses/fastctx/` and `NOTICE` for them.
 - 当前发行版改为 MIT 许可。FastCtx 已在 0.3.2 移除，复合 `MIT AND Apache-2.0` 不再描述现有代码；早期版本保留各自声明，FastCtx 的 Apache-2.0 文本与要求转载的归属仍保留在 `licenses/fastctx/` 与 `NOTICE` 中。
+- Reserve the exact `.dsh-ops` component case-insensitively on absolute public file-tool paths as well as relative batch paths. Reads, writes, edits, copy/move sources and destinations, removals, and explicit search/replace paths return `PATH_RESTRICTED` before content access or publication. Preserve ordinary hidden-search exclusions and trusted batch audit/result/cache lifecycle access (#329).
+- 绝对路径公开文件工具与相对 batch 通道统一将完整组件 `.dsh-ops` 视为保留名，忽略大小写。读取、写入、编辑、复制/移动的源与目标、删除及显式搜索/替换路径均在内容访问或发布前返回 `PATH_RESTRICTED`；保留普通隐藏搜索排除规则，以及可信 batch 审计、结果和缓存生命周期访问（#329）。
+
+- Fix independent restricted Windows Bash roots failing to reopen the current user's MSYS shared section while another root is alive (#363). Preserve the original ACL and the existing verified object-directory, pagefile-only and Low restricted-token boundaries; unrelated sections and filesystem permissions are unchanged.
+- 修复 Windows 受限模式中，一个 Bash 根进程仍在运行时，独立根进程无法重新打开当前用户的 MSYS 共享段的问题（#363）。保留原有 ACL，以及经过验证的对象目录、仅分页文件共享段、Low 受限令牌边界；不改变其它共享段和文件系统权限。
 
 ## [0.4.1] — 2026-10-20 — Update locks stop leaving files behind
 
@@ -48,11 +106,15 @@ this package adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 - 恢复扩展属性时改在写入最终模式之前进行，只读文件不再丢失 `user.*` 属性，macOS 的 `0400` 替换也不再报告 `com.apple.provenance` 未恢复；模式矩阵用例改为携带用户属性，使该顺序在所有平台都受断言约束，而不只依赖 macOS 自带的属性（#324）。
 - Stop inventing audit references for new batch validation failures that occur before a job is saved, and for synchronous failures before worker creation. Preserve worker-provided references, existing resume identities and recovery ids for interrupted or ambiguous execution; no additional worker calls are made (#78).
 - 新批次在审计记录创建前发生已确认的校验失败，或工作进程创建前同步失败时，不再返回不存在的审计引用。保留 worker 返回的引用、已有 resume 标识，以及执行中断或状态不明时的恢复标识；不增加 worker 调用（#78）。
+- Document stopped-host upgrades and removal, explicit trusted-registry selection for lockfile policy checks, and the 0.3.x-to-0.4.x migration contracts (#175, #335, #372). Distinguish file locks, missing registry metadata and unconfirmed native crash causes; retain security policies and provide scoped crash-evidence guidance.
+- 补充停止宿主后升级/卸载、锁文件策略检查时显式选择可信 registry，以及 0.3.x 到 0.4.x 的迁移契约（#175、#335、#372）。区分文件占用、registry 元数据缺失与未确认的原生崩溃原因；保留安全策略并提供按应用收集证据的方法。
 - Validate the selected profile CLI before both dry-run and execution (#100): reject missing or unusable launchers and missing Node bin targets, preserve PATH lookup and Windows PATHEXT/batch launchers, and apply Windows command-script path checks during preview. Dry-run never executes the candidate or changes the profile.
 - 在安装/卸载的预演与实际执行前共用 CLI 静态检查（#100）：拒绝缺失或不可用的启动文件及缺失的 Node bin 入口，保留 PATH 查找与 Windows PATHEXT/命令脚本，并在预演时同样检查 Windows 命令脚本路径。预演不启动候选程序、不修改 profile。
 
 - Fix the generated `ops_load_sdk` declaration (the builder still keyed on the pre-rename `sdk` name), cover the rename alias plus the `select:` and SDK request paths with tests, and align the catalogue facts in the current docs (20/18/15, 242 tokens/1101 bytes) with a docs guard (#302).
 - 修复生成的 `ops_load_sdk` 声明（构建脚本仍按改名前的 `sdk` 判定）、为改名别名与 `select:`/SDK 请求路径补测试，并把当前文档的目录事实（20/18/15、242 tokens/1101 bytes）对齐并加守护（#302）。
+- Add the opt-in `dsh-ops review snapshot` CLI for bounded PR/claim evidence, exact-head PR CI, matching base workflow health and isolated local merge probes (#356, P0). Missing evidence remains unknown; no resident schema, source-branch mutation or GitHub write is added.
+- 新增显式 `dsh-ops review snapshot` CLI，收集有界 PR/认领证据、准确 head 的 PR CI、同 workflow 的 base 状态与隔离的本地合并预演（#356，P0）。缺失证据保持 unknown，不新增常驻 schema、不修改源分支或 GitHub。
 - Account for existing append-log and new-session header bytes before admitting queued panel events, with bounded pending data and physical-stop behavior. Recover persisted caps without appending further events or duplicate markers. If opening the log fails, stop that capture without appending or replacing existing output. JSON parse losses now mark capture degraded and usage incomplete while preserving valid records and totals.
 - 面板恢复先计入已有追加日志或新会话头部的字节，再接纳排队事件，保留有界待写数据与实际停止语义；恢复已封顶日志时不再追加事件或重复的封顶标记。日志初始化失败后停止该会话的采集，不再追加或替换已有输出。JSON 解析丢失的记录现在会标记采集降级、用量不完整，同时保留有效记录及其合计。
 - Add `dsh-ops panel [--serve] [dir] [--port <n>]`: serve one capture directory and the shipped viewer on loopback, preselect the newest valid report, offer the other valid reports for switching, refuse malformed reports and paths outside the directory, and document the capture-directory `.gitignore` and drag-and-drop fallback (#257).
diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md
index cd823f53..41e5b0dc 100644
--- a/docs/CONTRIBUTING.md
+++ b/docs/CONTRIBUTING.md
@@ -114,22 +114,24 @@ What a skip means locally:
   `test/run.mjs` (every `test/*.test.mjs`
   in its own process with its own temporary `DSH_HOME`).
 - `node scripts/verify-gate.mjs --skip-install` — **the release gate**, exactly what
-  `.github/workflows/ci.yml` runs on Windows x64, Linux x64 and macOS arm64: worker unit tests, build
+  `.github/workflows/ci.yml` runs on Windows x64, Linux x64, macOS arm64 and macOS Intel x64: worker unit tests, build
   and stage, manifest floor, every suite, the allowed-skip set, the suite inventory on disk, and the
   packed artifact.
 - `node test/run.mjs <filter>` runs only the suites whose file names contain `<filter>`, e.g.
   `node test/run.mjs mount file-operations`.
 
 How to read the gate and the expected numbers per host: [verify-locally.md](verify-locally.md).
-CI runs on every pull request and every push to `main`, `0.3.2` and `release/0.4.0`. The two POSIX legs (`validate-posix`: Linux x64, macOS arm64) block a merge; the Windows x64 leg (`validate-windows`) still runs on every event but is non-blocking — a red Windows run is a defect to fix, not a reason to hold the merge (#316).
+CI runs on every pull request and every push to `main`, `0.3.2` and `release/0.4.0`. The two blocking POSIX legs (`validate-posix`: Linux x64, macOS arm64) block a merge. The Windows x64 leg (`validate-windows`) and the macOS Intel leg (`validate-macos-intel`) still run on every event but are non-blocking — a red run there is a defect to fix, not a reason to hold the merge (#316; the Intel leg measured 318 s).
 
 ## One CI run per pull request
 
+All target branches are covered, including stacked feature branches. Repository enforcement requires the separate [administrator ruleset and acceptance steps](required-ci-admin.md); passing CI alone does not configure branch protection.
+
 Every pull request must show one run of the [Cross-platform validation](https://github.com/T-Auto/dsh-ops/blob/main/.github/workflows/ci.yml)
 workflow that its **own `pull_request` event** triggered. The aggregate job **`CI required`**
-summarises the two blocking POSIX legs (Linux x64, macOS arm64); the non-blocking Windows x64 leg
-runs alongside it and is deliberately not waited on. That job's run URL is what the pull request
-template asks for.
+summarises the two blocking POSIX legs (Linux x64, macOS arm64); the non-blocking Windows x64 and
+macOS Intel legs run alongside it and are deliberately not waited on. That job's run URL is what the
+pull request template asks for.
 
 - **What triggers it.** `ci.yml` runs on `pull_request` targeting `main`, `0.3.2` and
   `release/0.4.0` (and on `push` to the same branches, plus `merge_group`). GitHub reads the
diff --git a/docs/PROVENANCE.md b/docs/PROVENANCE.md
index 469f87db..85baacda 100644
--- a/docs/PROVENANCE.md
+++ b/docs/PROVENANCE.md
@@ -50,6 +50,12 @@ FastCtx, `vendor/fastctx/`, the background component, or the FastCtx payload
 package, they describe those releases, not this one; those files remain in the
 repository history and in the published tarballs of the versions that carried them.
 
+## Current target matrix (0.4.x)
+
+The current package declares `win32-x64`, `linux-x64`, `darwin-arm64` and `darwin-x64`.
+The 0.3.1 record below is historical: it shipped Apple Silicon only and did not include
+Intel. macOS 12's `CLONE_ACL` fallback is a separate follow-up; see [macOS](macos.md).
+
 ## 0.3.1 release scope and verification
 
 0.3.1 targets Windows x64, Linux x64 and macOS Apple Silicon (`darwin-arm64`). Intel Mac and other ARM64 targets are not supported. Exact target pairs live in `PLATFORMS` and component `targets`; npm os/cpu filters are only their coarse projection. Windows Bash/pwsh remain pinned Windows-only optional dependencies; POSIX uses host Bash. No postinstall downloader is included.
@@ -74,6 +80,14 @@ payload dependency (see the 0.2.1 historical limitation below).
 
 All three workers are staged with version/target/hash receipts. Formal release closure requires every exact target and the Windows IPC binary/source closure. Local `check --staged` is a development check, not release approval. Final verification is linked in `docs/release-0.3.1.md` and the GitHub Release; early contributor measurements are not substituted for the integrated revision. GitHub publication does not automatically publish npm.
 
+The 0.3.1 Release notes headed that asset table `Target | SHA-256` and listed the
+**worker** digest — the value `runtime/<target>/provenance.json` records — not the
+digest of the attached `native-<target>-runtime-v0.3.1.zip`; the 0.3.2 notes kept
+the same heading and listed the **ZIP** digest. Both values are meaningful and
+they cover different bytes, so comparing one against the other reports a false
+mismatch. The published bodies are left as they were; this paragraph is the
+correction, recorded here the same way as the notes-only Releases below.
+
 ## Historical development evidence
 
 The file component is no longer a FastCtx client. `native/src/file.rs` implements
diff --git "a/docs/PTC\346\214\211\351\234\200\345\212\240\350\275\275.md" "b/docs/PTC\346\214\211\351\234\200\345\212\240\350\275\275.md"
index b1d60c51..d8593a8f 100644
--- "a/docs/PTC\346\214\211\351\234\200\345\212\240\350\275\275.md"
+++ "b/docs/PTC\346\214\211\351\234\200\345\212\240\350\275\275.md"
@@ -4,6 +4,8 @@ PTC 组件独立于 Native 文件组件提供文件 API。PTC-only 代理初始
 
 在 run_code 内调用 tools.ops_load_sdk({ tools: ['grep', 'read_files'] })。成功 Outcome 的 data.tools 列出请求名称，data.nextTurn 为 true。当前工具轮次结束、所属会话提交 step/end 后，请求的 API 会在紧接着的供应商请求中发布；当前冻结的 SDK 快照无法调用新 API。该边界前的系统提示组装、诊断组装以及工具注册通知不会提前激活排队请求。组装会等待本插件发布并按需通过公开服务获取新快照；内部呈现探测跳过此屏障，防止递归等待。
 
+PTC 与 discovery 对独立根会话分别探测。祖先与后代的工具叠加层相互依赖，仍作为同一继承族发布。如果宿主提示词 hook 永不返回，该族无法获得新验证的工具，但其他根会话仍可创建、组装、变更权限及销毁。被取代的探测收到取消信号；即使 hook 忽略信号，销毁与卸载也会结束 OPS 自身的等待，迟到结果不得发布。本改动隔离共享队列故障类型，不据此断定 [#359](https://github.com/T-Auto/dsh-ops/issues/359) 所述多插件 Desktop 冻结的原因或恢复结果。
+
 PTC 行配置由统一配置入口验证：
 
 | 配置 | 默认值 | 含义 |
diff --git a/docs/benchmark-gates.md b/docs/benchmark-gates.md
index 3033fd8b..6d415db9 100644
--- a/docs/benchmark-gates.md
+++ b/docs/benchmark-gates.md
@@ -15,7 +15,7 @@ node bench/cli.mjs gates --baseline-source baseline-031 --baseline-worker baseli
 
 On Windows append `.exe` to the baseline worker. To measure the complete Bash surface, first install an optional fixture into a dedicated temporary `DSH_HOME` with `node bin/dsh-ops.mjs bash-runtime install`, then set `DSH_OPS_TEST_BASH` to its validated absolute executable (the release gate uses the same fixture API). The benchmark records this explicit selection; it changes no schema options. A fresh home without an installed Bash correctly blocks BM-03 instead of counting only the file schemas. The manual workflow acquires this fixture explicitly. Use a new output filename for each run. The command refuses to overwrite either JSON evidence or its `.md` summary. It retains its exclusively owned temporary fixture directory for inspection. `--task BM-02` selects one gate; selected success never means that all five passed. Any failed or unavailable selected gate exits 1; malformed arguments or missing build inputs exit 2.
 
-The manual `Opt-in OPS acceptance benchmarks` workflow runs the same command on Windows x64, Linux x64 and Apple Silicon, independently builds the baseline, and uploads both artifacts even when a gate fails. It changes no default CI requirement and uses no model credentials.
+The manual `Opt-in OPS acceptance benchmarks` workflow runs the same command on Windows x64, Linux x64 and Apple Silicon, independently builds the baseline, and uploads both artifacts even when a gate fails. The functional CI and release matrix also cover macOS Intel (`darwin-x64`), but the opt-in benchmark sweep does not include it yet. It changes no default CI requirement and uses no model credentials.
 
 ## Fixed workloads and comparisons
 
diff --git a/docs/ci.md b/docs/ci.md
index 31d65a84..0fca470c 100644
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -8,24 +8,27 @@ a reviewer can trust a green PR without re-running anything by hand.
 
 | Workflow | Trigger | Blocks a merge? | Purpose |
 | --- | --- | --- | --- |
-| `ci.yml` — **Cross-platform validation** | `push: main`, `pull_request: main`, `merge_group`, manual dispatch | **Yes** (via the single `CI required` check) | The functional gate on Linux and macOS (blocking) and on Windows (a non-blocking signal), plus the Node floor, the source size gate, workflow lint and the tool trial |
+| `ci.yml` — **Cross-platform validation** | `push: main`, `pull_request: main`, `merge_group`, manual dispatch | **Yes** (via the single `CI required` check) | The functional gate on Linux and macOS arm64 (blocking), macOS Intel and Windows (non-blocking signals), plus the Node floor, the source size gate, workflow lint and the tool trial |
 | `sync-master.yml` — **Sync master with main** | `push: main`, manual dispatch | No | Fast-forwards the `master` mirror; fast-forward only, so a divergent `master` fails loudly |
-| `release.yml` — **Release** | `push: v*` tags, manual dispatch | No (`disabled_manually` today) | Builds the three declared targets, gates them, and publishes the GitHub Release. Nothing here runs on a branch or a pull request |
+| `release.yml` — **Release** | `push: v*` tags, manual dispatch | No (`disabled_manually` today) | Builds the four declared targets, gates them, and publishes the GitHub Release. Nothing here runs on a branch or a pull request |
 
 ### Jobs inside `ci.yml`
 
 | Job | Runner | Blocking? | What it proves |
 | --- | --- | --- | --- |
 | `validate-posix` | `ubuntu-24.04` (linux-x64), `macos-latest` (darwin-arm64) | **Yes** | `cargo test --workspace --locked`, the native worker builds, then `scripts/verify-gate.mjs --skip-install`: no unauthorised skips (`DSH_OPS_REQUIRE_RUNTIME=1` on POSIX turns a missing runtime into a failure), every suite file on disk was collected, and the packed artifact unpacks and passes `native-runtime check` |
+| `validate-macos-intel` | `macos-15-intel` (darwin-x64) | **No** (`continue-on-error`) | The same gate on Intel macOS, including the Mach-O x86_64 worker and its receipt; it runs on every push, pull request and merge group and uploads `native-darwin-x64`. The leg measured **318 s**, past the >300 s line (#316), so it is a signal, not a gate (see below) |
 | `validate-windows` | `windows-latest` (win32-x64) | **No** (`continue-on-error`) | The same gate on Windows, and it still runs on every push, pull request and merge group — the result is a **signal, not a gate**: a red Windows leg is a defect to fix, but it does not hold a merge (see below) |
 | `node-floor` | `ubuntu-24.04` | **Yes** | `package.json` promises `^22.19 \|\| >=24`; this runs the same gate on the declared **floor** so the promise is exercised rather than asserted |
 | `workflow-lint` | `ubuntu-24.04` | **Yes** | `scripts/check-workflows.mjs`: every workflow parses, declares triggers/jobs/permissions, bounds each job with `timeout-minutes`, avoids `write-all` and `pull_request_target`, and keeps `ci.yml`'s aggregate check wired to every blocking job — in `needs` and in its failure loop — while keeping every `continue-on-error` job out of both |
 | `source-size` | `ubuntu-24.04` | **Yes** | `scripts/check-file-size.mjs`: every tracked code file stays at or under 1000 lines. The file set comes from `git ls-files`, so a new module is in scope the moment it is added |
 | `tools-trial` | `ubuntu-24.04` | **No** (`continue-on-error`) | Boots a real host and calls every published tool; a broken tool shows up in its own job and in the uploaded `tools-trial-report` without blocking unrelated work |
-| `ci-required` | `ubuntu-24.04` | — (this is the check to require) | Collapses the matrix into one status: it fails unless every blocking job succeeded, and it waits only on blocking jobs — `validate-windows`, `tools-trial` and `bench-smoke` are `continue-on-error` and are deliberately not in its `needs` |
+| `ci-required` | `ubuntu-24.04` | — (this is the check to require) | Collapses the matrix into one status: it fails unless every blocking job succeeded, and it waits only on blocking jobs — `validate-windows`, `validate-macos-intel`, `tools-trial` and `bench-smoke` are `continue-on-error` and are deliberately not in its `needs` |
 
 `validate-windows` is non-blocking by measurement, not by preference: on `main` after #307 the leg took **527 / 529 s** — up from 482 s before #307, because `npm ci` now downloads the 411 MB Windows Bash payload — while the blocking legs took 136–139 s (Linux x64) and 168–182 s (macOS arm64). That is well past the approved ">300 s → non-blocking" line (#316); splitting the leg into shards was measured at 1.5–2.4× the runner minutes and still stayed above 300 s on a slow runner. It is still a signal worth reading — a red Windows run is a defect — but the aggregate check does not wait for it, so a merge does not pay for the slowest leg.
 
+`validate-macos-intel` follows the same rule. On the PR run that added the target it took **318 s**, against 174 s for Linux x64 and 146 s for macOS arm64 in the same run. It still runs on every event and uploads `native-darwin-x64`; a red Intel run is a defect to fix, not a reason to hold the merge. The blocking set remains Linux x64 and macOS arm64, plus `node-floor`, `workflow-lint` and `source-size`.
+
 `connectivity` of the required check matters more than its name: require **`CI required`**, not the
 per-platform names. The blocking matrix expands into one check per runner, so requiring those names
 by hand means keeping them in sync forever, and losing the gate the day a runner label changes.
diff --git a/docs/component-reference.md b/docs/component-reference.md
index b0cd1ceb..27e56146 100644
--- a/docs/component-reference.md
+++ b/docs/component-reference.md
@@ -86,7 +86,9 @@ Find regular files below `path`. `pattern` is an **array** of globs matched segm
 
 Search UTF-8 files below `path` with Rust regex, bounded output, paging and optional line context. `pattern` is **one** regex string; filter files with `glob`, an array in the same syntax as `ops_glob`. **There is no `include` field.** `glob` may contain only exclusions ("everything except"); when `path` is a single file, `glob` is ignored.
 
-Use `summary` for aggregate file/match totals, `count` for per-file counts, `content` for matching text (default). Each item page defaults to 100 entries. Every call scans candidates to count global totals while materializing only the requested window, so later matches are not silently lost at the first page boundary. Follow `nextOffset` for remaining pages; `truncated`/`failed` scans are not exhaustive and must not be blindly retried. Non-UTF-8 and oversized files are excluded and counted in `skippedFiles`; read failures increment `failed` and prevent completion. Traversal/file-size bounds still apply, and repeated pages rescan rather than use a persistent cursor.
+Use `summary` for aggregate file/match totals, `count` for per-file counts, `content` for matching text (default). Each item page defaults to 100 entries. By default (`exactTotal: true`), each call scans candidates to count global totals while materializing only the requested window. Set `exactTotal: false` for a first-prefix query that stops at `offset + limit` matching rows; content stops within a file, while count/file modes finish that file so per-file counts remain exact. An early stop reports `scanComplete: false`, `truncatedBy: row-limit` and `matchedObserved` as a lower bound, with no `matchedTotal`, `total` or stable continuation. Start a fresh exact query for complete totals. Summary mode and requests with a continuation always scan fully.
+
+Follow a returned continuation for stable remaining pages, keeping query options unchanged; incomplete scans must not be blindly retried. Non-UTF-8 and oversized files are coverage gaps counted in `skippedFiles`, so they prevent exact totals even when `failed` is zero. Invalid UTF-8 can contain matching ASCII bytes or other encoded text; skipping it does not establish absence. Filter out unwanted files explicitly with `glob`. Read failures also increment `failed`. Traversal/file-size bounds still apply, and repeated pages rescan rather than use a persistent cursor.
 
 | Parameter | Type | Notes |
 | --- | --- | --- |
@@ -98,6 +100,7 @@ Use `summary` for aggregate file/match totals, `count` for per-file counts, `con
 | `lineNumbers` | boolean | Show line numbers |
 | `beforeContext` / `afterContext` | integer ≤ 32 | Context lines |
 | `multiline` | boolean | Multi-line matching |
+| `exactTotal` | boolean | Default true; false permits a bounded prefix with lower-bound totals; summary/continuation still scan fully |
 | `offset` / `limit` | integer ≥ 0 / integer 1–10000 | 0-based offset (default 0); limit default 100 |
 
 ### `ops_replace`
@@ -184,6 +187,10 @@ On Windows x64 the install carries the pinned Bash payload as an optional depend
 
 `sandbox_permissions` plus `justification` can request a strictly wider mode through the host approval service. An allowed-once grant applies to that command only; rejection never executes it or changes the session mode. Authority is checked again after approval and sandbox preparation. Windows confinement reports the host provider’s actual enforcement (including `partial`); incompatible Bash runtimes fail closed.
 
+Successful Native foreground Bash calls can show a bounded JSON summary when stdout has an intact host spill between 8 KiB and 2 MiB. It reports object keys, array lengths, limited samples and sampled error records, with the full-output path; this is explicitly lossy and does not prove the absence of application errors. The summary is used only when at least 20% smaller in bytes than the ordinary rendered result. Stderr and exit information remain visible. Malformed, oversized, unavailable or unhelpful JSON keeps the ordinary output. No command is rewritten and no second output store is created. Canonical results and nested PTC SDK values are unchanged; background output still belongs to the host job tools. Hosts without execution-prepared content projection retain ordinary rendering.
+
+`ops_bash` supplies the host's terminal-card presentation: multiline command or script path, session-relative working directory, captured output, and recorded exit code or signal. Hosts supporting this public presentation contract can show a dedicated card without a tool-name-specific client registration; older UIs retain their generic fallback. This is captured-output presentation, not a live terminal connection. Background and promoted calls retain their job IDs; collect later output with host job tools.
+
 `script_path` (instead of `command`), `graceMs`, and `includeDiagnostics` remain explicit OPS compatibility extensions. They do not change the host command contract or its timeout limits.
 
 "Prefer bash as the terminal" means prompting the model to use `ops_bash` first; it **does not change the system default terminal, PATH or existing host shell tool names**. OPS never overlays the host PowerShell executor configuration. Use `dsh-ops upgrade-host-pwsh` to preview an explicit standard PowerShell 7 installation; `--yes` executes it. Restart DSH afterwards, and review any custom host `pwshPath` in host settings. Existing running commands and old provisioned copies are not removed.
diff --git a/docs/configuration-reference.md b/docs/configuration-reference.md
index 7d1c6cb7..d1ad9598 100644
--- a/docs/configuration-reference.md
+++ b/docs/configuration-reference.md
@@ -228,6 +228,8 @@ selection is rejected before writing. The host persists accepted changes and rel
 row, so the running configuration follows the saved selection. Ordinary row fields are preserved.
 A disabled row has no editable form; re-enable it with the host's built-in row switch first.
 
+The shell descriptor includes routing policy, prompt guidance and system-shell fallback alongside Bash selection. Its internal revision marker, file-only and retired FastCtx compatibility keys are deliberately excluded. Discovery exposes all seven accepted fields, including `binaryPath`, `required` and `denyCredentialReads`. The release gate checks component entries, targets, published tool declarations, retained host commands and explicit bundle defaults against their runtime definitions.
+
 Runtime actions use the host's authenticated gateway and managed subprocess service. Installation,
 removal and upgrade require a preview followed by execution of that current preview; expired,
 changed or reused plans are refused. Only one action runs at a time. Closing/unloading the owning
diff --git a/docs/discovery.md b/docs/discovery.md
index f76aae29..347b3e82 100644
--- a/docs/discovery.md
+++ b/docs/discovery.md
@@ -30,11 +30,29 @@ Every activated file tool keeps its declared path base, argument schema, Native
 
 Only this plugin's scoped `ctx.tools.register`, `restrict`, prompt sections and lifecycle listeners are used. No host method or shared tool registry is replaced. Publication compares the desired tool names before changing registrations so it can coexist with PTC lifecycle listeners.
 
+## Incremental presentation checks
+
+Adding an agent probes its presentation without reassembling unchanged agents. Background reconciliation reuses only a successful presentation decision, keyed by the agent context, session, cwd and freshly resolved sandbox policy (mode, workspace root and session identity). Starting the discovery worker with no resident tools does not emit a no-op tool-registry change. The inexpensive policy/ownership and desired-tool diff still visits existing entries; this is not a claim of constant-time reconciliation.
+
+`tools/change`, `system-prompt/change`, runtime configuration updates and discovery-row ownership changes invalidate decisions. The global runtime-update hook awaits `next()` before invalidating: the pinned host's default returns an asynchronous `Fiber.restart()` despite its `void` declaration, while an in-place update can be synchronous. The pinned host's registry notifications have no affected-scope payload. OPS-owned synchronous registration changes carry package-local scope attribution, so only the changed scope and its descendants lose cached decisions. Unknown external changes still conservatively invalidate all entries, including a new scoped presentation declaration. No host event or registry method is replaced. Discovery registers its own prompt provider once per row, not once per agent. A session's `sandbox/mode` event invalidates only its entries. Required host-service unload removes the row's registrations and cache; reload rebuilds them. Optional PTC-runtime mount/unmount also refreshes decisions, and failed probes are not cached.
+
+Arbitrary dynamic prompt providers need not emit any change event. For that reason, each model pre-step and every tool execution performs a fresh check for its own agent; this cache never authorizes a call. Runtime policy and cwd remain live inputs, including when the same agent object is reused. Native and `both` can publish discovery; pure PTC cannot. Invalidation during an asynchronous probe retires that result before publication; queued work and unload cleanup remain authoritative.
+
+`node test/run.mjs discovery-incremental discovery-composition presentation-readiness progressive-loop` covers counting, invalidation, scoped ownership and lifecycle races. The incremental fixture adds one agent beside twelve existing agents and asserts **zero old-agent probes and one new-agent probe**; this is a deterministic assembly count, not a wall-clock benchmark.
+
+## Incremental publication boundaries
+
+PTC publication lifts and rebuilds only the affected inheritance family, preserving unrelated root sessions' SDK and Bash definition identities. A connected parent/child family is processed together because an ancestor's PTC claim can hide the Native provider a child must inherit. Native source-provider revisions detect registrations hidden behind an existing PTC override; unknown external registry changes conservatively revalidate Native shadows so a foreign ancestor restriction cannot be bypassed. Superseded publication requests are merged rather than dropped. Live execution still checks the authoritative calling scope and presentation.
+
+The Bash component retains unchanged per-session definitions and inherited masks. Authority transitions update changed layers, while jobs/subprocess service replacement explicitly refreshes definitions. Neither component eliminates all inexpensive ownership, policy or tool-view scans. Real-host counter tests (`session-incremental`, `shells-incremental`) assert bounded attach probe/event counts and unchanged unrelated definition identities, separately from wall-clock GUI/session-create performance.
+
+Bash publication coalesces lifecycle notifications until the next event-loop turn, after the host finishes publishing the session event. Retained callbacks still check current authority before execution, including while withdrawal is queued. Component unload cancels queued publication. Awaited agent creation includes Bash publication; a prompt racing a pending pass waits and rebuilds its schema snapshot. Disposal requested during an append also defers registry writes, while retained callbacks become inactive immediately. The PTC assembly listener accepts the text-only `PromptPresentation` waterfall introduced in DSH 0.2.1-rc.3; its separate full-assembly probes still require the single `run_code` schema and the nonempty PTC instruction. This hook compatibility is not a claim that every rc.3 host API has been validated. `session-lifecycle` also covers a first prompt racing delayed discovery startup: selected replacement validation waits for publication instead of rejecting a correct configuration.
+
 ## Measurement boundaries
 
-The deterministic entry measurement uses `js-tiktoken@1.0.21` with `cl100k_base`, encoding compact JSON of the pinned host `ToolSchema` fields (`name`, `description`, `parameters`). The discovery entry is **94 tokens / 410 UTF-8 bytes**. This is a reproducible schema measurement, not provider billing, and excludes tool-message framing, prompt guidance and other OPS components. The tokenizer is a test-only dependency published on 2025-08-09; its locked `base64-js` dependency is also test-only.
+The deterministic entry measurement uses `js-tiktoken@1.0.21` with `cl100k_base`, encoding compact JSON of the pinned host `ToolSchema` fields (`name`, `description`, `parameters`). The discovery entry is **95 tokens / 416 UTF-8 bytes**. This is a reproducible schema measurement, not provider billing, and excludes tool-message framing, prompt guidance and other OPS components. The tokenizer is a test-only dependency published on 2025-08-09; its locked `base64-js` dependency is also test-only.
 
-The default file/discovery surface is now `ops_read_files` plus `ops_discover_tools`: **242 tokens / 1101 bytes** in actual host assembly order. The reader accepts multiple file ranges in one startup call; `ops_inspect_local_file` (including hex), search, mutations and Native result paging are discoverable. Routing names only published tools. The final Windows provider order with the full Bash/jobs contract measures **662 tokens / 3226 bytes** (the pre-rename snapshot was 660/3219; the older catalogue-order figure was 661 tokens). These full totals remain visible under the explicitly approved BM-03 scope: the ≤400-token gate applies to file/discovery schemas, while Bash remains at startup. Numeric bounds, defaults, path bases and permission contracts remain intact. Operator always-loaded choices expand the initial surface. See [benchmark evidence](benchmark-gates.md).
+The default file/discovery surface is now `ops_read_files` plus `ops_discover_tools`: **242 tokens / 1101 bytes** in actual host assembly order. The reader accepts multiple file ranges in one startup call; `ops_inspect_local_file` (including hex), search, mutations and Native result paging are discoverable. Routing names only published tools. The final Windows provider order with the full Bash/jobs contract measures **678 tokens / 3313 bytes** (the pre-rename snapshot was 660/3219; the older catalogue-order figure was 661 tokens). These full totals remain visible under the explicitly approved BM-03 scope: the ≤400-token gate applies to file/discovery schemas, while Bash remains at startup. Numeric bounds, defaults, path bases and permission contracts remain intact. Operator always-loaded choices expand the initial surface. See [benchmark evidence](benchmark-gates.md).
 
 BM-04 now runs the implemented PDF reader through the real AgentLoop: its schema is absent initially, remains pending in the current round, appears in the owning next provider request, stays absent for a sibling, and then returns the fixture text. This verifies the supported PDF subset, not general PDF/OCR coverage.
 
diff --git a/docs/file-batching.md b/docs/file-batching.md
index 79305af6..bc4c6dec 100644
--- a/docs/file-batching.md
+++ b/docs/file-batching.md
@@ -22,6 +22,17 @@ checks every path and refuses links/junctions. Read-only calls create no audit o
 Successful observations update the host read-before-edit table using versions captured before
 reading; failed and pending entries do not produce observations.
 
+The exact path component `.dsh-ops` is reserved case-insensitively on every platform, including
+absolute paths, ancestors above the session cwd, and missing create targets. Public file reads
+(including document readers, `stat`, `diff` and each `read_files` entry), writes, edits, copies,
+moves and removals reject it with `PATH_RESTRICTED`; copy/move check both source and destination.
+An explicitly requested search/replace path follows the same rule. Ordinary directory searches
+continue to exclude hidden audit entries without treating that exclusion as a coverage gap.
+Near names such as `.dsh-ops-backup` and `.dsh-ops.json` are not reserved, though normal hidden
+search exclusions still apply. This public-path restriction does not block trusted batch
+plan/run/resume, audit paging, or result/cache lifecycle APIs. It does not authenticate audit
+records against writes made outside these public file tools.
+
 `nextIndex` is the first unreturned input entry and `pending` counts remaining entries. Resume
 those files by sending the remaining slice of the original `files` array. Separately, an included
 file's `complete: false` and `nextOffset` describe unread lines in that file. Aggregate `complete`
diff --git a/docs/host-integration.md b/docs/host-integration.md
new file mode 100644
index 00000000..4ddb6828
--- /dev/null
+++ b/docs/host-integration.md
@@ -0,0 +1,102 @@
+# Host integration troubleshooting
+
+English | [中文](宿主集成.md)
+
+These checks separate plugin configuration from host presentation and provider
+transport failures. They do not establish that an unobserved Desktop freeze or
+an old conversation has been repaired.
+
+## A whitelist does not hide `ops_bash` (#380)
+
+In the pinned DSH tools API, `tools.restrict()` masks inherited registrations.
+An agent's own registrations are resolved separately. OPS publishes Bash in the
+agent's scope so its definition follows that session's authority and services;
+an inherited-tool whitelist therefore cannot be assumed to remove `ops_bash`.
+The fact that the same whitelist hides a globally registered file tool does not
+prove it also hides the session's shell. A read-only sandbox is also a filesystem
+permission mode, not a promise that every command tool is absent.
+
+To stop OPS Bash publication, set `publishBashTool: false` in its owning shell
+row. Merge this setting into the existing config, preserving other keys:
+
+```yaml
+- id: dsh-ops-shell
+  name: dsh-ops/shell
+  config:
+    publishBashTool: false
+```
+
+Check every `dsh-ops/shell` row in the effective configuration: another enabled
+row can still publish its own tool. Apply the change through the host settings
+or profile lifecycle, then verify a new session's tool list. This switch controls
+OPS Bash; it does not disable independently installed command tools.
+
+Per-preset command denial requires a host execution policy that covers owned
+tools, or a verified scoped mounting arrangement. Merely moving a shell row into
+a preset is not established as an isolation guarantee: the component also
+enumerates already live agents when mounted. Before relying on such an arrangement,
+verify both allowed and disallowed presets, existing and newly created sessions,
+and actual invocation rejection. OPS does not rewrite the shared tool registry
+to make inherited restrictions act on owned tools.
+
+## A provider rejects `tool_addition` in an old conversation (#367)
+
+OPS publishes tool definitions through the host registry. DSH records changes
+to the available tool set and serializes provider messages; OPS does not construct
+`tool_addition` blocks or choose their wire-message roles. The reported
+`tool_addition blocks can only be in system messages` error is therefore a
+host/provider serialization boundary, even when an OPS discovery change triggers it.
+
+For a bounded diagnostic, choose the intended configuration before creating a
+fresh session, then keep the tool set stable during that run. Configure any
+`alwaysLoaded` discovery capabilities before session creation and avoid changing
+selections or component settings mid-conversation. Disabling discovery removes
+that progressive-publication trigger but also removes access to capabilities
+that were available only through discovery. This does not repair retained history
+or guarantee compatibility with every provider.
+
+If the rejection persists, retain the exact host/plugin versions, provider/model,
+request ID, added/removed tool names, and the smallest redacted message-role
+fragment that demonstrates the invalid block. The host/provider adapter needs
+that evidence; changing OPS tool names or editing historical message roles is
+not a plugin-side serializer fix. [Issue #367](https://github.com/T-Auto/dsh-ops/issues/367)
+tracks the reported trigger.
+
+## `ops_discover_tools` is missing (#346)
+
+First inspect the profile actually used by the application, using its own CLI.
+Desktop uses its bundled CLI; the ordinary CLI does not manage the reserved
+Desktop profile. For a non-Desktop test profile:
+
+```console
+dsh plugin --profile ops-test add dsh-ops@latest
+dsh --profile ops-test --dump-config
+dsh --profile ops-test --dump-config-schema
+```
+
+Replace `@latest` with the intended version or packed checkout when testing an
+unpublished fix. Put `--profile` before `add` and package-manager arguments. The
+effective configuration should contain an enabled `dsh-ops-discovery` row named
+`dsh-ops/discovery`, with `enabled: true`. Inspect saved overrides and duplicate
+rows before adding another row. A stale profile missing discovery is a different
+case from an enabled row whose publication stalls.
+
+Presentation matters: ordinary Native scopes use `ops_discover_tools`; PTC scopes
+use the PTC SDK loader under the host's `run_code` presentation. Check the scoped
+assembled tools and presentation, not just a global registry or a prompt section
+name. An empty discovery section alone does not identify the cause.
+
+Host support declarations and component resource exports are addressed in
+[PR #395](https://github.com/T-Auto/dsh-ops/pull/395), with explicit 0.2.0-rc.2 and
+0.2.1-rc.2 coverage. The text-only PTC hook adaptation in
+[PR #390](https://github.com/T-Auto/dsh-ops/pull/390) is not full 0.2.1-rc.3 support.
+[PR #383](https://github.com/T-Auto/dsh-ops/pull/383) and #390 address unnecessary
+session work and append-time Bash publication. Check whether the installed version
+actually contains these changes before attributing its behavior to them.
+
+The original #346 report also describes an enabled row and a stalled publication
+chain. The profile checks above do not prove that failure fixed. If the row is
+enabled and the expected scoped tool remains absent, capture a minimal profile,
+exact versions, Native/PTC mode, affected scoped schemas, and a timed lifecycle
+trace showing the pending publication. Restart/new-session results are useful
+comparisons, not proof that an indefinite hot-mount stall cannot recur.
diff --git a/docs/macos-arm64.md b/docs/macos-arm64.md
deleted file mode 100644
index dc976e32..00000000
--- a/docs/macos-arm64.md
+++ /dev/null
@@ -1,42 +0,0 @@
-# macOS Apple Silicon (`darwin-arm64`)
-
-0.3.1 supports Apple Silicon, not Intel Mac. Exact native targets are `win32-x64`, `linux-x64` and `darwin-arm64`; the npm `os`/`cpu` projection is not a promise that every combination works.
-
-## Native worker and source build
-
-Published runtime-bearing packages use `runtime/darwin-arm64/dsh-ops-worker` with a version/target/executable/SHA256 receipt. A Git checkout does not contain generated workers.
-
-```console
-npm ci --ignore-scripts
-cargo build --release --locked --manifest-path native/Cargo.toml
-node bin/native-runtime.mjs stage --platform darwin-arm64 --input native/target/release
-node bin/native-runtime.mjs check --platform darwin-arm64
-npm run verify
-```
-
-Use a supported Rust toolchain (release validation pins 1.97.1). A custom `CARGO_TARGET_DIR` or `cargo --target` requires the matching explicit stage `--input`; never stage an old default-directory build by accident. The resolver refuses missing/corrupt receipts and Intel Mac targets.
-
-## Shells
-
-Bash is a **Windows-only optional npm payload** of the main package; PowerShell stays with the host. npm installs no payload on a Mac and there is no postinstall downloader. macOS `ops_bash` is enabled by default and resolves an explicit `bashPath`, then PATH and Homebrew/system locations. Example:
-
-```yaml
-- id: dsh-ops-shell
-  name: dsh-ops/shell
-  config:
-    bashPath: /opt/homebrew/bin/bash
-```
-
-`/bin/bash` is usable when Homebrew Bash is not installed. Restricted calls still require DSH confinement; unavailable confinement is an executor failure, never permission to run unconfined. The host disables its pwsh tool on macOS, so provisioning a pwsh executable does not create that tool.
-
-## PTC and filesystem boundaries
-
-- file and opt-in PTC use the independent Rust worker.
-- PTC tools publish only in pure PTC presentation. `batch.root` must be absolute when supplied; result paging of a batch audit must use the same root when it differs from the session root.
-- macOS `/tmp` and `/var` are system aliases. The file bridge canonicalizes the **parent chain**, preserving the final entry for no-follow checks. Descendants of those aliases work; directly naming a symlink still fails closed. Canonical write-root checks remain in force.
-- `replace` on macOS requires APFS clone support to preserve extended ACL metadata. Unsupported clone operations fail before publication rather than dropping a deny entry. Ordinary mode/owner/xattrs are restored before the final fsync and rename.
-- Hidden `.dsh-ops-update-*.lock` sidecars are cooperative path locks, removed by the writer that holds one. A sidecar left by a killed writer is reused and removed by the next write of that name; it is never a stuck lock.
-
-## Verification evidence
-
-The manually dispatched three-platform workflow builds and tests a native Apple Silicon worker on an actual arm64 macOS runner. Final run links and the shipped artifact digests are recorded in the GitHub v0.3.1 Release. Contributor PR #67's earlier real-session observations are useful history, not a substitute for final integrated-head validation. Desktop GUI sessions still require a normal app restart after replacing the package.
diff --git a/docs/macos.md b/docs/macos.md
new file mode 100644
index 00000000..9b1a6f38
--- /dev/null
+++ b/docs/macos.md
@@ -0,0 +1,97 @@
+# macOS (arm64 and Intel x64)
+
+Supported on **macOS 13 or later**, natively on Apple Silicon (`darwin-arm64`) and Intel
+(`darwin-x64`). Exact native targets are `win32-x64`, `linux-x64`, `darwin-arm64` and
+`darwin-x64`; the npm `os`/`cpu` projection is not a promise that every combination works.
+
+macOS 12 is not fully supported: its kernel lacks `CLONE_ACL`, so overwriting an existing file,
+`replace` and `copy` fail closed. Reads and non-mutating tools work. See [macOS 12](#macos-12)
+below; the fallback is a separate follow-up.
+
+## Native worker and source build
+
+Published runtime-bearing packages use `runtime/darwin-arm64/dsh-ops-worker` or
+`runtime/darwin-x64/dsh-ops-worker`, each with a version/target/executable/SHA256 receipt. A Git
+checkout does not contain generated workers.
+
+```console
+npm ci --ignore-scripts
+cargo build --release --locked --manifest-path native/Cargo.toml
+
+# Apple Silicon
+node bin/native-runtime.mjs stage --platform darwin-arm64 --input native/target/release
+node bin/native-runtime.mjs check --platform darwin-arm64
+
+# Intel
+node bin/native-runtime.mjs stage --platform darwin-x64 --input native/target/release
+node bin/native-runtime.mjs check --platform darwin-x64
+```
+
+`npm run build:ptc` builds and stages the host target, so it selects `darwin-arm64` on Apple
+Silicon and `darwin-x64` on Intel. A custom `CARGO_TARGET_DIR` or `cargo --target` requires the
+matching explicit stage `--input`; never stage an old default-directory build by accident. The
+resolver refuses missing/corrupt receipts and targets outside the matrix.
+
+## macOS 12
+
+`replace`, `copy` and writes that overwrite an existing file stage a copy-on-write sibling with
+`fclonefileat(..., CLONE_ACL)` so APFS ACLs and extended attributes survive. The xnu kernel in
+macOS 12 (`xnu-8020`) does not implement `CLONE_ACL` and returns `EINVAL`; the worker reports
+`METADATA_UNSUPPORTED` and publishes nothing. macOS 13, 14 and 15 (`xnu-8792`, `xnu-10002`,
+`xnu-11215`) implement it. New files and read-only operations do not use the flag. Do not treat
+macOS 12 as fully supported until the fallback lands; that fallback is a separate follow-up, not
+part of this change.
+
+## Shells
+
+Bash is a **Windows-only optional npm payload** of the main package; PowerShell stays with the host.
+npm installs no payload on a Mac and there is no postinstall downloader. macOS `ops_bash` is enabled
+by default and resolves an explicit `bashPath`, then PATH and Homebrew/system locations:
+
+- Apple Silicon Homebrew: `/opt/homebrew/bin/bash`
+- Intel Homebrew: `/usr/local/bin/bash`
+- System Bash: `/bin/bash`
+
+```yaml
+- id: dsh-ops-shell
+  name: dsh-ops/shell
+  config:
+    bashPath: /opt/homebrew/bin/bash   # Intel Homebrew: /usr/local/bin/bash
+```
+
+`/bin/bash` is usable when Homebrew Bash is not installed. Restricted calls still require DSH
+confinement; unavailable confinement is an executor failure, never permission to run unconfined.
+The host disables its pwsh tool on macOS, so provisioning a pwsh executable does not create that
+tool.
+
+## PTC and filesystem boundaries
+
+- file and opt-in PTC use the independent Rust worker.
+- PTC tools publish only in pure PTC presentation. `batch.root` must be absolute when supplied;
+  result paging of a batch audit must use the same root when it differs from the session root.
+- macOS `/tmp` and `/var` are system aliases. The file bridge canonicalizes the **parent chain**,
+  preserving the final entry for no-follow checks. Descendants of those aliases work; directly
+  naming a symlink still fails closed. Canonical write-root checks remain in force.
+- `replace` and overwrite operations on macOS require APFS clone support and `CLONE_ACL`
+  (macOS 13+). Unsupported clone operations fail before publication rather than dropping a deny
+  entry. Ordinary mode/owner/xattrs are restored before the final fsync and rename.
+- Hidden `.dsh-ops-update-*.lock` sidecars are cooperative path locks, removed by the writer that
+  holds one. A sidecar left by a killed writer is reused and removed by the next write of that name;
+  it is never a stuck lock.
+
+## Verification evidence
+
+- CI runs the full gate on `macos-latest` (arm64, blocking) and `macos-15-intel` (x64,
+  non-blocking because the leg measured 318 s > 300 s; see [CI](ci.md)).
+- The Intel leg builds and stages `darwin-x64`, runs all suites, checks the Mach-O x86_64 worker
+  and its receipt, and packs/unpacks the artifact.
+- The contributor reports an Intel macOS 12.7.6 run with 42 Rust unit tests passing and one
+  expected `CLONE_ACL` failure in [the original PR](https://github.com/OldLigant/dsh-ops/pull/1).
+  This is a reported local result, not a macOS 12 acceptance run for this change.
+- [The contributor's PR-event run](https://github.com/OldLigant/dsh-ops/actions/runs/39772711519)
+  passed the full Intel macOS 15 gate. Its receipt-verified x86_64 Mach-O has a 10.12 load minimum;
+  the macOS 13 floor comes from the required ACL clone capability. macOS 13/14 have not been
+  exercised by that CI run. Apple's [xnu-8792 implementation](https://github.com/apple-oss-distributions/xnu/blob/xnu-8792.61.2/bsd/vfs/vfs_syscalls.c)
+  accepts `CLONE_ACL` and copies the source ACL. Filesystem support is still required.
+- 0.3.1 shipped Apple Silicon only; current support adds Intel on macOS 13+. Desktop GUI sessions
+  still require a normal app restart after replacing the package.
diff --git a/docs/macos.zh.md b/docs/macos.zh.md
new file mode 100644
index 00000000..55306faa
--- /dev/null
+++ b/docs/macos.zh.md
@@ -0,0 +1,87 @@
+# macOS（arm64 与 Intel x64）
+
+支持 **macOS 13 或更高版本**，原生覆盖 Apple Silicon（`darwin-arm64`）与 Intel（`darwin-x64`）。
+精确原生目标是 `win32-x64`、`linux-x64`、`darwin-arm64` 和 `darwin-x64`；npm 的 `os`/`cpu`
+字段不能表达配对矩阵，实际支持以运行时常量和组件 `targets` 为准。
+
+macOS 12 不是完整支持：其内核缺少 `CLONE_ACL`，覆盖已有文件、`replace` 与 `copy` 会 fail closed。
+读取与不改写文件的工具可用。原因和后续回退见下文 [macOS 12](#macos-12)；该回退是独立的后续项，
+不属于本次变更。
+
+## 原生 worker 与源码构建
+
+发布包使用 `runtime/darwin-arm64/dsh-ops-worker` 或 `runtime/darwin-x64/dsh-ops-worker`，各自带
+version/target/executable/SHA256 收据。Git 检出目录不包含生成的 worker。
+
+```console
+npm ci --ignore-scripts
+cargo build --release --locked --manifest-path native/Cargo.toml
+
+# Apple Silicon
+node bin/native-runtime.mjs stage --platform darwin-arm64 --input native/target/release
+node bin/native-runtime.mjs check --platform darwin-arm64
+
+# Intel
+node bin/native-runtime.mjs stage --platform darwin-x64 --input native/target/release
+node bin/native-runtime.mjs check --platform darwin-x64
+```
+
+`npm run build:ptc` 构建并暂存宿主目标，因此在 Apple Silicon 上选 `darwin-arm64`，在 Intel 上选
+`darwin-x64`。自定义 `CARGO_TARGET_DIR` 或 `cargo --target` 必须用匹配的显式 stage `--input`；
+不要把默认目录里的旧构建误当成本次构建。解析器拒绝缺失/损坏的收据和矩阵之外的目标。
+
+## macOS 12
+
+`replace`、`copy` 和覆盖已有文件的写入会通过 `fclonefileat(..., CLONE_ACL)` 创建 copy-on-write
+副本，以保留 APFS ACL 与扩展属性。macOS 12 的 xnu（`xnu-8020`）没有实现 `CLONE_ACL`，返回
+`EINVAL`；worker 返回 `METADATA_UNSUPPORTED`，不会发布任何内容。macOS 13、14、15（`xnu-8792`、
+`xnu-10002`、`xnu-11215`）实现了该 flag。新文件与只读操作不使用它。在回退落地前，不要把
+macOS 12 当作完整支持；该回退是独立后续项，不属于本次变更。
+
+## Shell
+
+Bash 是主包的 **Windows-only 可选 npm 载荷**；PowerShell 由宿主管理。macOS 不落地任何载荷，也没有
+postinstall 下载器。macOS 的 `ops_bash` 默认开启，按显式 `bashPath`、PATH、Homebrew/系统位置解析：
+
+- Apple Silicon Homebrew：`/opt/homebrew/bin/bash`
+- Intel Homebrew：`/usr/local/bin/bash`
+- 系统 Bash：`/bin/bash`
+
+```yaml
+- id: dsh-ops-shell
+  name: dsh-ops/shell
+  config:
+    bashPath: /opt/homebrew/bin/bash   # Intel Homebrew: /usr/local/bin/bash
+```
+
+没有 Homebrew Bash 时 `/bin/bash` 可用。受限调用仍然要求 DSH 的宿主隔离；隔离不可用是执行器失败，
+绝不是无隔离运行的理由。宿主在 macOS 上禁用 pwsh 工具，因此 provision 一个 pwsh 可执行文件也不会
+产生该工具。
+
+## PTC 与文件系统边界
+
+- file 与可选的 PTC 使用独立的 Rust worker。
+- PTC 工具只在纯 PTC 呈现中发布。提供 `batch.root` 时必须为绝对路径；批处理审计的分页在与会话根
+  不同时必须使用同一个根。
+- macOS 的 `/tmp`、`/var` 是系统别名。文件桥会规范化 **父目录链**，保留最后一项用于 no-follow
+  检查；这些别名的后代可用，直接点名软链仍然 fail closed。规范化写根检查保持不变。
+- macOS 上的 `replace` 与覆盖写要求 APFS clone 支持与 `CLONE_ACL`（macOS 13+）。不支持 clone 的
+  文件系统会在发布前失败，而不是丢掉 deny 项；普通 mode/owner/xattr 在最终 fsync 与 rename 前恢复。
+- 隐藏的 `.dsh-ops-update-*.lock` sidecar 是协作式路径锁，由持有它的写入者删除。被杀死写入者留下的
+  sidecar 会被同名文件的下一次写入复用并删除，不会成为死锁。
+
+## 验证证据
+
+- CI 在 `macos-latest`（arm64，阻塞）与 `macos-15-intel`（x64，非阻塞；该 leg 实测 318 秒，
+  超过 300 秒线，见 [CI](ci.md)）上跑完整门禁。
+- Intel leg 会构建并暂存 `darwin-x64`、跑全部套件、校验 Mach-O x86_64 worker 及其收据，并打包/解包
+  artifact。
+- 贡献者在[原 PR](https://github.com/OldLigant/dsh-ops/pull/1) 中报告 Intel macOS 12.7.6
+  上 42 个 Rust 单测通过、1 个预期 `CLONE_ACL` 失败。这是其本地报告，不是本次变更的 macOS 12 验收。
+- [贡献者的 PR 事件运行](https://github.com/OldLigant/dsh-ops/actions/runs/39772711519) 通过了
+  Intel macOS 15 完整门禁。收据校验通过的 x86_64 Mach-O 最低加载版本为 10.12；macOS 13 下限
+  来自所需 ACL 克隆能力。该 CI 没有运行 macOS 13/14。苹果的
+  [xnu-8792 实现](https://github.com/apple-oss-distributions/xnu/blob/xnu-8792.61.2/bsd/vfs/vfs_syscalls.c)
+  接受 `CLONE_ACL` 并复制源 ACL，仍需文件系统支持。
+- 0.3.1 只发布 Apple Silicon；当前支持在 macOS 13+ 上增加 Intel。替换包之后，桌面 GUI 会话仍需
+  正常重启应用。
diff --git a/docs/native-ptc.md b/docs/native-ptc.md
index e282e4ce..b2039726 100644
--- a/docs/native-ptc.md
+++ b/docs/native-ptc.md
@@ -1,4 +1,4 @@
-# Native PTC enhancement — Windows x64, Linux x64, Apple Silicon
+# Native PTC enhancement — Windows x64, Linux x64, macOS arm64/x64
 
 0.4.0 PTC callers use [Outcome contracts](ptc-outcomes.md) / [PTC 结果契约](PTC结果契约.md).
 The historical worker/recovery details below remain applicable; SDK results now wrap canonical facts in `data`.
@@ -9,7 +9,7 @@ background component has been removed.
 
 ## Runtime-bearing installation and original DSH permission linkage
 
-0.3.1 ships native workers for `win32-x64`, `linux-x64` and `darwin-arm64`, each with a version/checksum receipt, plus the Windows Bash IPC proxies. Formal `verify:release` requires all three target pairs and validates every PE/ELF/Mach-O worker and the Windows IPC binary/source closure. Local `check --staged` verifies only local development outputs. Intel Mac and Windows/Linux ARM64 are not supported. The Windows Bash payload remains a Windows-only optional dependency; PowerShell is host-managed. POSIX uses host Bash. There is no postinstall download/build. Source builds use `npm run build:ptc`, plus `npm run build:bash-ipc` on Windows.
+The current release ships native workers for `win32-x64`, `linux-x64`, `darwin-arm64` and `darwin-x64`, each with a version/checksum receipt, plus the Windows Bash IPC proxies. 0.3.1 shipped the first three; current support adds Intel macOS on macOS 13+. Formal `verify:release` requires all four target pairs and validates every PE/ELF/Mach-O worker and the Windows IPC binary/source closure. Local `check --staged` verifies only local development outputs. Windows/Linux ARM64 are not supported. macOS 12 lacks `CLONE_ACL`; its write-path fallback is a separate follow-up, not part of this support claim. The Windows Bash payload remains a Windows-only optional dependency; PowerShell is host-managed. POSIX uses host Bash. There is no postinstall download/build. Source builds use `npm run build:ptc`, plus `npm run build:bash-ipc` on Windows.
 
 PTC/Bash use original per-call sandboxPolicy and sandbox.confine, reporting the
 host's full/partial enforcement honestly. Read-only permits existing result pages
@@ -25,7 +25,7 @@ Real Windows provider and pure PTC SDK acceptance is covered in the release gate
 
 The fixed file component follows DSH fs-sandbox's trusted-operation policy fence,
 not arbitrary-code isolation; shell and PTC code still require confinement.
-Runtime binaries target Windows x64, Linux x64 and macOS Apple Silicon; IPC proxies remain Windows x64 only.
+Runtime binaries target Windows x64, Linux x64 and macOS arm64/x64; IPC proxies remain Windows x64 only.
 
 In `workspace-write`, native batch/result operations and their audit records are
 permitted under the selected workspace root through DSH confinement. Read-only
@@ -362,9 +362,12 @@ Linux x64 (`x86_64-unknown-linux-gnu`): release build, `cargo test`, full
 `npm run verify` (every suite that does not need a FastCtx runtime, i.e. 28 passed
 and 2 skipped) and the native worker scenarios executed on the platform, including
 the DSH local sandbox's workspace/temporary-area policy fence.
-macOS arm64 (`aarch64-apple-darwin`) is `cargo check --locked` only: compiling the
-platform-specific code is not a run, and macOS is not a release claim. Actual
-on-platform macOS run and real sandbox denial tests **still required before release**.
+macOS arm64 (`aarch64-apple-darwin`) and macOS Intel (`x86_64-apple-darwin`) now run
+the full gate in CI: `macos-latest` (arm64) is blocking, and `macos-15-intel` (x64)
+is a non-blocking signal because the leg measured 318 s > 300 s. Both build and stage
+their Mach-O worker, run the suite, and verify the receipt. The earlier 0.3.1
+`cargo check --locked`-only record is superseded. A local Intel macOS 12.7.6 run
+still has one expected `CLONE_ACL` failure, so macOS 12 remains a follow-up.
 No fixed token/time saving percentage, actual model-turn benchmark,
 live Desktop upgrade, npm release or GitHub push is claimed.
 
diff --git a/docs/ptc-sdk-loading.md b/docs/ptc-sdk-loading.md
index a440b77d..6a443bd2 100644
--- a/docs/ptc-sdk-loading.md
+++ b/docs/ptc-sdk-loading.md
@@ -4,6 +4,8 @@ The PTC row owns its file APIs independently of the Native file row. A PTC-only
 
 Call `tools.ops_load_sdk({ tools: ['grep', 'read_files'] })` inside `run_code`. A completed Outcome contains `data.tools` and `data.nextTurn: true`. Finish the current tool round; the owning session's committed `step/end` makes the requested APIs visible in the immediately following provider request. They are absent from the current frozen SDK snapshot. Prompt and diagnostic assembly before that boundary, and registry notifications, never activate queued names. Assembly waits for owned publication and obtains a fresh public snapshot when needed; internal presentation probes bypass that barrier to avoid recursion.
 
+PTC and discovery probe independent root sessions separately. Related ancestors and descendants still publish together because their tool overlays depend on one another. If a host prompt hook never returns, that family cannot gain newly verified tools, but another root can create, assemble, change authority and dispose. Superseded probes receive cancellation; disposal and unload release OPS's wait even when the hook ignores its signal, and late responses cannot publish. This isolates the shared-queue failure class; it does not establish the cause or recovery of the multi-plugin Desktop freeze reported in [#359](https://github.com/T-Auto/dsh-ops/issues/359).
+
 The PTC row accepts these settings through central config validation:
 
 | Key | Default | Meaning |
diff --git a/docs/release-process.md b/docs/release-process.md
index 6d761f1e..f9087a8b 100644
--- a/docs/release-process.md
+++ b/docs/release-process.md
@@ -2,6 +2,8 @@
 
 > 0.4.0 仍是[未发布候选](0.4.0发布候选.md)，验收采用已批准的 OPS 0.3.x BM-01 基线与文件/发现 BM-03 预算，最终结果须单独核验。下面的仓库工作流状态是历史记录，实际发布前须重新检查；本次更新不启用发布、不打 tag、不发布包。
 > The [0.4.0 candidate](release-0.4.0.md) uses the approved OPS 0.3.x BM-01 comparator and file/discovery BM-03 budget; verify final results separately. Workflow state below is historical and must be checked before any release; this update does not enable publishing, tag or publish packages.
+> 指纹口径：外部产物的字节以 `SHA256SUMS` 为准；Release 正文（notes）不是摘要的权威，本工作流发布时抄进 run summary 的只是它的副本。由维护者本机发布的旧版本没有 run summary，也不一定带 `SHA256SUMS` 资产；它们的指纹以包内 `runtime/<target>/provenance.json` 为准（历史正文里的数值，见 `docs/PROVENANCE.md` 的更正记录）。任何公布的指纹都必须写明对象（哪一个文件的指纹），不得只手抄数值。
+> Checksum scope: the bytes of every external artifact are authoritative in `SHA256SUMS`; the Release body (notes) never defines a checksum, and the run summary is only a copy of that manifest. Releases published from a maintainer machine have no run summary and did not always carry a `SHA256SUMS` asset; for those, the in-package `runtime/<target>/provenance.json` is the record (see the correction in `docs/PROVENANCE.md`). Every published checksum must name its object, never a bare number.
 
 对象是 `.github/workflows/release.yml`（workflow 名 `Release`）。发布目标只有一个：**GitHub Release**（tag + 自动 notes + 一个可安装主包 tarball + `SHA256SUMS`）。npm publish 不在这条流水线里，理由见下。
 
@@ -23,7 +25,7 @@ Sync master with main | active
 
 | 触发 | 行为 |
 | --- | --- |
-| `push` tag `v*` | 完整跑：三个平台构建 → 门禁 → 打包 → 创建/更新 GitHub Release |
+| `push` tag `v*` | 完整跑：四个目标构建 → 门禁 → 打包 → 创建/更新 GitHub Release |
 | `workflow_dispatch`（在 `main` 等分支上） | 干跑：构建 → 门禁 → 打包 → 上传 artifact，**不发布**（`publish` job 被 `github.ref_type == 'tag'` 挡掉，运行期也不授予写权限） |
 | `workflow_dispatch`（tag 选为 ref） | 完成一次中断的发布：每个发布步骤幂等，重跑不会重复上传或重造内容 |
 
@@ -31,8 +33,8 @@ Sync master with main | active
 
 ## 流水线三段与失败语义
 
-1. **`native`（矩阵：`windows-latest`/`win32-x64`、`ubuntu-24.04`/`linux-x64`、`macos-latest`/`darwin-arm64`）**
-   - 只构建 [lib/ptc/runtime.js](../lib/ptc/runtime.js) 里声明的那三个目标；Intel macOS 与两种 arm64 变体不在矩阵内。
+1. **`native`（矩阵：`windows-latest`/`win32-x64`、`ubuntu-24.04`/`linux-x64`、`macos-latest`/`darwin-arm64`、`macos-15-intel`/`darwin-x64`）**
+   - 只构建 [lib/ptc/runtime.js](../lib/ptc/runtime.js) 里声明的那四个目标；Windows ARM64 与 Linux ARM64 不在矩阵内。
    - 固定 Rust 1.97.1 与已锁定的 `Cargo.lock`；npm 平台名和 Rust triple 分列（例如 `win32-x64` 对应 `x86_64-pc-windows-msvc`），`cargo build --release --locked --target <triple>` 失败即整次发布失败。
    - `bin/native-runtime.mjs stage` 为目标写入 `runtime/<target>/provenance.json`（version／target／executable／sha256）——这就是本仓库的 provenance 约定；缺二进制或不是常规文件都会报错。
    - Windows 目标额外跑 `npm run build:bash-ipc`，其 receipt 由门禁按仓库内的 `native/bash-ipc/*` 源码哈希复核。
@@ -40,9 +42,9 @@ Sync master with main | active
    - 这里**故意不做 `actions/cache` 恢复**：发布二进制在冷目录里由该 tag 的源码构建，不会被上一次运行的缓存顶替。
 2. **`gate`（`windows-latest`，只读权限）**
    - tag 与 `package.json` 版本不一致 → 直接失败（不进入打包）。
-   - 下载三个 artifact 分别放回 `runtime/win32-x64`、`runtime/linux-x64`、`runtime/darwin-arm64`，不把各目标的 `provenance.json` 展平覆盖。
+   - 下载四个 artifact 分别放回 `runtime/win32-x64`、`runtime/linux-x64`、`runtime/darwin-arm64`、`runtime/darwin-x64`，不把各目标的 `provenance.json` 展平覆盖。
    - 单独编译 gate 宿主 worker 到 `native/target/release` 供固定路径的真实套件使用；这份测试 build 不替换来自冷构建矩阵的 staged 发布产物。
-   - **`npm run verify:release`**（`validate-manifest` + 全部仓库测试 + `bin/check-release.mjs`）是硬门禁：三目标缺一、receipt 与字节哈希不符、Windows IPC 二进制/源码哈希不符、`dsh-plugin.json` 与 runtime 白名单不一致，任一都失败。
+   - **`npm run verify:release`**（`validate-manifest` + 全部仓库测试 + `bin/check-release.mjs`）是硬门禁：四目标缺一、receipt 与字节哈希不符、Windows IPC 二进制/源码哈希不符、`dsh-plugin.json` 与 runtime 白名单不一致，任一都失败。
    - 之后才 `build-platform-packages.mjs --dist`（组装主包与固定的 Windows bash 载荷包并打 tarball，写 `provenance.json` 与 `SHA256SUMS`），再 `... check --dist`（只重读已记录的摘要，不下载不构建）。
    - dist 目录以 `release-dist` 上传，`if-no-files-found: error`。
    - 同号载荷包的权威字节在 npm registry：Release 里附带的 `dsh-ops-bash-win32-x64-<pin>.tgz` 是本次构建记录（`provenance.json` 带 `builtAt`/`builtFromCommit`），与 registry 上同版本 tarball 不会字节相同；离线校验以 registry 的 `integrity` 为准。
@@ -74,7 +76,7 @@ gh api repos/T-Auto/dsh-ops/actions/workflows --jq '.workflows[]|select(.name=="
 
 ## 启用后：先手动干跑一次，再打 tag
 
-1. Actions → Release → **Run workflow**，分支选 `main`，不选 tag。预期：`native` 矩阵三个分支全绿、`gate` 绿、`publish` **skipped**，并产出 `native-win32-x64`／`native-linux-x64`／`native-darwin-arm64`／`release-dist` 四个 artifact。
+1. Actions → Release → **Run workflow**，分支选 `main`，不选 tag。预期：`native` 矩阵四个分支全绿、`gate` 绿、`publish` **skipped**，并产出 `native-win32-x64`／`native-linux-x64`／`native-darwin-arm64`／`native-darwin-x64`／`release-dist` 五个 artifact。
 2. 检查 `release-dist` 里有一个主包 tarball、`SHA256SUMS`、`provenance.json`；把 `SHA256SUMS` 与 run summary 里的摘要对上。
 3. 干跑全绿之前**不要**打 tag：`push` tag 会立即发布，而 Release 一旦创建就对外可见（可以改 notes、可以替换资产，但"没发布过"这件事收不回来）。
 4. 需要真正发布时：`git tag v<package.json 版本>` → push tag（或按上面第 1 步改用 tag 作为 ref 手动 dispatch）。tag 与 `package.json` 版本必须一致，否则 `gate` 会拒绝。
diff --git a/docs/required-ci-admin.md b/docs/required-ci-admin.md
new file mode 100644
index 00000000..a233f05f
--- /dev/null
+++ b/docs/required-ci-admin.md
@@ -0,0 +1,27 @@
+# Enforce required CI (#303)
+
+The workflow now accepts every pull-request target, including stacked feature branches. A workflow run and a local check cannot enable repository enforcement. An administrator must apply the separately reviewed [ruleset payload](../.github/required-ci-ruleset.json).
+
+The payload targets `main`, `0.3.2` and `release/0.4.0`, requires a PR and the current-base `CI required` check from GitHub Actions, and forbids force pushes. It grants no bypass and adds no review-count or merge-method restriction. The GitHub Actions app ID `15368` was verified from this repository's successful `CI required` check metadata. The account used for the 2026-10-25 audit had push/triage rights but no admin rights; the ruleset listing was empty. These observations are dated evidence, not a claim about future settings.
+
+An administrator should first inspect existing rules so applying this file does not create an overlapping duplicate:
+
+```console
+gh api repos/T-Auto/dsh-ops/rulesets
+```
+
+If no equivalent rule exists, create it from the repository root:
+
+```console
+gh api --method POST repos/T-Auto/dsh-ops/rulesets --input .github/required-ci-ruleset.json
+```
+
+If an equivalent rule exists, review its complete configuration and update that rule instead of blindly replacing it. Repository administration write permission is required by the [GitHub ruleset API](https://docs.github.com/en/rest/repos/rules#create-a-repository-ruleset).
+
+After applying, inspect Settings → Rules and the active branch rules. With a disposable PR, verify the merge UI refuses an absent/pending/failing `CI required` check and accepts the passing current head once other requirements are satisfied. Do not merge the probe just to test it. Record the ruleset URL, probe PR URL/head and observed result in #303. A JSON file or green workflow alone is not this acceptance evidence. Dependabot failures are blocked too; fix or close the PR rather than bypassing the check. Fork runs may still need a maintainer to approve `action_required`.
+
+## 管理员操作
+
+工作流现已覆盖所有 PR 目标分支，包括堆叠的功能分支；代码合入和本地校验都不会自动启用仓库规则。管理员需检查现有 ruleset，再审阅并应用上面的 JSON。它仅对三个维护分支要求 PR、来自 GitHub Actions 的最新基线 `CI required`，并禁止强推；无绕过名单，不额外规定审阅人数或合并方式。
+
+如已有同等规则，保留并审阅其完整设置后更新，不要直接覆盖。应用后用可丢弃 PR 验证缺失、等待和失败检查确实阻止合并，记录规则 URL、PR 和 head；无需真正合并测试 PR。绿灯或 JSON 文件不等于保护已生效。Dependabot 红灯同样应修复或关闭；fork 的 `action_required` 仍可能需要维护者批准。#303 的管理员验收在这些证据到位前保持未完成。
diff --git a/docs/review-snapshot.md b/docs/review-snapshot.md
new file mode 100644
index 00000000..21682e67
--- /dev/null
+++ b/docs/review-snapshot.md
@@ -0,0 +1,68 @@
+# Review snapshot CLI
+
+中文：[审阅快照](审阅快照.md).
+
+Collect the P0 review evidence from #356 in one explicit command. This integration
+adds no resident tools or file/PTC schema. It needs authenticated `gh` for
+github.com and Git for the optional local merge probe.
+
+```console
+dsh-ops review snapshot --repo T-Auto/dsh-ops --prs 389,392 --base main --workflow ci.yml --checkout .
+```
+
+From a built source checkout, use `node bin/dsh-ops.mjs review snapshot ...`.
+`--repo` and `--prs` are required. A request accepts 1–5 distinct positive PR
+numbers, `--base` defaults to `main`, and `--workflow` defaults to `ci.yml` (another
+workflow filename or numeric ID is accepted). Omit `--checkout` to collect only
+GitHub evidence. The command does not install/authenticate `gh` or change a profile.
+
+The JSON contains:
+
+- PR author, state, draft/review status, size, exact head and PR base SHAs, fork
+  repository and maintainer-edit permission.
+- Up to 25 changed paths and dependency/workflow/schema/changelog risk flags.
+  These flags are review hints, not findings; an incomplete file window is marked.
+- Up to three closing issues, their assignees and possible claim comments from
+  the last ten comments. A comment match carries author, excerpt and URL. It does
+  not prove ownership; other timeline cross-references are not collected.
+- The newest matching `pull_request` run for the exact head SHA and PR number,
+  its event, attempt, URL and up to 50 job conclusions. A push or manual run is
+  never substituted for PR validation.
+- The current requested base SHA and its newest matching `push` run for the
+  **same workflow**. This separates base evidence from PR evidence. It is not an
+  aggregate verdict over other workflows, required checks or branch protection.
+- A local merge result against that captured base SHA: `clean`, `conflicts` with
+  paths, or `unknown` with a reason. It is a point-in-time probe, not merge approval.
+
+## Bounds and unknown results
+
+Reads are fresh on each invocation; identical reads only share a result within
+that invocation. The CLI never reuses an old passing CI result for a changed
+head. Run lookup examines at most 20 matching API results. Absent credentials,
+missing runs, invalid responses, missing local commit objects, process failures
+and timeouts remain explicit unknown evidence. Narrow file/issue/comment/job
+windows are not represented as complete inventories.
+
+Each subprocess has a 20-second deadline and 512 KiB collection ceiling, with a
+120-second invocation signal. JSON output is capped at 64 KiB; if details exceed
+it, the command retains PR identifiers and URLs, sets `outputTruncated` and asks
+for fewer PRs. Exit 0 means the requested bounded snapshot was assembled without
+missing required evidence. Exit 1 means partial evidence or invalid/unavailable
+input; inspect the JSON. A completed snapshot can report failing CI. Neither exit
+code certifies that a PR is safe to merge.
+
+## Local merge isolation
+
+`--checkout` names a local repository that already contains the captured commit
+objects. No fetch, branch checkout, branch update, push or merge is performed in
+it. The probe creates a temporary bare repository with an empty template, ignores
+global/system Git config and inherited Git command overrides, and reads the
+source object store through an alternate. It does not copy the source repository's
+hooks or configured merge drivers. New merge objects go only into the temporary
+store, which is removed afterward. Missing objects are reported as unknown; the
+CLI does not fetch them automatically.
+
+This slice implements the CLI-first P0 evidence snapshot discussed in #356. It
+does not implement review-environment setup, baseline test runs, automatic claims,
+CI waiting/log analysis, merge trains, schema probes or an optional review-tool
+component. No review decision or GitHub mutation is automated.
diff --git a/docs/roadmap.md b/docs/roadmap.md
index cce809aa..d319f063 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -11,18 +11,21 @@
 - **0.3.0** — native Rust file tools and confined PTC batching (Windows x64).
 - **0.3.1** — cross-platform: Windows x64, Linux x64 and macOS Apple Silicon
   (`darwin-arm64`). See [linux-build.md](linux-build.md) and
-  [macos-arm64.md](macos-arm64.md).
+  [macos.md](macos.md).
 
 ## 0.4.0 candidate
 
 Separate Native/PTC projections, scoped discovery, bounded CSV/TSV, DOCX and restricted PDF readers, runtime/settings changes and strict TypeScript source are implemented. This is not a release announcement: final evidence must satisfy the approved OPS 0.3.x BM-01 threshold and file/discovery BM-03 budget, while separately reporting the official comparison and full Bash-inclusive startup total. See [candidate status and format limits](release-0.4.0.md).
 
+- macOS Intel (`darwin-x64`) on macOS 13+ is implemented and in review; macOS 12's
+  `CLONE_ACL` fallback remains a separate follow-up. See [macOS](macos.md).
+
 ## Later
 
 ### Platform coverage
 
 - Windows ARM64 and Linux ARM64 targets.
-- Intel Mac (`darwin-x64`).
+- macOS 12 (`CLONE_ACL` fallback for Intel and arm64) after the macOS 13+ support lands.
 
 ### Tool surface (progressive disclosure)
 
diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
index 4ba60e89..2fe98632 100644
--- a/docs/troubleshooting.md
+++ b/docs/troubleshooting.md
@@ -46,6 +46,20 @@ The provisioned copy lives in `<DSH_HOME>/dsh-ops/shells` (shared across profile
 
 When the bundled bash payload remains declared in the profile lockfile but its package directory has been removed by the host package manager, `ops_bash` returns a readable `ENOENT` diagnostic instead of exposing a raw `spawn` exception to the model. Restore the dependency with the profile's frozen install or official plugin manager; it does not silently switch to an unauthorized system bash.
 
+### How do I verify what I downloaded from a Release
+
+Two checksums are involved and they cover different bytes: `SHA256SUMS` lists the released tarballs, while each tarball records the digest of the native worker it contains in `runtime/<target>/provenance.json`. Neither value is defined by the Release body.
+
+The tarball ships its own checker, so no platform-specific hashing tool is needed:
+
+```console
+tar -xzf dsh-ops-<version>.tgz
+node package/bin/native-runtime.mjs check --root package --platform win32-x64
+# win32-x64: <bytes> bytes, sha256 <digest>
+```
+
+That digest is the one `package/runtime/<target>/provenance.json` holds. Run `tar` from inside the download directory with the bare file name: Git for Windows ships GNU tar, which reads a `C:\...` argument as a remote host. `SHA256SUMS` covers every tarball of that release — including the Windows Bash payload — so `sha256sum -c SHA256SUMS` only passes when all of them sit side by side; macOS has no `sha256sum` and uses `shasum -a 256 -c SHA256SUMS`.
+
 ---
 
 ## Command execution
@@ -62,6 +76,20 @@ Long scripts, heredocs and multi-layer quotes and backslashes make the model esc
 
 A key the `ops_bash` schema does not declare is refused before execution, and the error names both the unknown keys and the accepted ones. This is deliberate — nothing is silently ignored.
 
+### Bash script files, PATH precedence and empty input
+
+`script_path` always selects a Bash script; the extension does not select an
+interpreter. Run PowerShell scripts through the host's `pwsh` tool instead.
+The private Windows runtime keeps its matching `usr/bin` first in the child
+PATH, then searches the caller's PATH before its optional `ucrt64/bin` and `cmd`
+programs. This retains caller-installed Git/curl versions where the required
+MSYS directory does not provide the same command. The system PATH is unchanged.
+
+Bash receives an immediately closed empty input pipe rather than the Windows
+NUL device. Programs still see EOF, including scripts and commands that read
+stdin; this avoids the reported MSYS fd-0 device initialization condition
+(#372 section 1) without changing sandbox permissions.
+
 ### `ops_bash` cannot run a custom bashPath or Git for Windows in restricted modes
 
 Symptom, in a read-only or workspace-write session: `EXECUTOR_UNAVAILABLE: ops_bash cannot run the configured bashPath … in restricted modes` (0.3.0 printed `This MSYS version has no verified DSH IPC compatibility build. Rebuild the matching proxies`).
@@ -74,6 +102,17 @@ What to do:
 - Or switch the session to `danger-full-access`, where `bashPath` runs directly.
 - Check with the profile's own copy: `node "<profile>\node_modules\dsh-ops\bin\dsh-ops.mjs" ladder --config <file>` reports `restricted: yes/no` for the resolved bash.
 
+### A second restricted Bash fails while another Bash is still running
+
+The `CreateFileMapping S-<user SID>.<version>, Win32 error 5` failure in #363 came
+from a shared MSYS section missing the current logon SID. The IPC proxy now
+preserves that section's existing ACL and adds the same logon permission already
+used for private MSYS process trackers. This applies only to the current user's
+pagefile-backed section inside the verified MSYS object directory; filesystem
+permissions and sandbox modes are unchanged. Update to a build containing this
+fix and restart DSH after stopping its jobs. A DLL-not-found startup failure or
+an empty false-success result is a separate problem (#374 and #373).
+
 ### Bash approval is rejected or unavailable
 
 `ops_bash` uses host approval for a strictly wider `sandbox_permissions` mode. Supply a non-empty `justification` for that exact command. A rejection or missing approval service prevents execution; do not retry through another shell. Approval does not repair an incompatible restricted Bash runtime.
@@ -180,16 +219,26 @@ Legacy explicitly provisioned `<DSH_HOME>/dsh-ops/` files must be cleaned separa
 
 No. It is FastCtx's reusable shared process, started by earlier versions with the background component; this version starts none. With no clients and about ten minutes of inactivity, it exits normally. Do not kill it by process-name sweeps. This release does not automatically sweep processes left by older versions.
 
-## macOS arm64
+## macOS (arm64 and Intel)
 
 ### There is no bundled bash or PowerShell payload
 
-macOS ships no `@dsh-ops/bash-darwin-arm64` or `@dsh-ops/pwsh-darwin-arm64`
+macOS ships no `@dsh-ops/bash-darwin-*` or `@dsh-ops/pwsh-darwin-*`
 package, and no portable upstream bash exists for macOS. Select the shell the
-plugin should use with `bashPath` (for example `/opt/homebrew/bin/bash`) on the
-`dsh-ops/shell` row. PowerShell 7 can be provisioned, but the host disables its `pwsh-sandbox` and
+plugin should use with `bashPath` (for example `/opt/homebrew/bin/bash` on Apple
+Silicon, `/usr/local/bin/bash` on Intel, or `/bin/bash`) on the `dsh-ops/shell`
+row. PowerShell 7 can be provisioned, but the host disables its `pwsh-sandbox` and
 `tool-pwsh` rows outside Windows, so no pwsh tool appears on macOS.
 
+### macOS 12: replace or copy fails with `METADATA_UNSUPPORTED`
+
+Overwriting an existing file, `replace` and `copy` use `fclonefileat(..., CLONE_ACL)`
+to preserve APFS ACLs. macOS 12's kernel does not implement that flag and returns
+`EINVAL`; the worker fails closed with `METADATA_UNSUPPORTED` and publishes
+nothing. This is an OS-version limit, not an Intel-specific defect. Use macOS 13+
+for the write path, or keep to read-only tools; a macOS 12 fallback is tracked as
+a separate follow-up. See [macOS](macos.md) for the full matrix.
+
 ### The file tools reject a path under `/tmp`
 
 `/tmp` is a symlink to `/private/tmp` on macOS, and the native file worker
@@ -209,6 +258,7 @@ effect without a restart.
 
 ## See also
 
+- [Upgrade and uninstall safely](upgrading.md) — Windows file locks, registry policy checks and 0.3.x migration
 - [Usage](usage.md) — the complete install flow and CLI
 - [Configuration reference](configuration-reference.md) — keys and owning components
 - [Component reference](component-reference.md) — tools and permissions
diff --git a/docs/tui-panel.md b/docs/tui-panel.md
index 9d6213bf..9a8e9839 100644
--- a/docs/tui-panel.md
+++ b/docs/tui-panel.md
@@ -87,4 +87,4 @@ DSH_OPS_TUI_ROOT=/path/to/dsh-TUI DSH_OPS_TUI_WORKER=/absolute/path/to/dsh-ops/n
 
 This uses the real Rust worker, OPS file runtime, DSH tool runtime, AgentLoop and Session post-commit notifications, plus the real admitted sidebar and renderer. Model responses and policy selection are scripted fixtures; no online model is called. It covers native file reads, bounded listings, dry-run replacement and read-only refusal. PTC batch/result execution, production PTC-only publication, run_code execution, disk-persistence durability, Windows confinement and manual PTY acceptance are **not** covered. Only owned temporary fixtures are mutated; HOME/USERPROFILE/DSH_HOME stay isolated. The suite neither builds/downloads a worker nor changes the release platform resolver. Missing opt-in prerequisites are counted as skipped; the required flag makes them fail.
 
-The sidebar does not change the package's declared targets: Windows x64, Linux x64 and macOS arm64. UI tests alone do not establish native execution or OS sandbox acceptance.
+The sidebar does not change the package's declared targets: Windows x64, Linux x64, macOS arm64 and macOS Intel x64. UI tests alone do not establish native execution or OS sandbox acceptance.
diff --git a/docs/tui-panel.zh.md b/docs/tui-panel.zh.md
index ea57578e..13491782 100644
--- a/docs/tui-panel.zh.md
+++ b/docs/tui-panel.zh.md
@@ -87,4 +87,4 @@ DSH_OPS_TUI_ROOT=/path/to/dsh-TUI DSH_OPS_TUI_WORKER=/absolute/path/to/dsh-ops/n
 
 使用真实 Rust worker、OPS 文件运行时、DSH 工具运行时、AgentLoop、Session 提交后通知，以及真实准入的侧栏与渲染器。模型响应和策略选择是脚本夹具，不调用在线模型。覆盖原生文件读取、有界列表、dry-run 替换和只读拒绝；**不覆盖** PTC batch/result 执行、生产 PTC-only 发布门禁、run_code 执行、磁盘持久化耐久性、Windows 沙箱或手工 PTY 验收。只修改测试自有临时文件，隔离 HOME/USERPROFILE/DSH_HOME。用例本身不构建/下载 worker，也不改发布平台解析器。缺少 opt-in 前提时记为跳过，required 标志使其失败。
 
-侧栏不改变整包声明的 Windows x64、Linux x64 和 macOS arm64 目标；UI 测试本身不能替代原生执行或 OS 沙箱验收。
+侧栏不改变整包声明的 Windows x64、Linux x64、macOS arm64 与 macOS Intel x64 目标；UI 测试本身不能替代原生执行或 OS 沙箱验收。
diff --git a/docs/upgrading.md b/docs/upgrading.md
new file mode 100644
index 00000000..d1c89beb
--- /dev/null
+++ b/docs/upgrading.md
@@ -0,0 +1,108 @@
+# Upgrade and uninstall safely
+
+中文：[升级与卸载](升级与卸载.md).
+
+## Stop the affected profile before replacing packages
+
+On Windows, an active Bash, old bundled PowerShell or legacy FastCtx process can
+hold files in the profile's dependency tree. An `ERR_PNPM_EPERM` / `importPackage`
+failure is a file-lock problem, including when another plugin triggered the
+dependency rebuild (#175). A failed package-manager operation can leave the
+manifest, enabled bundle list and installed files inconsistent.
+
+1. Save work and stop affected jobs through the host's job controls. Let their
+   processes finish. Do not run the upgrade from an OPS shell in that profile.
+2. Fully exit the affected DSH application, including its tray process. Use an
+   external terminal and the same `DSH_HOME` and profile as the application.
+3. Back up the profile's `package.json`, `pnpm-lock.yaml`, `pnpm-workspace.yaml`
+   and `cordis.patch.yml` when present. Run the official CLI belonging to that
+   application; Desktop needs its bundled CLI, not an unrelated global `dsh`.
+4. Complete the operation successfully before reopening DSH. Check the installed
+   version and enabled rows in the intended profile after restart.
+
+For a standard Windows Desktop installation, the following selects its CLI.
+Change the path for a custom installation. Choose one operation:
+
+```powershell
+$desktopCli = Join-Path $env:LOCALAPPDATA 'Programs/DeepSeek Harness/resources/runtime/cli/bin/dsh.cmd'
+# Update to the version you have reviewed:
+& $desktopCli plugin --profile desktop add 'dsh-ops@<version>' --registry=https://registry.npmjs.org
+# Or remove the plugin:
+& $desktopCli plugin --profile desktop remove dsh-ops --registry=https://registry.npmjs.org
+```
+
+Replace `<version>` with the chosen version. `web` and `dsh-tui` use their own
+application CLI/profile. Keep any custom `DSH_HOME` from the original setup.
+If a failed operation left an inconsistent tree, keep the logs and use that
+same official CLI's `plugin --profile desktop install` to reconcile the saved
+manifest while the host is stopped; pass the verified registry there as well.
+This is recovery of the intended saved dependencies, not a promise that the host
+rolled back every file. Do not delete the lockfile or sweep/force-kill processes
+by executable name. Older FastCtx hosts may need to finish their normal idle
+shutdown before their files are released.
+
+## Removal can fail a registry policy check
+
+`ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION` with `version not present in registry
+manifest` is different from a locked file (#335). pnpm can validate existing
+lockfile entries even during removal. A mirror missing a pinned Bash version
+cannot provide the metadata needed by that check, even if the payload is already
+installed. Restarting the host does not repair the mirror.
+
+Use the same trusted registry with complete version metadata for installation,
+repair and removal. The examples above pass the registry to the official CLI's
+forwarded package-manager command explicitly; the OPS uninstall wrapper does
+not expose a registry argument. Do not rely on a plugin manager remembering a
+previous installation's source after restart. Read the operation's pnpm log to
+identify the rejected entry and active source; `npm config get registry` alone
+does not establish the registry used by the host's pnpm.
+
+For the currently pinned Windows payload, check the exact version rather than
+the `latest` tag before retrying the operation:
+
+```powershell
+npm view @dsh-ops/bash-win32-x64@0.2.1 version dist.integrity --registry=https://registry.npmjs.org
+```
+
+A missing version, network error or actual policy rejection still requires
+resolution. Keep `minimumReleaseAge`, integrity and other supply-chain checks
+enabled; do not add a blanket exclusion or remove lockfile entries to force the
+operation through. If removal only disabled the bundle, it has not necessarily
+removed the dependency or payload. Verify the final profile manifest, bundle
+selection and installed package state through the official manager. Transaction
+rollback and registry persistence belong to DSH's package manager.
+
+## Moving from 0.3.x to 0.4.x
+
+| Change | Action after upgrade |
+| --- | --- |
+| FastCtx/background tools and the bundled PowerShell dependency were removed. The pinned Windows Bash dependency remains. | Use host jobs for long-running Bash commands and the host's PowerShell tool for PowerShell. Remove an obsolete `dsh-ops/background` row to silence its no-op warning. Legacy provisioned state is separate; see [troubleshooting](troubleshooting.md#legacy-provisioned-files-were-not-cleaned-up). |
+| The host-facing `ops_bash` requires `description`. | Include a short task description with `command` or `script_path`, for example `{"description":"Check checkout status","command":"git status --short","workdir":"D:\\project"}`. `script_path` executes Bash; use host `pwsh` for `.ps1` scripts. |
+| Advanced Native tools are discovered on demand. | If `ops_edit_file` or another advanced tool is absent, call `ops_discover_tools` with `{"query":"select:ops_edit_file"}`, finish the tool round, then use it on the next model step. Configure the owning row's `alwaysLoaded` for capabilities you need at startup. See [discovery](discovery.md). |
+| PTC has a separate typed SDK and loader. | In `run_code`, call `tools.ops_load_sdk({ tools: ['glob'] })`, inspect the Outcome and finish the round. Use `tools.ops_glob` in the next step after successful loading. Loading and using a missing method in the same frozen SDK snapshot will not work. See [PTC loading](ptc-sdk-loading.md). |
+| Settings are layered profile patches. | Inspect the intended profile's `cordis.patch.yml`, home patches and installed bundle declarations. An empty root `cordis.yml` can be valid host composition; OPS does not rewrite that root to empty. Back up and diagnose the host's composed configuration before replacing anything. |
+| Package code is loaded into the host process. | Fully restart after replacing a package or after third-party hot reload leaves tools missing. A single-row remount is not a reliable package-code upgrade. Check enabled rows and actual loaded version in a fresh session before reinstalling. |
+
+Discovery publishes a selection; it does not guarantee that the model will
+choose it automatically. Native discovery and PTC SDK loading are separate
+surfaces. A missing loader, host tool-update protocol error or explicit permission
+failure needs its own diagnosis; the table does not bypass those conditions.
+
+## Report a native crash with evidence
+
+The NUL-stdin condition has a separate empty-pipe mitigation in [PR #392](https://github.com/T-Auto/dsh-ops/pull/392).
+That regression verifies pipe input and immediate EOF; it does not establish the
+cause of every Desktop crash. The update-window access violation in #372 lacks a
+dump. File-operation `.dsh-ops-update-*.lock` files are unrelated to replacing an
+npm package directory.
+
+Record host/plugin versions, launch method, exact operation, executable path,
+exit code and stderr. For a repeatable Windows crash, an administrator can enable
+[WER per-application LocalDumps](https://learn.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps)
+under `HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\<executable>.exe`:
+set `DumpType` (DWORD) to `2` and `DumpCount` to `2`. Select the actual crashing
+executable, such as `DeepSeek Harness.exe` or `bash.exe`. The default dump folder
+is `%LOCALAPPDATA%\CrashDumps`; custom crash handlers may prevent WER collection.
+Remove only the diagnostic settings you added after capture. Dumps may contain
+session data and credentials; share them privately after review, not in a public
+issue attachment. A missing dump is not proof of a particular native fault.
diff --git a/docs/usage.md b/docs/usage.md
index cced155a..0eb4a3f5 100644
--- a/docs/usage.md
+++ b/docs/usage.md
@@ -2,6 +2,9 @@
 
 The complete install, update and remove flow, plus every option of the command-line interface.
 
+Before replacing a running installation, read [Upgrade and uninstall safely](upgrading.md)
+for stopping the host, registry-policy failures and the 0.3.x-to-0.4.x migration checklist.
+
 ## 0.4.0 candidate and component defaults
 
 This checkout is an unreleased candidate; acceptance uses the approved OPS 0.3.x BM-01 comparator and file/discovery BM-03 budget, with Bash still resident and the full total reported separately.
@@ -18,23 +21,27 @@ forms and the optional browser carrier. Use [manual acceptance](manual-validatio
 
 ## Prerequisites
 
+For repository review evidence, the explicit [review snapshot CLI](review-snapshot.md)
+aggregates bounded PR, claim, CI and base-head facts without adding resident tools.
+
 | Item | Requirement |
 | --- | --- |
-| OS | Windows x64, Linux x64 or macOS arm64; OPS Bash is on by default on all three (pinned payload on Windows, distribution Bash on POSIX) |
+| OS | Windows x64, Linux x64 or macOS 13+ (arm64 or Intel x64); OPS Bash is on by default on all of them (pinned payload on Windows, distribution Bash on POSIX) |
 | Node.js | `^22.19 \|\| >=24` (the `engines` field in `package.json`) |
 | Host | DSH `0.2.0-rc.2` |
 | Target application | Initialized |
 
-### macOS arm64
+### macOS (arm64 and Intel)
 
 macOS carries no bundled shell payload, and the native worker is not part of the
-repository on any platform, so two extra steps apply.
-
-Build and stage the worker once from the checkout (Rust >= 1.88):
+repository on any platform. Build and stage the worker for the host:
 
 ```console
 cargo build --release --manifest-path native/Cargo.toml
+# Apple Silicon
 node bin/native-runtime.mjs stage --platform darwin-arm64
+# Intel
+node bin/native-runtime.mjs stage --platform darwin-x64
 ```
 
 Then point the shell row at a bash the machine already has:
@@ -44,14 +51,18 @@ Then point the shell row at a bash the machine already has:
   name: dsh-ops/shell
   disabled: false
   config:
-    bashPath: /opt/homebrew/bin/bash
+    bashPath: /opt/homebrew/bin/bash   # Intel Homebrew: /usr/local/bin/bash
 ```
 
+`/bin/bash` also works. macOS 12 is not fully supported: the write path needs
+`CLONE_ACL`, which macOS 13+ provides; read-only tools still work. See
+[macOS (arm64 and Intel)](macos.md) for the capability matrix and the known
+limitations.
+
 The desktop application's bundled CLI lives inside its own installation, at
 `.../Contents/Resources/runtime/cli/bin/dsh` on macOS, rather than at the
 `%LOCALAPPDATA%` path used on Windows. The host exposes no pwsh row on macOS, so
-PowerShell 7 is unavailable there. See [macOS arm64](macos-arm64.md) for the
-capability matrix and the known limitations.
+PowerShell 7 is unavailable there.
 
 ---
 
@@ -98,10 +109,46 @@ dsh plugin --profile dsh-tui add dsh-ops
 
 The ordinary DSH CLI cannot manage the reserved `desktop` profile; do not confuse it with the desktop app's bundled entry point.
 
+### Host compatibility and display metadata
+
+The package declares **DSH 0.2.0-rc.2 and 0.2.1-rc.2** explicitly in both `engines.dsh`
+and the legacy DSH peer dependency. DSH 0.2.1 uses `engines.dsh` in preference to peers.
+Other prereleases, including 0.2.1-rc.3, are outside this declaration: accepting its
+text-only prompt hook does not establish compatibility with all presentation and
+official-tool replacement APIs.
+
+The bundle icon comes from the root manifest. Each component exports its own
+`dsh-ops/<component>/icon` and `locale/*.json`; DSH 0.2.1 does not use a component's
+`package.json` for these resources. The metadata gate resolves the PNG bytes and
+bilingual text through host APIs. This is resource-loading evidence, not a Desktop
+screenshot or a claim about a particular theme.
+
+Keep `--profile` before `add` and its package-manager arguments. For an existing
+test profile, refresh the bundle through the official installer, then inspect the
+composition and schema without starting a model request:
+
+```console
+dsh plugin --profile ops-test add dsh-ops@latest
+dsh --profile ops-test --dump-config
+dsh --profile ops-test --dump-config-schema
+```
+
+Use the intended package version or a packed checkout instead of `@latest` when
+testing an unpublished change. The dump must contain the seven `dsh-ops-*` rows
+(`shell`, `file`, `ptc`, `discovery`, `panel`, `tui`, `hide-official`) with no
+`patch: entry ... not found` diagnostic. Saved profile overrides remain effective;
+new opt-in rows remain disabled until enabled. CI's manifest validation runs the
+same public host patch composer and rejects skipped overrides, alongside each
+component's config validator. A regression removes an override target and verifies
+the resulting warning fails the gate.
+
 ---
 
 ## Update
 
+For inherited whitelist limits, missing discovery rows and provider tool-change
+errors, see [host integration troubleshooting](host-integration.md).
+
 Repeat the same `npx --yes dsh-ops@latest install --profile ...` command, or use the official CLI's `add dsh-ops@latest`. Reload as requested by the application; restart it when replacing already-loaded code.
 
 ---
diff --git a/docs/verify-locally.md b/docs/verify-locally.md
index 8162821c..bbbcdf2a 100644
--- a/docs/verify-locally.md
+++ b/docs/verify-locally.md
@@ -31,6 +31,8 @@ There is no exit code for "green with a surprise in it" — that is `1`.
 
 ## The pull request run (CI, not this host)
 
+Feature-branch targets also run CI. Applying and proving repository enforcement is a separate [administrator task](required-ci-admin.md); a local gate never configures GitHub rulesets.
+
 Every pull request must show one `Cross-platform validation` run triggered by its own
 `pull_request` event, and paste the `CI required` run URL into the PR template. A local
 `verify-gate` run — however green — is not that run: it proves the checkout, not the merge
@@ -74,11 +76,14 @@ that breaks is visible without blocking a merge.
 
 | Host | Suites | Skipped, and why |
 | --- | --- | --- |
-| `linux-x64`, `darwin-arm64` | all of `test/*.test.mjs` | `tui-host` and `tui-native` unless an optional DSH-TUI checkout is present (`DSH_OPS_TUI_ROOT`, plus `DSH_OPS_TUI_WORKER` for the native one); `mount` only when no native worker can be resolved there |
+| `linux-x64`, `darwin-arm64`, `darwin-x64` | all of `test/*.test.mjs` | `tui-host` and `tui-native` unless an optional DSH-TUI checkout is present (`DSH_OPS_TUI_ROOT`, plus `DSH_OPS_TUI_WORKER` for the native one); `mount` only when no native worker can be resolved there |
 | `win32-x64` | same inventory | the two above, plus `file-metadata` and `linux-attributes` (mode bits, POSIX ACLs, user xattrs, inode identity, sparse allocation) and `linux-shell` (the POSIX bash rung, which is its own subject) |
 
 `DSH_OPS_REQUIRE_RUNTIME=1` — which turns any skip into a failure — is set on the POSIX hosts
-only. On Windows the three suites above skip by platform, and `test/run.mjs` cannot tell that
+only. CI runs this same gate on `macos-15-intel` as a non-blocking signal because that leg takes
+318 s (>300 s, see [ci.md](ci.md)); locally it is still the full gate.
+
+On Windows the three suites above skip by platform, and `test/run.mjs` cannot tell that
 apart from a missing runtime, so the script keeps its protection there through the skip set
 instead: anything skipped outside that list fails. The suites that would betray a worker that was
 never built (`permissions`, `ptc`) are not in the list.
diff --git "a/docs/\344\275\277\347\224\250\346\214\207\345\215\227.md" "b/docs/\344\275\277\347\224\250\346\214\207\345\215\227.md"
index b82fdafb..205f01d1 100644
--- "a/docs/\344\275\277\347\224\250\346\214\207\345\215\227.md"
+++ "b/docs/\344\275\277\347\224\250\346\214\207\345\215\227.md"
@@ -2,6 +2,9 @@
 
 安装、更新、卸载的完整流程，以及命令行接口的全部选项。
 
+替换运行中的安装前，先阅读[安全升级与卸载](升级与卸载.md)：停止宿主、registry
+策略失败处理，以及从 0.3.x 到 0.4.x 的迁移清单。
+
 ## 0.4.0 候选与组件默认值
 
 本检出是未发布候选；验收采用已批准的 OPS 0.3.x BM-01 基线与文件/发现 BM-03 预算，Bash 仍常驻且完整总数另列，见[候选状态](0.4.0发布候选.md)。新 profile 的七行默认开启 file/PTC/discovery，三个平台都开启 shell，panel/TUI/替换关闭；已有显式开关和带名称配置在升级后保留。Native 初始常驻 read_files/discover_tools 及可用 Bash（Windows 为固定载荷，POSIX 为发行版 bash），文档能力按需加载。PTC 有18个类型化 API，使用独立配置池与 SDK 加载器。[配置参考](配置参考.md)说明内置表单和可选浏览器承载行；升级按[手动验收](手动验收.md)复核。
@@ -11,22 +14,26 @@
 
 ## 前置条件
 
+仓库审阅可显式使用[审阅快照 CLI](审阅快照.md)，汇总有界 PR、认领、CI 与 base
+head 证据，不增加常驻工具。
+
 | 项 | 要求 |
 | --- | --- |
-| 操作系统 | Windows x64、Linux x64 或 macOS Apple Silicon（darwin-arm64） |
+| 操作系统 | Windows x64、Linux x64，或 macOS 13+（arm64 / Intel x64） |
 | Node.js | `^22.19 \|\| >=24`（`package.json` 的 `engines`） |
 | 宿主 | DSH `0.2.0-rc.2` |
 | 目标应用 | 已初始化 |
 
-### macOS arm64
+### macOS（arm64 与 Intel）
 
-macOS 没有自带 shell 载荷，原生 worker 也不在任何平台的仓库里，因此多两步。
-
-先在检出目录构建并 stage 一次原生 worker（需要 Rust >= 1.88）：
+macOS 没有自带 shell 载荷，原生 worker 也不在任何平台的仓库里。先在检出目录为宿主构建并 stage：
 
 ```console
 cargo build --release --manifest-path native/Cargo.toml
+# Apple Silicon
 node bin/native-runtime.mjs stage --platform darwin-arm64
+# Intel
+node bin/native-runtime.mjs stage --platform darwin-x64
 ```
 
 然后在 shell 组件行用 `bashPath` 指向本机已有的 bash：
@@ -36,12 +43,15 @@ node bin/native-runtime.mjs stage --platform darwin-arm64
   name: dsh-ops/shell
   disabled: false
   config:
-    bashPath: /opt/homebrew/bin/bash
+    bashPath: /opt/homebrew/bin/bash   # Intel Homebrew: /usr/local/bin/bash
 ```
 
+`/bin/bash` 也可用。macOS 12 不是完整支持：写路径需要 `CLONE_ACL`，只有 macOS 13+ 提供；
+只读工具仍可用。能力矩阵与已知限制见 [macOS（arm64 与 Intel）](macos.zh.md)。
+
 macOS 上桌面应用自带的 CLI 位于其安装包内（`.../Contents/Resources/runtime/cli/bin/dsh`），
 而不是 Windows 的 `%LOCALAPPDATA%` 路径。宿主在 macOS 上不暴露 pwsh 行，因此
-PowerShell 7 在 macOS 上不可用。能力矩阵与已知限制见 [macOS arm64](macos-arm64.md)。
+PowerShell 7 在 macOS 上不可用。
 
 ---
 
@@ -88,10 +98,37 @@ dsh plugin --profile dsh-tui add dsh-ops
 
 普通 DSH CLI 不能管理保留的 `desktop` profile；不要把它与桌面自带入口混淆。
 
+### 宿主兼容范围与展示元数据
+
+包在 `engines.dsh` 和旧版 DSH peer 依赖中明确声明 **DSH 0.2.0-rc.2 与 0.2.1-rc.2**。
+DSH 0.2.1 优先使用 `engines.dsh`。其他预发布版本（包括 0.2.1-rc.3）不在声明范围内：
+适配只含文本的 prompt hook，并不代表所有展示与官方工具替换接口均已兼容。
+
+bundle 图标来自顶层清单。每个组件单独导出 `dsh-ops/<组件>/icon` 和 `locale/*.json`；
+DSH 0.2.1 不再通过组件 `package.json` 读取这些资源。元数据门禁通过宿主 API 读取 PNG
+字节及中英文文案。这是资源加载验证，不是 Desktop 页面截图，也不代表已验证具体主题。
+
+把 `--profile` 放在 `add` 及转发给包管理器的参数之前。对已有测试 profile，先用官方
+安装器刷新 bundle，再检查配置合成与 schema，无需启动模型请求：
+
+```console
+dsh plugin --profile ops-test add dsh-ops@latest
+dsh --profile ops-test --dump-config
+dsh --profile ops-test --dump-config-schema
+```
+
+验证未发布改动时，将 `@latest` 换成目标版本或本地打包产物。配置中应有七个 `dsh-ops-*`
+行（`shell`、`file`、`ptc`、`discovery`、`panel`、`tui`、`hide-official`），且不出现
+`patch: entry ... not found`。已保存的 profile override 继续生效；新增的可选行默认关闭。
+CI 清单校验使用同一个公开宿主 patch 合成器，将跳过 override 的警告视为失败，并校验每个
+组件配置。回归测试会删除一个 override 的目标行，确认门禁能捕获这类漂移。
+
 ---
 
 ## 更新
 
+继承白名单限制、缺少 discovery 行及提供商工具变更错误，见[宿主集成排查](宿主集成.md)。
+
 重新运行相同的 `npx --yes dsh-ops@latest install --profile ...`，或用官方 CLI `add dsh-ops@latest`。按应用提示重载；替换已加载代码时重启应用。
 
 ---
diff --git "a/docs/\345\215\207\347\272\247\344\270\216\345\215\270\350\275\275.md" "b/docs/\345\215\207\347\272\247\344\270\216\345\215\270\350\275\275.md"
new file mode 100644
index 00000000..2bc1fafb
--- /dev/null
+++ "b/docs/\345\215\207\347\272\247\344\270\216\345\215\270\350\275\275.md"
@@ -0,0 +1,92 @@
+# 安全升级与卸载
+
+English: [Upgrade and uninstall](upgrading.md).
+
+## 替换依赖包前先停止受影响的 profile
+
+Windows 上运行中的 Bash、旧版随包 PowerShell 或遗留 FastCtx 进程可能占用
+profile 依赖树中的文件。`ERR_PNPM_EPERM` / `importPackage` 是文件占用问题，
+即使这次重建依赖树是由另一个插件触发（#175）。包管理操作失败后，清单、
+启用的 bundle 列表和磁盘文件可能不一致。
+
+1. 保存工作，通过宿主任务控制停止受影响的任务，并等待进程结束。不要在该
+   profile 的 OPS shell 内执行升级。
+2. 完全退出受影响的 DSH 应用，包括托盘进程。使用外部终端，并保持原来的
+   `DSH_HOME` 和 profile。
+3. 备份 profile 中已有的 `package.json`、`pnpm-lock.yaml`、`pnpm-workspace.yaml`
+   和 `cordis.patch.yml`。使用该应用自己的官方 CLI；Desktop 要用随附入口，
+   不能换成无关的全局 `dsh`。
+4. 操作成功后再启动 DSH，核对目标 profile 的安装版本和启用组件。
+
+标准 Windows Desktop 安装可按下列方式选择 CLI；自定义安装应修改路径。
+从两种操作中选择一种：
+
+```powershell
+$desktopCli = Join-Path $env:LOCALAPPDATA 'Programs/DeepSeek Harness/resources/runtime/cli/bin/dsh.cmd'
+# 更新到已审阅的版本：
+& $desktopCli plugin --profile desktop add 'dsh-ops@<version>' --registry=https://registry.npmjs.org
+# 或卸载插件：
+& $desktopCli plugin --profile desktop remove dsh-ops --registry=https://registry.npmjs.org
+```
+
+将 `<version>` 替换为选定版本。`web` 和 `dsh-tui` 使用各自应用的 CLI/profile；
+保留原来设置的自定义 `DSH_HOME`。若失败操作留下不一致的依赖树，保留日志，
+在宿主停止时用同一个官方 CLI 的 `plugin --profile desktop install` 按已保存
+清单修复，并显式传入已核验的 registry。这是恢复预期依赖，不表示宿主已经
+完整回滚所有文件。不要删除锁文件，也不要按进程名批量强杀。旧 FastCtx 宿主
+可能需要完成正常空闲退出后才会释放文件。
+
+## 卸载也可能被 registry 策略检查拒绝
+
+`ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION` 配合 `version not present in registry
+manifest` 与文件占用不同（#335）。pnpm 在卸载时也可能验证现有锁文件条目。
+镜像缺少固定 Bash 版本时，即使载荷已经安装，也无法提供策略所需的版本元数据；
+重启宿主不能修复镜像。
+
+安装、修复和卸载都使用同一个可信且版本元数据完整的 registry。上面的示例将
+registry 显式传给官方 CLI 转发的包管理命令；OPS 卸载包装命令没有 registry
+参数。不要依赖插件管理器跨重启记住上次安装源。查看该次操作的 pnpm 日志，
+确认被拒条目和实际源；单独执行 `npm config get registry` 不能证明宿主 pnpm
+使用了哪个源。
+
+对于当前固定的 Windows 载荷，重试前查询准确版本，不要只查询 `latest`：
+
+```powershell
+npm view @dsh-ops/bash-win32-x64@0.2.1 version dist.integrity --registry=https://registry.npmjs.org
+```
+
+缺失版本、网络失败或真实策略拒绝仍需处理。保持 `minimumReleaseAge`、完整性
+等供应链检查启用，不要添加宽泛豁免或删除锁文件条目来强行通过。卸载若只是
+停用了 bundle，不代表依赖和载荷已移除；通过官方管理器核对最终清单、bundle
+选择和安装状态。事务回滚与 registry 的持久化由 DSH 包管理器负责。
+
+## 从 0.3.x 迁移到 0.4.x
+
+| 变化 | 升级后的操作 |
+| --- | --- |
+| FastCtx/background 工具和随包 PowerShell 依赖已移除；固定 Windows Bash 依赖仍保留。 | 长任务使用宿主 jobs，PowerShell 使用宿主工具。删除过时的 `dsh-ops/background` 行可消除空操作警告。旧 provision 状态单独管理，见[常见问题](常见问题.md)。 |
+| 宿主投影的 `ops_bash` 必填 `description`。 | 与 `command` 或 `script_path` 一起传入简短说明，例如 `{"description":"检查工作区状态","command":"git status --short","workdir":"D:\\project"}`。`script_path` 使用 Bash；`.ps1` 脚本使用宿主 `pwsh`。 |
+| 高级 Native 工具按需发现。 | 若 `ops_edit_file` 等工具不在当前表里，先调用 `ops_discover_tools`，参数为 `{"query":"select:ops_edit_file"}`，结束本轮后在下一模型步使用。启动即需要的能力可配置到所属行的 `alwaysLoaded`。见[工具发现](工具发现.md)。 |
+| PTC 有独立的类型化 SDK 和加载器。 | 在 `run_code` 中调用 `tools.ops_load_sdk({ tools: ['glob'] })`，检查 Outcome 并结束本轮；成功加载后下一步再使用 `tools.ops_glob`。不能在同一个冻结 SDK 快照中加载并调用原先缺失的方法。见[PTC 按需加载](PTC按需加载.md)。 |
+| 配置采用分层 profile patch。 | 检查目标 profile 的 `cordis.patch.yml`、home patch 与已安装 bundle 声明。空根 `cordis.yml` 可以是合法宿主组合；OPS 不会把这个根文件重写为空。先备份并排查宿主合成配置，再决定是否恢复文件。 |
+| 包代码加载在宿主进程中。 | 替换包或第三方热重载后工具消失时，应完全重启。单行重挂载不能可靠升级已加载的包代码。先在新会话中检查启用行与实际版本，再考虑重装。 |
+
+发现机制负责发布选中工具，不保证模型自动选择。Native discovery 与 PTC SDK
+加载是不同入口。加载器本身缺失、宿主工具更新协议错误或明确权限拒绝需要单独
+排查，上表不会绕过这些条件。
+
+## 用证据报告原生崩溃
+
+NUL stdin 条件的空管道缓解单独见 [PR #392](https://github.com/T-Auto/dsh-ops/pull/392)。
+回归验证了管道输入和立即 EOF，未证明所有 Desktop 崩溃的原因。#372 的更新窗口
+访问冲突尚无 dump；文件操作的 `.dsh-ops-update-*.lock` 与 npm 包目录替换无关。
+
+记录宿主/插件版本、启动方式、准确操作、可执行文件路径、退出码和 stderr。
+对于可重现的 Windows 崩溃，管理员可按微软的
+[WER 按应用 LocalDumps 指引](https://learn.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps)，
+在 `HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\<executable>.exe`
+下设置 DWORD `DumpType=2`、`DumpCount=2`。选择实际崩溃的可执行文件，例如
+`DeepSeek Harness.exe` 或 `bash.exe`。默认保存于 `%LOCALAPPDATA%\CrashDumps`；
+自带崩溃处理器可能使 WER 无法收集。完成后只移除本次新增的诊断设置。Dump 可能
+含会话数据和凭据，审阅后通过私密渠道提供，不要直接附到公开 issue；缺少 dump
+不能证明某个具体原生故障。
diff --git "a/docs/\345\237\272\345\207\206\351\227\250\347\246\201.md" "b/docs/\345\237\272\345\207\206\351\227\250\347\246\201.md"
index e8d624dc..ccc6a420 100644
--- "a/docs/\345\237\272\345\207\206\351\227\250\347\246\201.md"
+++ "b/docs/\345\237\272\345\207\206\351\227\250\347\246\201.md"
@@ -15,7 +15,7 @@ node bench/cli.mjs gates --baseline-source baseline-031 --baseline-worker baseli
 
 Windows 的基线 worker 路径须加 `.exe`。每次运行使用新的输出文件名，JSON 证据与 `.md` 摘要都拒绝覆盖。工具保留独占创建的临时夹具目录以便检查。`--task BM-02` 仅选择一个门禁，其成功不能代表五项全部通过。所选项失败或不可用时退出 1；参数错误或缺少构建输入时退出 2。
 
-手动工作流 `Opt-in OPS acceptance benchmarks` 在 Windows x64、Linux x64 和 Apple Silicon 上运行同一命令，独立构建基线，并在门禁失败时仍上传两份产物。默认 CI 要求不变，无需模型凭据。
+手动工作流 `Opt-in OPS acceptance benchmarks` 在 Windows x64、Linux x64 和 Apple Silicon 上运行同一命令，独立构建基线，并在门禁失败时仍上传两份产物。功能 CI 与发布矩阵也覆盖 macOS Intel（`darwin-x64`），但这个按需基准矩阵尚未包含它。默认 CI 要求不变，无需模型凭据。
 
 ## 固定工作负载与比较方式
 
diff --git "a/docs/\345\256\241\351\230\205\345\277\253\347\205\247.md" "b/docs/\345\256\241\351\230\205\345\277\253\347\205\247.md"
new file mode 100644
index 00000000..7caa7045
--- /dev/null
+++ "b/docs/\345\256\241\351\230\205\345\277\253\347\205\247.md"
@@ -0,0 +1,53 @@
+# 审阅快照 CLI
+
+English: [Review snapshot](review-snapshot.md).
+
+通过一个显式命令收集 #356 的 P0 审阅证据。这个独立集成不增加常驻工具或
+file/PTC schema。需要已登录 github.com 的 `gh`；可选本地合并预演还需要 Git。
+
+```console
+dsh-ops review snapshot --repo T-Auto/dsh-ops --prs 389,392 --base main --workflow ci.yml --checkout .
+```
+
+已构建的源码检出使用 `node bin/dsh-ops.mjs review snapshot ...`。
+`--repo`、`--prs` 必填；每次接受 1–5 个不同的正整数 PR 号。`--base` 默认 `main`，
+`--workflow` 默认 `ci.yml`，也接受其他 workflow 文件名或数字 ID。
+省略 `--checkout` 则只收集 GitHub 证据。命令不会安装/登录 `gh` 或修改 profile。
+
+JSON 包含：
+
+- PR 作者、状态、Draft/review 状态、规模、准确 head/base SHA、fork 仓库与维护者修改权限。
+- 最多 25 个变更路径，以及依赖/workflow/schema/changelog 风险提示。这些是审阅线索，
+  不代表发现了缺陷；不完整的文件窗口会明确标记。
+- 最多三个 closing issue、assignees，以及最后十条评论中的可能认领证据。
+  匹配项保留作者、摘录和 URL，不证明归属；不会收集全部 timeline cross-reference。
+- 同时匹配 head SHA、PR 号和 `pull_request` 事件的最新运行，包含 event、attempt、URL
+  和最多 50 个 job 结论。不会拿 push 或手动运行替代 PR 验证。
+- 当前指定 base 的 SHA 与**同一个 workflow** 的最新匹配 push 运行，分开呈现 base 与
+  PR 证据。这不是其他 workflow、required check 或分支保护的聚合健康结论。
+- 对该次捕获 base SHA 的本地合并预演：`clean`、带路径的 `conflicts`，或带原因的
+  `unknown`。它只是当时的预演，不是合并批准。
+
+## 边界与未知结果
+
+每次调用重新读取；只有同一次调用里的相同读取共享结果。head 改变后不会沿用旧绿灯。
+运行查找最多检查 20 条 API 结果。缺少凭据、无匹配运行、响应无效、本地 commit 对象
+不存在、进程失败和超时都会保留为未知证据。有限的文件/issue/评论/job 窗口不会冒充
+完整清单。
+
+单个子进程限时 20 秒、收集上限 512 KiB，整个调用使用 120 秒截止信号。JSON 上限
+64 KiB；超过时保留 PR 标识与 URL、设置 `outputTruncated`，提示减少 PR 数量。
+退出 0 表示请求的有界快照已组装且所需证据无缺失；退出 1 表示部分证据或输入无效/
+不可用，应检查 JSON。完整快照也可以记录红色 CI；任何退出码都不是安全合并认证。
+
+## 本地合并隔离
+
+`--checkout` 指向已具有所需 commit 对象的本地仓库。不会在其中 fetch、检出分支、
+更新分支、push 或执行 merge。预演建立临时 bare 仓库，使用空 template，忽略全局/
+系统 Git 配置和继承的 Git 命令覆盖，仅以 alternate 读取源对象库；不会复制源仓库
+hooks 或配置的 merge driver。新增合并对象只写入临时库，随后删除该临时目录。
+对象缺失时返回 unknown，不自动下载。
+
+本次仅实现 #356 后续讨论中的 CLI-first P0 证据快照。审阅环境搭建、基线测试、
+自动认领、CI 等待/日志分析、合并列车、schema probe 和可选 review 工具组件属于
+后续切片。本命令不自动作出审阅决定或修改 GitHub。
diff --git "a/docs/\345\256\277\344\270\273\351\233\206\346\210\220.md" "b/docs/\345\256\277\344\270\273\351\233\206\346\210\220.md"
new file mode 100644
index 00000000..e49b4ea9
--- /dev/null
+++ "b/docs/\345\256\277\344\270\273\351\233\206\346\210\220.md"
@@ -0,0 +1,80 @@
+# 宿主集成排查
+
+[English](host-integration.md) | 中文
+
+以下检查区分插件配置、宿主展示与提供商传输问题，不代表已修复未复现的 Desktop 卡死，
+也不代表已修复旧会话的历史记录。
+
+## 白名单无法隐藏 `ops_bash`（#380）
+
+固定版本的 DSH tools API 中，`tools.restrict()` 只遮蔽继承的注册项，agent 自有注册项
+单独解析。OPS 在 agent 作用域发布 Bash，使定义跟随该会话的权限与服务。因此不能认为
+继承工具白名单也会移除 `ops_bash`。同一白名单能隐藏全局注册的文件工具，并不能证明它
+能隐藏会话自身的 shell。只读沙箱也是文件系统权限模式，不承诺命令工具全部不可见。
+
+要停止 OPS Bash 发布，在拥有它的 shell 行设置 `publishBashTool: false`。
+把该字段合并进已有配置，保留其他键：
+
+```yaml
+- id: dsh-ops-shell
+  name: dsh-ops/shell
+  config:
+    publishBashTool: false
+```
+
+检查有效配置中的所有 `dsh-ops/shell` 行：另一条启用的行仍可能发布自己的工具。
+通过宿主设置或 profile 生命周期应用变更，再验证新会话的工具清单。该开关只控制 OPS
+Bash，不会禁用其他独立安装的命令工具。
+
+按 preset 禁止命令，需要能覆盖自有工具的宿主执行策略，或经过验证的作用域挂载方案。
+仅把 shell 行移入某个 preset，尚不能作为隔离保证：组件挂载时也会枚举已存活的 agent。
+依赖此方案前，应验证允许与禁止的 preset、已有与新建会话，以及实际调用被拒绝的结果。
+OPS 不会改写共享工具注册表，让继承掩码强行作用于自有工具。
+
+## 提供商拒绝旧会话中的 `tool_addition`（#367）
+
+OPS 通过宿主注册表发布工具定义；DSH 记录工具集变化并序列化提供商消息。OPS 不构造
+`tool_addition` 块，也不选择它在线路消息中的角色。因此，报告中的
+`tool_addition blocks can only be in system messages` 属于宿主/提供商序列化边界，
+即使触发条件是一次 OPS discovery 工具变化。
+
+进行有限诊断时，先确定配置，再新建会话，并在该次运行中保持工具集稳定。需要的
+`alwaysLoaded` discovery 能力应在创建会话前配置，运行中避免修改选择或组件设置。
+禁用 discovery 可以去掉该渐进发布触发器，但也会失去只能通过 discovery 获得的能力。
+这不会修复保留的历史，也不保证适配所有提供商。
+
+若仍被拒绝，保留准确的宿主/插件版本、提供商/模型、request ID、新增/移除工具名，
+以及能展示错误块的最小脱敏消息角色片段。宿主/提供商适配器需要这些证据；改 OPS 工具名
+或修改历史消息角色，不是插件侧序列化修复。
+[议题 #367](https://github.com/T-Auto/dsh-ops/issues/367) 记录了该触发场景。
+
+## 缺少 `ops_discover_tools`（#346）
+
+先用应用自己的 CLI 检查它实际使用的 profile。Desktop 使用自带 CLI；普通 CLI 不能管理
+保留的 Desktop profile。非 Desktop 测试 profile 的示例：
+
+```console
+dsh plugin --profile ops-test add dsh-ops@latest
+dsh --profile ops-test --dump-config
+dsh --profile ops-test --dump-config-schema
+```
+
+验证未发布修复时，将 `@latest` 换成目标版本或本地打包产物。把 `--profile` 放在 `add`
+及包管理器参数之前。有效配置中应有启用的 `dsh-ops-discovery` 行，名称为
+`dsh-ops/discovery`，且 `enabled: true`。先检查已保存的 override 与重复行，再决定是否
+补行。旧 profile 缺少 discovery，与启用的行发生发布停滞，是不同问题。
+
+展示模式也影响工具：普通 Native 作用域使用 `ops_discover_tools`；PTC 作用域通过宿主
+`run_code` 展示使用 PTC SDK loader。应检查具体作用域的装配工具和展示模式，不只查看
+全局注册表或提示词段名称。discovery 段为空本身不足以确定原因。
+
+[PR #395](https://github.com/T-Auto/dsh-ops/pull/395) 处理宿主兼容声明与组件资源导出，
+明确覆盖 0.2.0-rc.2 和 0.2.1-rc.2。
+[PR #390](https://github.com/T-Auto/dsh-ops/pull/390) 的纯文本 PTC hook 适配不代表完整
+支持 0.2.1-rc.3。[PR #383](https://github.com/T-Auto/dsh-ops/pull/383) 与 #390 处理会话
+重复工作及 append 期间 Bash 发布问题。判断行为前，先确认安装版本确实包含这些改动。
+
+#346 原始报告也包含“行已启用，但发布链停滞”的情况，上述 profile 检查不能证明它已被
+修复。若行已启用而预期的作用域工具仍缺失，应提供最小 profile、准确版本、Native/PTC
+模式、受影响作用域的 schemas，以及带时间信息的生命周期轨迹以定位尚未完成的发布。
+重启/新建会话结果可用于比较，但不能证明无限热挂载停滞不会再次发生。
diff --git "a/docs/\345\267\245\345\205\267\345\217\221\347\216\260.md" "b/docs/\345\267\245\345\205\267\345\217\221\347\216\260.md"
index 1f3df7e0..4c4d3c02 100644
--- "a/docs/\345\267\245\345\205\267\345\217\221\347\216\260.md"
+++ "b/docs/\345\267\245\345\205\267\345\217\221\347\216\260.md"
@@ -30,11 +30,31 @@ English: [Advanced tools on demand](discovery.md).
 
 只使用本插件自己的作用域 `ctx.tools.register`、`restrict`、提示词段落和生命周期监听；不替换宿主方法或共享工具注册表。发布前比较目标工具名称，避免与 PTC 生命周期监听器互相触发重复注册。
 
+## 增量 presentation 检查
+
+新增 agent 时只探测它的 presentation，不重新组装未变化的旧 agent。后台 reconcile 仅复用成功的 presentation 判定，匹配 agent context、session、cwd 以及实时解析的沙箱策略（mode、workspace root、session identity）。发现组件以空常驻工具集启动 worker 时，不再发送无实际变化的工具注册表事件。低成本的策略、ownership 与目标工具差异检查仍遍历已有条目；这不代表 reconcile 整体变为常数时间。
+
+`tools/change`、`system-prompt/change`、运行时配置更新和发现行 ownership 变更会使判定失效。全局 runtime-update hook 等待 `next()` 完成后再失效：固定宿主虽将其声明为 `void`，默认路径实际返回异步 `Fiber.restart()`；原地更新则可以同步完成。固定宿主版本的注册表通知没有受影响作用域参数。OPS 自己的同步注册变化会携带本地作用域归属，因此只使变化作用域及其后代的缓存失效；未知的外部变化仍保守地使所有条目失效，包括新增作用域 presentation 声明。不替换宿主事件或注册表方法。发现组件自己的 prompt provider 每行只注册一次，而不是每个 agent 注册一次。会话的 `sandbox/mode` 事件只使自身条目失效。必需宿主服务卸载时移除本行注册及缓存，重载后重新建立；可选 PTC runtime 挂载、卸载也会刷新判定，探测失败不缓存。
+
+任意动态提示词 provider 不保证发送变化事件，所以每次模型 pre-step 和每次工具执行仍对自己的 agent 做新鲜检查，缓存绝不用于授权调用。即使复用同一个 agent 对象，运行时策略与 cwd 也保持实时。Native 和 `both` 可以发布发现工具，纯 PTC 不发布。异步探测期间发生失效时，旧结果在发布前作废；后续排队任务和卸载清理仍具有最终效力。
+
+`node test/run.mjs discovery-incremental discovery-composition presentation-readiness progressive-loop` 覆盖计数、失效、作用域 ownership 和生命周期竞争。增量 fixture 在十二个已有 agent 旁新增一个，断言**旧 agent 探测零次、新 agent 一次**；这是确定性的组装计数，不是耗时基准。
+
+## 增量发布边界
+
+PTC 发布只解除并重建受影响的继承族，保持无关根会话的 SDK 与 Bash 定义身份不变。父子相连的作用域必须一起处理，因为祖先的 PTC 声明可能遮住子作用域应继承的 Native provider。Native 源 provider 修订号能发现被已有 PTC 覆盖隐藏的注册；未知外部注册表变化会保守地重新校验 Native shadow，避免绕过外部祖先限制。被后续 pass 取代的发布请求会合并而不会丢弃。实时执行仍检查调用作用域和当前 presentation 的权威状态。
+
+Bash 组件保留未变化会话的定义与继承 mask。权限变化只更新受影响层；jobs/subprocess 服务替换会显式刷新定义。两个组件都不宣称消除所有低成本 ownership、policy 或 tool-view 扫描。真实宿主计数测试（`session-incremental`、`shells-incremental`）断言新增会话的 probe/事件有界、无关定义身份不变，并与 GUI/session-create 的耗时测量分开。
+
+## 会话事件与装配兼容性
+
+Bash 发布会合并生命周期通知，延后到下一个事件循环轮次、宿主完成会话事件发布后执行。即使撤销仍在排队，保留的工具回调也会在执行前核验当前权限；卸载组件会取消尚未执行的发布。等待 agent 创建完成也会等待 Bash 发布；与发布竞争的提示词会等待并重新生成 schema 快照。在 append 中请求销毁时，注册表写入也会延后，而保留的回调立即失效。PTC 装配监听器兼容 DSH 0.2.1-rc.3 引入的纯文本 `PromptPresentation` waterfall；独立的完整装配探针仍同时要求唯一的 `run_code` schema 与非空 PTC 指令。这只说明该 hook 契约兼容，不表示所有 rc.3 宿主 API 都已验证。`session-lifecycle` 还覆盖首次提示词与延迟 discovery 启动竞争：所选替代工具的就绪校验会等待发布，不会把正确配置误判为配置错误。
+
 ## 测量边界
 
-确定性的入口测量固定 `js-tiktoken@1.0.21` 和 `cl100k_base`，编码固定宿主 `ToolSchema` 字段（`name`、`description`、`parameters`）的紧凑 JSON。发现入口为 **94 tokens / 410 UTF-8 字节**。这是可复现的 schema 测量，不是供应商账单；不含消息封装、提示词指引和其它 OPS 组件。分词器是测试依赖，发布于 2025-08-09；锁定的 `base64-js` 也仅供测试使用。
+确定性的入口测量固定 `js-tiktoken@1.0.21` 和 `cl100k_base`，编码固定宿主 `ToolSchema` 字段（`name`、`description`、`parameters`）的紧凑 JSON。发现入口为 **95 tokens / 416 UTF-8 字节**。这是可复现的 schema 测量，不是供应商账单；不含消息封装、提示词指引和其它 OPS 组件。分词器是测试依赖，发布于 2025-08-09；锁定的 `base64-js` 也仅供测试使用。
 
-默认文件/发现工具面为 `ops_read_files` 加 `ops_discover_tools`，**242 tokens / 1101 字节**。完整 Windows Bash/jobs 契约按供应商实际顺序为 **662 tokens / 3226 字节**（改名前快照为 660/3219，更早的目录顺序口径为 661 tokens）。已明确批准 BM-03 的 ≤400 token 门禁仅作用于文件/发现 schema；Bash 保持启动常驻，其成本及完整总数继续单列。高级读取、搜索、修改、文档与结果分页按需发现；路由只列出已发布工具。数值边界、默认值、路径基准与权限契约保持不变；始终加载项会扩大初始面。见[基准证据](基准门禁.md)。
+默认文件/发现工具面为 `ops_read_files` 加 `ops_discover_tools`，**242 tokens / 1101 字节**。完整 Windows Bash/jobs 契约按供应商实际顺序为 **678 tokens / 3313 字节**（改名前快照为 660/3219，更早的目录顺序口径为 661 tokens）。已明确批准 BM-03 的 ≤400 token 门禁仅作用于文件/发现 schema；Bash 保持启动常驻，其成本及完整总数继续单列。高级读取、搜索、修改、文档与结果分页按需发现；路由只列出已发布工具。数值边界、默认值、路径基准与权限契约保持不变；始终加载项会扩大初始面。见[基准证据](基准门禁.md)。
 
 BM-04 已通过真实 AgentLoop 验证已实现 PDF 读取器：初始 schema 不可见，当前轮保持等待，所属供应商下一请求可见，兄弟 agent 不可见，并成功读取 fixture 文本。这只验证已支持 PDF 子集，不代表通用 PDF/OCR 覆盖。
 
diff --git "a/docs/\345\270\270\350\247\201\351\227\256\351\242\230.md" "b/docs/\345\270\270\350\247\201\351\227\256\351\242\230.md"
index 2873ce07..837cad38 100644
--- "a/docs/\345\270\270\350\247\201\351\227\256\351\242\230.md"
+++ "b/docs/\345\270\270\350\247\201\351\227\256\351\242\230.md"
@@ -46,6 +46,20 @@ provisioned 副本在 `<DSH_HOME>/dsh-ops/shells`（跨 profile 共享，provisi
 
 当随包 bash 载荷在 profile 的声明/lockfile 中存在、但实际 `node_modules` 已被宿主包管理器清理时，`ops_bash` 会返回可读的 `ENOENT` 诊断，而不是把裸的 `spawn` 异常抛给模型。此时应使用 profile 的 frozen install 或官方插件管理器恢复依赖；不会静默切换到未授权的系统 bash。
 
+### 怎么验证从 Release 下载的东西
+
+这里有两个摘要，覆盖的字节不同：`SHA256SUMS` 列的是本次发布的各个 tarball，而每个 tarball 在 `runtime/<target>/provenance.json` 里记录自带 native worker 的摘要。两者都不由 Release 正文定义。
+
+包里自带校验器，不需要依赖平台专有的哈希工具：
+
+```console
+tar -xzf dsh-ops-<version>.tgz
+node package/bin/native-runtime.mjs check --root package --platform win32-x64
+# win32-x64: <bytes> bytes, sha256 <digest>
+```
+
+打印出来的就是 `package/runtime/<target>/provenance.json` 里记录的值。请在下载目录里用裸文件名运行 `tar`：Git for Windows 带的是 GNU tar，会把 `C:\...` 参数当成远程主机。`SHA256SUMS` 覆盖该 release 的全部 tarball（含 Windows Bash 载荷），所以在同级目录跑 `sha256sum -c SHA256SUMS` 需要把文件都下齐；macOS 没有 `sha256sum`，用 `shasum -a 256 -c SHA256SUMS`。
+
 ---
 
 ## 命令执行
@@ -62,6 +76,17 @@ provisioned 副本在 `<DSH_HOME>/dsh-ops/shells`（跨 profile 共享，provisi
 
 `ops_bash` 的 schema 不声明的键会在执行前被拒绝，错误信息会同时点出未知键与可接受的键。这是刻意的——不会静默忽略。
 
+### Bash 脚本文件、PATH 顺序与空输入
+
+`script_path` 始终由 Bash 执行，文件扩展名不会切换解释器。PowerShell 脚本应通过
+宿主 `pwsh` 工具执行。Windows 私有运行时仍将匹配的 `usr/bin` 放在子进程 PATH
+首位，然后先搜索调用者 PATH，最后搜索可选的 `ucrt64/bin` 和 `cmd`。当必要的
+MSYS 目录没有同名命令时，用户自行安装的 Git/curl 保持优先。系统 PATH 不变。
+
+Bash 的空输入现在使用立即关闭的管道，而不是 Windows NUL 设备。读取 stdin 的
+命令和脚本仍立即收到 EOF；此改动避免 #372 第 1 节报告的 MSYS fd-0 设备初始化
+条件，不改变沙箱权限。
+
 ### 受限模式下 `ops_bash` 无法运行自定义 bashPath 或 Git for Windows
 
 现象（只读或工作区内修改会话）：`EXECUTOR_UNAVAILABLE: ops_bash cannot run the configured bashPath … in restricted modes`（0.3.0 时报 `This MSYS version has no verified DSH IPC compatibility build. Rebuild the matching proxies`）。
@@ -74,6 +99,14 @@ provisioned 副本在 `<DSH_HOME>/dsh-ops/shells`（跨 profile 共享，provisi
 - 或者把会话切换到 `danger-full-access`，此时 `bashPath` 会直接运行。
 - 用 profile 自己的副本检查：`node "<profile>\node_modules\dsh-ops\bin\dsh-ops.mjs" ladder --config <文件>`，报告中的 `restricted: yes/no` 表示受限模式能否运行所选 bash。
 
+### 一个受限 Bash 仍在运行时，第二个 Bash 启动失败
+
+#363 的 `CreateFileMapping S-<用户 SID>.<版本>, Win32 error 5` 来自 MSYS
+共享段缺少当前登录 SID。IPC 代理现在保留该共享段的原有 ACL，并补入私有 MSYS
+进程跟踪对象已经使用的登录权限。仅处理经过验证的 MSYS 对象目录内、属于当前用户的
+分页文件共享段；文件系统权限和沙箱模式不变。请更新到包含此修复的构建，停止任务后
+重启 DSH。DLL 未找到的启动失败和空输出假成功属于其它问题（#374、#373）。
+
 ### Bash 审批被拒绝或不可用
 
 `ops_bash` 通过宿主审批申请更宽的 `sandbox_permissions`，必须为当前命令提供非空 `justification`。拒绝或缺少审批服务时不执行；不要换 shell 重试。审批无法修复不兼容的受限 Bash 运行时。
@@ -169,11 +202,15 @@ provisioned 副本在 `<DSH_HOME>/dsh-ops/shells`（跨 profile 共享，provisi
 
 不是。它是 FastCtx 的可复用共享进程，由带后台组件的早期版本启动；本版本不会启动它。无客户端且空闲约十分钟后自行退出。不要按进程名批量杀它。新版不自动清理旧版本已留下的进程。
 
-## macOS arm64
+## macOS（arm64 与 Intel）
 
 ### 没有自带的 bash / PowerShell 载荷
 
-macOS 没有 `@dsh-ops/bash-darwin-arm64` 或 `@dsh-ops/pwsh-darwin-arm64`，也没有可移植的官方 macOS bash。在 `dsh-ops/shell` 行用 `bashPath` 指定要使用的 bash（例如 `/opt/homebrew/bin/bash`）。PowerShell 7 可以 provision，但宿主在非 Windows 上禁用了 `pwsh-sandbox` 与 `tool-pwsh` 两行，所以 macOS 上不会出现 pwsh 工具。
+macOS 没有 `@dsh-ops/bash-darwin-*` 或 `@dsh-ops/pwsh-darwin-*`，也没有可移植的官方 macOS bash。在 `dsh-ops/shell` 行用 `bashPath` 指定要使用的 bash（Apple Silicon 例如 `/opt/homebrew/bin/bash`，Intel 例如 `/usr/local/bin/bash`，或 `/bin/bash`）。PowerShell 7 可以 provision，但宿主在非 Windows 上禁用了 `pwsh-sandbox` 与 `tool-pwsh` 两行，所以 macOS 上不会出现 pwsh 工具。
+
+### macOS 12：replace/copy 返回 `METADATA_UNSUPPORTED`
+
+覆盖已有文件、`replace` 与 `copy` 使用 `fclonefileat(..., CLONE_ACL)` 保留 APFS ACL。macOS 12 的内核没有实现该 flag，返回 `EINVAL`；worker 以 `METADATA_UNSUPPORTED` fail closed，不发布任何内容。这是 OS 版本限制，不是 Intel 专有缺陷。写路径请使用 macOS 13+；只读工具仍可用。macOS 12 的回退作为独立后续项跟踪。完整矩阵见 [macOS](macos.zh.md)。
 
 ### 文件工具拒绝 `/tmp` 下的路径
 
@@ -187,6 +224,7 @@ macOS 上 `/tmp` 是指向 `/private/tmp` 的软链，而原生 file worker 拒
 
 ## 相关文档
 
+- [安全升级与卸载](升级与卸载.md) —— Windows 文件占用、registry 策略检查与 0.3.x 迁移
 - [使用指南](使用指南.md) —— 完整安装与命令行接口
 - [配置参考](配置参考.md) —— 配置项与归属组件
 - [组件参考](组件参考.md) —— 工具与权限
diff --git "a/docs/\346\226\207\344\273\266\346\211\271\351\207\217\346\223\215\344\275\234.md" "b/docs/\346\226\207\344\273\266\346\211\271\351\207\217\346\223\215\344\275\234.md"
index 9ad8422e..d604261e 100644
--- "a/docs/\346\226\207\344\273\266\346\211\271\351\207\217\346\223\215\344\275\234.md"
+++ "b/docs/\346\226\207\344\273\266\346\211\271\351\207\217\346\223\215\344\275\234.md"
@@ -17,6 +17,14 @@ English: [file-batching.md](file-batching.md).
 验证路径并拒绝符号链接/junction。只读调用不创建审计或缓存文件。成功项使用读取前观察到的版本更新
 宿主的“读后编辑”记录；失败项与尚未读取的项不更新该记录。
 
+所有平台都将完整路径组件 `.dsh-ops` 视为保留名，忽略 ASCII 大小写；绝对路径、会话 cwd 上方的
+祖先组件及尚不存在的创建目标也适用。公开文件读取（包括文档读取器、`stat`、`diff` 及每个
+`read_files` 项）、写入、编辑、复制、移动和删除均以 `PATH_RESTRICTED` 拒绝；复制和移动同时
+检查源与目标。显式指定的搜索/替换路径遵循同一规则。普通目录搜索仍排除隐藏审计项，不将这种
+排除视为覆盖缺口。`.dsh-ops-backup`、`.dsh-ops.json` 等近似名称不是保留名，但仍受通常的隐藏
+搜索排除规则约束。此公开路径限制不阻断可信的 batch plan/run/resume、审计分页及结果/缓存生命
+周期 API，也不对绕过公开文件工具写入的审计记录提供真实性认证。
+
 `nextIndex` 指向输入数组中首个未返回项，`pending` 是剩余项数。继续读取时提交原始 `files` 数组的
 剩余片段。每个已返回文件还有独立的 `complete` 与 `nextOffset`，表示该文件尚未读取的行。只有所有
 文件均已完整读取、没有错误且没有待处理项，顶层 `complete` 才为 true。`pending: 0` 的部分结果仍
diff --git "a/docs/\347\273\204\344\273\266\345\217\202\350\200\203.md" "b/docs/\347\273\204\344\273\266\345\217\202\350\200\203.md"
index c7a6c756..e986793b 100644
--- "a/docs/\347\273\204\344\273\266\345\217\202\350\200\203.md"
+++ "b/docs/\347\273\204\344\273\266\345\217\202\350\200\203.md"
@@ -86,7 +86,9 @@ Native 输出文件标题、带行号的可逆转义正文及 revision/续读提
 
 用 Rust regex 在 `path` 下搜索 UTF-8 文件，输出有界，支持分页与行上下文。`pattern` 是**一个**正则字符串；用 `glob`（与 `ops_glob` 相同语法的数组）限定文件，**没有 `include` 字段**。`glob` 可以只有排除项（表示「除此之外全部」）；`path` 指向单个文件时忽略 `glob`。
 
-只需全局文件/匹配总数用 `summary`；需要逐文件计数用 `count`；要匹配文本用 `content`（默认）。条目分页默认 100 条。每次调用扫描候选文件统计全局总数，只构造请求窗口，不再把首屏前缀当作完整结果。剩余页按 `nextOffset` 读取；`truncated`/`failed` 的扫描并非穷尽，不应盲目循环重试。非 UTF-8 与超大文件被排除，并记入 `skippedFiles`；读取失败记入 `failed`，阻止报告完成。遍历/文件大小边界仍生效；后续页会重扫，并非持久扫描游标。
+只需全局文件/匹配总数用 `summary`；需要逐文件计数用 `count`；要匹配文本用 `content`（默认）。条目分页默认 100 条。默认 `exactTotal: true` 扫描候选文件统计全局总数，只构造请求窗口。设置 `exactTotal: false` 可在获得 `offset + limit` 个匹配行后提前停止；content 可以在文件内停止，count/文件列表模式仍扫描完当前文件以保留准确的逐文件计数。提前停止返回 `scanComplete: false`、`truncatedBy: row-limit` 和下界 `matchedObserved`，不返回 `matchedTotal`、`total` 或稳定续页游标。需要完整总数时应重新开始精确查询。summary 与带 continuation 的请求仍完整扫描。
+
+使用返回的 continuation 读取稳定后续页，保持查询参数不变；不完整扫描不应盲目循环重试。非 UTF-8 与超大文件属于覆盖缺口，计入 `skippedFiles`，即使 `failed` 为零也不能给出精确总数。无效 UTF-8 仍可能含匹配的 ASCII 字节或其他编码文本，跳过并不能证明没有匹配；应通过 `glob` 显式排除不需要的文件。读取失败还会增加 `failed`。遍历/文件大小边界仍生效，后续页会重扫，并非持久扫描游标。
 
 | 参数 | 类型 | 说明 |
 | --- | --- | --- |
@@ -98,6 +100,7 @@ Native 输出文件标题、带行号的可逆转义正文及 revision/续读提
 | `lineNumbers` | boolean | 显示行号 |
 | `beforeContext` / `afterContext` | integer ≤ 32 | 上下文行数 |
 | `multiline` | boolean | 跨行匹配 |
+| `exactTotal` | boolean | 默认 true；false 允许返回有限前缀和总数下界，summary/continuation 仍完整扫描 |
 | `offset` / `limit` | integer ≥ 0 / integer 1–10000 | 0-based offset 默认 0；limit 默认 100 |
 
 ### `ops_replace`
@@ -186,6 +189,10 @@ Bash 参数错误以失败的 foreground 值返回，不抛出异常。兼容的
 
 `sandbox_permissions` 和 `justification` 可通过宿主审批服务申请更宽的权限。一次批准只作用于当前命令；拒绝后不执行，也不修改会话模式。审批与沙箱准备后都会重新检查会话权限。Windows 如实报告宿主的实际约束级别（包括 `partial`）；不兼容的 Bash 运行时直接拒绝执行。
 
+成功的 Native 前台 Bash 调用在 stdout 存在 8 KiB 至 2 MiB 的完整宿主溢出文件时，可显示有界 JSON 摘要：对象键、数组长度、有限样本和错误记录样本，并保留完整输出路径。摘要明确是有损展示，不能证明没有应用错误；仅在展示字节比普通结果至少少 20% 时采用。stderr 和退出信息保持可见。JSON 无效、过大、文件不可用或摘要无收益时保留普通输出。不重写命令、不新增第二套输出存储。规范结果和嵌套 PTC SDK 值不变，后台输出仍由宿主 job 工具管理；不支持执行期内容投影的宿主保留普通展示。
+
+`ops_bash` 提供宿主 terminal card 展示：多行命令或脚本路径、相对会话的工作目录、已捕获的输出以及记录中的退出码或信号。支持此公开展示契约的宿主可直接显示专属卡片，无需按工具名注册客户端组件；旧 UI 保留通用展示。这里展示已捕获输出，不提供实时终端连接。后台及转后台调用保留 job ID，后续输出由宿主 job 工具收集。
+
 `script_path`（替代 `command`）、`graceMs` 和 `includeDiagnostics` 是保留的 OPS 兼容扩展，不改变宿主命令契约或超时上限。
 
 “默认终端改为 bash”指模型提示优先使用 `ops_bash`，**不修改系统默认终端、PATH 或宿主原有 shell 工具名称**。OPS 不覆盖宿主 PowerShell 执行器配置。运行 `dsh-ops upgrade-host-pwsh` 预览标准 PowerShell 7 的显式安装计划，添加 `--yes` 才执行。之后重启 DSH，并在宿主设置中检查自定义 `pwshPath`。已有运行命令和旧托管副本都不会被移除。
diff --git "a/docs/\350\264\241\347\214\256\346\214\207\345\215\227.md" "b/docs/\350\264\241\347\214\256\346\214\207\345\215\227.md"
index 16ba3035..ffcecde0 100644
--- "a/docs/\350\264\241\347\214\256\346\214\207\345\215\227.md"
+++ "b/docs/\350\264\241\347\214\256\346\214\207\345\215\227.md"
@@ -83,16 +83,18 @@ npm run build:bash-ipc                                  # 仅 Windows：Bash IPC
 ## 验证门禁
 
 - `npm run verify` —— 先将 `src/` 构建到 `lib/`，再运行 `scripts/validate-manifest.mjs` 和 `test/run.mjs`（每个 `test/*.test.mjs` 独立进程、独立临时 `DSH_HOME`）。
-- `node scripts/verify-gate.mjs --skip-install` —— **发布门禁**，即 `.github/workflows/ci.yml` 在 Windows x64、Linux x64、macOS arm64 上运行的同一脚本：worker 单元测试、构建与暂存、manifest 下限、全部套件、允许跳过的集合、磁盘上的套件清单，以及打包产物。
+- `node scripts/verify-gate.mjs --skip-install` —— **发布门禁**，即 `.github/workflows/ci.yml` 在 Windows x64、Linux x64、macOS arm64、macOS Intel x64 上运行的同一脚本：worker 单元测试、构建与暂存、manifest 下限、全部套件、允许跳过的集合、磁盘上的套件清单，以及打包产物。
 - `node test/run.mjs <过滤词>` 只运行文件名包含该词的套件，例如 `node test/run.mjs mount file-operations`。
 
-如何阅读门禁输出、各宿主的预期数字：见 [verify-locally.md](verify-locally.md)。CI 在每个 PR 和每次推送到 `main` 时运行。两条 POSIX 腿（`validate-posix`：Linux x64、macOS arm64）阻塞合并；Windows x64 腿（`validate-windows`）仍每次运行但不阻塞合并——它红了要当缺陷处理，只是不挡合并（#316）。
+如何阅读门禁输出、各宿主的预期数字：见 [verify-locally.md](verify-locally.md)。CI 在每个 PR 和每次推送到 `main` 时运行。两条阻塞的 POSIX 腿（`validate-posix`：Linux x64、macOS arm64）阻塞合并；Windows x64 腿（`validate-windows`）与 macOS Intel 腿（`validate-macos-intel`）仍每次运行但不阻塞合并——它们红了要当缺陷处理，只是不挡合并（#316；Intel leg 实测 318 秒）。
 
 ## 每个 PR 必须有一次 pull_request run
 
+所有目标分支均触发，包括堆叠的功能分支。仓库强制保护仍需单独执行[管理员规则与验收步骤](required-ci-admin.md)，不能把 CI 绿灯当作保护已配置。
+
 每个 PR 都必须有一次由它**自己的 `pull_request` 事件**触发的
 [Cross-platform validation](https://github.com/T-Auto/dsh-ops/blob/main/.github/workflows/ci.yml)
-运行。聚合 job **`CI required`** 汇总阻塞的 Linux x64 与 macOS arm64 两腿；非阻塞的 Windows x64 腿同时运行，但不在它的等待与判定范围内。PR 模板要求贴出的就是它的 run URL。
+运行。聚合 job **`CI required`** 汇总阻塞的 Linux x64 与 macOS arm64 两腿；非阻塞的 Windows x64 与 macOS Intel 腿同时运行，但不在它的等待与判定范围内。PR 模板要求贴出的就是它的 run URL。
 
 - **触发条件。** `ci.yml` 在 `pull_request` 指向 `main`、`0.3.2` 与 `release/0.4.0` 时触发
   （同时对同分支的 `push` 与 `merge_group` 触发）。GitHub 从 PR 自身的 head 读取 workflow 文件，
diff --git "a/docs/\350\267\257\347\272\277\345\233\276.md" "b/docs/\350\267\257\347\272\277\345\233\276.md"
index d613ad27..f0d5df66 100644
--- "a/docs/\350\267\257\347\272\277\345\233\276.md"
+++ "b/docs/\350\267\257\347\272\277\345\233\276.md"
@@ -13,9 +13,11 @@ English: [Roadmap](roadmap.md).
 
 Native/PTC 独立投影、作用域发现、有界 CSV/TSV、DOCX 与受限 PDF 读取、运行时/设置变更和严格 TypeScript 源码已实现。本页不是发布公告：最终证据须满足已批准的 OPS 0.3.x BM-01 门槛与文件/发现 BM-03 预算，同时单列官方对照及含 Bash 的完整启动总数。范围和格式限制见[候选说明](0.4.0发布候选.md)。
 
+- macOS Intel（darwin-x64）在 macOS 13+ 上的支持已实现、待审阅；macOS 12 的 `CLONE_ACL` 回退是独立后续项，见 [macOS](macos.zh.md)。
+
 ## 后续方向
 
-- Windows ARM64、Linux ARM64、Intel Mac 平台。
+- Windows ARM64、Linux ARM64 平台；macOS 12 的 `CLONE_ACL` 回退（Intel 与 arm64）在 macOS 13+ 支持落地后处理。
 - 扩展 0.4.0 有界 DOCX/PDF 子集以外的文档支持。
 - Web 搜索、HTML 转 Markdown、更多 PTC 工具与有界结果投影。
 - 同步双语文档并补充故障排查；跟踪上游 DSH 接口变化。
diff --git "a/docs/\351\205\215\347\275\256\345\217\202\350\200\203.md" "b/docs/\351\205\215\347\275\256\345\217\202\350\200\203.md"
index 53cff4d3..87ee5f38 100644
--- "a/docs/\351\205\215\347\275\256\345\217\202\350\200\203.md"
+++ "b/docs/\351\205\215\347\275\256\345\217\202\350\200\203.md"
@@ -215,6 +215,8 @@ Cordis 通过 `StandardSchemaV1` 校验配置；独立的公共设置描述在
 宿主持久化成功后重新加载对应行，使运行中的设置与已保存选择一致，同时保留其他行字段。
 禁用的行没有可编辑表单；请先使用宿主内置的行开关重新启用。
 
+Shell 设置描述除 Bash 选择外，还包含路由策略、提示指引和系统 shell 回退开关；内部版本标记、仅用于文件组件及已移除 FastCtx 的兼容字段明确不提供编辑。Discovery 展示全部七个接受的字段，包括 `binaryPath`、`required` 和 `denyCredentialReads`。发布门禁将组件入口、目标平台、工具声明、保留的宿主命令以及 bundle 中显式默认值与运行时定义逐项比较。
+
 运行时操作使用宿主已认证的网关及受管理的子进程服务。安装、删除和升级必须先预览，
 再执行仍然有效的预览；过期、内容变化或已使用的计划会被拒绝。同一时间只执行一个操作。
 卸载对应 shell 组件会取消尚未完成的操作并等待结束；启动后取消可能已造成更改，副作用标为未知。
diff --git a/dsh-plugin.json b/dsh-plugin.json
index f88c1649..0da9d40d 100644
--- a/dsh-plugin.json
+++ b/dsh-plugin.json
@@ -109,7 +109,7 @@
         "defaultEnabled": true,
         "platforms": ["win32", "linux", "darwin"],
         "architectures": ["x64", "arm64"],
-        "targets": ["win32-x64", "linux-x64", "darwin-arm64"],
+        "targets": ["win32-x64", "linux-x64", "darwin-arm64", "darwin-x64"],
         "presentation": "PTC-only; reader/result/SDK loader resident, other APIs become visible on the next agent step",
         "runtime": "independent native Rust file worker",
         "tools": ["ops_inspect_local_file","ops_grep","ops_glob","ops_replace","ops_write_file","ops_edit_file","ops_diff","ops_stat","ops_copy","ops_move","ops_remove","ops_read_files","ops_read_table","ops_read_docx","ops_read_pdf","ops_batch","ops_result","ops_load_sdk"],
@@ -120,21 +120,21 @@
         "entry": "dsh-ops/shell",
         "defaultEnabled": true,
         "platforms": ["win32", "linux", "darwin"],
-        "targets": ["win32-x64", "linux-x64", "darwin-arm64"]
+        "targets": ["win32-x64", "linux-x64", "darwin-arm64", "darwin-x64"]
       },
       {
         "id": "dsh-ops-file",
         "entry": "dsh-ops/file",
         "defaultEnabled": true,
         "platforms": ["win32", "linux", "darwin"],
-        "targets": ["win32-x64", "linux-x64", "darwin-arm64"]
+        "targets": ["win32-x64", "linux-x64", "darwin-arm64", "darwin-x64"]
       },
       {
         "id": "dsh-ops-discovery",
         "entry": "dsh-ops/discovery",
         "defaultEnabled": true,
         "platforms": ["win32", "linux", "darwin"],
-        "targets": ["win32-x64", "linux-x64", "darwin-arm64"],
+        "targets": ["win32-x64", "linux-x64", "darwin-arm64", "darwin-x64"],
         "presentation": "Native scopes; activation on the next admitted model step",
         "tools": ["ops_discover_tools"]
       },
@@ -144,7 +144,7 @@
         "defaultEnabled": false,
         "presentation": "Disabled by default; enabling the row captures subsequent events. Explicit legacy capture:false stays off until changed.",
         "platforms": ["win32", "linux", "darwin"],
-        "targets": ["win32-x64", "linux-x64", "darwin-arm64"],
+        "targets": ["win32-x64", "linux-x64", "darwin-arm64", "darwin-x64"],
         "tools": []
       },
       {
diff --git a/native/bash-ipc/README.md b/native/bash-ipc/README.md
index 5a5c3640..fd68f7e6 100644
--- a/native/bash-ipc/README.md
+++ b/native/bash-ipc/README.md
@@ -14,9 +14,11 @@ unchanged except:
 - `CreatePipe`: newly created anonymous process-tracking pipes.
 - `NtCreateNamedPipeFile`: new single-instance MSYS data pipes, relative to the
   verified `\Device\NamedPipe\` root, with the current PID in their name.
-- `NtCreateSection`: pagefile-backed `cygpid.<digits>` process trackers under a
-  verified MSYS installation object-directory root. Disk-backed mappings and
-  all other names are unchanged.
+- `NtCreateSection`: pagefile-backed `cygpid.<digits>` process trackers and the
+  current token user's `S-<SID>.<digits>` shared section under a verified MSYS
+  installation object-directory root. Independent Bash roots can reopen that
+  shared section while another root remains alive. Disk-backed mappings, other
+  users' SIDs and names outside that object directory are unchanged.
 
 For those new objects only, retain the original DACL/denies, add the current
 logon SID already present in the host restricting list, and use a Low integrity
@@ -44,7 +46,9 @@ creates a complete private copy under `DSH_HOME/dsh-ops/bash-ipc/<identity>`,
 redirects import DLL names (no executable instructions modified), and records a
 receipt. Unsupported layouts/versions or corrupt generations fail closed.
 Only the per-call environment puts the matching `usr/bin` first in PATH, so
-Bash children do not accidentally load another MSYS installation. Full access
+Bash children do not accidentally load another MSYS installation. The caller's
+PATH then precedes the optional private `ucrt64/bin` and `cmd` programs, retaining
+caller-installed tools where the required MSYS directory has no same-name tool. Full access
 continues using the original shell. The default payload remains GPL software;
 existing LICENSE/provenance files are copied unchanged, and the modified MSYS
 copy is identified in `.ops-ipc.json`. That manifest records the published PATH
@@ -60,4 +64,7 @@ Node PTC runtime with the generated tools SDK: workspace-write command,
 script_path, external executable pipeline, inside writes, outside writes denied,
 read-only downgrade denied, and full access. Test failures are gate failures.
 `test/bash-ipc.test.mjs` pins untouched file/token APIs and unsupported-version
-rejection. GUI Desktop acceptance is separate and requires a restart.
+rejection. `test/bash-ipc-roots.test.mjs` keeps one restricted MSYS root alive
+while eight independent roots execute, checks their output and file effects,
+and verifies an outside-workspace write is still denied. GUI Desktop acceptance
+is separate and requires a restart.
diff --git a/native/bash-ipc/opsnt.cpp b/native/bash-ipc/opsnt.cpp
index aa4a6b54..524d6df1 100644
--- a/native/bash-ipc/opsnt.cpp
+++ b/native/bash-ipc/opsnt.cpp
@@ -1,5 +1,5 @@
 #include "security.h"
-// Only new private MSYS named pipes and pagefile-backed cygpid sections.
+// Only new private MSYS named pipes and pagefile-backed process/user sections.
 // NtCreateFile/NtOpenFile and token APIs remain unmodified forwarders.
 inline bool selected_pipe(POBJECT_ATTRIBUTES object) {
     if (!object || !object->RootDirectory || object_name(object->RootDirectory) != L"\\Device\\NamedPipe\\") return false;
@@ -8,13 +8,30 @@ inline bool selected_pipe(POBJECT_ATTRIBUTES object) {
     return name.size() > 16 + marker.size() && hex_key(name.substr(0,16)) &&
         name.substr(16,marker.size()) == marker && name.substr(16 + marker.size()).find_first_not_of(L"0123456789abcdefABCDEF") == std::wstring::npos;
 }
+inline bool current_user_section(const std::wstring& name) {
+    const auto dot = name.find_last_of(L'.');
+    if (dot == std::wstring::npos || dot + 1 == name.size() ||
+        name.substr(dot + 1).find_first_not_of(L"0123456789") != std::wstring::npos) return false;
+    HANDLE token = nullptr;
+    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &token)) return false;
+    alignas(void*) BYTE bytes[sizeof(TOKEN_USER) + SECURITY_MAX_SID_SIZE]; DWORD size = 0;
+    const bool queried = GetTokenInformation(token, TokenUser, bytes, sizeof(bytes), &size) != FALSE;
+    CloseHandle(token);
+    if (!queried) return false;
+    LPWSTR sid = nullptr;
+    if (!ConvertSidToStringSidW(reinterpret_cast<TOKEN_USER*>(bytes)->User.Sid, &sid)) return false;
+    const bool selected = name.substr(0, dot) == sid;
+    LocalFree(sid);
+    return selected;
+}
 inline bool selected_section(POBJECT_ATTRIBUTES object, HANDLE file) {
     if (file || !object || !object->RootDirectory) return false;
     auto root = object_name(object->RootDirectory);
     const std::wstring prefix = L"\\BaseNamedObjects\\msys-2.0S5-";
     if (!root.starts_with(prefix) || !hex_key(root.substr(prefix.size()))) return false;
     auto name = attribute_name(object);
-    return name.starts_with(L"cygpid.") && name.size() > 7 && name.substr(7).find_first_not_of(L"0123456789") == std::wstring::npos;
+    return (name.starts_with(L"cygpid.") && name.size() > 7 && name.substr(7).find_first_not_of(L"0123456789") == std::wstring::npos)
+        || current_user_section(name);
 }
 extern "C" NTSTATUS NTAPI OpsNtCreateNamedPipeFile(PHANDLE handle, ULONG access, POBJECT_ATTRIBUTES object, PIO_STATUS_BLOCK io, ULONG share, ULONG disposition, ULONG options, ULONG type, ULONG read, ULONG completion, ULONG count, ULONG inQuota, ULONG outQuota, PLARGE_INTEGER timeout) {
     using Fn = NTSTATUS(NTAPI*)(PHANDLE,ULONG,POBJECT_ATTRIBUTES,PIO_STATUS_BLOCK,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,ULONG,PLARGE_INTEGER);
diff --git a/native/crates/ops-files/src/file_path.rs b/native/crates/ops-files/src/file_path.rs
index ca7d0551..1513cbad 100644
--- a/native/crates/ops-files/src/file_path.rs
+++ b/native/crates/ops-files/src/file_path.rs
@@ -6,6 +6,10 @@ use cap_fs_ext::OsMetadataExt;
 use cap_std::{ambient_authority, fs::{Dir, File, Metadata, OpenOptions}};
 use std::path::{Component, Path, PathBuf};
 
+#[cfg(test)]
+#[path = "file_path_tests.rs"]
+mod audit_tests;
+
 pub struct Target { pub parent: Dir, pub name: String, pub display: PathBuf }
 pub fn checked(raw: &str) -> Result<Target> {
     checked_leaf(raw, false)
@@ -63,6 +67,9 @@ pub fn validate_name(name: &str) -> Result<()> {
     if name.is_empty() || name == "." || name == ".." || name.contains('\0') {
         return Err(Failure::new("INVALID_ARGUMENT", format!("Invalid path component {name:?}")));
     }
+    if name.eq_ignore_ascii_case(crate::paths::STORE) {
+        return Err(Failure::new("PATH_RESTRICTED", "Audit storage is reserved for internal operations"));
+    }
     #[cfg(windows)]
     {
         let base = name.split('.').next().unwrap_or("").trim_end().to_ascii_uppercase();
diff --git a/native/crates/ops-files/src/file_path_tests.rs b/native/crates/ops-files/src/file_path_tests.rs
new file mode 100644
index 00000000..95c64838
--- /dev/null
+++ b/native/crates/ops-files/src/file_path_tests.rs
@@ -0,0 +1,30 @@
+use super::*;
+
+#[test]
+fn audit_components_are_reserved_case_insensitively() {
+    for name in [".dsh-ops", ".DsH-OpS", ".DSH-OPS"] {
+        assert_eq!(validate_name(name).unwrap_err().code, "PATH_RESTRICTED");
+        assert_eq!(crate::paths::relative(name).unwrap_err().code, "PATH_RESTRICTED");
+    }
+}
+
+#[test]
+fn audit_component_rejection_precedes_missing_ancestor_io() {
+    let root = std::env::temp_dir().join(format!("dsh-ops-missing-{}", uuid::Uuid::new_v4()));
+    for suffix in [".DSH-OPS", ".dsh-ops/new", "nested/.DsH-OpS/new"] {
+        let path = root.join(suffix);
+        match checked_leaf(path.to_str().unwrap(), true) {
+            Err(error) => assert_eq!(error.code, "PATH_RESTRICTED"),
+            Ok(_) => panic!("reserved path was accepted"),
+        }
+    }
+    assert!(!root.exists());
+}
+
+#[test]
+fn near_audit_names_are_not_reserved_components() {
+    for name in [".dsh-ops-backup", ".dsh-ops.json", "dsh-ops", ".dsh-ops-update-lock"] {
+        validate_name(name).unwrap();
+        crate::paths::relative(name).unwrap();
+    }
+}
diff --git a/native/crates/ops-search/src/paging.rs b/native/crates/ops-search/src/paging.rs
index f0d243fe..b1c90326 100644
--- a/native/crates/ops-search/src/paging.rs
+++ b/native/crates/ops-search/src/paging.rs
@@ -91,7 +91,9 @@ pub fn finish(mut scan: Scan, cursor: Cursor, page: Page, observed: usize, item_
         "skipped":page.offset,"failed":scan.failed,"complete":complete && !more && !page.output_cut,
         "truncated":!complete || more || page.output_cut,"items":page.items,"nextOffset":next});
     if complete { output["total"] = json!(item_total); output["omitted"] = json!(item_total.saturating_sub(next)); }
-    if !complete { output["nextAction"] = json!("Narrow path/glob or resolve the reported scan gaps, then start a fresh query. No stable continuation is available for an incomplete traversal."); }
+    if !complete { output["nextAction"] = json!(if scan.stopped == Some(TruncatedBy::RowLimit) {
+        "Stopped at the requested row limit (exactTotal=false). matchedObserved is a lower bound; no stable continuation is available. Start a fresh query with exactTotal=true for totals, resolving any reported scan gaps. If a line is only partly displayed, inspect its file with bounded text/hex ranges."
+    } else { "Narrow path/glob or resolve the reported scan gaps, then start a fresh query. No stable continuation is available for an incomplete traversal." }); }
     else if page.partial_item { output["nextAction"] = json!("A matching line is only partially displayed. Inspect that file with bounded text/hex ranges; nextOffset does not skip the undisplayed suffix."); }
     output.as_object_mut().unwrap().extend(serde_json::to_value(report)?.as_object().unwrap().clone());
     if let Some(extra) = extra.as_object() { output.as_object_mut().unwrap().extend(extra.clone()); }
diff --git a/native/crates/ops-search/src/scan.rs b/native/crates/ops-search/src/scan.rs
index b99149ec..1ad1c55d 100644
--- a/native/crates/ops-search/src/scan.rs
+++ b/native/crates/ops-search/src/scan.rs
@@ -102,6 +102,12 @@ impl Scan {
         for name in names {
             if !self.running() { break; }
             let child = display.join(&name);
+            // Reserved audit entries remain intentional exclusions, not scan gaps.
+            if name.eq_ignore_ascii_case(ops_files::paths::STORE) {
+                let file = directory.symlink_metadata(&name).is_ok_and(|metadata| metadata.is_file());
+                self.skip("excluded", file, false);
+                continue;
+            }
             if file_path::validate_name(&name).is_err() { self.skip("invalid-path", false, true); continue; }
             let metadata = match directory.symlink_metadata(&name) {
                 Ok(metadata) => metadata, Err(_) => { self.skip("unreadable-entry", false, true); continue; }
diff --git a/native/crates/ops-search/src/search.rs b/native/crates/ops-search/src/search.rs
index 5792061d..93dbabc8 100644
--- a/native/crates/ops-search/src/search.rs
+++ b/native/crates/ops-search/src/search.rs
@@ -1,6 +1,7 @@
 //! Search execution streams bounded files and keeps only the requested output page.
 use super::*;
 use super::{scan::Scan, paging::{Cursor, Page, finish}};
+use ops_protocol::search::TruncatedBy;
 
 #[derive(Debug, Deserialize)]
 #[serde(deny_unknown_fields, rename_all = "camelCase")]
@@ -25,6 +26,7 @@ struct GrepArgs {
     #[serde(default)] multiline: bool,
     #[serde(default)] offset: usize,
     #[serde(default = "one_hundred")] limit: usize,
+    #[serde(default = "yes")] exact_total: bool,
     continuation: Option<String>,
 }
 
@@ -75,18 +77,21 @@ pub fn grep(request: &Request) -> Result<Value> {
     let mut scan = Scan::new(); let mut page = Page::new(cursor.offset, args.limit, request.output_sink.clone());
     let mut file_count = 0; let mut match_count = 0;
     let content = matches!(args.output_mode.as_str(), "" | "content");
+    // Cursors must revalidate a complete snapshot; summaries always need every match.
+    let early = !args.exact_total && args.continuation.is_none() && args.output_mode != "summary";
+    let wanted = cursor.offset.saturating_add(args.limit);
     scan.walk(&root, &args.glob, request, |file, _, scan| {
         let Some(bytes) = scan.read(file) else { return Ok(()); };
         let text = match String::from_utf8(bytes) { Ok(text) => text, Err(_) => { scan.skip("invalid-encoding", true, true); return Ok(()); } };
         if text.is_empty() { return Ok(()); }
         let mut hits = 0;
-        let mut hit = |first: usize, last: usize, line: usize| -> Result<()> {
+        let mut hit = |first: usize, last: usize, line: usize| -> Result<bool> {
             let ordinal = match_count + hits; hits += 1;
             if content && page.wants(ordinal) {
                 page.push(json!({"path":file,"line":if args.line_numbers {line} else {0},
                     "text":excerpt(&text, first, last, args.before_context, args.after_context)}), ordinal)?;
             }
-            Ok(())
+            Ok(early && content && ordinal.saturating_add(1) >= wanted)
         };
         if args.multiline {
             let mut previous = 0; let mut line = 1;
@@ -94,14 +99,20 @@ pub fn grep(request: &Request) -> Result<Value> {
                 if !scan.running() { break; }
                 if found.start() >= text.len() && text.ends_with('\n') { continue; }
                 line += text[previous..found.start()].bytes().filter(|byte| *byte == b'\n').count(); previous = found.start();
-                hit(found.start(), found.end().saturating_sub(1).max(found.start()), line)?;
+                if hit(found.start(), found.end().saturating_sub(1).max(found.start()), line)? {
+                    if content { scan.stopped = Some(TruncatedBy::RowLimit); }
+                    break;
+                }
             }
         } else {
             let mut start = 0;
             for (index, raw) in text.split_inclusive('\n').enumerate() {
                 if !scan.running() { break; }
                 let line = raw.strip_suffix('\n').map(|line| line.strip_suffix('\r').unwrap_or(line)).unwrap_or(raw);
-                if regex.is_match(line) { hit(start, start + line.len().saturating_sub(1), index + 1)?; }
+                if regex.is_match(line) && hit(start, start + line.len().saturating_sub(1), index + 1)? {
+                    if content { scan.stopped = Some(TruncatedBy::RowLimit); }
+                    break;
+                }
                 start += raw.len();
             }
         }
@@ -110,6 +121,7 @@ pub fn grep(request: &Request) -> Result<Value> {
             if !content && args.output_mode != "summary" {
                 page.push(if args.output_mode == "count" { json!({"path":file,"count":hits}) } else { json!({"path":file}) }, ordinal)?;
             }
+            if early && !content && file_count >= wanted { scan.stopped = Some(TruncatedBy::RowLimit); }
         }
         Ok(())
     })?;
diff --git a/package-lock.json b/package-lock.json
index 9dcc6dcf..5ec3fef5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -66,11 +66,12 @@
         "yaml": "^2.9.1"
       },
       "engines": {
-        "node": "^22.19 || >=24"
+        "node": "^22.19 || >=24",
+        "dsh": "0.2.0-rc.2 || 0.2.1-rc.2"
       },
       "peerDependencies": {
         "@deepseek-ai/cordis": "^4.0.4",
-        "@deepseek-ai/dsh": "^0.2.0-rc.2"
+        "@deepseek-ai/dsh": "0.2.0-rc.2 || 0.2.1-rc.2"
       },
       "peerDependenciesMeta": {
         "@deepseek-ai/cordis": {
diff --git a/package.json b/package.json
index 6d87d734..e0536489 100644
--- a/package.json
+++ b/package.json
@@ -21,7 +21,7 @@
     "x64",
     "arm64"
   ],
-  "description": "Native file and PTC tools for DSH on Windows x64, Linux x64 and macOS Apple Silicon; Windows-only optional Bash payload and host PowerShell integration",
+  "description": "Native file and PTC tools for DSH on Windows x64, Linux x64 and macOS arm64/x64; Windows-only optional Bash payload and host PowerShell integration",
   "icon": "./docs/assets/icon.png",
   "keywords": [
     "dsh",
@@ -46,16 +46,19 @@
     },
     "./shell/package.json": "./lib/components/shell/package.json",
     "./shell/locale/*.json": "./lib/components/shell/locale/*.json",
+    "./shell/icon": "./lib/components/shell/icon.png",
     "./file": {
       "default": "./lib/components/file/index.js"
     },
     "./file/package.json": "./lib/components/file/package.json",
     "./file/locale/*.json": "./lib/components/file/locale/*.json",
+    "./file/icon": "./lib/components/file/icon.png",
     "./background": {
       "default": "./lib/components/background/index.js"
     },
     "./background/package.json": "./lib/components/background/package.json",
     "./background/locale/*.json": "./lib/components/background/locale/*.json",
+    "./background/icon": "./lib/components/background/icon.png",
     "./ptc": {
       "default": "./lib/components/ptc/index.js"
     },
@@ -64,6 +67,7 @@
     },
     "./ptc/package.json": "./lib/components/ptc/package.json",
     "./ptc/locale/*.json": "./lib/components/ptc/locale/*.json",
+    "./ptc/icon": "./lib/components/ptc/icon.png",
     "./panel": {
       "default": "./lib/components/panel/index.js"
     },
@@ -75,16 +79,19 @@
     },
     "./tui/package.json": "./lib/components/tui/package.json",
     "./tui/locale/*.json": "./lib/components/tui/locale/*.json",
+    "./tui/icon": "./lib/components/tui/icon.png",
     "./discovery": {
       "default": "./lib/components/discovery/index.js"
     },
     "./discovery/package.json": "./lib/components/discovery/package.json",
     "./discovery/locale/*.json": "./lib/components/discovery/locale/*.json",
+    "./discovery/icon": "./lib/components/discovery/icon.png",
     "./hide-official": {
       "default": "./lib/components/hide-official/index.js"
     },
     "./hide-official/package.json": "./lib/components/hide-official/package.json",
     "./hide-official/locale/*.json": "./lib/components/hide-official/locale/*.json",
+    "./hide-official/icon": "./lib/components/hide-official/icon.png",
     "./client": {
       "default": "./lib/client.js"
     }
@@ -156,7 +163,7 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.4",
-    "@deepseek-ai/dsh": "^0.2.0-rc.2"
+    "@deepseek-ai/dsh": "0.2.0-rc.2 || 0.2.1-rc.2"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/cordis": {
@@ -215,6 +222,7 @@
     "yaml": "^2.9.1"
   },
   "engines": {
-    "node": "^22.19 || >=24"
+    "node": "^22.19 || >=24",
+    "dsh": "0.2.0-rc.2 || 0.2.1-rc.2"
   }
 }
diff --git a/scripts/check-workflows.mjs b/scripts/check-workflows.mjs
index 00ffaf93..1a416de5 100644
--- a/scripts/check-workflows.mjs
+++ b/scripts/check-workflows.mjs
@@ -71,11 +71,15 @@ if (!ci) {
   check(triggers?.push !== undefined, 'ci.yml: runs on push to the protected branch')
   check(triggers?.pull_request !== undefined, 'ci.yml: runs on pull_request before a merge')
   check(triggers?.merge_group !== undefined, 'ci.yml: runs on merge_group, so a merge queue can use it')
-  for (const event of ['push', 'pull_request']) {
+  for (const event of ['push']) {
     check(triggers?.[event]?.branches?.includes('release/0.4.0'), `ci.yml: ${event} includes the 0.4.0 staging branch`)
   }
+  check(triggers?.pull_request?.branches === undefined && triggers?.pull_request?.['branches-ignore'] === undefined,
+    'ci.yml: pull_request has no target-branch filter, including stacked PRs')
+  check(triggers?.pull_request?.paths === undefined && triggers?.pull_request?.['paths-ignore'] === undefined,
+    'ci.yml: pull_request has no path filter')
   const jobs = ci.doc.jobs ?? {}
-  checkPluginBuild('ci.yml', jobs, ['validate-posix', 'validate-windows', 'node-floor', 'tools-trial', 'bench-smoke'])
+  checkPluginBuild('ci.yml', jobs, ['validate-posix', 'validate-macos-intel', 'validate-windows', 'node-floor', 'tools-trial', 'bench-smoke'])
   const entry = Object.entries(jobs).find(([, job]) => job?.name === 'CI required')
   check(entry !== undefined, 'ci.yml: exposes one aggregate check named "CI required"')
   if (entry) {
@@ -113,6 +117,15 @@ if (!ci) {
   }
 }
 
+const ruleset = JSON.parse(await readFile(join(root, '.github', 'required-ci-ruleset.json'), 'utf8'))
+check(ruleset.target === 'branch' && ruleset.enforcement === 'active', 'ruleset template enforces branches')
+check(JSON.stringify(ruleset.conditions?.ref_name) === JSON.stringify({ include: ['refs/heads/main', 'refs/heads/0.3.2', 'refs/heads/release/0.4.0'], exclude: [] }), 'ruleset template targets the three maintained branches')
+check(Array.isArray(ruleset.bypass_actors) && ruleset.bypass_actors.length === 0, 'ruleset template has no bypass actors')
+check(ruleset.rules.some(rule => rule.type === 'pull_request'), 'ruleset template requires a pull request')
+const statusRule = ruleset.rules.find(rule => rule.type === 'required_status_checks')?.parameters
+check(statusRule?.strict_required_status_checks_policy === true, 'ruleset template requires validation against current base')
+check(JSON.stringify(statusRule?.required_status_checks) === JSON.stringify([{ context: 'CI required', integration_id: 15368 }]), 'ruleset template requires CI required from GitHub Actions')
+
 // The release path is deliberately secret-free (see its header); that promise is enforced, not
 // documented, because a half-wired publish is worse than none. The assertion is tied to the gated
 // rewrite's `publish` job: the legacy file still names `NPM_TOKEN`, and #177 replaces that path, so
diff --git a/scripts/lib/catalogue-checks.mjs b/scripts/lib/catalogue-checks.mjs
new file mode 100644
index 00000000..7cd94a5e
--- /dev/null
+++ b/scripts/lib/catalogue-checks.mjs
@@ -0,0 +1,32 @@
+/** Importable declaration checks, shared by the release gate and drift regressions. */
+import { isDeepStrictEqual } from 'node:util'
+import { COMPONENTS, componentEntry, componentEnabled } from '../../lib/components/defaults.js'
+import { DISCOVERY_CAPABILITIES } from '../../lib/capabilities/registry.js'
+import { publicToolName } from '../../lib/policy.js'
+import { platformSurface } from '../../lib/official-tool-catalog.js'
+
+export function defaultChecks(component, config, resolve) {
+  const defaults = resolve({})
+  return Object.entries(config ?? {}).map(([key, value]) => [
+    isDeepStrictEqual(value, defaults[key]), `${component}.${key} patch default matches its resolver`,
+  ])
+}
+
+export function componentChecks(components, platform = process.platform) {
+  const checks = [], check = (...value) => checks.push(value)
+  const ptc = components.find(row => row.id === 'dsh-ops-ptc')
+  check(components.length === COMPONENTS.length && new Set(components.map(row => row.id)).size === COMPONENTS.length, 'component declarations are complete and unique')
+  for (const component of COMPONENTS) {
+    const row = components.find(value => value.id === `dsh-ops-${component}`)
+    check(row?.entry === componentEntry(component), `${component} declaration uses its exported entry`)
+    check(row?.defaultEnabled === componentEnabled(component, platform), `${component} declaration matches its enablement default`)
+    const hasRuntimeTarget = ['ptc', 'shell', 'file', 'discovery', 'panel'].includes(component)
+    check(isDeepStrictEqual(row?.targets, hasRuntimeTarget ? ptc?.targets : undefined), `${component} target declaration matches its runtime requirements`)
+    const tools = component === 'discovery' ? DISCOVERY_CAPABILITIES.map(entry => publicToolName(entry.rawName))
+      : ['panel', 'tui'].includes(component) ? [] : undefined
+    if (component !== 'ptc') check(isDeepStrictEqual(row?.tools, tools), `${component} tool declaration matches its catalogue projection`)
+  }
+  const retained = Object.fromEntries(['win32', 'linux', 'darwin'].map(platform => [platform, platformSurface(platform).retainedCommand]))
+  check(isDeepStrictEqual(components.find(row => row.id === 'dsh-ops-hide-official')?.retainedOfficialCommand, retained), 'retained official commands match platform policy')
+  return checks
+}
diff --git a/scripts/lib/compose-bundle.mjs b/scripts/lib/compose-bundle.mjs
new file mode 100644
index 00000000..477286ba
--- /dev/null
+++ b/scripts/lib/compose-bundle.mjs
@@ -0,0 +1,9 @@
+import { composeEntries } from '@deepseek-ai/dsh-app-boot'
+
+/** Use the host's patch composer, treating skipped overrides as invalid input. */
+export function composeBundle(layers, compose = composeEntries) {
+  const warnings = []
+  const rows = compose(layers, message => warnings.push(message))
+  if (warnings.length) throw new Error(`Bundle patch does not compose: ${warnings.join('; ')}`)
+  return rows
+}
diff --git a/scripts/validate-manifest.mjs b/scripts/validate-manifest.mjs
index 0dee414f..6746141c 100644
--- a/scripts/validate-manifest.mjs
+++ b/scripts/validate-manifest.mjs
@@ -18,6 +18,7 @@
 import fs from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { componentChecks, defaultChecks } from './lib/catalogue-checks.mjs'
 import { parse as parseYaml } from 'yaml'
 import {
   IN_PROCESS_TOOLS,
@@ -34,6 +35,8 @@ import { PTC_API_TOOLS, definition } from '../lib/ptc/contract.js'
 import { resolveConfig, resolveDiscoveryConfig } from '../lib/config.js'
 import { COMPONENTS, componentEntry, componentEnabled } from '../lib/components/defaults.js'
 import { resolveHidingConfig } from '../lib/official-tool-hiding.js'
+import { evaluatePluginCompatibility } from '@deepseek-ai/dsh-app-boot'
+import { composeBundle } from './lib/compose-bundle.mjs'
 
 /** The repository root (`scripts/`'s parent). */
 const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
@@ -224,6 +227,10 @@ if (typeof patch === 'string' && fs.existsSync(path.join(PACKAGE_ROOT, patch)))
 
   if (document !== undefined) {
     check(Array.isArray(document), 'the bundle patch is a list of loader patch entries')
+    try {
+      const composed = composeBundle([document])
+      check(composed.length === 7, 'the host composes seven rows without skipped patch targets')
+    } catch (error) { check(false, 'the host composes seven rows without skipped patch targets', String(error?.message ?? error)) }
     const rows = Array.isArray(document)
       ? document.flatMap((entry) => (Array.isArray(entry?.insert) ? entry.insert : []))
       : []
@@ -239,7 +246,10 @@ if (typeof patch === 'string' && fs.existsSync(path.join(PACKAGE_ROOT, patch)))
           : component === 'hide-official' ? resolveHidingConfig
             : component === 'panel' ? resolvePanelConfig
               : resolveConfig
-      try { resolve(row.config); check(true, `${component} config is valid`) }
+      try {
+        resolve(row.config); check(true, `${component} config is valid`)
+        for (const fact of defaultChecks(component, row.config, resolve)) check(...fact)
+      }
       catch (error) { check(false, `${component} config is valid`, String(error?.message ?? error)) }
     }
   }
@@ -485,13 +495,15 @@ if (display !== undefined) {
 
 /** Payload the published package must carry, as `files` entries or paths they cover. */
 const ptc = manifestRaw.contributes?.['x-components']?.find(c => c.id === 'dsh-ops-ptc')
+const components = manifestRaw.contributes?.['x-components'] ?? []
+for (const fact of componentChecks(components)) check(...fact)
 check(ptc?.entry === 'dsh-ops/ptc' && ptc?.defaultEnabled === true, 'native PTC enhancement is enabled by default; presentation stays scoped')
 check(JSON.stringify(ptc?.tools) === JSON.stringify([...PTC_API_TOOLS, 'load_sdk'].map(publicToolName)), 'PTC declaration matches the generated tool contract')
 check(PTC_API_TOOLS.every(t => definition(t, () => {}).parameters.type === 'object'), 'PTC schemas remain structured')
 check(JSON.stringify(pkg.os) === '["win32","linux","darwin"]' && JSON.stringify(pkg.cpu) === '["x64","arm64"]' &&
   JSON.stringify(ptc?.platforms) === '["win32","linux","darwin"]' && JSON.stringify(ptc?.architectures) === '["x64","arm64"]' &&
-  JSON.stringify(ptc?.targets) === '["win32-x64","linux-x64","darwin-arm64"]',
-  'Supported exact targets are Windows x64, Linux x64 and macOS Apple Silicon; Intel Mac is unsupported')
+  JSON.stringify(ptc?.targets) === '["win32-x64","linux-x64","darwin-arm64","darwin-x64"]',
+  'Supported exact targets are Windows x64, Linux x64 and macOS arm64/x64; Intel Mac is supported')
 /** Every component states the platforms it really serves, so a Linux claim cannot ride along. */
 const platformClaims = id => manifestRaw.contributes?.['x-components']?.find(c => c.id === id)?.platforms
 check(JSON.stringify(platformClaims('dsh-ops-shell')) === '["win32","linux","darwin"]',
@@ -545,9 +557,17 @@ check(
 )
 
 check(
-  typeof pkg.peerDependencies?.['@deepseek-ai/dsh'] === 'string',
-  'the plugin declares a DSH peer range for the host compatibility gate',
+  typeof pkg.engines?.dsh === 'string' && pkg.engines.dsh === pkg.peerDependencies?.['@deepseek-ai/dsh'],
+  'engines.dsh and the legacy DSH peer declare the same compatibility range',
 )
+for (const version of ['0.2.0-rc.2', '0.2.1-rc.2']) {
+  check(evaluatePluginCompatibility(pkg, {}, version) === undefined, `the declared range accepts DSH ${version}`)
+}
+for (const component of [...COMPONENTS, 'background']) {
+  const resource = pkg.exports?.[`./${component}/icon`]
+  check(typeof resource === 'string' && fs.existsSync(path.join(PACKAGE_ROOT, resource)),
+    `the ${component} icon is exported for subpath metadata readers`)
+}
 
 for (const line of notes) console.log(line)
 if (failures.length > 0) {
diff --git a/src/bash-ipc.ts b/src/bash-ipc.ts
index da8a23d8..e7c1240c 100644
--- a/src/bash-ipc.ts
+++ b/src/bash-ipc.ts
@@ -47,6 +47,11 @@ export function restrictedCompatibility(file: string, {platform=process.platform
 }
 /** The directories this runtime puts on the child's PATH — what an attacker would target. */
 const PATH_DIRS=['usr/bin','ucrt64/bin','cmd']
+/** Per-call PATH for the verified private MSYS tree. */
+export function privateRuntimePath(target: string, inheritedPath = process.env.PATH ?? '') {
+  return [path.join(target,'usr/bin'), ...inheritedPath.split(path.delimiter).filter(Boolean),
+    path.join(target,'ucrt64/bin'),path.join(target,'cmd')].join(path.delimiter)
+}
 /** Relative-path → `{sha256, size, mtimeMs}` for every file under {@link PATH_DIRS}.
  *  `bash.exe` and the DLLs are verified individually; this covers the rest of what the child can
  *  actually execute, so swapping `cmd/git.exe` — which the PATH exposes and the child will
@@ -264,7 +269,7 @@ export function confinedBash(file: string, {home=process.env.DSH_HOME ?? path.jo
       try {renameWithRetry(stage,target)} catch(error){if(!fs.existsSync(marker))throw error}
     } finally {fs.rmSync(stage,{recursive:true,force:true})}
   }
-  const result={file:selected,env:{PATH:[path.join(target,'usr/bin'),path.join(target,'ucrt64/bin'),path.join(target,'cmd'),process.env.PATH??''].join(path.delimiter)},runtime:identity}
+  const result={file:selected,env:{PATH:privateRuntimePath(target)},runtime:identity}
   cache.set(key,result)
   return result
 }
diff --git a/src/capabilities/file.ts b/src/capabilities/file.ts
index e23092d5..a6bd8d2b 100644
--- a/src/capabilities/file.ts
+++ b/src/capabilities/file.ts
@@ -53,6 +53,7 @@ export const PARAMETERS = Object.freeze({
     multiline: { type: 'boolean', description: 'Search whole-file text instead of individual lines; default false.' },
     offset: integer,
     limit: range(1, 10000, 'Default 100.'),
+    exactTotal: { type: 'boolean', description: 'Default true. False stops at the row limit with lower bounds and no stable cursor; summary and continuation still scan fully.' },
     continuation: { ...string, description: 'Opaque cursor from a complete scan. Keep query options unchanged; omit offset or use nextOffset. SEARCH_STALE requires a fresh query.' },
   }, ['pattern']),
   stat: bounded({ path: filePath }, ['path']),
diff --git a/src/capabilities/registry.ts b/src/capabilities/registry.ts
index 78e71064..adb82992 100644
--- a/src/capabilities/registry.ts
+++ b/src/capabilities/registry.ts
@@ -12,18 +12,24 @@ export type PtcToolName = keyof typeof ptcParameters
 // Preserve the published registration order independently of schema object key order.
 const fileOrder = ['inspect_local_file', 'grep', 'glob', 'replace', 'write_file', 'edit_file', 'diff', 'stat', 'copy', 'move', 'remove', 'read_files', 'read_table', 'read_docx', 'read_pdf'] as const satisfies readonly FileToolName[]
 const fileMutations = new Set<FileToolName>(['replace', 'write_file', 'edit_file', 'copy', 'move', 'remove'])
+const continuationReaders = new Set<FileToolName>(['inspect_local_file', 'read_files', 'glob', 'grep', 'diff', 'read_table', 'read_docx', 'read_pdf'])
+const observedReaders = new Set<FileToolName>(['inspect_local_file', 'read_files'])
 const allPresentations = Object.freeze(['native', 'ptc', 'both'] as const)
 
 export const FILE_CAPABILITIES = Object.freeze(fileOrder.map(rawName => Object.freeze({
   rawName, component: 'file' as const, presentations: allPresentations,
   availability: rawName === 'read_files' ? 'resident' as const : 'discoverable' as const, mutates: fileMutations.has(rawName),
   concurrencySafe: !fileMutations.has(rawName),
+  ptcAvailability: rawName === 'inspect_local_file' ? 'resident' as const : 'discoverable' as const,
+  supportsContinuation: continuationReaders.has(rawName), observesRead: observedReaders.has(rawName),
   parameters: fileParameters[rawName], description: fileDescriptions[rawName], output: fileOutput(rawName),
 } satisfies SchemaCapability)))
 export const PTC_CAPABILITIES = Object.freeze((Object.keys(ptcParameters) as PtcToolName[]).map(rawName => Object.freeze({
   rawName, component: 'ptc' as const, presentations: rawName === 'result' ? allPresentations : Object.freeze(['ptc'] as const),
   ...(rawName === 'result' ? { nativeProjection: { component: 'file' as const, availability: 'discoverable' as const, parameters: NATIVE_RESULT_PARAMETERS, description: NATIVE_RESULT_DESCRIPTION } } : {}),
   availability: 'resident' as const, mutates: true, concurrencySafe: false,
+  ptcAvailability: rawName === 'result' ? 'resident' as const : 'discoverable' as const,
+  supportsContinuation: rawName === 'result',
   parameters: ptcParameters[rawName], description: ptcDescriptions[rawName], output: ptcOutput,
 } satisfies SchemaCapability)))
 // The shell owns its host-dependent schema. Its name and ownership still come from this catalogue.
@@ -51,3 +57,7 @@ export const NATIVE_RESIDENT_FILE_TOOLS = Object.freeze(FILE_CAPABILITIES.filter
 export const FILE_MUTATIONS = Object.freeze(FILE_CAPABILITIES.filter(capability => capability.mutates).map(capability => capability.rawName))
 export const PTC_TOOLS = PTC_CAPABILITIES.map(capability => capability.rawName)
 export const IN_PROCESS_TOOLS = Object.freeze(SHELL_CAPABILITIES.map(capability => capability.rawName))
+export const DISCOVERY_TOOL_NAME = DISCOVERY_CAPABILITIES[0].rawName
+export const CONTINUATION_TOOLS = Object.freeze([...FILE_CAPABILITIES, ...PTC_CAPABILITIES].filter(entry => entry.supportsContinuation).map(entry => entry.rawName))
+export const OBSERVED_READ_TOOLS = Object.freeze(FILE_CAPABILITIES.filter(entry => entry.observesRead).map(entry => entry.rawName))
+export const PTC_RESIDENT_TOOLS = Object.freeze([...FILE_CAPABILITIES, ...PTC_CAPABILITIES].filter(entry => entry.ptcAvailability === 'resident').map(entry => entry.rawName))
diff --git a/src/capabilities/replacements.ts b/src/capabilities/replacements.ts
new file mode 100644
index 00000000..04f78170
--- /dev/null
+++ b/src/capabilities/replacements.ts
@@ -0,0 +1,6 @@
+/** Reviewed replacement choices, shared with the browser without importing host code. */
+export const RAW_OFFICIAL_REPLACEMENTS = Object.freeze({
+  read: 'inspect_local_file', glob: 'glob', grep: 'grep',
+} as const)
+export type OfficialReplacement = keyof typeof RAW_OFFICIAL_REPLACEMENTS
+export const OFFICIAL_REPLACEMENT_NAMES = Object.freeze(Object.keys(RAW_OFFICIAL_REPLACEMENTS) as OfficialReplacement[])
diff --git a/src/capabilities/sdk.ts b/src/capabilities/sdk.ts
index f0730e01..7414ac36 100644
--- a/src/capabilities/sdk.ts
+++ b/src/capabilities/sdk.ts
@@ -8,7 +8,7 @@ export const SDK_OUTPUT: JsonSchemaNode = { type: 'object', properties: {
   status: { type: 'string', const: 'completed' }, tools: { type: 'array', items: { type: 'string' } }, nextTurn: { type: 'boolean', const: true },
 }, required: ['status', 'tools', 'nextTurn'], additionalProperties: false }
 export const SDK_CAPABILITIES = Object.freeze([Object.freeze({
-  rawName: 'load_sdk', component: 'ptc', presentations: Object.freeze(['ptc'] as const), availability: 'resident',
+  rawName: 'load_sdk', component: 'ptc', presentations: Object.freeze(['ptc'] as const), availability: 'resident', ptcAvailability: 'resident',
   mutates: false, concurrencySafe: false, parameters: SDK_PARAMETERS, output: SDK_OUTPUT,
   description: 'Load 1-5 named OPS APIs into this agent’s typed SDK on the next model step. The current run_code snapshot cannot call newly requested APIs. No file operation runs here. Native/both presentations do not expose this loader.',
 } as const satisfies SchemaCapability)])
diff --git a/src/capabilities/types.ts b/src/capabilities/types.ts
index 6a466c41..43c1739b 100644
--- a/src/capabilities/types.ts
+++ b/src/capabilities/types.ts
@@ -12,6 +12,10 @@ export interface CapabilityMetadata {
   readonly component: Component
   readonly presentations: readonly ToolPresentationMode[]
   readonly availability: 'resident' | 'discoverable'
+  /** PTC publication is independent of the Native tier. */
+  readonly ptcAvailability?: 'resident' | 'discoverable'
+  readonly supportsContinuation?: boolean
+  readonly observesRead?: boolean
   /** Conservative per-tool flag: some actions (batch plan/result page) remain read-only. */
   readonly mutates: boolean
   readonly concurrencySafe: boolean
diff --git a/src/client/selections.tsx b/src/client/selections.tsx
index 1e0ab192..92155620 100644
--- a/src/client/selections.tsx
+++ b/src/client/selections.tsx
@@ -1,7 +1,7 @@
 import { DISCOVERY_TERMS } from '../capabilities/discovery.js'
+import { OFFICIAL_REPLACEMENT_NAMES as replacements } from '../capabilities/replacements.js'
 import { checked, FormActions, strings, Unavailable, useEditor } from './forms.js'
 import type { SettingsProps } from './forms.js'
-const replacements = ['read', 'glob', 'grep'] as const
 const readReplacement = (value: Record<string, unknown>) => strings(value.replaceTools)
 export function ReplacementForm(props: SettingsProps) {
   const { form, t } = props, editor = useEditor(form, readReplacement, t)
diff --git a/src/components/discovery/index.ts b/src/components/discovery/index.ts
index 03622670..cbc2bf0e 100644
--- a/src/components/discovery/index.ts
+++ b/src/components/discovery/index.ts
@@ -6,4 +6,7 @@ export const Config = settingsConfig(resolveDiscoveryConfig, {
   maxResults: editable('number', 'Maximum capabilities selected per discovery call, from 1 to 5.'),
   allowedTools: editable('array', 'Implemented capabilities available for discovery.', { type: 'string' }),
   alwaysLoaded: editable('array', 'Allowed capabilities published without a discovery request.', { type: 'string' }),
+  binaryPath: editable('string', 'Absolute native worker path; omit to use the packaged worker.'),
+  required: editable('boolean', 'Fail activation when the native worker is unavailable.'),
+  denyCredentialReads: editable('boolean', 'Refuse credential locations during file reads.'),
 })
diff --git a/src/components/shell/index.ts b/src/components/shell/index.ts
index 7d491752..78870fa7 100644
--- a/src/components/shell/index.ts
+++ b/src/components/shell/index.ts
@@ -4,6 +4,8 @@ import { mountRuntimeSettings } from '../../settings/runtime-host.js'
 import { resolveConfig } from '../../config.js'
 import { editable, settingsConfig, configObject } from '../../settings/schema.js'
 export const name = 'dsh-ops-bash & host PowerShell'
+// Shared core validator compatibility keys do not configure the shell row's settings form.
+export const NON_EDITABLE_CONFIG_KEYS = ['configUpdateVersion', 'binaryPath', 'required', 'denyCredentialReads', 'serverName', 'enableShellTools', 'toolCallTimeoutMs'] as const
 export const Config = settingsConfig(value => {
   const raw = configObject(value ?? {}), validated = resolveConfig(raw)
   // Keep raw ordinary keys: applyComponent owns normalization and migration.
@@ -11,6 +13,11 @@ export const Config = settingsConfig(value => {
 }, {
   bashPath: editable('string', 'Absolute Bash executor path. Remove the override to select the optional managed installation.'),
   publishBashTool: editable('boolean', 'Publish Bash for authorized sessions.'),
+  shellPolicy: editable('string', 'Use advise or deny-host-shell for host shell routing.'),
+  deniedHostTools: editable('array', 'Host tool names denied by deny-host-shell policy.', { type: 'string' }),
+  promptPolicy: editable('boolean', 'Publish tool routing guidance.'),
+  extraGuidance: editable('string', 'Additional tool routing guidance.'),
+  allowSystemShellFallback: editable('boolean', 'Allow ambient system Bash when no managed installation is available.'),
 })
 export function apply(ctx: Context, config: unknown): void {
   applyComponent(ctx, config, 'shell')
diff --git a/src/config.ts b/src/config.ts
index bbfab175..5f08bda6 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -19,6 +19,10 @@
  * config update 2 removes them from saved rows (`lib/config-updates.js`).
  */
 export const LEGACY_FASTCTX_KEYS = Object.freeze(['serverName', 'enableShellTools', 'toolCallTimeoutMs'])
+export const CORE_CONFIG_KEYS = Object.freeze([
+  ...LEGACY_FASTCTX_KEYS, 'binaryPath', 'required', 'shellPolicy', 'deniedHostTools', 'promptPolicy',
+  'extraGuidance', 'bashPath', 'publishBashTool', 'allowSystemShellFallback', 'denyCredentialReads', 'configUpdateVersion',
+])
 
 /** Upper bound accepted for the legacy `toolCallTimeoutMs`, matching the loader's timer ceiling. */
 const MAX_TOOL_CALL_TIMEOUT_MS = 2_147_483_647
@@ -121,22 +125,7 @@ export function resolveConfig(rawConfig?: unknown): ResolvedConfig {
     throw new ConfigError(`config must be an object, got ${JSON.stringify(rawConfig)}`)
   }
   const raw = rawConfig as Record<string, unknown>
-  rejectUnknownKeys(raw, [
-    'binaryPath',
-    'serverName',
-    'enableShellTools',
-    'toolCallTimeoutMs',
-    'required',
-    'shellPolicy',
-    'deniedHostTools',
-    'promptPolicy',
-    'extraGuidance',
-    'bashPath',
-    'publishBashTool',
-    'allowSystemShellFallback',
-    'denyCredentialReads',
-    'configUpdateVersion',
-  ])
+  rejectUnknownKeys(raw, CORE_CONFIG_KEYS)
 
   const configUpdateVersion = raw.configUpdateVersion ?? 0
   if (typeof configUpdateVersion !== 'number' || !Number.isSafeInteger(configUpdateVersion) || configUpdateVersion < 0) {
diff --git a/src/discovery/config.ts b/src/discovery/config.ts
index e8e1b73a..c5f48750 100644
--- a/src/discovery/config.ts
+++ b/src/discovery/config.ts
@@ -13,11 +13,12 @@ export interface DiscoveryConfig {
   denyCredentialReads: boolean
 }
 export const DISCOVERABLE_TOOLS = Object.freeze(Object.keys(DISCOVERY_TERMS) as DiscoverableName[])
+export const DISCOVERY_CONFIG_KEYS = Object.freeze(['enabled', 'maxResults', 'allowedTools', 'alwaysLoaded', 'binaryPath', 'required', 'denyCredentialReads'] as const satisfies readonly (keyof DiscoveryConfig)[])
 export function resolveDiscoveryConfig(raw: unknown = {}): DiscoveryConfig {
   if (!raw || typeof raw !== 'object' || Array.isArray(raw)) throw new ConfigError('discovery config must be an object')
   const input = raw as Record<string, unknown>
   for (const key of Object.keys(input)) {
-    if (!['enabled', 'maxResults', 'allowedTools', 'alwaysLoaded', 'binaryPath', 'required', 'denyCredentialReads'].includes(key)) {
+    if (!(DISCOVERY_CONFIG_KEYS as readonly string[]).includes(key)) {
       throw new ConfigError(`unknown discovery key: ${key}`)
     }
   }
diff --git a/src/discovery/index.ts b/src/discovery/index.ts
index 678fb2fd..6e079c65 100644
--- a/src/discovery/index.ts
+++ b/src/discovery/index.ts
@@ -5,17 +5,19 @@ import type { PromptAssembly } from '@deepseek-ai/dsh-system-prompt'
 import type {} from '@deepseek-ai/dsh-sandbox-policy'
 import { resolveDiscoveryConfig } from '../config.js'
 import { NativeFileTools } from '../file/runtime.js'
-import { nativeProviders, registerNativeProvider, claimNativeSelection } from '../file/result-provider.js'
+import { nativeProviders, registerNativeProviderAtScope, claimNativeSelection } from '../file/result-provider.js'
+import { onToolChange } from '../tool-changes.js'
 import { ownScopes } from '../scoped-ownership.js'
 import { isNativePresentation, isPresentationProbe } from '../presentation.js'
 import { mountResultLifecycle } from '../kernel/result-lifecycle.js'
 import { failure, resolveWorker } from '../file/worker.js'
-import { capability } from '../capabilities/registry.js'
+import { capability, DISCOVERY_TOOL_NAME } from '../capabilities/registry.js'
 import { DISCOVERY_DESCRIPTION, DISCOVERY_PARAMETERS, DISCOVERY_OUTPUT } from '../capabilities/discovery.js'
 import { publicToolName, renderToolingPolicy } from '../policy.js'
 import { DISCOVERABLE_TOOLS } from './config.js'
 import type { DiscoverableName } from './config.js'
 import { parseRequest, search } from './search.js'
+import { scopedReconciliation, scopeFamilies } from '../scoped-reconciliation.js'
 
 interface Entry {
   ctx?: Context
@@ -26,9 +28,11 @@ interface Entry {
   disposers: (() => void)[]
   owned: Set<string>
   ready: Promise<void>
+  revision: number
+  presentation?: { inputs: unknown[]; native: boolean }
   releaseSelection?: () => void
 }
-const DISCOVER = publicToolName('discover_tools')
+const DISCOVER = publicToolName(DISCOVERY_TOOL_NAME)
 const advanced = DISCOVERABLE_TOOLS.map(publicToolName)
 export const name = 'dsh-ops-discovery'
 
@@ -45,15 +49,12 @@ export function apply(root: Context, raw: unknown): void {
     const tools = ctx.get('tools'), prompt = ctx.get('systemPrompt'), policyService = ctx.get('sandboxPolicy')
     if (!tools || !prompt || !policyService) return
     const entries = new Map<Agent, Entry>()
+    const retired = new WeakSet<Agent>()
+    let scopeChainOf: (scope: object) => object[] = scope => [scope]
     mountResultLifecycle(ctx)
     let ownership: Awaited<ReturnType<typeof ownScopes>> | undefined
-    let stopped = false, mutating = false, epoch = 0, chain = Promise.resolve()
-    let settled = chain
-    const drain = async () => {
-      let current: Promise<void>
-      do { current = chain; await current } while (current !== chain)
-      settled = current
-    }
+    let stopped = false, mutating = false
+    const work = scopedReconciliation<Agent>(() => ctx.logger.warn('dsh-ops: discovery publication unavailable; tools remain withdrawn.'))
     const clear = (entry: Entry) => {
       entry.owned.clear()
       for (const dispose of entry.disposers.splice(0)) {
@@ -68,38 +69,63 @@ export function apply(root: Context, raw: unknown): void {
       } catch { return false }
     }
     const ptcOnly = (assembly: PromptAssembly): boolean => assembly.sections.some(section => section.name === 'tools:ptc-only' && Boolean(section.text.trim()))
-    const native = (agent: Agent): Promise<boolean> => isNativePresentation(prompt, agent)
-    const own = async (agent: Agent, entry: Entry, tool: ToolDefinition): Promise<void> => {
+    const invalidate = (entry: Entry) => { ++entry.revision; entry.presentation = undefined }
+    const inputs = (agent: Agent): unknown[] => {
+      const policy = policyService.resolve({ session: agent.session })
+      return [agent.ctx, agent.session, agent.session.header.cwd, policy.mode, policy.workspaceRoot, policy.sessionId]
+    }
+    const same = (left: unknown[], right: unknown[]) => left.length === right.length && left.every((value, index) => value === right[index])
+    // Only background reconciliation reuses a probe. A step or execution can
+    // observe arbitrary dynamic prompt providers with no registry notification.
+    const native = async (agent: Agent, fresh = false, signal?: AbortSignal): Promise<boolean> => {
+      const entry = entries.get(agent)
+      if (!entry) return false
+      if (fresh) invalidate(entry)
+      const current = inputs(agent), revision = entry.revision
+      if (entry.presentation && same(entry.presentation.inputs, current)) return entry.presentation.native
+      const result = await isNativePresentation(prompt, agent, signal)
+      if (!stopped && !signal?.aborted && entries.get(agent) === entry && revision === entry.revision && same(current, inputs(agent))) {
+        entry.presentation = { inputs: current, native: result }
+      }
+      return result
+    }
+    const own = (agent: Agent, entry: Entry, tool: ToolDefinition): void => {
       if (!entry.ctx) return
       const execute = tool.execute
       const registration: ToolDefinition = { ...tool, execute: async (args, exec) => {
-        await chain
-        const version = epoch
-        const available = () => ownership?.owns(agent) && !stopped && entries.get(agent) === entry && exec.agent === agent && entry.owned.has(tool.name)
-        if (!available() || !await native(agent).catch(() => false) || !available() || version !== epoch) {
+        await work.drain(agent)
+        const version = work.version(agent)
+        const available = () => ownership?.owns(agent) && !stopped && !exec.signal?.aborted && entries.get(agent) === entry && exec.agent === agent && entry.owned.has(tool.name)
+        if (!available() || !permitted(agent) || !await native(agent, true, exec.signal).catch(() => false) || !available() || version !== work.version(agent)) {
           return failure('POLICY_DENIED', 'Discovery capability belongs to a different or inactive scope.')
         }
         return execute(args, exec)
       } }
-      entry.disposers.push(await registerNativeProvider(entry.ctx, [registration], tool => entry.ctx!.tools.register(tool), { inheritable: false, priority: 10 }))
+      const dispose = registerNativeProviderAtScope(entry.ctx, agent, [registration], tool => entry.ctx!.tools.register(tool), { inheritable: false, priority: 10 })
+      if (stopped || entries.get(agent) !== entry || !ownership?.owns(agent)) { dispose(); return }
+      entry.disposers.push(dispose)
       entry.owned.add(tool.name)
     }
     const inheritedNative = (agent: Agent, entry: Entry): string[] => nativeProviders(ctx, agent)
       .map(provider => provider.definition.name).filter(name => (advanced.includes(name) || name === DISCOVER) && !entry.owned.has(name))
-    const reconcile = (): Promise<void> => {
-      if (stopped || mutating) return chain
-      const version = ++epoch
-      chain = chain.then(async () => {
-        if (stopped || version !== epoch) return
-        const ready: [Agent, Entry][] = []
-        for (const [agent, entry] of entries) if (entry.ctx && ownership?.owns(agent) && permitted(agent) && await native(agent).catch(() => false)) ready.push([agent, entry])
-        if (stopped || version !== epoch) return
+    const reconcile = (targets: Iterable<Agent> = entries.keys()): Promise<void> => {
+      if (stopped) return Promise.resolve()
+      const families = scopeFamilies(entries.keys(), targets, scopeChainOf)
+      return Promise.all(families.map(family => work.run(family, async task => {
+        const ready = new Set<Agent>()
+        for (const agent of family) {
+          if (stopped || !task.current()) return
+          const entry = entries.get(agent)
+          if (entry?.ctx && ownership?.owns(agent) && permitted(agent) && await task.wait(native(agent, false, task.signal)).catch(() => false)) ready.add(agent)
+        }
+        if (stopped || !task.current()) return
         mutating = true; ownership?.begin()
         try {
           for (const [agent, entry] of entries) {
+            if (!family.has(agent)) continue
             if (!ownership?.owns(agent)) { clear(entry); entry.releaseSelection?.(); entry.releaseSelection = undefined; continue }
             entry.releaseSelection ??= claimNativeSelection(ctx, agent, new Set(advanced))
-            const isReady = ready.some(([candidate]) => candidate === agent)
+            const isReady = ready.has(agent)
             const wanted = isReady ? [...new Set([...config.alwaysLoaded, ...entry.selected])].filter(tool => permitted(agent, tool)) : []
             const desired = new Set([...(isReady && config.enabled ? [DISCOVER] : []), ...wanted.map(publicToolName)])
             const inherited = inheritedNative(agent, entry)
@@ -107,7 +133,7 @@ export function apply(root: Context, raw: unknown): void {
             // surface, or independent lifecycle listeners can amplify one another.
             if (desired.size === entry.owned.size && [...desired].every(tool => entry.owned.has(tool)) && !inherited.length) continue
             clear(entry)
-            if (isReady && config.enabled) await own(agent, entry, {
+            if (isReady && config.enabled) own(agent, entry, {
               name: DISCOVER, description: DISCOVERY_DESCRIPTION, parameters: DISCOVERY_PARAMETERS,
               output: { schema: DISCOVERY_OUTPUT, render: (_args, value) => [{ type: 'text', text: typeof value === 'object' && value && 'message' in value ? String(value.message) : JSON.stringify(value) }] },
               execute: async args => {
@@ -122,65 +148,99 @@ export function apply(root: Context, raw: unknown): void {
               },
             })
             for (const tool of wanted) {
-              await own(agent, entry, entry.runtime.definition(tool))
+              own(agent, entry, entry.runtime.definition(tool))
             }
           }
           // A child must not inherit its parent's activation or an old global advanced surface.
-          for (const [agent, entry] of entries) if (entry.ctx && ownership?.owns(agent)) {
+          for (const [agent, entry] of entries) if (family.has(agent) && entry.ctx && ownership?.owns(agent)) {
             const deny = inheritedNative(agent, entry)
             if (deny.length) entry.disposers.push(entry.ctx.tools.restrict({ deny }))
           }
+        } catch (error) {
+          for (const agent of family) { const entry = entries.get(agent); if (entry) clear(entry) }
+          throw error
         } finally { ownership?.end(); mutating = false }
         ownership?.changedBelow()
-      }).catch(() => {
-        mutating = true
-        try { for (const entry of entries.values()) clear(entry) } finally { mutating = false }
-        ctx.logger.warn('dsh-ops: discovery publication unavailable; tools remain withdrawn.')
-      })
-      return chain
+      }))).then(() => undefined)
     }
     const attach = (agent: Agent): Promise<void> => {
-      if (stopped || entries.has(agent) || !agent.ctx) return entries.get(agent)?.ready ?? Promise.resolve()
+      if (stopped || retired.has(agent) || entries.has(agent) || !agent.ctx) return entries.get(agent)?.ready ?? Promise.resolve()
+      // Preserve observation of mutable host session inputs without awaiting
+      // another root's probe. Unchanged roots retain their cached verdicts.
+      const changed = new Set<Agent>()
+      for (const [other, prior] of entries) if (prior.presentation) {
+        let fresh = false
+        try { fresh = same(prior.presentation.inputs, inputs(other)) } catch { /* fail closed */ }
+        if (!fresh) { invalidate(prior); changed.add(other) }
+      }
+      if (changed.size) void reconcile(changed)
       const entry: Entry = { runtime: new NativeFileTools({ ctx, config: { ...config, workerPath: worker }, report: undefined }),
-        selected: new Set(), pending: new Set(), disposers: [], owned: new Set(), ready: Promise.resolve() }
+        selected: new Set(), pending: new Set(), disposers: [], owned: new Set(), ready: Promise.resolve(), revision: 0 }
       entries.set(agent, entry); ownership?.track(agent)
       entry.fiber = agent.ctx.plugin({ inject: ['tools'], apply(scoped) { entry.ctx = scoped } })
-      entry.ready = Promise.resolve(entry.fiber).then(async () => { await entry.runtime.start([]); await reconcile() })
+      entry.ready = Promise.resolve(entry.fiber).then(async () => { await entry.runtime.start([]); await reconcile([agent]) })
       return entry.ready
     }
-    ctx.on('agent/created', async ({ agent }) => { await attach(agent); return undefined })
+    ctx.on('agent/created', async ({ agent }) => { await attach(agent); await work.drain(agent); return undefined })
     ctx.on('agent/pre-step', async (payload, next) => {
       await attach(payload.agent)
       const entry = entries.get(payload.agent)
-      if (entry && ownership?.owns(payload.agent) && !payload.signal.aborted && await native(payload.agent).catch(() => false)) {
+      if (entry && ownership?.owns(payload.agent) && !payload.signal.aborted && await native(payload.agent, true, payload.signal).catch(() => false)
+        && !payload.signal.aborted && entries.get(payload.agent) === entry && ownership?.owns(payload.agent)) {
         for (const tool of entry.pending) if (permitted(payload.agent, tool)) entry.selected.add(tool)
         entry.pending.clear()
-        await reconcile()
+        await reconcile([payload.agent])
       }
       return next()
     })
     ctx.on('agent/disposed', async ({ agent }) => {
+      retired.add(agent); work.forget(agent)
       const entry = entries.get(agent)
       if (!entry) return
+      const affected = scopeFamilies(entries.keys(), [agent], scopeChainOf).flatMap(family => [...family]).filter(member => member !== agent)
       entries.delete(agent); ownership?.forget(agent); mutating = true
       try { clear(entry); entry.releaseSelection?.() } finally { mutating = false }
-      await entry.runtime.stop(); await entry.fiber?.dispose(); await reconcile()
+      await entry.runtime.stop(); await entry.fiber?.dispose(); await reconcile(affected)
+    })
+    const refresh = () => {
+      if (stopped) return
+      for (const entry of entries.values()) invalidate(entry)
+      void reconcile()
+    }
+    ;({ scopeChainOf } = await import('@deepseek-ai/dsh-scope'))
+    onToolChange(ctx, scopes => {
+      if (mutating || ownership?.publishing()) return
+      if (!scopes?.length) { refresh(); return }
+      const affected = new Set<Agent>()
+      for (const [agent, entry] of entries) if (scopes.some(scope => scopeChainOf(agent).includes(scope))) { invalidate(entry); affected.add(agent) }
+      void reconcile(affected)
+    })
+    ctx.on('system-prompt/change', refresh)
+    // Observe in-place hooks and the default asynchronous Fiber.restart().
+    // Await the runtime result even though the pinned next() type says void.
+    ctx.on('internal/update', async (_config, _noSave, next) => {
+      try { return await next() } finally { refresh() }
+    }, { global: true, prepend: true })
+    // This optional service is not an injection prerequisite: native agents
+    // work without it, while failed PTC probes must recover when it arrives.
+    ctx.inject(['ptcRuntime'], inner => {
+      refresh()
+      inner.effect(() => () => { refresh() })
     })
-    ctx.on('tools/change', () => { if (!ownership?.publishing()) void reconcile() })
     ctx.on('system-prompt/assemble', async (_assembly, context, next) => {
       // The pinned host assembles BEFORE agent/pre-step. Wait for publication
       // queued by the previous committed step, then obtain a fresh public assembly.
       if (!isPresentationProbe(context)) {
-        const entry = entries.get(context.scope as Agent), before = chain, pending = chain !== settled
-        await entry?.ready; await drain()
-        if (pending || before !== chain) return prompt.assemble(context)
+        const agent = context.scope as Agent, entry = entries.get(agent), before = work.version(agent)
+        await entry?.ready
+        if (await work.drain(agent) || before !== work.version(agent)) return prompt.assemble(context)
       }
       const entry = entries.get(context.scope as Agent)
       // Snapshot ownership before yielding: another assembly may withdraw it while
       // this request still contains an already-rendered Native SDK section.
       const heldNative = Boolean(entry?.owned.size)
       const result = await next()
-      if (!entry || !heldNative || !ptcOnly(result)) return result
+      if (!entry || context.signal?.aborted || entries.get(context.scope as Agent) !== entry || !heldNative || !ptcOnly(result)) return result
       mutating = true
       try { entry.runtime.cancel('Native presentation withdrawn'); clear(entry) }
       finally { mutating = false }
@@ -190,24 +250,28 @@ export function apply(root: Context, raw: unknown): void {
     })
     ctx.on('session/event', (session, event) => {
       if (event.type === 'step/end') {
-        let changed = false
+        const affected = new Set<Agent>()
         for (const [agent, entry] of entries) if (agent.session === session && ownership?.owns(agent) && entry.pending.size) {
           for (const tool of entry.pending) if (permitted(agent, tool)) entry.selected.add(tool)
-          entry.pending.clear(); changed = true
+          entry.pending.clear(); affected.add(agent)
         }
-        if (changed) void reconcile()
+        if (affected.size) void reconcile(affected)
         return
       }
       if (event.type !== 'sandbox/mode') return
+      const affected = new Set<Agent>()
       mutating = true
       try {
         for (const [agent, entry] of entries) if (agent.session === session) {
+          invalidate(entry)
+          affected.add(agent)
           entry.pending.clear(); entry.runtime.cancel('Sandbox authority changed'); clear(entry)
         }
       } finally { mutating = false }
-      void reconcile()
+      void reconcile(affected)
     })
     ownership = await ownScopes(ctx, 'discovery', () => {
+      for (const entry of entries.values()) invalidate(entry)
       mutating = true
       try {
         for (const [agent, entry] of entries) if (!ownership?.owns(agent)) {
@@ -225,10 +289,11 @@ export function apply(root: Context, raw: unknown): void {
       },
     }), 'dsh-ops: discovered capability guidance')
     ctx.effect(() => async () => {
-      stopped = true; ++epoch; mutating = true
+      stopped = true; mutating = true
+      const cancelled = work.stop()
       for (const entry of entries.values()) { clear(entry); entry.releaseSelection?.() }
       await Promise.allSettled([...entries.values()].map(async entry => { await entry.runtime.stop(); await entry.fiber?.dispose() }))
-      entries.clear(); ownership?.dispose(); await chain
+      entries.clear(); ownership?.dispose(); await cancelled
     }, 'dsh-ops: discovery lifecycle')
     for (const agent of entries.keys()) ownership.track(agent)
     ownership.refresh()
diff --git a/src/file/result-provider.ts b/src/file/result-provider.ts
index 208dcf20..0e7de99f 100644
--- a/src/file/result-provider.ts
+++ b/src/file/result-provider.ts
@@ -1,31 +1,47 @@
 /** Exact visible OPS registrations supply Native projections; no shared registry mutation. */
 import type { ToolDefinition } from '@deepseek-ai/dsh-tools'
 import type { Context } from '@deepseek-ai/cordis'
+import { withToolChange } from '../tool-changes.js'
 interface Host { root?: object; emit?(name: 'tools/change'): unknown; get(name: 'tools'): { get(name: string, scope?: unknown): ToolDefinition | undefined } | undefined }
 export interface NativeProvider { definition: ToolDefinition; scope: unknown; active: boolean; inheritable: boolean; priority: number }
 interface Provider extends NativeProvider { publish(visible: boolean): void }
-interface State { providers: Set<Provider>; shadows: Set<NativeProvider>; ptc: Set<unknown>; selections: Set<{ scope: unknown; names: ReadonlySet<string> }> }
+interface State { providers: Set<Provider>; shadows: Set<NativeProvider>; ptc: Set<unknown>; revisions: WeakMap<object, number>; globalRevision: number; selections: Set<{ scope: unknown; names: ReadonlySet<string> }> }
 const owners = new WeakMap<object, State>()
 function state(ctx: Host): State {
   const key = ctx.root ?? ctx
   let entry = owners.get(key)
-  if (!entry) { entry = { providers: new Set(), shadows: new Set(), ptc: new Set(), selections: new Set() }; owners.set(key, entry) }
+  if (!entry) { entry = { providers: new Set(), shadows: new Set(), ptc: new Set(), revisions: new WeakMap(), globalRevision: 0, selections: new Set() }; owners.set(key, entry) }
   return entry
 }
+function changed(owner: State, scope: unknown): void {
+  if (scope && typeof scope === 'object') owner.revisions.set(scope, (owner.revisions.get(scope) ?? 0) + 1)
+  else ++owner.globalRevision
+}
+/** Source-provider revisions include hidden registrations, unlike the projected tool view. */
+export function nativeProviderRevision(ctx: Host, chain: readonly unknown[]): string {
+  const owner = state(ctx)
+  return [owner.globalRevision, ...chain.map(scope => scope && typeof scope === 'object' ? owner.revisions.get(scope) ?? 0 : 0)].join(':')
+}
 function refresh(owner: State, scope: unknown): void {
-  const providers = [...owner.providers].filter(provider => provider.scope === scope)
-  const chosen = new Map<string, Provider>()
-  if (!owner.ptc.has(scope)) for (const provider of providers) {
-    if (!selectionAllows(owner, scope, provider)) continue
-    if ((chosen.get(provider.definition.name)?.priority ?? -Infinity) <= provider.priority) chosen.set(provider.definition.name, provider)
-  }
-  // Withdraw the previous owned registration before publishing its replacement in the same layer.
-  for (const provider of providers) if (chosen.get(provider.definition.name) !== provider) provider.publish(false)
-  for (const provider of chosen.values()) provider.publish(true)
+  withToolChange(scope && typeof scope === 'object' ? [scope] : [], () => {
+    const providers = [...owner.providers].filter(provider => provider.scope === scope)
+    const chosen = new Map<string, Provider>()
+    if (!owner.ptc.has(scope)) for (const provider of providers) {
+      if (!selectionAllows(owner, scope, provider)) continue
+      if ((chosen.get(provider.definition.name)?.priority ?? -Infinity) <= provider.priority) chosen.set(provider.definition.name, provider)
+    }
+    // Withdraw the previous owned registration before publishing its replacement in the same layer.
+    for (const provider of providers) if (chosen.get(provider.definition.name) !== provider) provider.publish(false)
+    for (const provider of chosen.values()) provider.publish(true)
+  })
 }
 export async function registerNativeProvider(ctx: Host, definitions: ToolDefinition[], register: (tool: ToolDefinition) => (() => void), options: { inheritable?: boolean; priority?: number } = {}): Promise<() => void> {
   const { scopeOf } = await import('@deepseek-ai/dsh-scope')
-  const owner = state(ctx), scope = scopeOf(ctx as Context)
+  return registerNativeProviderAtScope(ctx, scopeOf(ctx as Context), definitions, register, options)
+}
+/** Callers that already resolved the public scope API can commit synchronously. */
+export function registerNativeProviderAtScope(ctx: Host, scope: unknown, definitions: ToolDefinition[], register: (tool: ToolDefinition) => (() => void), options: { inheritable?: boolean; priority?: number } = {}): () => void {
+  const owner = state(ctx)
   const providers = definitions.map(definition => {
     let dispose: (() => void) | undefined
     const provider: Provider = { definition, scope, active: true, inheritable: options.inheritable ?? true, priority: options.priority ?? 0, publish(visible) {
@@ -35,18 +51,20 @@ export async function registerNativeProvider(ctx: Host, definitions: ToolDefinit
     owner.providers.add(provider)
     return provider
   })
+  changed(owner, scope)
   const stop = () => {
+    changed(owner, scope)
     const errors: unknown[] = []
     for (const provider of providers) {
       provider.active = false; owner.providers.delete(provider)
-      try { provider.publish(false) } catch (error) { errors.push(error) }
+      try { withToolChange(scope && typeof scope === 'object' ? [scope] : [], () => provider.publish(false)) } catch (error) { errors.push(error) }
     }
     try { refresh(owner, scope) } catch (error) { errors.push(error) }
-    ctx.emit?.('tools/change')
+    withToolChange(scope && typeof scope === 'object' ? [scope] : [], () => ctx.emit?.('tools/change'))
     if (errors.length) throw new AggregateError(errors, 'Native provider teardown failed')
   }
   try { refresh(owner, scope) } catch (error) { stop(); throw error }
-  ctx.emit?.('tools/change')
+  withToolChange(scope && typeof scope === 'object' ? [scope] : [], () => ctx.emit?.('tools/change'))
   return stop
 }
 function selectionAllows(owner: State, scope: unknown, provider: NativeProvider): boolean {
@@ -56,8 +74,8 @@ function selectionAllows(owner: State, scope: unknown, provider: NativeProvider)
 /** Discovery controls only owned advanced Native providers in its exact layer. */
 export function claimNativeSelection(ctx: Host, scope: unknown, names: ReadonlySet<string>): () => void {
   const owner = state(ctx), selection = { scope, names }
-  owner.selections.add(selection); refresh(owner, scope)
-  return () => { owner.selections.delete(selection); refresh(owner, scope) }
+  owner.selections.add(selection); changed(owner, scope); refresh(owner, scope)
+  return () => { owner.selections.delete(selection); changed(owner, scope); refresh(owner, scope) }
 }
 /** Yield only this plugin's registrations in the exact layer being claimed. */
 export function claimPtcSurface(ctx: Host, scope: unknown): () => void {
diff --git a/src/file/runtime.ts b/src/file/runtime.ts
index 18581534..86d75f64 100644
--- a/src/file/runtime.ts
+++ b/src/file/runtime.ts
@@ -43,7 +43,9 @@ export class NativeFileTools {
       return []
     }
     const definitions = names.map(rawName => this.definition(rawName))
-    this.unregisterProvider = await registerNativeProvider(this.ctx, definitions, tool => this.ctx.tools.register(tool))
+    // Discovery starts a worker without a resident surface. Do not emit a
+    // registry change for an empty provider on every newly attached agent.
+    if (definitions.length) this.unregisterProvider = await registerNativeProvider(this.ctx, definitions, tool => this.ctx.tools.register(tool))
     return names.map(publicToolName)
   }
 
diff --git a/src/index.ts b/src/index.ts
index f7ff8f8d..1964fbb6 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -11,6 +11,7 @@ import { resolveShells } from './shells.js'
 import { mountSessionBash } from './session-shells.js'
 import { NativeFileTools } from './file/runtime.js'
 import { resolveWorker } from './ptc/runtime.js'
+import { visibleNames } from './surface.js'
 import { mountWorkspacePreparation } from './workspace-preparation.js'
 import { safeDispose, safeDisposeAll } from './teardown.js'
 import { mountResultLifecycle } from './kernel/result-lifecycle.js'
@@ -31,8 +32,11 @@ function report(ctx: Context, message: string, level = 'error'): void {
 }
 function visibleTools(ctx: Context, agent?: Agent): string[] {
   try {
-    return (ctx.get('tools')?.schemas(agent) ?? []).map(schema => schema.name)
-      .filter(tool => typeof tool === 'string')
+    const tools = ctx.get('tools')
+    // Names only, through the view: `schemas()` projected every visible definition —
+    // 34.2 ms for 258 tools at the published runtime's surface shape — to keep a
+    // handful of owned names, and this section renders once per assembly.
+    return tools ? visibleNames(tools, agent) : []
   } catch { return [] }
 }
 
@@ -44,7 +48,7 @@ function installHostShellDenial(ctx: Context, config: ResolvedConfig): void {
   const hide = (agent: Agent) => {
     if (lifts.has(agent) || !agent?.ctx) return
     try {
-      const names = (ctx.tools.schemas(agent) ?? []).map(tool => tool.name).filter(name => denied.has(name))
+      const names = visibleNames(ctx.tools, agent).filter(name => denied.has(name))
       if (names.length) lifts.set(agent, agent.ctx.tools.restrict({ deny: names }))
     } catch (error) {
       if (!warned) {
diff --git a/src/modes/native/read-dedup.ts b/src/modes/native/read-dedup.ts
index db04a621..89860c5b 100644
--- a/src/modes/native/read-dedup.ts
+++ b/src/modes/native/read-dedup.ts
@@ -3,12 +3,12 @@ import type { Agent } from '@deepseek-ai/dsh-agent'
 import type { GenerateOptions, StreamChunk } from '@deepseek-ai/dsh-llm'
 import type { ToolDefinition, ToolExecution, ToolExecutionResult, ToolExecutionToken } from '@deepseek-ai/dsh-tools'
 import { publicToolName } from '../../policy.js'
-import { CAPABILITIES } from '../../capabilities/registry.js'
+import { CAPABILITIES, OBSERVED_READ_TOOLS } from '../../capabilities/registry.js'
 import { exactJson, observeRead, unchangedContent } from './read-observation.js'
 import { generation, readRecord, requestProof } from './read-evidence.js'
 import type { EvidenceState, ReadRecord } from './read-evidence.js'
 
-const READS = new Set([publicToolName('inspect_local_file'), publicToolName('read_files')])
+const READS = new Set(OBSERVED_READ_TOOLS.map(publicToolName))
 const harmless = new Set(CAPABILITIES.filter(entry => !entry.mutates).map(entry => publicToolName(entry.rawName)))
 const MAX_AGENTS = 16, MAX_RECORDS = 32, MAX_BODY_BYTES = 2 * 1024 * 1024
 
diff --git a/src/modes/native/render.ts b/src/modes/native/render.ts
index 5abdce39..b37e479b 100644
--- a/src/modes/native/render.ts
+++ b/src/modes/native/render.ts
@@ -1,4 +1,5 @@
 import { Buffer } from 'node:buffer'
+import { FILE_MUTATIONS } from '../../capabilities/registry.js'
 import { compactRanges } from './ranges.js'
 import { encodeSourceLine } from './line-encoding.js'
 import { renderDocument } from './documents.js'
@@ -103,7 +104,7 @@ function failure(value: Row): string[] {
   return output
 }
 
-const mutations = new Set(['replace', 'write_file', 'edit_file', 'copy', 'move', 'remove'])
+const mutations = new Set<string>(FILE_MUTATIONS)
 function receiptItems(value: Row): string[] {
   return rows(value.items).map(item => `${label(item.path ?? '(path unavailable)')}: ${facts(item, [
     'removed', 'changed', 'revision', 'revisionBefore', 'revisionAfter', 'bytes', 'bytesBefore', 'bytesAfter',
diff --git a/src/modes/ptc/continuation.ts b/src/modes/ptc/continuation.ts
index 12b00a45..7230080e 100644
--- a/src/modes/ptc/continuation.ts
+++ b/src/modes/ptc/continuation.ts
@@ -1,8 +1,8 @@
 /** Continuations describe read-only retrieval. They are data, never authority or automatic retries. */
 import type { CanonicalData, JsonValue } from './outcome.js'
+import { CONTINUATION_TOOLS as readers } from '../../capabilities/registry.js'
 const object = (value: unknown): CanonicalData | undefined => value !== null && typeof value === 'object' && !Array.isArray(value) ? value as CanonicalData : undefined
 const integer = (value: unknown): value is number => Number.isSafeInteger(value) && Number(value) >= 0
-const readers = ['inspect_local_file', 'read_files', 'glob', 'grep', 'diff', 'result', 'read_table', 'read_docx', 'read_pdf'] as const
 export type ContinuationTool = typeof readers[number]
 export interface RetrievalContinuation { version: 1, tool: ContinuationTool, args: CanonicalData }
 const PREFIX = 'ops-next-v1:'
diff --git a/src/official-tool-catalog.ts b/src/official-tool-catalog.ts
index e5e05e1e..697c108d 100644
--- a/src/official-tool-catalog.ts
+++ b/src/official-tool-catalog.ts
@@ -6,17 +6,16 @@
  */
 import { publicToolName } from './policy.js'
 import { componentEnabled } from './components/defaults.js'
+import { RAW_OFFICIAL_REPLACEMENTS } from './capabilities/replacements.js'
+import type { OfficialReplacement } from './capabilities/replacements.js'
+export type { OfficialReplacement } from './capabilities/replacements.js'
 
 // Only reviewed, implemented replacements belong here. A similarly named ops_*
 // registration is NOT evidence of equivalent capability. In particular replace
 // cannot stand in for write/edit, and background jobs cannot control host jobs.
-export const OFFICIAL_REPLACEMENTS = Object.freeze({
-  read: publicToolName('inspect_local_file'),
-  glob: publicToolName('glob'),
-  grep: publicToolName('grep'),
-})
-
-export type OfficialReplacement = keyof typeof OFFICIAL_REPLACEMENTS
+export const OFFICIAL_REPLACEMENTS = Object.freeze(Object.fromEntries(
+  Object.entries(RAW_OFFICIAL_REPLACEMENTS).map(([name, raw]) => [name, publicToolName(raw)]),
+) as Record<OfficialReplacement, string>)
 
 export function platformSurface(platform: string = process.platform) {
   if (!['win32', 'linux', 'darwin'].includes(platform)) throw new Error(`Unsupported official-tool hiding platform: ${platform}`)
diff --git a/src/policy.ts b/src/policy.ts
index 0c97048b..018aae14 100644
--- a/src/policy.ts
+++ b/src/policy.ts
@@ -1,4 +1,4 @@
-import { FILE_TOOLS, NATIVE_FILE_TOOLS, IN_PROCESS_TOOLS } from './capabilities/registry.js'
+import { FILE_TOOLS, NATIVE_FILE_TOOLS, IN_PROCESS_TOOLS, DISCOVERY_TOOL_NAME } from './capabilities/registry.js'
 export { FILE_TOOLS, FILE_MUTATIONS, IN_PROCESS_TOOLS } from './capabilities/registry.js'
 
 /** Model-facing routing, kept in one section. No shared registry mutation. */
@@ -35,7 +35,7 @@ export function renderToolingPolicy({ published, mounted, levels, shellComponent
     ? [...NATIVE_FILE_TOOLS, ...(levels?.bash ? IN_PROCESS_TOOLS : [])].map(publicToolName) : []))
   if (levels?.pwsh) names.add('pwsh')
   if (!shellComponent) names.delete('pwsh')
-  const hasDiscovery = names.has(publicToolName('discover_tools'))
+  const hasDiscovery = names.has(publicToolName(DISCOVERY_TOOL_NAME))
   const hasFiles = NATIVE_FILE_TOOLS.some(name => names.has(publicToolName(name)))
   const hasBash = names.has(BASH_TOOL)
   const hasPwsh = shellComponent && names.has('pwsh')
@@ -46,7 +46,7 @@ export function renderToolingPolicy({ published, mounted, levels, shellComponent
   const row = (raw: string, task: string) => {
     if (names.has(publicToolName(raw))) lines.push(`| ${task} | ${publicToolName(raw)} |`)
   }
-  row('discover_tools', 'Find advanced capabilities for the next model step')
+  row(DISCOVERY_TOOL_NAME, 'Find advanced capabilities for the next model step')
   row('read_files', 'Read UTF-8 ranges from multiple files')
   row('read_table', 'Read bounded CSV / TSV lexical rows')
   row('read_docx', 'Read DOCX main-body paragraphs')
diff --git a/src/presentation.ts b/src/presentation.ts
index 4a3d60da..be704d6c 100644
--- a/src/presentation.ts
+++ b/src/presentation.ts
@@ -12,7 +12,7 @@ export async function inspectPresentation(prompt: Pick<SystemPrompt, 'assemble'>
   } finally { probes.delete(context) }
 }
 
-export async function isNativePresentation(prompt: Pick<SystemPrompt, 'assemble'>, scope: NonNullable<AssembleContext['scope']>): Promise<boolean> {
-  const assembly = await inspectPresentation(prompt, scope)
+export async function isNativePresentation(prompt: Pick<SystemPrompt, 'assemble'>, scope: NonNullable<AssembleContext['scope']>, signal?: AbortSignal): Promise<boolean> {
+  const assembly = await inspectPresentation(prompt, scope, signal)
   return !assembly.sections.some(section => section.name === 'tools:ptc-only' && Boolean(section.text.trim()))
 }
diff --git a/src/profile-install.ts b/src/profile-install.ts
index 003bbb75..1fef155f 100644
--- a/src/profile-install.ts
+++ b/src/profile-install.ts
@@ -15,7 +15,7 @@ import { PLATFORMS } from './ptc/runtime.js'
  * the native payloads are a separate question with their own gate in
  * `lib/ptc/runtime.js`.
  */
-const SUPPORTED_TARGETS: Readonly<Partial<Record<NodeJS.Platform, readonly string[]>>> = Object.freeze({ win32: ['x64'], linux: ['x64'], darwin: ['arm64'] })
+const SUPPORTED_TARGETS: Readonly<Partial<Record<NodeJS.Platform, readonly string[]>>> = Object.freeze({ win32: ['x64'], linux: ['x64'], darwin: ['arm64', 'x64'] })
 
 /**
  * Where each platform's desktop application keeps its own CLI.
diff --git a/src/ptc/config.ts b/src/ptc/config.ts
index 6adbc989..1d255633 100644
--- a/src/ptc/config.ts
+++ b/src/ptc/config.ts
@@ -1,8 +1,8 @@
-import { FILE_TOOLS, PTC_TOOLS } from '../capabilities/registry.js'
+import { FILE_TOOLS, PTC_TOOLS, PTC_RESIDENT_TOOLS } from '../capabilities/registry.js'
+export { PTC_RESIDENT_TOOLS } from '../capabilities/registry.js'
 import type { FileToolName, PtcToolName } from '../capabilities/registry.js'
 import { migrateRawNames } from '../compat/alias.js'
 export type ApiName = FileToolName | PtcToolName
-export const PTC_RESIDENT_TOOLS: readonly ApiName[] = ['inspect_local_file', 'result']
 export const PTC_LOADABLE_TOOLS: readonly ApiName[] = [...FILE_TOOLS, ...PTC_TOOLS].filter(tool => !PTC_RESIDENT_TOOLS.includes(tool))
 export interface PtcConfig { binaryPath?: string; required: boolean; allowedTools: ApiName[]; alwaysLoaded: ApiName[] }
 export function parsePtcConfig(raw: unknown = {}): PtcConfig {
diff --git a/src/ptc/index.ts b/src/ptc/index.ts
index 66df24c0..9441d9ae 100644
--- a/src/ptc/index.ts
+++ b/src/ptc/index.ts
@@ -12,24 +12,42 @@ import { publicToolName } from '../policy.js'
 import { resolveWorker, failure } from './worker.js'
 import { mountWorkspacePreparation } from '../workspace-preparation.js'
 import { mountResultLifecycle } from '../kernel/result-lifecycle.js'
-import { nativeProviders, claimPtcSurface, trackNativeShadow } from '../file/result-provider.js'
+import { nativeProviders, nativeProviderRevision, claimPtcSurface, trackNativeShadow } from '../file/result-provider.js'
 import { resolvePtcConfig } from '../config.js'
 import { PTC_RESIDENT_TOOLS } from './config.js'
 import type { ApiName } from './config.js'
 import { sdkDefinition, requestedApis } from './sdk.js'
 import { ownPtcScopes } from './ownership.js'
+import { surfaceOf as toolSurface } from '../surface.js'
+import { onToolChange, withToolChange } from '../tool-changes.js'
 import { monitoredInvoke } from './invoke.js'
+import { scopedReconciliation, scopeFamilies } from '../scoped-reconciliation.js'
 export { resolvePtcConfig } from '../config.js'
 export const name = 'dsh-ops-ptc'
 const apiTools = [...FILE_TOOLS, ...PTC_TOOLS]
 const publishedNames = [...apiTools, 'load_sdk'].map(publicToolName)
 const ptcDefinitions = new WeakSet<ToolDefinition>()
 interface Entry {
-  ctx?: Context; fiber?: Fiber; ready: Promise<void>; disposers: (() => void)[]
+  agent: Agent; ctx?: Context; fiber?: Fiber; ready: Promise<void>; disposers: (() => void)[]
   selected: Set<ApiName>; pending: Set<ApiName>; owned: Map<string, ToolDefinition>; ptc: boolean
+  /**
+   * Committed view identity plus Native source-provider revisions. A prompt-only
+   * change is checked afresh at pre-step/execution and by the assembly withdrawal
+   * guard; background memoization alone never authorizes execution.
+   */
+  surface?: string
+  published?: number
+  revision: number
 }
-const isPtc = (assembly: PromptAssembly): boolean => assembly.tools.length === 1 && assembly.tools[0]?.name === 'run_code'
-  && assembly.sections.some(section => section.name === 'tools:ptc-only' && section.text.trim() !== '')
+type Presentation = Pick<PromptAssembly, 'sections'> & Partial<Pick<PromptAssembly, 'tools'>>
+const hasPtcInstruction = (presentation: Presentation): boolean =>
+  presentation.sections.some(section => section.name === 'tools:ptc-only' && section.text.trim() !== '')
+const isPtc = (assembly: Presentation): boolean => Array.isArray(assembly.tools)
+  && assembly.tools.length === 1 && assembly.tools[0]?.name === 'run_code' && hasPtcInstruction(assembly)
+// rc.3's waterfall owns text only; the host attaches authoritative tools after
+// it returns. Full assemble probes still require the exact run_code surface.
+const isPtcPresentation = (presentation: Presentation): boolean =>
+  Object.hasOwn(presentation, 'tools') ? isPtc(presentation) : hasPtcInstruction(presentation)
 
 export function apply(root: Context, rawConfig: unknown): void {
   const config = resolvePtcConfig(rawConfig)
@@ -44,24 +62,18 @@ export function apply(root: Context, rawConfig: unknown): void {
     if (!tools || !prompt) return
     mountResultLifecycle(ctx)
     const entries = new Map<Agent, Entry>()
+    const retired = new WeakSet<Agent>()
     const active = new Map<AbortController, { owner: Agent; promise: Promise<unknown> }>()
-    let stopped = false, mutating = false, epoch = 0, chain = Promise.resolve(), lastSnapshot = ''
-    let settled = chain
-    const drain = async () => {
-      let current: Promise<void>
-      do { current = chain; await current } while (current !== chain)
-      settled = current
-    }
-    const ids = new WeakMap<object, number>(); let sequence = 0
-    const snapshot = (): string => JSON.stringify([...entries.keys()].map(agent => tools.schemas(agent).map(schema => {
-      const def = tools.get(schema.name, agent)
-      if (def && !ids.has(def)) ids.set(def, ++sequence)
-      return [schema.name, def && ids.get(def)]
-    })))
+    let stopped = false, mutating = false, epoch = 0, foreignDuringPublish = false
+    let verifyingForeign = false
+    const reconciliation = scopedReconciliation<Agent>(error => ctx.logger.warn('dsh-ops: PTC publication failed: ' + String(error)))
+    let scopeChainOf: (scope: object) => object[] = scope => [scope]
+    const surfaceOf = (agent: Agent): string => toolSurface(tools, agent) + '\u0002' + nativeProviderRevision(ctx, scopeChainOf(agent))
     const clear = (entry: Entry) => {
+      entry.published = undefined
       entry.owned.clear()
       for (const dispose of entry.disposers.splice(0)) {
-        try { dispose() } catch (error) { ctx.logger.warn('dsh-ops: PTC teardown failed; continuing:', error) }
+        try { withToolChange([entry.agent], dispose) } catch (error) { ctx.logger.warn('dsh-ops: PTC teardown failed; continuing:', error) }
       }
     }
     const ptcOnly = async (agent: Agent, signal?: AbortSignal): Promise<boolean> => Boolean(ctx.get('ptcRuntime')) && isPtc(await inspectPresentation(prompt, agent, signal))
@@ -70,10 +82,10 @@ export function apply(root: Context, rawConfig: unknown): void {
     }
     let ownership: Awaited<ReturnType<typeof ownPtcScopes>> | undefined
     const execute = (agent: Agent, entry: Entry, tool: ApiName | 'load_sdk'): ToolDefinition['execute'] => async (args, exec) => {
-      await chain
-      const version = epoch
-      const available = () => !stopped && entries.get(agent) === entry && ownership?.owns(agent) && exec.agent === agent && entry.ptc && entry.owned.has(publicToolName(tool))
-      if (!available() || !await ptcOnly(agent, exec.signal).catch(() => false) || !available() || version !== epoch) {
+      await reconciliation.drain(agent)
+      const version = entry.published, revision = entry.revision
+      const available = () => !stopped && !exec.signal?.aborted && entries.get(agent) === entry && ownership?.owns(agent) && exec.agent === agent && entry.ptc && entry.owned.has(publicToolName(tool))
+      if (!available() || !await ptcOnly(agent, exec.signal).catch(() => false) || !available() || version !== entry.published || revision !== entry.revision) {
         return failure('POLICY_DENIED', 'The calling scope must own this API in authoritative PTC-only presentation.')
       }
       if (tool === 'load_sdk') {
@@ -90,22 +102,63 @@ export function apply(root: Context, rawConfig: unknown): void {
       try { return await work }
       finally { clearTimeout(timer); active.delete(controller); exec.signal?.removeEventListener('abort', abort) }
     }
-    const reconcile = (force = false): Promise<void> => {
-      if (stopped || mutating) return chain
-      const version = ++epoch
-      chain = chain.then(async () => {
-        if (stopped || version !== epoch) return
+    // Lift a connected inheritance family together. This keeps the pre-publication
+    // Native snapshot exact without disturbing independent root sessions. Ancestors
+    // may hold Native claims, so lifting only the leaf would miss their providers.
+    const related = (targets: ReadonlySet<Agent>): Set<Agent> => {
+      const roots = new Set<Agent>()
+      for (const agent of targets) {
+        const ancestors = scopeChainOf(agent).filter(scope => entries.has(scope as Agent)) as Agent[]
+        roots.add(ancestors.at(-1) ?? agent)
+      }
+      return new Set([...entries.keys()].filter(agent => [...roots].some(root => agent === root || scopeChainOf(agent).includes(root))))
+    }
+    /** Probe changed scopes, then rebuild only their inheritance dependency family. */
+    const queued = new Map<Agent, boolean>()
+    const reconcile = (force = false, targets?: ReadonlySet<Agent>): Promise<void> => {
+      if (stopped || mutating) return Promise.resolve()
+      for (const agent of targets ?? entries.keys()) {
+        const entry = entries.get(agent)
+        if (entry) ++entry.revision
+        queued.set(agent, force || queued.get(agent) === true)
+      }
+      const families = scopeFamilies(entries.keys(), targets ?? entries.keys(), scopeChainOf)
+      return Promise.all(families.map(family => reconciliation.run(family, async task => {
+        const changed = new Set<Agent>(), version = ++epoch
+        const requests = new Map([...queued].filter(([agent]) => family.has(agent)))
+        const probedBefore = new Set<Agent>()
         const ready = new Set<Agent>()
-        for (const [agent, entry] of entries) if (entry.ctx && ownership?.owns(agent) && await ptcOnly(agent).catch(() => false)) ready.add(agent)
-        if (stopped || version !== epoch) return
-        if (!force && snapshot() === lastSnapshot && [...entries].every(([agent, entry]) => entry.ptc === ready.has(agent))) return
+        // Superseded passes keep their requests queued. Commit surfaces only after
+        // publishing the affected family, and retain every unprobed verdict.
+        let dirty = false
+        for (const [agent, entry] of entries) {
+          if (stopped || !task.current()) return
+          if (!family.has(agent)) continue
+          if (!entry.ctx || !ownership?.owns(agent)) continue
+          if (!requests.has(agent)) { if (entry.ptc) ready.add(agent); continue }
+          const surface = surfaceOf(agent)
+          const fresh = requests.get(agent) === true
+          if (!fresh && entry.surface === surface) { if (entry.ptc) ready.add(agent); continue }
+          if (entry.surface !== surface || fresh) { dirty = true; changed.add(agent) }
+          probedBefore.add(agent)
+          const next = await task.wait(ptcOnly(agent, task.signal)).catch(() => false)
+          if (next !== entry.ptc) { dirty = true; changed.add(agent) }
+          if (next) ready.add(agent)
+        }
+        if (stopped || !task.current()) return
+        for (const agent of family) queued.delete(agent)
+        if (!dirty) return
+        const affected = related(changed)
+        const publications = [...entries].filter(([agent]) => affected.has(agent))
         mutating = true; ownership?.begin()
         try {
-          for (const entry of entries.values()) clear(entry)
-          // Snapshot exact Native visibility only after all our masks/overrides have lifted.
-          const native = new Map([...entries].map(([agent, entry]) => [agent, nativeProviders(entry.ctx ?? ctx, agent, true)]))
-          for (const [agent, entry] of entries) {
+          withToolChange(publications.map(([agent]) => agent), () => {
+          for (const [, entry] of publications) { clear(entry); entry.published = version }
+          // Every ancestor that could suppress a Native origin is lifted with its family.
+          const native = new Map(publications.map(([agent, entry]) => [agent, nativeProviders(entry.ctx ?? ctx, agent, true)]))
+          for (const [agent, entry] of publications) {
             if (!entry.ctx || !ownership?.owns(agent)) continue
+            if (entry.ptc) { if (!probedBefore.has(agent)) ready.add(agent) }
             entry.ptc = ready.has(agent)
             if (!entry.ptc) { entry.pending.clear(); abortOwner(agent, 'PTC presentation withdrawn'); continue }
             const releaseNative = claimPtcSurface(entry.ctx, agent)
@@ -113,23 +166,26 @@ export function apply(root: Context, rawConfig: unknown): void {
               const wanted = new Set([...PTC_RESIDENT_TOOLS, ...config.alwaysLoaded, ...entry.selected])
               const definitions = [...wanted].map(tool => definition(tool, execute(agent, entry, tool)))
               definitions.push(sdkDefinition(config.allowedTools, execute(agent, entry, 'load_sdk')))
-              for (const def of definitions) { ptcDefinitions.add(def); entry.disposers.push(entry.ctx.tools.register(def)); entry.owned.set(def.name, def) }
+              for (const def of definitions) { ptcDefinitions.add(def); entry.disposers.push(withToolChange([agent], () => entry.ctx!.tools.register(def))); entry.owned.set(def.name, def) }
               entry.disposers.push(releaseNative)
             } catch (error) { releaseNative(); throw error }
           }
-          for (const [agent, entry] of entries) {
+          for (const [agent, entry] of publications) {
             if (!entry.ctx || !ownership?.owns(agent)) continue
             if (!entry.ptc) for (const provider of native.get(agent) ?? []) {
               if (!provider.inheritable && provider.scope !== agent) continue
               const def = provider.definition
               if (provider.scope === agent || tools.get(def.name, agent) === def) continue
+              const publication = entry.published
               const shadow: ToolDefinition = { ...def, execute: async (args, exec) => {
-                const version = epoch
-                if (stopped || !provider.active || entries.get(agent) !== entry || exec.agent !== agent || await ptcOnly(agent, exec.signal).catch(() => true)
-                  || stopped || !provider.active || version !== epoch) return failure('POLICY_DENIED', 'Native projection or owning scope is unavailable.')
+                const version = entry.published
+                if (publication !== entry.published || stopped || !provider.active || entries.get(agent) !== entry || exec.agent !== agent
+                  || tools.get(def.name, agent) !== shadow
+                  || await ptcOnly(agent, exec.signal).catch(() => true)
+                  || stopped || !provider.active || version !== entry.published) return failure('POLICY_DENIED', 'Native projection or owning scope is unavailable.')
                 return def.execute(args, exec)
               } }
-              entry.disposers.push(entry.ctx.tools.register(shadow), trackNativeShadow(entry.ctx, agent, shadow, provider)); entry.owned.set(def.name, shadow)
+              entry.disposers.push(withToolChange([agent], () => entry.ctx!.tools.register(shadow)), trackNativeShadow(entry.ctx, agent, shadow, provider)); entry.owned.set(def.name, shadow)
             }
             const nativeNames = new Set((native.get(agent) ?? []).map(provider => provider.definition.name))
             const ownedNative = new Set(nativeProviders(ctx, agent).map(provider => provider.definition))
@@ -138,74 +194,112 @@ export function apply(root: Context, rawConfig: unknown): void {
               return visible && !entry.owned.has(name) && (entry.ptc || !nativeNames.has(name))
                 && (ptcDefinitions.has(visible) || entry.ptc && ownedNative.has(visible))
             })
-            if (deny.length) entry.disposers.push(entry.ctx.tools.restrict({ deny }))
+            if (deny.length) entry.disposers.push(withToolChange([agent], () => entry.ctx!.tools.restrict({ deny })))
           }
-          lastSnapshot = snapshot()
+          // Store the committed view, not the temporary pre-publish overlay. Otherwise
+          // the next unrelated registry event mistakes our own definitions for a change.
+          for (const [agent, entry] of publications) entry.surface = surfaceOf(agent)
+          })
         } catch (error) {
-          for (const entry of entries.values()) clear(entry)
+          for (const [, entry] of publications) { clear(entry); entry.surface = undefined }
           throw error
         } finally { ownership?.end(); mutating = false }
+        if (foreignDuringPublish) {
+          foreignDuringPublish = false
+          if (!verifyingForeign) {
+            verifyingForeign = true
+            void reconcile(true).finally(() => { verifyingForeign = false })
+          }
+        }
         ownership?.changedBelow()
-      }).catch(error => ctx.logger.warn('dsh-ops: PTC publication failed: ' + String(error)))
-      return chain
+      }))).then(() => undefined)
     }
     const attach = (agent: Agent): Promise<void> => {
-      if (stopped || entries.has(agent) || !agent.ctx) return entries.get(agent)?.ready ?? Promise.resolve()
-      const entry: Entry = { disposers: [], selected: new Set(), pending: new Set(), owned: new Map(), ptc: false, ready: Promise.resolve() }
+      if (stopped || retired.has(agent) || entries.has(agent) || !agent.ctx) return entries.get(agent)?.ready ?? Promise.resolve()
+      const entry: Entry = { agent, revision: 0, disposers: [], selected: new Set(), pending: new Set(), owned: new Map(), ptc: false, ready: Promise.resolve() }
       entries.set(agent, entry); ownership?.track(agent)
       entry.fiber = agent.ctx.plugin({ inject: ['tools'], apply(scoped) { entry.ctx = scoped } })
-      entry.ready = Promise.resolve(entry.fiber).then(() => reconcile(true))
+      entry.ready = Promise.resolve(entry.fiber).then(() => reconcile(true, new Set([agent])))
       return entry.ready
     }
     ctx.on('agent/created', async ({ agent }) => { await attach(agent); return undefined })
     ctx.on('agent/pre-step', async ({ agent, signal }, next) => {
       await attach(agent)
       const entry = entries.get(agent)
-      if (entry && !signal.aborted && await ptcOnly(agent, signal).catch(() => false)) {
-        for (const tool of entry.pending) entry.selected.add(tool)
-        const changed = entry.pending.size > 0; entry.pending.clear()
-        await reconcile(changed)
+      if (entry && !signal.aborted) {
+        const wasPtc = entry.ptc
+        const presentationPtc = await ptcOnly(agent, signal).catch(() => false)
+        if (signal.aborted || entries.get(agent) !== entry || !ownership?.owns(agent)) return next()
+        if (presentationPtc) {
+          for (const tool of entry.pending) entry.selected.add(tool)
+        }
+        const changed = entry.pending.size > 0
+        entry.pending.clear()
+        if (changed) entry.surface = undefined
+        // A presentation transition can keep the visible tool surface unchanged
+        // (for example both -> ptc with no resident tools). It still owes a publish.
+        await reconcile(changed || presentationPtc !== wasPtc, new Set([agent]))
       }
       return next()
     })
     ctx.on('agent/disposed', async ({ agent }) => {
+      retired.add(agent); reconciliation.forget(agent); queued.delete(agent)
       const entry = entries.get(agent); if (!entry) return
+      const affected = related(new Set([agent])); affected.delete(agent)
       entries.delete(agent); ownership?.forget(agent); abortOwner(agent, 'Owning agent disposed'); mutating = true
-      try { clear(entry) } finally { mutating = false }
-      await entry.fiber?.dispose(); await reconcile(true)
+      try { withToolChange([agent], () => clear(entry)) } finally { mutating = false }
+      // Only a departed scope's inheritance family can depend on its projection.
+      await entry.fiber?.dispose(); await reconcile(true, affected)
+    })
+    // A registry change only owes a republish when some agent's probed surface moved,
+    // so the change listener probes and lets the dirty check decide.
+    onToolChange(ctx, scopes => {
+      if (mutating || ownership?.publishing()) {
+        if (!scopes?.length) foreignDuringPublish = true
+        return
+      }
+      const targets = scopes?.length ? new Set([...entries.keys()].filter(agent => scopes.some(scope => scopeChainOf(agent).includes(scope)))) : undefined
+      // A host presentation change carries no affected scope. Probe every entry
+      // because its visible names may stay identical while ptcOnly changes.
+      // OPS-owned changes can still be narrowed to their scope descendants.
+      for (const [agent, entry] of entries) if ((!targets || targets.has(agent)) && !entry.ptc) queued.set(agent, true)
+      void reconcile(false, targets)
     })
-    ctx.on('tools/change', () => { if (!ownership?.publishing()) void reconcile(true) })
     ctx.on('system-prompt/assemble', async (_assembly, context, next) => {
       // The pinned host assembles BEFORE agent/pre-step. Wait for publication
       // queued by the previous committed step, then obtain a fresh public assembly.
       if (!isPresentationProbe(context)) {
-        const entry = entries.get(context.scope as Agent), before = chain, pending = chain !== settled
-        await entry?.ready; await drain()
-        if (pending || before !== chain) return prompt.assemble(context)
+        const agent = context.scope as Agent, entry = entries.get(agent), before = reconciliation.version(agent)
+        await entry?.ready
+        if (await reconciliation.drain(agent) || before !== reconciliation.version(agent)) return prompt.assemble(context)
       }
       const entry = entries.get(context.scope as Agent), heldPtc = Boolean(entry?.ptc && entry.owned.size)
       const result = await next()
-      if (!entry || !heldPtc || isPtc(result)) return result
+      if (!entry || context.signal?.aborted || entries.get(context.scope as Agent) !== entry || !heldPtc || isPtcPresentation(result)) return result
       mutating = true
-      try { entry.ptc = false; entry.pending.clear(); abortOwner(context.scope as Agent, 'PTC presentation withdrawn'); clear(entry) }
+      try { entry.ptc = false; entry.surface = undefined; entry.pending.clear(); abortOwner(context.scope as Agent, 'PTC presentation withdrawn'); clear(entry) }
       finally { mutating = false }
-      void reconcile(true)
+      void reconcile(true, new Set([context.scope as Agent]))
       return prompt.assemble(context)
     })
     ctx.on('session/event', (session, event) => {
       if (event.type === 'step/end') {
         let changed = false
+        const affected = new Set<Agent>()
         for (const [agent, entry] of entries) if (agent.session === session && ownership?.owns(agent) && entry.pending.size) {
           for (const tool of entry.pending) if (entry.ptc) entry.selected.add(tool)
-          entry.pending.clear(); changed = true
+          entry.pending.clear(); entry.surface = undefined; affected.add(agent); changed = true
         }
-        if (changed) void reconcile(true)
+        if (changed) void reconcile(true, affected)
         return
       }
       if (event.type !== 'sandbox/mode') return
-      for (const [agent, entry] of entries) if (agent.session === session) { entry.pending.clear(); abortOwner(agent, 'Sandbox authority changed') }
-      void reconcile(true)
+      const affected = new Set<Agent>()
+      for (const [agent, entry] of entries) if (agent.session === session) { entry.pending.clear(); entry.surface = undefined; abortOwner(agent, 'Sandbox authority changed'); affected.add(agent) }
+      // An unknown session keeps the unqualified (whole-fleet) pass.
+      void reconcile(true, affected.size ? affected : undefined)
     })
+    ;({ scopeChainOf } = await import('@deepseek-ai/dsh-scope'))
     ownership = await ownPtcScopes(ctx, () => {
       mutating = true
       try {
@@ -221,12 +315,13 @@ export function apply(root: Context, rawConfig: unknown): void {
         ? 'OPS APIs return typed Outcome values. Inspect status before data; preserve partial coverage and continuation. Use ' + publicToolName('load_sdk') + ' to request advanced APIs by raw name; they become callable on the next model step. Process results locally in run_code and return only needed summaries. References do not grant authority.' : ''
     } }), 'dsh-ops: progressive PTC guidance')
     ctx.effect(() => async () => {
-      stopped = true; ++epoch; mutating = true
+      stopped = true; mutating = true
+      const cancelled = reconciliation.stop()
       for (const controller of active.keys()) controller.abort(new Error('PTC component unloaded'))
       for (const entry of entries.values()) clear(entry)
       await Promise.allSettled([...active.values()].map(work => work.promise))
       await Promise.allSettled([...entries.values()].map(entry => entry.fiber?.dispose()))
-      entries.clear(); ownership?.dispose(); await chain
+      entries.clear(); ownership?.dispose(); await cancelled
     }, 'dsh-ops: PTC lifecycle')
     for (const agent of entries.keys()) ownership.track(agent)
     ownership.refresh()
diff --git a/src/ptc/runtime.ts b/src/ptc/runtime.ts
index 1b72395c..102069ff 100644
--- a/src/ptc/runtime.ts
+++ b/src/ptc/runtime.ts
@@ -7,7 +7,7 @@ export interface WorkerSelection { binaryPath?: string }
 export interface RuntimeOptions { packageRoot?: string; env?: NodeJS.ProcessEnv; platform?: string; arch?: string }
 export type WorkerResolution = { ok: true; file: string } | { ok: false; reason: string }
 export const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..')
-export const PLATFORMS = Object.freeze(['win32-x64', 'linux-x64', 'darwin-arm64'])
+export const PLATFORMS = Object.freeze(['win32-x64', 'linux-x64', 'darwin-arm64', 'darwin-x64'])
 export function workerName(platform: string = process.platform) { return platform === 'win32' ? 'dsh-ops-worker.exe' : 'dsh-ops-worker' }
 /**
  * Read a JSON file, or name it.
@@ -60,7 +60,7 @@ export function tryResolveWorker(config: WorkerSelection = {}, options: RuntimeO
 }
 
 export function resolveWorker(config: WorkerSelection = {}, { packageRoot = PACKAGE_ROOT, env = process.env, platform = process.platform, arch = process.arch }: RuntimeOptions = {}): string {
-  if (!PLATFORMS.includes(`${platform}-${arch}`)) throw new Error(`dsh-ops supports Windows x64, Linux x64 and macOS Apple Silicon (darwin-arm64) only; unsupported runtime target ${platform}-${arch}.`)
+  if (!PLATFORMS.includes(`${platform}-${arch}`)) throw new Error(`dsh-ops supports Windows x64, Linux x64 and macOS (arm64/x64) only; unsupported runtime target ${platform}-${arch}.`)
   const explicit = config.binaryPath ?? env.DSH_OPS_WORKER_BIN
   const fromPackage = path.resolve(packageRoot, 'runtime', `${platform}-${arch}`, workerName(platform))
   const fromSourceTree = path.resolve(packageRoot, 'native', 'target', 'release', workerName(platform))
diff --git a/src/review/cli.ts b/src/review/cli.ts
new file mode 100644
index 00000000..b9c0497e
--- /dev/null
+++ b/src/review/cli.ts
@@ -0,0 +1,17 @@
+import { parseArgs } from 'node:util'
+import { renderSnapshot, reviewSnapshot } from './snapshot.js'
+
+export async function commandReview(args: string[]): Promise<number> {
+  try {
+    const { values, positionals } = parseArgs({ args, allowPositionals: true, options: {
+      repo: { type: 'string' }, prs: { type: 'string' }, base: { type: 'string' }, workflow: { type: 'string' }, checkout: { type: 'string' },
+    } })
+    if (positionals.length !== 1 || positionals[0] !== 'snapshot') throw new Error('Expected review snapshot --repo owner/name --prs 1,2 [--base main] [--checkout path]')
+    const result = await reviewSnapshot({ repo: values.repo ?? '', prs: (values.prs ?? '').split(',').map(Number), base: values.base, workflow: values.workflow, checkout: values.checkout })
+    console.log(renderSnapshot(result))
+    return result.status === 'completed' && Buffer.byteLength(JSON.stringify(result)) <= 64 * 1024 ? 0 : 1
+  } catch (error) {
+    console.log(JSON.stringify({ status: 'failed', error: { code: 'REVIEW_SNAPSHOT_UNAVAILABLE', message: String(error instanceof Error ? error.message : error).slice(0, 500) } }))
+    return 1
+  }
+}
diff --git a/src/review/merge.ts b/src/review/merge.ts
new file mode 100644
index 00000000..086d8427
--- /dev/null
+++ b/src/review/merge.ts
@@ -0,0 +1,42 @@
+import fs from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+import { isolatedGitEnv, runCommand, type Runner } from './process.js'
+
+export interface MergeProbe { status: 'clean' | 'conflicts' | 'unknown'; tree?: string; files?: string[]; reason?: string }
+const oid = (value: string) => /^[a-f0-9]{40}([a-f0-9]{24})?$/.test(value)
+
+/** Read only the source object store. All generated objects/config live in a disposable bare repo. */
+export async function probeMerge(checkout: string | undefined, base: string, head: string,
+  signal?: AbortSignal, run: Runner = runCommand): Promise<MergeProbe> {
+  if (!checkout) return { status: 'unknown', reason: 'No --checkout supplied; no local merge probe.' }
+  if (!oid(base) || !oid(head)) return { status: 'unknown', reason: 'Exact commit object IDs are unavailable.' }
+  const temporary = await fs.mkdtemp(path.join(os.tmpdir(), 'dsh-ops-review-'))
+  try {
+    const empty = path.join(temporary, 'empty'), bare = path.join(temporary, 'probe.git')
+    await fs.writeFile(empty, '')
+    const env = isolatedGitEnv(empty)
+    const source = await run('git', ['-C', path.resolve(checkout), 'rev-parse', '--path-format=absolute', '--git-common-dir'], { env, signal })
+    const common = source.stdout.trim()
+    if (source.code !== 0 || !path.isAbsolute(common) || /[\r\n]/.test(common)) return { status: 'unknown', reason: 'Cannot locate the checkout object store.' }
+    const template = path.join(temporary, 'template')
+    await fs.mkdir(template)
+    const initialized = await run('git', ['init', '--bare', `--template=${template}`, bare], { env, signal })
+    if (initialized.code !== 0) return { status: 'unknown', reason: initialized.stderr || 'Cannot initialize isolated merge probe.' }
+    await fs.writeFile(path.join(bare, 'objects/info/alternates'), `${path.join(common, 'objects').replaceAll('\\', '/')}\n`)
+    const args = ['--git-dir', bare, '-c', `core.hooksPath=${template}`, '-c', `core.attributesFile=${empty}`]
+    for (const commit of [base, head]) {
+      const present = await run('git', [...args, 'cat-file', '-e', `${commit}^{commit}`], { env, signal })
+      if (present.code !== 0) return { status: 'unknown', reason: `Commit ${commit} is not available locally; no fetch was attempted.` }
+    }
+    const result = await run('git', [...args, 'merge-tree', '--write-tree', '--name-only', '-z', '--no-messages', base, head], { env, signal })
+    if (result.code !== 0 && result.code !== 1) return { status: 'unknown', reason: result.stderr || 'Merge probe unavailable.' }
+    const [tree, ...names] = result.stdout.split('\0')
+    const files = names.filter(Boolean)
+    if (!oid(tree ?? '') || files.length > 100 || files.some(file => file.length > 500)) return { status: 'unknown', reason: 'Merge output exceeded the supported bounds.' }
+    if (result.code === 0 && files.length !== 0) return { status: 'unknown', reason: 'Unexpected clean-merge output.' }
+    return { status: result.code === 0 ? 'clean' : 'conflicts', tree, files }
+  } catch (error) {
+    return { status: 'unknown', reason: String(error instanceof Error ? error.message : error).slice(0, 500) }
+  } finally { await fs.rm(temporary, { recursive: true, force: true }) }
+}
diff --git a/src/review/process.ts b/src/review/process.ts
new file mode 100644
index 00000000..f79f9d73
--- /dev/null
+++ b/src/review/process.ts
@@ -0,0 +1,21 @@
+/** Bounded subprocesses for the opt-in review CLI; never used by core tool registration. */
+import { execFile } from 'node:child_process'
+
+export interface CommandResult { code: number | null; stdout: string; stderr: string }
+export interface CommandOptions { cwd?: string; env?: NodeJS.ProcessEnv; signal?: AbortSignal }
+export type Runner = (file: string, args: string[], options?: CommandOptions) => Promise<CommandResult>
+
+export const runCommand: Runner = (file, args, options = {}) => new Promise(resolve => {
+  execFile(file, args, { ...options, encoding: 'utf8', timeout: 20_000, maxBuffer: 512 * 1024, windowsHide: true },
+    (error, stdout, stderr) => resolve({
+      code: error ? typeof error.code === 'number' ? error.code : null : 0,
+      stdout: String(stdout), stderr: String(stderr || error?.message || '').slice(0, 1000),
+    }))
+})
+
+/** Drop inherited Git command/config overrides while retaining executable lookup. */
+export function isolatedGitEnv(emptyConfig: string): NodeJS.ProcessEnv {
+  const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.toUpperCase().startsWith('GIT_')))
+  return { ...env, GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_SYSTEM: emptyConfig, GIT_CONFIG_GLOBAL: emptyConfig,
+    GIT_ATTR_NOSYSTEM: '1', GIT_NO_REPLACE_OBJECTS: '1', GIT_TERMINAL_PROMPT: '0', GIT_OPTIONAL_LOCKS: '0' }
+}
diff --git a/src/review/snapshot.ts b/src/review/snapshot.ts
new file mode 100644
index 00000000..91aa0209
--- /dev/null
+++ b/src/review/snapshot.ts
@@ -0,0 +1,113 @@
+import { runCommand, type Runner } from './process.js'
+import { probeMerge } from './merge.js'
+
+export interface SnapshotInput { repo: string; prs: number[]; base?: string; workflow?: string; checkout?: string }
+const object = (value: unknown): Record<string, unknown> => value !== null && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}
+const array = (value: unknown): unknown[] => Array.isArray(value) ? value : []
+const text = (value: unknown, limit = 160) => typeof value === 'string' ? value.slice(0, limit) : ''
+const sha = (value: unknown) => typeof value === 'string' && /^[a-f0-9]{40}([a-f0-9]{24})?$/.test(value) ? value : ''
+const nodes = (value: unknown) => array(object(value).nodes)
+const more = (value: unknown) => Object.values(object(object(value).pageInfo)).some(value => value === true)
+const QUERY = `query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){pullRequest(number:$number){
+number title url state isDraft reviewDecision additions deletions changedFiles headRefOid baseRefOid baseRefName maintainerCanModify
+author{login} headRepository{nameWithOwner}
+files(first:25){nodes{path} pageInfo{hasNextPage}}
+closingIssuesReferences(first:3){pageInfo{hasNextPage} nodes{number url assignees(first:5){nodes{login} pageInfo{hasNextPage}}
+comments(last:10){pageInfo{hasPreviousPage} nodes{author{login} body url}}}}}}}`
+
+export function validateSnapshot(input: SnapshotInput): SnapshotInput & { base: string; workflow: string } {
+  if (input.repo.length > 200 || !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(input.repo)) throw new Error('--repo must be owner/name on github.com')
+  if (!Array.isArray(input.prs) || input.prs.length < 1 || input.prs.length > 5 || input.prs.some(n => !Number.isSafeInteger(n) || n < 1)) throw new Error('--prs must contain 1–5 positive PR numbers')
+  const base = input.base ?? 'main'
+  if (!base || base.length > 200 || /[\x00-\x20]/.test(base)) throw new Error('--base must be a nonempty branch/ref without whitespace')
+  const workflow = input.workflow ?? 'ci.yml'
+  if (!/^[A-Za-z0-9_.-]{1,100}$/.test(workflow)) throw new Error('--workflow must be a workflow filename or numeric ID')
+  return { ...input, prs: [...new Set(input.prs)], base, workflow }
+}
+
+/** Every request is fresh; memoization only shares identical reads within this invocation. */
+export async function reviewSnapshot(input: SnapshotInput, run: Runner = runCommand) {
+  const request = validateSnapshot(input), signal = AbortSignal.timeout(120_000)
+  const memo = new Map<string, Promise<unknown>>()
+  const api = (args: string[]) => {
+    const key = JSON.stringify(args)
+    if (!memo.has(key)) memo.set(key, (async () => {
+      const result = await run('gh', ['api', '--hostname', 'github.com', ...args], { signal })
+      if (result.code !== 0) throw new Error(result.stderr || 'GitHub read failed')
+      const value: unknown = JSON.parse(result.stdout)
+      if (array(object(value).errors).length) throw new Error('GitHub returned GraphQL errors')
+      return value
+    })())
+    return memo.get(key)!
+  }
+  const ci = async (commit: string, event: 'push' | 'pull_request', pr?: number) => {
+    if (!commit) return { status: 'unknown', reason: 'No verified head SHA.' }
+    try {
+      const response = object(await api([`repos/${request.repo}/actions/workflows/${request.workflow}/runs?event=${event}&head_sha=${commit}&per_page=20`]))
+      const runs = array(response.workflow_runs).map(object).filter(run => run.event === event && run.head_sha === commit
+        && (pr === undefined || array(run.pull_requests).some(value => object(value).number === pr)))
+      const latest = runs.sort((a, b) => text(b.created_at).localeCompare(text(a.created_at)))[0]
+      if (!latest || !Number.isSafeInteger(latest.id)) return { status: 'unknown', reason: 'No matching run in the latest 20 results; absence is not a pass.' }
+      const jobs = object(await api([`repos/${request.repo}/actions/runs/${latest.id}/jobs?per_page=50`]))
+      return { status: text(latest.status), conclusion: text(latest.conclusion) || null, event,
+        headSha: commit, name: text(latest.name), url: text(latest.html_url, 500), attempt: latest.run_attempt,
+        coverage: 'latest matching run of the requested workflow; not aggregate branch health',
+        jobsTruncated: Number(jobs.total_count) > 50,
+        jobs: array(jobs.jobs).slice(0, 50).map(value => { const job = object(value); return {
+          name: text(job.name, 100), status: text(job.status), conclusion: text(job.conclusion) || null,
+        } }) }
+    } catch (error) { return { status: 'unknown', reason: String(error instanceof Error ? error.message : error).slice(0, 500) } }
+  }
+  let baseSha = '', baseError = ''
+  try { baseSha = sha(object(await api([`repos/${request.repo}/commits/${encodeURIComponent(request.base)}`])).sha) }
+  catch (error) { baseError = String(error instanceof Error ? error.message : error).slice(0, 500) }
+  const baseCi = await ci(baseSha, 'push')
+  const [owner, name] = request.repo.split('/')
+  const prs = []
+  for (const number of request.prs) {
+    try {
+      const response = object(await api(['graphql', '-f', `query=${QUERY}`, '-f', `owner=${owner}`, '-f', `name=${name}`, '-F', `number=${number}`]))
+      const pr = object(object(object(response.data).repository).pullRequest)
+      if (pr.number !== number || !sha(pr.headRefOid)) throw new Error('PR metadata or exact head SHA unavailable')
+      const files = nodes(pr.files).map(value => text(object(value).path, 200))
+      const risks = [files.some(file => /(?:^|\/)(?:package(?:-lock)?\.json|Cargo\.(?:toml|lock))$/.test(file)) && 'dependencies',
+        files.some(file => file.startsWith('.github/workflows/')) && 'workflows',
+        files.some(file => /schema|contract|capabilities|host-tool/.test(file)) && 'schemas',
+        files.some(file => /CHANGELOG/i.test(file)) && 'changelog'].filter(Boolean)
+      const issues = nodes(pr.closingIssuesReferences).map(value => {
+        const issue = object(value), comments = nodes(issue.comments).map(object)
+        const claims = comments.filter(comment => /\b(?:claim|taking|working on|i am handling)\b|认领/i.test(text(comment.body, 4000))).slice(0, 2)
+        const assignees = nodes(issue.assignees).map(value => text(object(value).login, 80))
+        return { number: issue.number, url: text(issue.url, 500), assignees,
+          claimStatus: assignees.length ? 'assigned' : claims.length ? 'possible_claim_comments' : 'no_evidence_in_window',
+          coverage: 'closing issues and last 10 comments only; not all timeline cross-references',
+          truncated: more(issue.comments) || more(issue.assignees),
+          claims: claims.map(comment => ({ author: text(object(comment.author).login, 80), url: text(comment.url, 500), excerpt: text(comment.body) })) }
+      })
+      prs.push({ number, title: text(pr.title), url: text(pr.url, 500), author: text(object(pr.author).login, 80), state: text(pr.state),
+        draft: pr.isDraft === true, reviewDecision: text(pr.reviewDecision), headSha: sha(pr.headRefOid), prBaseSha: sha(pr.baseRefOid),
+        prBaseRef: text(pr.baseRefName), headRepo: text(object(pr.headRepository).nameWithOwner), maintainerCanModify: pr.maintainerCanModify === true,
+        additions: pr.additions, deletions: pr.deletions, changedFiles: pr.changedFiles, files, filesTruncated: more(pr.files), risks,
+        issues, issuesTruncated: more(pr.closingIssuesReferences), ci: await ci(sha(pr.headRefOid), 'pull_request', number),
+        merge: await probeMerge(request.checkout, baseSha, sha(pr.headRefOid), signal, run) })
+    } catch (error) { prs.push({ number, status: 'unknown', reason: String(error instanceof Error ? error.message : error).slice(0, 500) }) }
+  }
+  const partial = !baseSha || baseCi.status === 'unknown' || ('jobsTruncated' in baseCi && baseCi.jobsTruncated) || prs.some(pr => 'status' in pr || pr.ci.status === 'unknown'
+    || ('jobsTruncated' in pr.ci && pr.ci.jobsTruncated)
+    || pr.filesTruncated || pr.issuesTruncated || pr.issues.some(issue => issue.truncated)
+    || (request.checkout !== undefined && pr.merge.status === 'unknown'))
+  return { version: 1, status: partial ? 'partial' : 'completed', repo: request.repo, workflow: request.workflow, observedAt: new Date().toISOString(),
+    base: { ref: request.base, sha: baseSha, ...(baseError ? { error: baseError } : {}), ci: baseCi }, prs,
+    limits: { prs: 5, filesPerPr: 25, closingIssuesPerPr: 3, commentsPerIssue: 10, jobsPerRun: 50 },
+    scope: 'P0 evidence snapshot; no approval, fetch, branch mutation, CI wait, or cross-PR merge train' }
+}
+
+export function renderSnapshot(value: Awaited<ReturnType<typeof reviewSnapshot>>) {
+  let output = JSON.stringify(value)
+  if (Buffer.byteLength(output) > 64 * 1024) {
+    const bounded = { ...value, status: 'partial', outputTruncated: true, prs: value.prs.map(pr => 'headSha' in pr
+      ? { number: pr.number, headSha: pr.headSha, url: pr.url, omitted: 'details exceeded 64 KiB; request fewer PRs' } : pr) }
+    output = JSON.stringify(bounded)
+  }
+  return output
+}
diff --git a/src/scoped-reconciliation.ts b/src/scoped-reconciliation.ts
new file mode 100644
index 00000000..e61d688b
--- /dev/null
+++ b/src/scoped-reconciliation.ts
@@ -0,0 +1,64 @@
+/** Host probes may never resolve. Only their inheritance family may wait for them. */
+export interface Reconciliation {
+  signal: AbortSignal
+  current(): boolean
+  wait<T>(promise: Promise<T>): Promise<T>
+}
+interface Work extends Reconciliation { controller: AbortController; promise: Promise<void>; pending: boolean }
+const cancelled = new Error('Superseded scope reconciliation')
+export function scopedReconciliation<K>(failed: (error: unknown) => void) {
+  const states = new Map<K, Work>()
+  const cancel = (members: Iterable<K>) => {
+    for (const member of members) states.get(member)?.controller.abort(cancelled)
+  }
+  return {
+    cancel,
+    forget(member: K): void { cancel([member]); states.delete(member) },
+    version: (member: K): unknown => states.get(member),
+    run(members: Iterable<K>, action: (work: Reconciliation) => Promise<void>): Promise<void> {
+      const keys = [...members]
+      cancel(keys)
+      const controller = new AbortController(), { signal } = controller
+      const work: Work = { controller, signal, pending: true, promise: Promise.resolve(),
+        current: () => !signal.aborted,
+        wait: <T>(promise: Promise<T>): Promise<T> => new Promise((resolve, reject) => {
+          const abort = () => reject(cancelled)
+          // Attach both continuations even if already cancelled: a late host
+          // rejection is observed, and can neither publish nor go unhandled.
+          promise.then(value => { signal.removeEventListener('abort', abort); resolve(value) },
+            error => { signal.removeEventListener('abort', abort); reject(error) })
+          if (signal.aborted) abort(); else signal.addEventListener('abort', abort, { once: true })
+        }),
+      }
+      for (const key of keys) states.set(key, work)
+      work.promise = Promise.resolve().then(() => { if (work.current()) return action(work) })
+        .catch(error => { if (work.current()) failed(error) }).finally(() => { work.pending = false })
+      return work.promise
+    },
+    async drain(member: K): Promise<boolean> {
+      const before = states.get(member), pending = before?.pending === true
+      let current: Work | undefined
+      do { current = states.get(member); await current?.promise } while (current !== states.get(member))
+      return pending || current !== before
+    },
+    async stop(): Promise<void> {
+      cancel(states.keys())
+      await Promise.all([...new Set(states.values())].map(work => work.promise))
+      states.clear()
+    },
+  }
+}
+/** Ancestor overlays and their descendants commit together; roots stay independent. */
+export function scopeFamilies<K extends object>(members: Iterable<K>, targets: Iterable<K>, ancestors: (scope: K) => object[]): Set<K>[] {
+  const all = new Set(members), groups = new Map<K, Set<K>>()
+  const root = (member: K): K => (ancestors(member).filter(scope => all.has(scope as K)).at(-1) as K | undefined) ?? member
+  const selected = new Set([...targets].map(root))
+  for (const member of all) {
+    const key = root(member)
+    if (!selected.has(key)) continue
+    let family = groups.get(key)
+    if (!family) { family = new Set(); groups.set(key, family) }
+    family.add(member)
+  }
+  return [...groups.values()]
+}
diff --git a/src/session-shells.ts b/src/session-shells.ts
index 240c7bc5..86ee254a 100644
--- a/src/session-shells.ts
+++ b/src/session-shells.ts
@@ -11,6 +11,7 @@ import { bashToolDefinition, DEFAULT_BASH_TIMEOUT_MS } from './shells.js'
 import { BashArgumentError } from './shells/argument-error.js'
 import { MODES } from './permissions.js'
 import { hostBashDefinition } from './shells/host-tool.js'
+import { withToolChange } from './tool-changes.js'
 import { startSessionBash } from './shells/session-execution.js'
 
 /**
@@ -128,7 +129,10 @@ export function bashRefusalValue(error: unknown): ShellResult {
   }
 }
 
-interface Entry { ctx?: Context; fiber?: Fiber; dispose?: () => void; definition?: HostShellDefinition }
+interface Entry {
+  agent: Agent; ctx?: Context; fiber?: Fiber; dispose?: () => void; definition?: HostShellDefinition
+  published?: boolean; generation?: number
+}
 
 export function mountSessionBash(ctx: Context, config: Pick<ResolvedConfig, 'publishBashTool'>, shells: { bash: ShellResolution }) {
   if (!config.publishBashTool) return
@@ -140,6 +144,12 @@ export function mountSessionBash(ctx: Context, config: Pick<ResolvedConfig, 'pub
   const entries = new Map<Agent, Entry>()
   let ready = false
   let stopped = false
+  let generation = 0
+  let scheduled: NodeJS.Immediate | undefined
+  let pending: Promise<void> | undefined
+  let settle: (() => void) | undefined
+  const retiring = new Set<Promise<void>>()
+  let refreshPending = false
   // Bound once by the jobs injection below; the host's registry is a tracked service, so every
   // `ctx.get('jobs')` hands out a fresh traceable proxy and cannot be compared by identity.
   let jobs: ShellJobs | undefined
@@ -152,16 +162,15 @@ export function mountSessionBash(ctx: Context, config: Pick<ResolvedConfig, 'pub
     catch { return false }
   }
   const clear = (entry: Entry) => {
-    // One broken teardown must not strand the rest: `reconcile()` clears every entry before
-    // republishing, so an exception escaping here stops the loop at the first entry and leaves the
-    // later sessions without a bash tool. Log it — a silently swallowed dispose failure would hide
-    // a real leak.
+    // Keep cleanup isolated: one failed layer must not strand other sessions.
     try {
-      entry.dispose?.()
+      withToolChange([entry.agent], () => entry.dispose?.())
     } catch (error) {
       ctx.logger?.warn?.(`dsh-ops: bash tool teardown failed; continuing with the remaining sessions: ${errorMessage(error)}`)
     } finally {
       entry.dispose = undefined
+      entry.published = undefined
+      entry.generation = undefined
     }
   }
   const publish = (entry: Entry, definition: HostShellDefinition) => {
@@ -170,71 +179,122 @@ export function mountSessionBash(ctx: Context, config: Pick<ResolvedConfig, 'pub
     // with no bash tool at all (#30). `entry.definition` survives `clear()`, so it holds the last
     // definition registered successfully for this entry.
     try {
-      entry.dispose = entry.ctx.tools.register(definition)
+      entry.dispose = withToolChange([entry.agent], () => entry.ctx!.tools.register(definition))
       entry.definition = definition
     } catch (error) {
       ctx.logger?.warn?.(`dsh-ops: bash publication failed: ${errorMessage(error)}`)
       if (entry.definition === undefined) return
-      try { entry.dispose = entry.ctx.tools.register(entry.definition) }
+      try { entry.dispose = withToolChange([entry.agent], () => entry.ctx!.tools.register(entry.definition!)) }
       catch (restoreError) { ctx.logger?.warn?.(`dsh-ops: bash restoration failed: ${errorMessage(restoreError)}`) }
     }
   }
-  const reconcile = () => {
-    for (const entry of entries.values()) clear(entry)
-    // Publish authorized ancestors before masking inheritance in restricted children.
+  const reconcile = (refreshDefinitions = false) => {
+    if (refreshDefinitions) ++generation
+    // Resolve live authority cheaply, but never withdraw an unrelated, unchanged layer.
+    // Publish ancestors before adding masks, so a newly available parent is also hidden
+    // from already tracked restricted children. Existing masks remain authoritative.
+    const permitted = new Map([...entries].map(([agent]) => [agent, allowed(agent)]))
     for (const [agent, entry] of entries) {
-      if (!entry.ctx || !allowed(agent)) continue
+      if (!entry.ctx) continue
+      const publishable = permitted.get(agent) === true
+      if (entry.dispose && entry.published === publishable && (!publishable || entry.generation === generation)) continue
+      clear(entry)
+      if (!publishable) continue
       const base = bashToolDefinition({ file: bash.file, source: bash.source, subprocess: ctx.get('subprocess') })
       const definition = hostBashDefinition(ctx, base,
-        (args, exec, standing, policy, dshEnv, options) => startSessionBash({ ctx, bash, active: () => ready && !stopped && exec.agent !== undefined && entries.has(exec.agent) },
+        (args, exec, standing, policy, dshEnv, options) => startSessionBash({ ctx, bash, active: () => exec.agent !== undefined && entries.has(exec.agent) && allowed(exec.agent) },
           args, exec, standing, policy, dshEnv, options), sessionWorkdir, jobs)
       publish(entry, definition)
+      if (entry.dispose) { entry.published = true; entry.generation = generation }
     }
     for (const [agent, entry] of entries) {
-      if (!entry.ctx || allowed(agent) || stopped) continue
-      if ((ctx.get('tools')!.schemas(agent) ?? []).some(tool => tool.name === BASH_TOOL)) {
-        try { entry.dispose = entry.ctx.tools.restrict({ deny: [BASH_TOOL] }) }
+      if (!entry.ctx || permitted.get(agent) || stopped || entry.dispose) continue
+      if (ctx.get('tools')?.get(BASH_TOOL, agent)) {
+        try { entry.dispose = withToolChange([agent], () => entry.ctx!.tools.restrict({ deny: [BASH_TOOL] })); entry.published = false }
         catch (error) { ctx.logger?.warn?.(`dsh-ops: inherited bash restriction failed: ${errorMessage(error)}`) }
       }
     }
   }
+  // Session events are delivered while the host is publishing an append. Both
+  // register and dispose may append their own events, so leave that window first.
+  // Coalesce a burst and read current authority when the pass actually runs.
+  const scheduleReconcile = (refreshDefinitions = false) => {
+    if (stopped) return Promise.resolve()
+    refreshPending ||= refreshDefinitions
+    if (scheduled) return pending!
+    pending = new Promise(resolve => { settle = resolve })
+    scheduled = setImmediate(() => {
+      scheduled = undefined
+      const pass = pending, done = settle; settle = undefined
+      const refresh = refreshPending; refreshPending = false
+      try { if (!stopped) reconcile(refresh) }
+      finally { if (pending === pass) pending = undefined; done?.() }
+    })
+    return pending
+  }
   const attach = (agent: Agent) => {
     if (stopped || !agent?.ctx || entries.has(agent)) return
-    const entry: Entry = { ctx: undefined, fiber: undefined, dispose: undefined, definition: undefined }
+    const entry: Entry = { agent, ctx: undefined, fiber: undefined, dispose: undefined, definition: undefined }
     entries.set(agent, entry)
     entry.fiber = agent.ctx.plugin(child => {
       child.inject(['tools'], toolsCtx => {
         entry.ctx = toolsCtx
-        reconcile()
+        scheduleReconcile()
       })
     })
+    return entry
   }
   const detach = (agent: Agent) => {
     const entry = entries.get(agent)
     if (!entry) return
     entries.delete(agent)
-    clear(entry)
-    reconcile()
-    return entry.fiber?.dispose()
+    // Removal revokes retained callbacks immediately. Dispose can emit a tool
+    // change too, including when another observer disposes during an append.
+    const retired = new Promise<void>(resolve => setImmediate(resolve)).then(async () => {
+      clear(entry)
+      await entry.fiber?.dispose()
+    })
+    retiring.add(retired)
+    void retired.finally(() => { retiring.delete(retired) }).catch(() => {})
+    scheduleReconcile()
+    return retired
   }
   ctx.effect(() => async () => {
     stopped = true
+    if (scheduled) clearImmediate(scheduled)
+    scheduled = undefined
+    settle?.(); settle = undefined; pending = undefined
     // allSettled: one failing detach must not leave the remaining sessions' bash layers published.
     await Promise.allSettled([...entries.keys()].map(detach))
+    await Promise.allSettled(retiring)
   }, 'dsh-ops: session bash layers')
-  ctx.on('agent/created', ({ agent }) => { attach(agent) })
+  ctx.on('agent/created', async ({ agent }) => {
+    const entry = attach(agent)
+    if (!entry) return
+    await entry.fiber
+    await scheduleReconcile()
+  })
   ctx.on('agent/disposed', ({ agent }) => detach(agent))
-  ctx.on('session/event', (_session, event) => { if (event.type === 'sandbox/mode') reconcile() })
-  ctx.inject(['sandbox'], () => { reconcile() })
+  ctx.inject(['systemPrompt'], promptCtx => {
+    const prompt = promptCtx.get('systemPrompt')!
+    promptCtx.on('system-prompt/assemble', async (_assembly, options, next) => {
+      if (!pending) return next()
+      while (pending) await pending
+      // Schemas were collected before this hook. Rebuild after publication.
+      return prompt.assemble(options)
+    })
+  })
+  ctx.on('session/event', (_session, event) => { if (event.type === 'sandbox/mode') scheduleReconcile() })
+  ctx.inject(['sandbox'], () => { scheduleReconcile() })
   ctx.inject(['jobs'], jobsCtx => {
     jobs = jobsCtx.get('jobs') as ShellJobs | undefined
-    reconcile()
-    jobsCtx.effect(() => () => { jobs = undefined; reconcile() })
+    scheduleReconcile(true)
+    jobsCtx.effect(() => () => { jobs = undefined; scheduleReconcile(true) })
   })
   ctx.inject(['sandboxPolicy', 'subprocess'], authorityCtx => {
     ready = true
-    reconcile()
-    authorityCtx.effect(() => () => { ready = false; reconcile() }, 'dsh-ops: bash authority and executor')
+    scheduleReconcile(true)
+    authorityCtx.effect(() => () => { ready = false; scheduleReconcile() }, 'dsh-ops: bash authority and executor')
   })
   for (const agent of ctx.get('agents')?.list?.() ?? []) attach(agent)
 }
diff --git a/src/shells/execution.ts b/src/shells/execution.ts
index a2becca3..654f3848 100644
--- a/src/shells/execution.ts
+++ b/src/shells/execution.ts
@@ -88,7 +88,8 @@ export function startBashExecution({ file, source, subprocess, prepareArgv, env
         // Legacy direct executor callers can omit cwd; scoped host calls resolve it before this seam.
         cwd: spec.workdir!,
         stdio: {
-          stdin: 'ignore',
+          // A closed pipe supplies EOF without exposing Windows NUL to MSYS as a device.
+          stdin: { data: '' },
           stdout: { maxBytes: DEFAULT_MAX_OUTPUT_BYTES, spill: { maxBytes: DEFAULT_MAX_SPILL_BYTES } },
           stderr: { maxBytes: DEFAULT_MAX_OUTPUT_BYTES, spill: { maxBytes: DEFAULT_MAX_SPILL_BYTES } },
         },
diff --git a/src/shells/host-tool.ts b/src/shells/host-tool.ts
index 7c1e1747..f5b62c3e 100644
--- a/src/shells/host-tool.ts
+++ b/src/shells/host-tool.ts
@@ -8,6 +8,9 @@ import { BashArgumentError, isBashArgumentError } from './argument-error.js'
 import { approveBashPolicy } from './approval.js'
 import { HOST_BASH_OUTPUT_SCHEMA, hostFailure, hostForeground, renderHostBash } from './host-contract.js'
 import { BashJobAdmissionError, startBashJob, waitOnBashJob } from './jobs.js'
+import { createJsonDigestProjection } from './json-digest.js'
+
+import { bashPresentationMeta, presentBashCall, presentBashResult } from './presentation.js'
 
 export const HOST_MAX_BASH_TIMEOUT_MS = 600_000
 
@@ -26,13 +29,18 @@ export function hostBashDefinition(ctx: ShellContext, base: ShellBase, createExe
     sandbox_permissions: { type: 'string', enum: ['workspace-write', 'danger-full-access'], description: 'After a real denial, request the narrowest wider mode for this exact command with justification. Approval applies only to this call. Do not bypass a rejection.' },
     justification: { type: 'string', description: 'One sentence explaining why this command needs wider access, in the user’s language. Required when changing sandbox_permissions.' },
   } }
+  const projection = createJsonDigestProjection()
   return {
     ...base,
     description: 'Execute a Bash command in a fresh shell using the host sandbox, approvals and jobs. Relative workdir uses the current session workspace. Output is bounded with spill paths. Use command for host-compatible calls; script_path is an OPS extension for an existing script file. Verify resolved absolute targets before delete or move. Never bypass a sandbox denial by switching shells.',
     parameters: { ...parameters },
+    projectContent: projection.projectContent,
     // The host validates this value against the declared schema before invoking its renderer.
-    output: { schema: HOST_BASH_OUTPUT_SCHEMA, render: (_args, value) => [{ type: 'text', text: renderHostBash(value as unknown as HostBashResult) }] },
+    output: { schema: HOST_BASH_OUTPUT_SCHEMA, render: (_args, value) => [{ type: 'text', text: renderHostBash(value as unknown as HostBashResult) }], presentationMeta: bashPresentationMeta },
+    presentCall: presentBashCall,
+    presentResult: presentBashResult,
     async execute(input: unknown, exec: ShellCall = {}): Promise<HostBashResult> {
+      const complete = async (value: HostBashResult) => { await projection.prepare(value, exec); return value }
       let timeoutMs = 120_000
       let policy: ShellPolicy | undefined
       let attempted = false
@@ -70,11 +78,11 @@ export function hostBashDefinition(ctx: ShellContext, base: ShellBase, createExe
             if (run_in_background || attempted || error instanceof BashJobAdmissionError && error.runInvoked) throw error
             ctx.logger?.warn?.(`Bash job admission refused; using the foreground deadline: ${errorMessage(error)}`)
           }
-          if (attached) return run_in_background ? { kind: 'background', jobId: attached.id, label: attached.label } : await waitOnBashJob(jobs, attached, exec, timeoutMs)
+          if (attached) return run_in_background ? { kind: 'background', jobId: attached.id, label: attached.label } : await complete(await waitOnBashJob(jobs, attached, exec, timeoutMs))
         } else if (run_in_background) return hostFailure('EXECUTOR_UNAVAILABLE: the host job registry is unavailable.', timeoutMs)
         const execution = await start(exec, {})
         const result = await execution.result()
-        return hostForeground(result, execution.started ? 'unknown' : 'none')
+        return await complete(hostForeground(result, execution.started ? 'unknown' : 'none'))
       } catch (error) {
         const message = isBashArgumentError(error) ? `INVALID_BASH_ARGUMENT: ${errorMessage(error)}` : errorMessage(error)
         return { ...hostFailure(message, timeoutMs, process ? (process.started ? 'unknown' : 'none') : attempted ? 'unknown' : 'none', exec.signal?.aborted === true), ...(policy ? { sandbox: { mode: policy.mode, denied: false } } : {}) }
diff --git a/src/shells/json-digest.ts b/src/shells/json-digest.ts
new file mode 100644
index 00000000..9851cd90
--- /dev/null
+++ b/src/shells/json-digest.ts
@@ -0,0 +1,110 @@
+/** Optional Native projection of intact JSON in the host's existing output spill. */
+import { constants } from 'node:fs'
+import { lstat, open } from 'node:fs/promises'
+import path from 'node:path'
+import type { ToolDefinition, ToolExecutionToken } from '@deepseek-ai/dsh-tools'
+import type { HostBashResult, ShellCall } from './types.js'
+import { renderHostBash } from './host-contract.js'
+
+const MAX_BYTES = 2 * 1024 * 1024
+const MIN_BYTES = 8192
+const record = (value: unknown): value is Record<string, unknown> =>
+  value !== null && typeof value === 'object' && !Array.isArray(value)
+
+function preview(value: unknown, depth = 0): unknown {
+  if (typeof value === 'string') return value.length > 160 ? { type: 'string', length: value.length, prefix: value.slice(0, 160) } : value
+  if (typeof value === 'number' && (!Number.isFinite(value) || Number.isInteger(value) && !Number.isSafeInteger(value))) return { type: 'number', value: 'see original for exact representation' }
+  if (Array.isArray(value)) return { type: 'array', length: value.length,
+    ...(depth < 3 ? { sample: value.slice(0, 3).map(item => preview(item, depth + 1)), omitted: Math.max(0, value.length - 3) } : {}) }
+  if (record(value)) {
+    const keys = Object.keys(value)
+    return { type: 'object', keyCount: keys.length, keys: keys.slice(0, 12),
+      ...(depth < 3 ? { fields: Object.fromEntries(keys.slice(0, 8).map(key => [key, preview(value[key], depth + 1)])), omitted: Math.max(0, keys.length - 8) } : {}) }
+  }
+  return value
+}
+
+/** A bounded sample, explicitly not an exhaustive validation of application-level errors. */
+function errorSamples(value: unknown) {
+  const pending = [value], samples: unknown[] = []
+  let visited = 0
+  while (pending.length && visited++ < 10000 && samples.length < 3) {
+    const item = pending.pop()
+    if (record(item)) {
+      if (item.error || Array.isArray(item.errors) && item.errors.length || item.status === 'error' || item.status === 'failed' || item.success === false) samples.push(preview(item, 1))
+      for (const child of Object.values(item)) if (child !== null && typeof child === 'object') pending.push(child)
+    } else if (Array.isArray(item)) {
+      for (let i = item.length - 1; i >= 0; i--) if (item[i] !== null && typeof item[i] === 'object') pending.push(item[i])
+    }
+  }
+  return samples
+}
+
+/** Pure digest construction: malformed, scalar, oversized or unhelpful input retains its old rendering. */
+export function jsonDigest(text: string, fullPath: string): string | undefined {
+  const bytes = Buffer.byteLength(text)
+  if (bytes < MIN_BYTES || bytes > MAX_BYTES) return undefined
+  let value: unknown
+  try { value = JSON.parse(text) } catch { return undefined }
+  if (!record(value) && !Array.isArray(value)) return undefined
+  const facts = { preview: preview(value), errorSamples: errorSamples(value) }
+  const summary = JSON.stringify(facts)
+  if (Buffer.byteLength(summary) > 4096) return undefined
+  return `[JSON summary; lossy samples, not an exhaustive error check]\n${summary}\n[full output: ${JSON.stringify(fullPath)}]`
+}
+
+/** Read only a settled, regular host spill, with bounded allocation and change detection. */
+async function readSpill(file: string): Promise<string | undefined> {
+  let handle
+  try {
+    if (!path.isAbsolute(file)) return undefined
+    const entry = await lstat(file)
+    if (!entry.isFile() || entry.isSymbolicLink() || entry.size < MIN_BYTES || entry.size > MAX_BYTES) return undefined
+    handle = await open(file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0))
+    const before = await handle.stat()
+    if (!before.isFile() || before.ino !== entry.ino || before.dev !== entry.dev || before.size !== entry.size) return undefined
+    const data = Buffer.alloc(before.size + 1)
+    let bytes = 0
+    while (bytes < data.length) {
+      const read = await handle.read(data, bytes, data.length - bytes, bytes)
+      if (!read.bytesRead) break
+      bytes += read.bytesRead
+    }
+    const after = await handle.stat(), current = await lstat(file)
+    if (bytes !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs
+      || current.isSymbolicLink() || current.ino !== before.ino || current.dev !== before.dev) return undefined
+    return new TextDecoder('utf-8', { fatal: true }).decode(data.subarray(0, bytes))
+  } catch { return undefined }
+  finally { await handle?.close().catch(() => {}) }
+}
+
+/** Canonical/SDK values stay unchanged. Prepared text is attached only to a direct Native call. */
+export function createJsonDigestProjection() {
+  const prepared = new WeakMap<ToolExecutionToken, {
+    value: string; content: string; projected: ReturnType<NonNullable<ToolDefinition['projectContent']>>
+  }>()
+  return {
+    async prepare(value: HostBashResult, exec: ShellCall) {
+      if (!exec.token || exec.parent || exec.signal?.aborted || value.kind !== 'foreground' || value.status !== 'completed'
+        || value.exitCode !== 0 || value.signal !== null || value.aborted || value.stopped || !value.stdout.spillPath) return
+      try {
+        const text = await readSpill(value.stdout.spillPath)
+        if (text === undefined || exec.signal?.aborted) return
+        const summary = jsonDigest(text, value.stdout.spillPath)
+        if (!summary) return
+        const original = renderHostBash(value)
+        const rendered = renderHostBash({ ...value, stdout: { ...value.stdout, text: summary, truncated: false } })
+        if (Buffer.byteLength(rendered) > Buffer.byteLength(original) * 0.8) return
+        prepared.set(exec.token, { value: JSON.stringify(value), content: JSON.stringify([{ type: 'text', text: original }]),
+          projected: [{ type: 'text', text: rendered }] })
+      } catch { /* Optional projection failures must preserve the command's original result. */ }
+    },
+    projectContent: ((exec, result) => {
+      const candidate = prepared.get(exec.token)
+      prepared.delete(exec.token)
+      if (!candidate || result.isError || exec.signal.aborted || JSON.stringify(result.value) !== candidate.value
+        || JSON.stringify(result.content) !== candidate.content) return undefined
+      return candidate.projected
+    }) satisfies NonNullable<ToolDefinition['projectContent']>,
+  }
+}
diff --git a/src/shells/presentation.ts b/src/shells/presentation.ts
new file mode 100644
index 00000000..050cdd96
--- /dev/null
+++ b/src/shells/presentation.ts
@@ -0,0 +1,36 @@
+/** Pure, replayable shell cards through the host's public presentation contract. */
+import type { ToolDefinition } from '@deepseek-ai/dsh-tools'
+
+const record = (value: unknown): value is Record<string, unknown> =>
+  value !== null && typeof value === 'object' && !Array.isArray(value)
+
+export const presentBashCall: NonNullable<ToolDefinition['presentCall']> = args => {
+  if (!record(args)) return undefined
+  const command = typeof args.command === 'string' && args.command.trim() ? args.command : undefined
+  const script = typeof args.script_path === 'string' && args.script_path.trim() ? args.script_path : undefined
+  if ((!command && !script) || (command && script)) return undefined
+  return {
+    card: 'terminal', title: command ?? script!,
+    ...(typeof args.description === 'string' && args.description.trim() ? { description: args.description } : {}),
+    ...(typeof args.workdir === 'string' && args.workdir.trim() ? { cwd: args.workdir } : {}),
+  }
+}
+
+/** Only process facts are persisted here; output remains in the host's content record. */
+export const bashPresentationMeta: NonNullable<ToolDefinition['output']['presentationMeta']> = (_args, value): ReturnType<NonNullable<ToolDefinition['output']['presentationMeta']>> => {
+  if (!record(value) || value.kind !== 'foreground') return {}
+  if (typeof value.signal === 'string' && value.signal) return { opsShell: { signal: value.signal } }
+  if (typeof value.exitCode === 'number' && Number.isSafeInteger(value.exitCode)) return { opsShell: { exitCode: value.exitCode } }
+  return {}
+}
+
+export const presentBashResult: NonNullable<ToolDefinition['presentResult']> = (_args, result) => {
+  const facts = record(result.meta) && record(result.meta.opsShell) ? result.meta.opsShell : {}
+  const signal = typeof facts.signal === 'string' && facts.signal ? facts.signal : undefined
+  const exitCode = typeof facts.exitCode === 'number' && Number.isSafeInteger(facts.exitCode) ? facts.exitCode : undefined
+  return {
+    card: 'terminal',
+    output: result.content.filter(block => block.type === 'text').map(block => block.text).join('\n'),
+    ...(signal ? { signal } : exitCode !== undefined ? { exitCode } : {}),
+  }
+}
diff --git a/src/shells/tool.ts b/src/shells/tool.ts
index 42966882..4fe4b812 100644
--- a/src/shells/tool.ts
+++ b/src/shells/tool.ts
@@ -195,7 +195,7 @@ export function withBashStatus(value: ShellResult): SettledShellResult {
 export function bashToolDescription() {
   return 'Run general commands, builds, git/gh, pipelines and scripts in bash; prefer this command '
     + 'executor over PowerShell. Use file tools for file operations. Each call uses a fresh non-login '
-    + 'shell; set workdir explicitly. For scripts longer than about 1 KB or containing heredocs, '
+    + 'shell; set workdir explicitly. For Bash scripts longer than about 1 KB or containing heredocs, '
     + 'quotes, backslashes or non-ASCII text, write the script to a file first and pass script_path '
     + 'instead of embedding it in command. Use command for short commands and pipelines. Fix failed '
     + 'bash commands here, do not switch shells or mix PowerShell syntax. Output is bounded with '
@@ -233,7 +233,7 @@ export function bashToolDefinition({ file, source, subprocess, prepareArgv, env
         },
         script_path: {
           type: 'string',
-          description: 'Existing bash script path. Omit or leave empty when using command. Never use /dev/null as a placeholder.',
+          description: 'Existing Bash script path, always executed by Bash regardless of extension. Use host pwsh for PowerShell scripts. Omit or leave empty when using command. Never use /dev/null as a placeholder.',
         },
         workdir: {
           type: 'string',
diff --git a/src/shells/types.ts b/src/shells/types.ts
index 85101589..4bb1275e 100644
--- a/src/shells/types.ts
+++ b/src/shells/types.ts
@@ -6,7 +6,7 @@ import type { SandboxExecutionPolicy, SandboxProvider } from '@deepseek-ai/dsh-s
 import type { SandboxPolicyService } from '@deepseek-ai/dsh-sandbox-policy'
 import type { SubprocessRuntime, SubprocessOutputReader } from '@deepseek-ai/dsh-subprocess'
 
-export type ShellCall = Partial<Pick<ToolRunContext, 'agent' | 'callId' | 'signal'>>
+export type ShellCall = Partial<Pick<ToolRunContext, 'agent' | 'callId' | 'signal' | 'token' | 'parent'>>
 export type ShellPolicy = SandboxExecutionPolicy
 export interface ShellStream { text: string; truncated: boolean; spillPath?: string; bytes?: number; bytesTotal?: number; lines?: number }
 export interface ShellResult {
diff --git a/src/surface.ts b/src/surface.ts
new file mode 100644
index 00000000..cc6a2734
--- /dev/null
+++ b/src/surface.ts
@@ -0,0 +1,113 @@
+/** The tool surface a presentation probe reads, shared by both PTC rows. */
+import type { Agent } from '@deepseek-ai/dsh-agent'
+import type ToolRuntime from '@deepseek-ai/dsh-tools'
+
+/**
+ * The part of a scope view this module reads: the names and definitions a scope can see.
+ *
+ * `ToolRuntime.view` is declared `private`, yet it is `schemas()`'s own implementation —
+ * `schemas()` is `[...this.view(scope).visible.values()].map(schemaOf)` — so its entries
+ * ARE the visible definitions, before any `snapshotJsonValue` copy. A structural local
+ * type keeps that read honest: it names only what is used, and the `schemas()` branch
+ * below holds if a host stops serving it.
+ */
+interface ScopeView {
+  visible?: {
+    entries?: () => Iterable<[string, unknown]>
+    keys?: () => Iterable<string>
+  }
+}
+type Viewable = { view?: (scope?: object) => ScopeView | undefined }
+
+/** Stable per-definition identities, so a swapped definition cannot reuse its predecessor's. */
+const identities = new WeakMap<object, number>()
+let sequence = 0
+
+/**
+ * The identity of one visible definition.
+ *
+ * Only object definitions can carry identity; anything else (an absent entry) folds to 0
+ * so the key stays a plain string.
+ * @param definition - the value a scope view holds under a tool name.
+ * @returns a process-unique index for that exact object.
+ */
+const identityOf = (definition: unknown): number => {
+  if (definition === null || typeof definition !== 'object') return 0
+  const known = identities.get(definition as object)
+  if (known !== undefined) return known
+  const next = ++sequence
+  identities.set(definition as object, next)
+  return next
+}
+
+/**
+ * The surface of one agent, the memo key a presentation probe is cached under.
+ *
+ * Two things move a `ptcOnly`/`native` verdict, and the key must see both:
+ *
+ * - **which names are visible.** `run_code` exists only outside `native`, so a mode flip
+ *   adds or drops it.
+ * - **which definition each name resolves to.** A same-named registration shadows the one
+ *   it replaces, and the publish that follows captures the definition inside its shadow's
+ *   closure. A names-only key returns a stale hit there and publishes nothing, leaving the
+ *   cached verdict standing for a surface it never described.
+ *
+ * Both are read from ONE `view()` call. `view()` hands back the definitions themselves, so
+ * identity costs a `WeakMap` lookup against an object already in hand — measurably cheaper
+ * than pairing `schemas()` with a `tools.get()` per name, because that `get()` rebuilds the
+ * whole scope view and turns the key into O(names²).
+ *
+ * The cost is what makes this safe to memoize at all: reading through `schemas()` deep-copies
+ * every visible schema — 34.2 ms for 258 tools at the issue's own surface shape on the
+ * published runtime — against ~0.05 ms here, identity included. A key that costs more
+ * than the assembly it skips turns the memo into a slowdown. `schemas()` survives only as
+ * the fallback for a host whose view is not reachable, where correctness outranks the cost.
+ * @param tools - the tool registry.
+ * @param agent - the scope to read.
+ * @returns per-entry `name\u0001identity` joined by NUL, usable as a memo key.
+ */
+export const surfaceOf = (tools: Pick<ToolRuntime, 'schemas'>, agent: Agent): string => {
+  // Duck-typed rather than `instanceof Map`: a host may serve the view through a subclass
+  // or a proxy, and a failed instanceof would silently take the expensive branch forever.
+  const visible = (tools as unknown as Viewable).view?.(agent)?.visible
+  if (typeof visible?.entries === 'function') {
+    const parts: string[] = []
+    for (const [name, definition] of visible.entries()) parts.push(`${name}\u0001${identityOf(definition)}`)
+    return parts.join('\u0000')
+  }
+  // A view that publishes names only still beats a projection: a mode flip moves names even
+  // where a same-named swap cannot be seen.
+  if (typeof visible?.keys === 'function') return [...visible.keys()].join('\u0000')
+  return tools.schemas(agent).map(schema => schema.name).join('\u0000')
+}
+
+/**
+ * The tool names a surface names, in view order.
+ *
+ * Callers that only need the name set (diagnostics, assertions) read it back out of a key
+ * rather than paying for a second `view()`.
+ * @param surface - a key produced by {@link surfaceOf}.
+ * @returns the names, in the order the view reported them.
+ */
+export const surfaceNames = (surface: string): string[] =>
+  surface === '' ? [] : surface.split('\u0000').map(entry => entry.split('\u0001')[0]!)
+
+/**
+ * The visible tool names of one scope, without copying any schema.
+ *
+ * `schemas()` deep-copies every definition's parameters (34.2 ms for 258 tools at the
+ * issue's own surface shape on the official host) just to hand back names; the view
+ * reports the same names, in the same order, for ~0.043 ms. Name-only readers (prompt
+ * sections, restriction planning) pay the copy for nothing. Cost tracks nested schema
+ * nodes rather than payload bytes, so both figures are for the shape the issue measured.
+ * `undefined` reads the global layer on both paths, and a host without a reachable view
+ * falls back to the projection — correctness outranks the cost.
+ * @param tools - the tool registry.
+ * @param scope - the scope to read, or `undefined` for the global layer.
+ * @returns the visible tool names, in view order.
+ */
+export const visibleNames = (tools: Pick<ToolRuntime, 'schemas'>, scope?: object): string[] => {
+  const visible = (tools as unknown as Viewable).view?.(scope)?.visible
+  if (typeof visible?.keys === 'function') return [...visible.keys()]
+  return tools.schemas(scope as Agent).map(schema => schema.name)
+}
diff --git a/src/tool-changes.ts b/src/tool-changes.ts
new file mode 100644
index 00000000..4b207fd7
--- /dev/null
+++ b/src/tool-changes.ts
@@ -0,0 +1,23 @@
+/** One-shot attribution captured at dispatch entry, before arbitrary event listeners run. */
+import type { Context } from '@deepseek-ai/cordis'
+interface Attribution { scopes: readonly object[]; consumed: boolean }
+let changing: Attribution | undefined
+const dispatches = new WeakMap<object, readonly object[] | undefined>()
+export function toolChangeScopes(): readonly object[] | undefined { return changing?.consumed ? undefined : changing?.scopes }
+export function withToolChange<T>(scopes: readonly object[], action: () => T): T {
+  const previous = changing
+  changing = { scopes: previous && !previous.consumed ? previous.scopes.length && scopes.length ? [...previous.scopes, ...scopes] : [] : scopes, consumed: false }
+  try { return action() } finally { changing = previous }
+}
+/** Every dispatch has its own args array; nested unwrapped mutations receive no attribution. */
+export function onToolChange(ctx: Context, callback: (scopes?: readonly object[]) => void): void {
+  ctx.on('internal/dispatch', (_type, name, args) => {
+    if (name !== 'tools/change') return
+    if (!dispatches.has(args)) {
+      const scopes = toolChangeScopes()
+      dispatches.set(args, scopes)
+      if (changing) changing.consumed = true
+    }
+    callback(dispatches.get(args))
+  }, { prepend: true, global: true })
+}
diff --git a/test/audit-store-paths.test.mjs b/test/audit-store-paths.test.mjs
new file mode 100644
index 00000000..688a4f90
--- /dev/null
+++ b/test/audit-store-paths.test.mjs
@@ -0,0 +1,242 @@
+/** Public paths cannot address private audit records; trusted lifecycle APIs still can. */
+import fs from 'node:fs'
+import path from 'node:path'
+import { createHash, randomUUID } from 'node:crypto'
+import { assert, test, report, withTempDir } from './lib/harness.mjs'
+import { callTool, callWorker, request, envelopeOf, requireWorker } from './lib/boundary.mjs'
+
+requireWorker('audit-store-paths')
+const content = 'reserved needle\n'
+const hash = value => createHash('sha256').update(value).digest('hex')
+const call = async (root, tool, args, options = {}) =>
+  envelopeOf(await callTool(tool, args, { root, writeRoots: [root], ...options }), assert)
+const denied = value => {
+  assert.equal(value.status, 'error', JSON.stringify(value))
+  assert.equal(value.error.code, 'PATH_RESTRICTED', JSON.stringify(value))
+  assert.equal(value.error.effectState, 'none', JSON.stringify(value))
+  assert.equal(value.error.retryable, false)
+}
+const snapshot = root => fs.readdirSync(root, { recursive: true }).sort().map(name => {
+  const file = path.join(root, name)
+  return [name, fs.statSync(file).isFile() ? fs.readFileSync(file).toString('hex') : null]
+})
+const variants = [
+  ['lowercase ancestor', ['.dsh-ops', 'record.txt']],
+  ['mixed-case nested ancestor', ['nested', '.DsH-OpS', 'deep', 'record.txt']],
+  ['uppercase final component', ['final', '.DSH-OPS']],
+]
+const fixture = (parts, body) => withTempDir('audit-paths', async root => {
+  const target = path.join(root, ...parts), ordinary = path.join(root, 'ordinary.txt')
+  fs.mkdirSync(path.dirname(target), { recursive: true })
+  fs.writeFileSync(target, content)
+  fs.writeFileSync(ordinary, content)
+  await body(root, target, ordinary)
+})
+const operations = [
+  ['write_file', (target) => ({ path: target, content: 'changed', expectedRevision: hash(content) })],
+  ['edit_file', (target) => ({ path: target, edits: [{ oldText: 'needle', newText: 'changed' }], expectedRevision: hash(content) })],
+  ['copy source', (target, ordinary, root) => ({ path: target, to: path.join(root, 'copied.txt'), expectedRevision: hash(content) })],
+  ['copy destination', (target, ordinary) => ({ path: ordinary, to: target, expectedRevision: hash(content) })],
+  ['move source', (target, ordinary, root) => ({ path: target, to: path.join(root, 'moved.txt'), expectedRevision: hash(content) })],
+  ['move destination', (target, ordinary) => ({ path: ordinary, to: target, expectedRevision: hash(content) })],
+  ['remove', target => ({ path: target, expectedRevision: hash(content) })],
+  ['inspect_local_file', target => ({ path: target })],
+  ['stat', target => ({ path: target })],
+  ['diff', target => ({ path: target, content: 'changed' })],
+  ['read_table', target => ({ path: target })],
+  ['read_docx', target => ({ path: target })],
+  ['read_pdf', target => ({ path: target })],
+  ['grep', target => ({ path: target, pattern: 'needle' })],
+  ['replace', target => ({ path: target, pattern: 'needle', replacement: 'changed' })],
+]
+
+for (const [label, parts] of variants) {
+  for (const [operation, args] of operations) {
+    await test(`${operation} refuses ${label} without filesystem effects`, async () => {
+      await fixture(parts, async (root, target, ordinary) => {
+        // Destinations must be absent so no-clobber cannot mask the reserved-path error.
+        if (operation.endsWith('destination')) fs.unlinkSync(target)
+        const before = snapshot(root)
+        const value = await call(root, operation.split(' ')[0], args(target, ordinary, root))
+        assert.deepEqual(snapshot(root), before, JSON.stringify(value))
+        denied(value)
+      })
+    })
+  }
+  await test(`read_files refuses ${label} per item while retaining ordinary neighbors`, async () => {
+    await fixture(parts, async (root, target, ordinary) => {
+      const before = snapshot(root)
+      const value = await call(root, 'read_files', { files: [{ path: ordinary }, { path: target }, { path: ordinary }] }, { readOnly: true })
+      assert.equal(value.status, 'partial')
+      assert.equal(value.complete, false)
+      assert.equal(value.failed, 1)
+      assert.equal(value.pending, 0)
+      denied(value.items[1])
+      assert.deepEqual(value.items[1].items, [])
+      assert.equal(value.items[0].revision, hash(content))
+      assert.equal(value.items[2].revision, hash(content))
+      assert.deepEqual(snapshot(root), before)
+    })
+  })
+  for (const operation of ['write_file', 'stat']) {
+    await test(`${operation} refuses missing ${label} rather than accepting absent`, async () => {
+      await fixture(parts, async (root, target) => {
+        fs.unlinkSync(target)
+        const before = snapshot(root)
+        const args = operation === 'stat' ? { path: target } : { path: target, content, expectedRevision: 'absent' }
+        denied(await call(root, operation, args))
+        assert.deepEqual(snapshot(root), before)
+      })
+    })
+  }
+}
+
+for (const spelling of ['.dsh-ops', '.DsH-OpS']) {
+  await test(`glob refuses an explicitly requested ${spelling} directory`, async () => {
+    await fixture([spelling, 'record.txt'], async (root, target) => {
+      const before = snapshot(root)
+      denied(await call(root, 'glob', { path: path.dirname(target), pattern: ['**/*'] }))
+      denied(await call(root, 'grep', { path: path.dirname(target), pattern: 'needle' }))
+      denied(await call(root, 'replace', { path: path.dirname(target), pattern: 'needle', replacement: 'changed' }))
+      assert.deepEqual(snapshot(root), before)
+    })
+  })
+}
+
+await test('reserved ancestors above the session cwd are not an alternate entrance', async () => {
+  await fixture(['.DsH-OpS', 'workspace', 'record.txt'], async (root, target) => {
+    const before = snapshot(root), cwd = path.dirname(target)
+    denied(await call(cwd, 'inspect_local_file', { path: target }))
+    denied(await call(cwd, 'write_file', { path: target, content: 'changed', expectedRevision: hash(content) }))
+    assert.deepEqual(snapshot(root), before)
+  })
+})
+
+await test('ordinary search excludes hidden audit directories without introducing a coverage gap', async () => {
+  await withTempDir('audit-search', async root => {
+    fs.writeFileSync(path.join(root, 'visible.txt'), content)
+    for (const name of ['.dsh-ops', 'nested/.DsH-OpS', '.dsh-ops-backup']) {
+      fs.mkdirSync(path.join(root, name), { recursive: true })
+      fs.writeFileSync(path.join(root, name, 'record.txt'), content)
+    }
+    const before = snapshot(root)
+    for (const [tool, args] of [
+      ['glob', { pattern: ['**/*'] }],
+      ['grep', { pattern: 'needle' }],
+    ]) {
+      const value = await call(root, tool, { path: root, ...args })
+      assert.equal(value.status, 'completed', JSON.stringify(value))
+      assert.equal(value.complete, true, JSON.stringify(value))
+      assert.equal(value.items.length, 1)
+      assert.ok(JSON.stringify(value.items).includes('visible.txt'))
+      assert.equal(value.skipReasons?.['invalid-path'] ?? 0, 0)
+    }
+    assert.deepEqual(snapshot(root), before)
+    const replaced = await call(root, 'replace', { path: root, pattern: 'needle', replacement: 'changed' })
+    assert.equal(replaced.status, 'completed', JSON.stringify(replaced))
+    assert.equal(fs.readFileSync(path.join(root, 'visible.txt'), 'utf8'), 'reserved changed\n')
+    for (const [name, bytes] of before) {
+      if (bytes !== null && name !== 'visible.txt') assert.equal(fs.readFileSync(path.join(root, name)).toString('hex'), bytes)
+    }
+  })
+})
+
+await test('near names remain usable through real write/edit/read/stat/copy/move/remove/search calls', async () => {
+  await withTempDir('audit-near', async root => {
+    const dir = path.join(root, '.dsh-ops-backup'); fs.mkdirSync(dir)
+    const target = path.join(dir, '.dsh-ops.json')
+    assert.equal((await call(root, 'write_file', { path: target, content, expectedRevision: 'absent' })).status, 'completed')
+    assert.equal((await call(root, 'edit_file', { path: target, expectedRevision: hash(content), edits: [{ oldText: 'needle', newText: 'changed' }] })).status, 'completed')
+    const revision = hash('reserved changed\n')
+    assert.equal((await call(root, 'stat', { path: target })).revision, revision)
+    assert.equal((await call(root, 'inspect_local_file', { path: target })).revision, revision)
+    assert.equal((await call(root, 'read_files', { files: [{ path: target }] })).items[0].revision, revision)
+    assert.equal((await call(root, 'diff', { path: target, content })).status, 'completed')
+    assert.equal((await call(root, 'grep', { path: target, pattern: 'changed' })).items.length, 1)
+    assert.equal((await call(root, 'glob', { path: dir, pattern: ['**/*'] })).status, 'completed')
+    const copy = path.join(dir, 'copied'), moved = path.join(dir, 'moved')
+    assert.equal((await call(root, 'copy', { path: target, to: copy, expectedRevision: revision })).status, 'completed')
+    assert.equal((await call(root, 'move', { path: copy, to: moved, expectedRevision: revision })).status, 'completed')
+    assert.equal((await call(root, 'remove', { path: moved, expectedRevision: revision })).status, 'completed')
+    assert.equal(fs.existsSync(copy), false)
+    assert.equal(fs.existsSync(moved), false)
+  })
+})
+
+await test('relative batch source, destination and protect paths retain PATH_RESTRICTED', async () => {
+  await withTempDir('audit-relative', async root => {
+    fs.writeFileSync(path.join(root, 'ordinary.txt'), content)
+    for (const reserved of ['.dsh-ops', 'nested/.DsH-OpS/record.txt']) {
+      for (const args of [
+        { operations: [{ op: 'remove', path: reserved }] },
+        { operations: [{ op: 'copy', path: 'ordinary.txt', to: reserved }] },
+        { operations: [{ op: 'move', path: reserved, to: 'moved' }] },
+        { operations: [{ op: 'remove', path: 'ordinary.txt' }], protect: [reserved] },
+      ]) denied(await call(root, 'batch', { action: 'plan', ...args }))
+    }
+    assert.equal(fs.readFileSync(path.join(root, 'ordinary.txt'), 'utf8'), content)
+  })
+})
+
+await test('public write cannot plant a forged pending manifest for batch resume (#329)', async () => {
+  await withTempDir('audit-forgery', async root => {
+    const victim = path.join(root, 'victim.txt'); fs.writeFileSync(victim, content)
+    const plan = await call(root, 'batch', { action: 'plan', operations: [{ op: 'remove', path: 'victim.txt' }] })
+    assert.equal(plan.status, 'planned', JSON.stringify(plan))
+    const manifest = JSON.parse(fs.readFileSync(path.join(root, '.dsh-ops', `${plan.id}.000000.json`), 'utf8'))
+    const id = `j-${randomUUID()}`, target = path.join(root, '.dsh-ops', `${id}.000000.json`)
+    manifest.id = id
+    const before = snapshot(root)
+    denied(await call(root, 'write_file', { path: target, content: JSON.stringify(manifest), expectedRevision: 'absent' }))
+    assert.deepEqual(snapshot(root), before)
+    const resumed = await call(root, 'batch', { action: 'resume', id })
+    assert.equal(resumed.error.code, 'NOT_FOUND', JSON.stringify(resumed))
+    assert.equal(fs.readFileSync(victim, 'utf8'), content)
+  })
+})
+
+await test('trusted batch plan/resume and legacy result put/page/release retain audit access', async () => {
+  await withTempDir('audit-lifecycle', async root => {
+    const victim = path.join(root, 'victim.txt'); fs.writeFileSync(victim, content)
+    const plan = await call(root, 'batch', { action: 'plan', operations: [{ op: 'remove', path: 'victim.txt' }] })
+    assert.equal(plan.status, 'planned', JSON.stringify(plan))
+    const done = await call(root, 'batch', { action: 'resume', id: plan.id })
+    assert.equal(done.status, 'completed', JSON.stringify(done))
+    assert.equal(done.done, 1)
+    assert.equal(fs.existsSync(victim), false)
+    assert.equal((await call(root, 'batch', { action: 'resume', id: plan.id })).done, 1)
+    const audit = await call(root, 'result', { action: 'page', id: plan.id }, { readOnly: true })
+    assert.equal(audit.complete, true)
+    assert.equal(audit.items[0].state, 'completed')
+    fs.writeFileSync(victim, content)
+    const run = await call(root, 'batch', { action: 'run', operations: [{ op: 'copy', path: 'victim.txt', to: 'copy.txt' }] })
+    assert.equal(run.status, 'completed', JSON.stringify(run))
+    assert.equal(fs.readFileSync(path.join(root, 'copy.txt'), 'utf8'), content)
+    const stored = await call(root, 'result', { action: 'put', items: [{ trusted: true }] })
+    assert.ok(stored.id?.startsWith('r-'), JSON.stringify(stored))
+    const page = await call(root, 'result', { action: 'page', id: stored.id }, { readOnly: true })
+    assert.deepEqual(page.items, [{ trusted: true }])
+    assert.equal((await call(root, 'result', { action: 'release', id: stored.id })).status, 'released')
+    assert.ok(fs.readdirSync(path.join(root, '.dsh-ops')).some(name => name.startsWith(plan.id)))
+  })
+})
+
+await test('trusted session cache put/page/release remains independent of the public path guard', async () => {
+  await withTempDir('audit-cache', async root => {
+    const cache = path.join(root, 'cache'); fs.mkdirSync(cache, { mode: 0o700 })
+    const invoke = async args => envelopeOf(await callWorker(JSON.stringify({
+      version: 1, requestId: 'audit-cache', component: 'ptc',
+      budget: { timeoutMs: 30000, maxBytes: 131072 },
+      storage: { root: cache, authorityId: 'a'.repeat(64), allowedTools: ['result', 'batch'] },
+      request: request('result', args, { root, writeRoots: [] }),
+    })), assert)
+    const stored = await invoke({ action: 'put', items: [{ trusted: 'cache' }] })
+    assert.equal(stored.status, 'completed', JSON.stringify(stored))
+    assert.ok(stored.id.startsWith('ref://'))
+    assert.deepEqual((await invoke({ action: 'page', id: stored.id })).items, [{ trusted: 'cache' }])
+    assert.equal((await invoke({ action: 'release', id: stored.id })).status, 'released')
+    assert.equal(fs.existsSync(path.join(root, '.dsh-ops')), false)
+  })
+})
+
+report('audit-store-paths')
diff --git a/test/authority.test.mjs b/test/authority.test.mjs
index ad4599a7..7a84dcf6 100644
--- a/test/authority.test.mjs
+++ b/test/authority.test.mjs
@@ -4,7 +4,7 @@ import path from 'node:path'
 import { createHash } from 'node:crypto'
 import Subprocess from '@deepseek-ai/dsh-subprocess-local'
 import { createScope } from '@deepseek-ai/dsh-scope'
-import { assert, test, report, withTempDir, skipSuite } from './lib/harness.mjs'
+import { assert, test, report, withTempDir, skipSuite, waitFor } from './lib/harness.mjs'
 import { bootHost, shutdown } from './lib/host.mjs'
 import { invoke as fileCall } from '../lib/file/worker.js'
 import { invoke as ptcCall } from '../lib/ptc/worker.js'
@@ -221,6 +221,7 @@ await test('Bash stops on a middle-preparation authority change using the real s
       await ctx.plugin(inner => inner.provide('sandboxPolicy', { resolve: () => ({ mode: race && ++resolves > 1 ? 'workspace-write' : 'danger-full-access', workspaceRoot: root }) }))
       await ctx.plugin({ inject: ['tools'], apply(inner) { mountSessionBash(inner, { publishBashTool: true }, { bash: { available: true, file: process.execPath, source: 'config' } }) } })
       await ctx.serial('agent/created', { agent })
+      await waitFor(() => ctx.get('tools').get('ops_bash', agent), { what: 'deferred Bash publication' })
       const tool = ctx.get('tools').get('ops_bash', agent)
       assert.ok(tool)
       race = true
diff --git a/test/bash-ipc-roots.test.mjs b/test/bash-ipc-roots.test.mjs
new file mode 100644
index 00000000..56f559cc
--- /dev/null
+++ b/test/bash-ipc-roots.test.mjs
@@ -0,0 +1,30 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { pinnedBashExecutable } from '../lib/shells/pinned.js'
+import { confinedBash } from '../lib/bash-ipc.js'
+import { independentBashRoots } from './lib/bash-ipc-processes.mjs'
+import { assert, test, report, withTempDir } from './lib/harness.mjs'
+
+await test('independent restricted Bash roots reopen the user shared section (#363)', async () => {
+  if (process.platform !== 'win32') {
+    console.log('  Windows restricted MSYS fixture unavailable: non-Windows host')
+    return
+  }
+  const file = pinnedBashExecutable({ file: process.env.DSH_OPS_TEST_BASH })
+  const source = path.resolve(path.dirname(file), '../usr/bin')
+  await withTempDir('bash-ipc-roots', async home => {
+    // Only Bash builtins are exercised. Preserve the pinned executable and DLL bytes while
+    // avoiding copies of unrelated Git documentation/programs for this IPC regression.
+    const minimal = path.join(home, 'payload/usr/bin')
+    fs.mkdirSync(minimal, { recursive: true })
+    for (const name of fs.readdirSync(source).filter(name => name === 'bash.exe' || name.endsWith('.dll'))) {
+      fs.copyFileSync(path.join(source, name), path.join(minimal, name))
+    }
+    const runtime = confinedBash(path.join(minimal, 'bash.exe'), { home })
+    assert.ok(runtime.runtime)
+    const workspace = path.join(home, 'workspace')
+    fs.mkdirSync(workspace)
+    await independentBashRoots(runtime, workspace)
+  })
+})
+report('bash-ipc-roots')
diff --git a/test/bench-ci.test.mjs b/test/bench-ci.test.mjs
index 9811100d..b0640c6f 100644
--- a/test/bench-ci.test.mjs
+++ b/test/bench-ci.test.mjs
@@ -65,7 +65,13 @@ await test('"CI required" neither waits on nor judges the smoke', () => {
 await test('the smoke drives the one CLI entry point with the same binary on both sides', () => {
   assert.match(benchRuns, /node bench\/cli\.mjs tools\b/u, 'the smoke goes through the single cross-platform entry')
   assert.match(benchRuns, /--baseline "\$worker" --candidate "\$worker"/u, 'both sides are the same staged worker')
-  assert.match(benchRuns, /runtime\/linux-x64\/dsh-ops-worker/u, 'it uses the worker this job just built and staged')
+  assert.ok(benchRuns.includes('runtime/${{ matrix.target }}/${{ matrix.worker }}'), 'each runner uses its own staged worker')
+  assert.equal(benchJob['runs-on'], '${{ matrix.os }}')
+  assert.deepEqual(benchJob.strategy.matrix.include, [
+    { os: 'ubuntu-24.04', target: 'linux-x64', worker: 'dsh-ops-worker' },
+    { os: 'windows-latest', target: 'win32-x64', worker: 'dsh-ops-worker.exe' },
+    { os: 'macos-latest', target: 'darwin-arm64', worker: 'dsh-ops-worker' },
+  ])
   assert.doesNotMatch(benchRuns, /bench\/cli\.mjs ab\b/u, 'the model-driven sweep is never run in CI')
   for (const flag of ['--max-ms', '--budget', '--threshold']) {
     assert.equal(benchRuns.includes(flag), false, `no timing gate in the smoke (${flag})`)
@@ -81,6 +87,7 @@ await test('the smoke uploads report.md / run.json / panel.html when they exist'
   assert.equal(uploads.length, 1, 'the smoke uploads exactly one artifact')
   const upload = uploads[0]
   assert.match(String(upload.with?.name ?? ''), /-report$/u, 'the name follows the tools-trial-report convention')
+  assert.ok(upload.with.name.includes('${{ matrix.target }}'), 'parallel platforms never overwrite one another’s artifact')
   assert.equal(upload.with?.['if-no-files-found'], 'warn', 'a tools-only smoke makes no run.json and must not fail on that')
   assert.match(String(upload.if ?? ''), /always\(\)/u, 'evidence is uploaded even when the comparison is red')
   const paths = String(upload.with?.path ?? '')
diff --git a/test/bench-cli.test.mjs b/test/bench-cli.test.mjs
index b54894fd..c28f5ef7 100644
--- a/test/bench-cli.test.mjs
+++ b/test/bench-cli.test.mjs
@@ -78,7 +78,7 @@ await test('ab --show prints the three commands and this suite never starts a sw
   const text = lines.join('\n')
   assert.equal(text.split('\n').filter((line) => line.startsWith('node ')).length, 3, text)
   assert.match(text, /node bench\/run\.mjs --label bench-base --profile bench-base --task csv-sum/)
-  assert.match(text, /node bench\/compare\.mjs bench-base bench-ops --folder benchmark-test-\d+/)
+  assert.match(text, /node bench\/compare\.mjs bench-base bench-ops --folder benchmark-\d{4}-\d{2}-\d{2}-\d{2}/)
   // Only assert the pending path while the runner is genuinely absent: once it lands,
   // `abMain([])` would spawn a real session, and a unit suite must never do that.
   if (!fs.existsSync(path.join(PACKAGE_ROOT, 'bench/run.mjs'))) {
@@ -98,18 +98,20 @@ await test('ab parsing defaults, repeats --task, and rejects malformed flags', (
 })
 await test('next-folder hands one group to both sides and skips anything already named', async () => {
   await withTempDir('bench-runs', (runs) => {
-    assert.equal(nextFolderName(runs), `${FOLDER_PREFIX}01`)
+    const day = new Date(2026, 9, 24, 15, 42) // mid-day local 2026-10-24; the clock must not steer the name
+    const stamp = `${FOLDER_PREFIX}2026-10-24`
+    assert.equal(nextFolderName(runs, day), `${stamp}-00`)
     const explicit = planAb(['--folder', 'ops-1'], { runsDir: runs })
     assert.equal(explicit.folder, 'ops-1')
     assert.equal(explicit.allocated, false)
     assert.deepEqual(explicit.commands.map((command) => command.args.at(-1)), ['ops-1', 'ops-1', 'ops-1'])
-    fs.mkdirSync(path.join(runs, `${FOLDER_PREFIX}01`))
-    fs.mkdirSync(path.join(runs, `${FOLDER_PREFIX}02`))
-    fs.mkdirSync(path.join(runs, `${FOLDER_PREFIX.toUpperCase()}03`)) // Windows would collide with this one
+    fs.mkdirSync(path.join(runs, `${stamp}-00`))
+    fs.mkdirSync(path.join(runs, `${stamp}-01`))
+    fs.mkdirSync(path.join(runs, `${stamp.toUpperCase()}-02`)) // Windows would collide with this one
     fs.writeFileSync(path.join(runs, 'unrelated.txt'), '')
-    assert.equal(nextFolderName(runs), `${FOLDER_PREFIX}04`)
-    assert.ok(takenFolders(runs).has(`${FOLDER_PREFIX}01`))
-    assert.equal(planAb(['--task', 'x'], { runsDir: runs }).folder, `${FOLDER_PREFIX}04`)
+    assert.equal(nextFolderName(runs, day), `${stamp}-03`)
+    assert.ok(takenFolders(runs).has(`${stamp}-00`))
+    assert.equal(planAb(['--task', 'x'], { runsDir: runs, now: day }).folder, `${stamp}-03`)
   })
 })
 await test('a good task validates, gets its timeout defaulted, and round-trips through a directory', async () => {
@@ -184,7 +186,7 @@ await test('the spawn plan never uses a shim and keeps argv verbatim', () => {
   assert.equal(exe.command, '/usr/bin/dsh')
   assert.deepEqual(exe.args, ['--version'])
 })
-await test('run.schema.json parses, describes every property with a unit, and matches the README', () => {
+await test('run.schema.json parses and describes every property with a unit', () => {
   const schema = JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT, 'bench', 'run.schema.json'), 'utf8'))
   assert.equal(schema.$schema, 'https://json-schema.org/draft/2020-12/schema')
   assert.deepEqual([...schema.required].sort(), Object.keys(schema.properties).sort())
@@ -209,13 +211,6 @@ await test('run.schema.json parses, describes every property with a unit, and ma
   walk(schema, 'run.json')
   assert.deepEqual(missing, [], 'every property documents itself')
   assert.deepEqual(units, [], 'every numeric field names its unit')
-
-  const readme = fs.readFileSync(path.join(PACKAGE_ROOT, 'bench', 'README.md'), 'utf8')
-  const section = readme.split(/^## /m).find((part) => part.startsWith('run.json 契约'))
-  assert.ok(section, 'README documents the run.json contract')
-  const documented = [...section.matchAll(/^\|\s*`([A-Za-z][A-Za-z0-9]*)`\s*\|/gm)].map((match) => match[1])
-  assert.ok(documented.length > 0, 'the contract table has rows')
-  assert.deepEqual([...documented].sort(), Object.keys(schema.properties).sort())
 })
 
 report('bench-cli')
diff --git a/test/bench-compare-core.test.mjs b/test/bench-compare-core.test.mjs
index ed2405cc..00bd19ad 100644
--- a/test/bench-compare-core.test.mjs
+++ b/test/bench-compare-core.test.mjs
@@ -26,6 +26,7 @@ import {
   FAIL_ON,
   NOISE_FORMAT,
   REGRESSION_SCOPES,
+  aggregateTask,
   compareSummaries,
   geometricMeanPct,
   median,
@@ -58,6 +59,7 @@ function run(taskId, tokens, pass, extra = {}) {
     steps: extra.steps ?? 4,
     toolCalls: extra.toolCalls ?? 6,
     toolErrors: extra.toolErrors ?? 0,
+    durationMs: extra.durationMs ?? 60_000,
     toolCallsByName: {},
     verify: { passed: pass, checks: [] },
     exitCode: 0,
@@ -131,6 +133,28 @@ await test('the vocabularies and the scalar helpers are pinned', () => {
   assert.equal(percentChange(0, 0), 0)
 })
 
+await test('durations aggregate like steps: median/min per task, totals summed, gate unchanged', () => {
+  const aggregate = aggregateTask([
+    run('csv-sum', 1000, true, { repeatIndex: 1, durationMs: 60_000 }),
+    run('csv-sum', 1000, true, { repeatIndex: 2, durationMs: 62_000 }),
+  ])
+  assert.equal(aggregate.durationMsMedian, 61_000, 'the wall-clock median follows the same aggregate as steps')
+  assert.equal(aggregate.durationMsMin, 60_000)
+
+  // 60.0s of base work against 55.0s of candidate work: the delta and the sums are
+  // evidence in the document, and the gate still judges tokens and pass rate.
+  const base = summary('bench-base', [run('csv-sum', 1000, true, { durationMs: 60_000 })])
+  const faster = compareSummaries(base, summary('bench-ops', [run('csv-sum', 1000, true, { durationMs: 55_000 })]), { noiseFloorPct: 3.1, failOn: 'both' })
+  assert.equal(faster.tasks[0].delta.durationPct, -8.3)
+  assert.equal(faster.totals.baseDurationMs, 60_000)
+  assert.equal(faster.totals.candDurationMs, 55_000)
+  assert.equal(faster.gate.fail, false, 'identical tokens and passes gate clean')
+
+  const slower = compareSummaries(base, summary('bench-ops', [run('csv-sum', 1000, true, { durationMs: 600_000 })]), { noiseFloorPct: 3.1, failOn: 'both' })
+  assert.equal(slower.tasks[0].delta.durationPct, 900)
+  assert.equal(slower.gate.fail, false, 'the gate still judges tokens and pass rate, not wall-clock')
+})
+
 await test('pass-drop outranks a token win and is the first reason given', () => {
   const base = summary('base', [run('csv-sum', 1000, true), run('csv-sum', 1000, true)])
   const cand = summary('cand', [run('csv-sum', 400, true), run('csv-sum', 400, false)])
diff --git a/test/bench-compare.test.mjs b/test/bench-compare.test.mjs
index f0d090f7..753e2a7b 100644
--- a/test/bench-compare.test.mjs
+++ b/test/bench-compare.test.mjs
@@ -57,6 +57,7 @@ function metrics(taskId, tokens, pass, extra = {}) {
     steps: extra.steps ?? 4,
     toolCalls: extra.toolCalls ?? 6,
     toolErrors: extra.toolErrors ?? 0,
+    durationMs: extra.durationMs ?? 60_000,
     toolCallsByName: extra.toolCallsByName ?? { ops_read: 2, bash: 1 },
     verify: { passed: pass, checks: [] },
     exitCode: 0,
@@ -152,12 +153,6 @@ function literal(text) {
   return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
 }
 
-/** The two resolved sides a render needs, with stable paths. */
-const SOURCES = {
-  base: { file: '/runs/aa/base/run.json', spec: 'bench-base', kind: 'run' },
-  cand: { file: '/runs/aa/cand/run.json', spec: 'bench-ops', kind: 'run' },
-}
-
 /** The two spans the report paints every percent with: green for a drop, red for a rise. */
 const green = (text) => `<span style="color:#3fb950">${text}</span>`
 const red = (text) => `<span style="color:#f85149">${text}</span>`
@@ -165,98 +160,97 @@ const red = (text) => `<span style="color:#f85149">${text}</span>`
 /** The report is English-only: no CJK character may reach a generated artifact. */
 const assertEnglish = (text) => assert.doesNotMatch(text, /[\u3400-\u4dbf\u4e00-\u9fff\uf900-\ufaff]/, 'the report must not contain CJK characters')
 
-await test('the same comparison renders byte-identical text twice, and the closing conclusion words each noise outcome', () => {
+await test('the same comparison renders byte-identical text twice: tables first, Evidence last, no verdict prose', () => {
   const base = summary('bench-base', [metrics('csv-sum', 1000, true), metrics('csv-sum', 1000, true)])
-  const cheaper = summary('bench-ops', [metrics('csv-sum', 926, true), metrics('csv-sum', 926, true)])
+  const cheaper = summary('bench-ops', [metrics('csv-sum', 926, true, { durationMs: 55_000 }), metrics('csv-sum', 926, true, { durationMs: 55_000 })])
   const beyond = compareSummaries(base, cheaper, { noiseFloorPct: 3.1, failOn: 'both' })
-  const text = renderReport(beyond, SOURCES)
-  assert.equal(renderReport(beyond, SOURCES), text, 'rendering is a pure function of its inputs')
+  const text = renderReport(beyond)
+  assert.equal(renderReport(beyond), text, 'rendering is a pure function of its inputs')
   assertEnglish(text)
-  assert.match(text, /^# DSH-OPS Benchmark Report\n\n## Per-task pairs$/m, 'the title leads straight into the data — no summary bar')
-  assert.match(text, /^\| task \| base \| cand \(Δ%\) \| steps base→cand \(Δ%\) \| tool calls base→cand \(Δ%\) \| tool errors \| pass \|$/m, 'the first table carries cost, behaviour and pass: no pairs, exclusion or direction column')
-  assert.ok(text.includes(`| csv-sum | 1,000 | 926 (${green('\u22127.4%')}) | 4 → 4 (${green('0.0%')}) | 6 → 6 (${green('0.0%')}) | 0 → 0 | 2/2→2/2 |`), 'each cell keeps its own Δ% in parentheses, painted like every other percent')
+  assert.match(text, /^# DSH-OPS Benchmark Report \(beta\)\n\nCondition: unknown\nCandidate switches: null \(null means unknown\)\n\nPlatform: base=unknown; cand=unknown\./, 'the header states condition, switches and environment evidence before the data')
+  assert.match(text, /^## Per-task pairs$/m)
+  assert.match(text, /^\| task \| base \| ops \(Δ%\) \| steps: base→ops \(Δ%\) \| tool calls: base→ops \(Δ%\) \| time: base→ops \(Δ%\) \| tool errors \| pass \|$/m, 'the first table carries cost, behaviour, wall-clock evidence and pass: no pairs, exclusion or direction column')
+  assert.ok(text.includes(`| csv-sum | 1,000 | 926 (${green('\u22127.4%')}) | 4 → 4 (${green('0.0%')}) | 6 → 6 (${green('0.0%')}) | 60.0s → 55.0s (${green('\u22128.3%')}) | 0 → 0 | 2/2→2/2 |`), 'each cell keeps its own Δ% in parentheses, painted like every other percent — time included')
   assert.doesNotMatch(text, /geomean/, 'the table ends at TOTAL: the geomean row is gone')
   assert.doesNotMatch(text, /## Excluded pairs|## A\/A noise band|## Token attribution/, 'the report keeps to cost, calls and the verdict: the three diagnostic sections are gone')
-  assert.doesNotMatch(text, /^## (Per-task pairs|Tool calls \(per-side overlap counts\)|Per-task bucket detail \(median\)|usage split \(TOTAL, median\)|steps and tool calls \(median\))\n\n(?!\|)/m, 'a table heading leads straight into its table: no explanatory line')
-  assert.match(text, /^- base:\/runs\/aa\/base\/run\.json\(spec `bench-base`,run\)$/m, 'the compared sides stay named in Evidence')
-  assert.match(text, /^- cand:\/runs\/aa\/cand\/run\.json\(spec `bench-ops`,run\)$/m)
+  assert.doesNotMatch(text, /^## (Per-task pairs|Tool calls|Per-task bucket detail|Per-request overhead)\n\n(?!\|)/m, 'a table heading leads straight into its table: no explanatory line')
   const headings = text.split('\n').filter((line) => line.startsWith('## '))
-  assert.equal(headings[headings.length - 1], '## Conclusion', 'the conclusion closes the report')
-  assert.ok(text.includes(`- Direction: Δ ${green('\u22127.4%')}, beyond the noise floor ±${red('3.1%')} ⇒ readable direction: cheaper`), 'a drop beyond the band reads green')
-  assert.ok(text.includes(`- noise floor (A/A): ±${red('3.1%')}, method \`provided\``))
-  assert.match(text, /Time fields are evidence only/)
-
-  // Inside the band: the interval is reported, the direction is not.
-  const inside = compareSummaries(base, summary('bench-ops', [metrics('csv-sum', 975, true), metrics('csv-sum', 975, true)]), { noiseFloorPct: 3.1, failOn: 'both' })
-  const insideText = renderReport(inside, SOURCES)
-  assert.ok(insideText.includes(`- Direction: Δ ${green('\u22122.5%')} sits inside the noise band ±${red('3.1%')} ⇒ interval only, no direction is read (within-noise)`))
-  assert.doesNotMatch(insideText, /readable direction/)
-  assert.match(insideText, /- gate: 🚦 passed ·/)
-
-  // No floor at all: the report says so and withholds every direction.
-  const unknown = compareSummaries(base, summary('bench-ops', [metrics('csv-sum', 1500, true), metrics('csv-sum', 1500, true)]), { failOn: 'both' })
-  const unknownText = renderReport(unknown, SOURCES)
-  assert.match(unknownText, /- noise floor \(A\/A\): unknown \(noise-floor-unknown\)/)
-  assert.ok(unknownText.includes(`- Direction: Δ ${red('+50.0%')}, but the noise floor is unknown ⇒ abstaining, no direction is read (noise-floor-unknown)`))
-  assert.match(unknownText, /--noise-floor-pct N or --noise <base> <cand>/)
-  assert.doesNotMatch(unknownText, /readable direction/)
-  assert.match(unknownText, /- gate: 🚦 passed ·/, 'an abstaining gate is not a failed gate')
-
-  // A costlier delta beyond the band is the one case that names a regression.
+  assert.equal(headings[headings.length - 1], '## Per-request overhead (what every request costs before any work)', 'the overhead table closes the report')
+  assert.doesNotMatch(text, /## Conclusion|## Warnings|## Evidence|## Usage split|## steps and tool calls|Direction:|noise floor \(A\/A\)|- gate:/, 'no verdict, warning or evidence prose: the verdict lives in the exit code and the comparison document')
+  assert.doesNotMatch(text, /Time is reported/, 'the report is tables and nothing else')
+
+  // The gate still judges even though the report no longer prints a conclusion: a
+  // costlier delta fails the comparison document, and the CLI maps it to exit 1.
   const worse = compareSummaries(base, summary('bench-ops', [metrics('csv-sum', 1050, true), metrics('csv-sum', 1050, true)]), { noiseFloorPct: 3.1, failOn: 'both' })
-  const worseText = renderReport(worse, SOURCES)
-  assert.ok(worseText.includes(`- Direction: Δ ${red('+5.0%')}, beyond the noise floor ±${red('3.1%')} ⇒ readable direction: costlier`), 'a rise beyond the band reads red')
-  assert.match(worseText, /- gate: 🚦 failed \(regression\) ·/)
-  assert.ok(worseText.includes(`| csv-sum | 1,000 | 1,050 (${red('+5.0%')}) | 4 → 4 (${green('0.0%')}) | 6 → 6 (${green('0.0%')}) | 0 → 0 | 2/2→2/2 |`))
-  assert.ok(worseText.includes(`- reason: token regression: csv-sum 1,050 > 1,020 (base 1,000 + ${red('2%')}; noise ±${red('3.1%')})`), 'a reason quoted from the core is painted too, its digits intact')
-  for (const rendered of [insideText, unknownText, worseText]) assertEnglish(rendered)
+  const worseText = renderReport(worse)
+  assert.ok(worseText.includes(`| csv-sum | 1,000 | 1,050 (${red('+5.0%')}) | 4 → 4 (${green('0.0%')}) | 6 → 6 (${green('0.0%')}) | 60.0s → 60.0s (${green('0.0%')}) | 0 → 0 | 2/2→2/2 |`))
+  assert.equal(worse.gate.fail, true, 'the gate verdict stays in the comparison document')
+  assert.equal(worse.gate.primary, 'regression')
+  assertEnglish(worseText)
 })
 
-await test('the steps and tool calls table pairs each task, sums the totals, and reads the aggregate its title names', () => {
+await test('the first table reads the aggregate its flag names: medians, min, halved medians and raw error counts', () => {
   const base = summary('bench-base', [metrics('csv-sum', 1000, true, { steps: 5 }), metrics('csv-sum', 1000, true, { steps: 3 })])
   const cand = summary('bench-ops', [metrics('csv-sum', 900, true, { steps: 3 }), metrics('csv-sum', 900, true, { steps: 3 })])
-
-  const text = renderReport(compareSummaries(base, cand, { noiseFloorPct: 3.1, failOn: 'both' }), SOURCES)
+  const text = renderReport(compareSummaries(base, cand, { noiseFloorPct: 3.1, failOn: 'both' }))
   assertEnglish(text)
-  assert.match(text, /^## steps and tool calls \(median\)$/m)
-  assert.ok(text.includes(`| csv-sum | 4 → 3 (${green('\u221225.0%')}) | 6 → 6 (${green('0.0%')}) |`))
-  assert.ok(text.includes(`| **TOTAL** | 4 → 3 (${green('\u221225.0%')}) | 6 → 6 (${green('0.0%')}) |`), 'no change is green too')
+  assert.ok(text.includes(`| csv-sum | 1,000 | 900 (${green('\u221210.0%')}) | 4 → 3 (${green('\u221225.0%')}) | 6 → 6 (${green('0.0%')}) | 60.0s → 60.0s (${green('0.0%')}) | 0 → 0 | 2/2→2/2 |`), 'the steps and tool-call cells carry the medians with their Δ%')
 
-  // `min` must move the cells, not only the title: the same fixture reads 3 → 3.
-  const minText = renderReport(compareSummaries(base, cand, { noiseFloorPct: 3.1, failOn: 'both', aggregate: 'min' }), SOURCES)
-  assert.match(minText, /^## steps and tool calls \(min\)$/m)
-  assert.ok(minText.includes(`| csv-sum | 3 → 3 (${green('0.0%')}) | 6 → 6 (${green('0.0%')}) |`))
-  assert.ok(minText.includes(`| **TOTAL** | 3 → 3 (${green('0.0%')}) | 6 → 6 (${green('0.0%')}) |`))
+  const minText = renderReport(compareSummaries(base, cand, { noiseFloorPct: 3.1, failOn: 'both', aggregate: 'min' }))
+  assert.ok(minText.includes(`| 3 → 3 (${green('0.0%')}) | 6 → 6 (${green('0.0%')}) |`), '`min` moves the cells, not only the title')
 
   // An even repeat count halves the median: the cell has to show 12.5, not round it
   // into "13 → 13 (+4.0%)", which contradicts its own Δ%.
   const halfBase = summary('bench-base', [metrics('csv-sum', 1000, true, { toolCalls: 13 }), metrics('csv-sum', 1000, true, { toolCalls: 12 })])
   const halfCand = summary('bench-ops', [metrics('csv-sum', 900, true, { toolCalls: 13 }), metrics('csv-sum', 900, true, { toolCalls: 13 })])
-  const halfText = renderReport(compareSummaries(halfBase, halfCand, { noiseFloorPct: 3.1, failOn: 'both' }), SOURCES)
-  assert.ok(halfText.includes(`| csv-sum | 4 → 4 (${green('0.0%')}) | 12.5 → 13 (${red('+4.0%')}) |`))
+  const halfText = renderReport(compareSummaries(halfBase, halfCand, { noiseFloorPct: 3.1, failOn: 'both' }))
+  assert.ok(halfText.includes(`| 12.5 → 13 (${red('+4.0%')}) |`), 'a halved median shows 12.5, not a rounded 13')
 
   // Tool errors are raw counts in the first table, not a median ratio: 2 → 0.
   const errBase = summary('bench-base', [metrics('csv-sum', 1000, true, { toolErrors: 2 })])
   const errCand = summary('bench-ops', [metrics('csv-sum', 900, true, { toolErrors: 0 })])
-  const errText = renderReport(compareSummaries(errBase, errCand, { noiseFloorPct: 3.1, failOn: 'both' }), SOURCES)
-  assert.ok(errText.includes('| 2 → 0 | 1/1→1/1 |'), 'tool errors are counted, not percentaged')
+  const errText = renderReport(compareSummaries(errBase, errCand, { noiseFloorPct: 3.1, failOn: 'both' }))
+  assert.ok(errText.includes(`| 60.0s → 60.0s (${green('0.0%')}) | 2 → 0 | 1/1→1/1 |`), 'tool errors are counted, not percentaged')
+})
+
+await test('the per-request overhead table prices the first request and degrades without prompt data', () => {
+  const base = summary('bench-base', [
+    metrics('csv-sum', 1000, true, { steps: 6, firstStep: 6249, total: 15186 }),
+    metrics('csv-sum', 1000, true, { steps: 6, firstStep: 6249, total: 15186 }),
+  ])
+  const cand = summary('bench-ops', [
+    metrics('csv-sum', 1000, true, { steps: 6, firstStep: 8032, total: 23628 }),
+    metrics('csv-sum', 1000, true, { steps: 6, firstStep: 8032, total: 23628 }),
+  ])
+  const text = renderReport(compareSummaries(base, cand, { noiseFloorPct: 3.1, failOn: 'both' }))
+  assertEnglish(text)
+  assert.match(text, /^## Per-request overhead \(what every request costs before any work\)$/m)
+  assert.ok(text.includes(`| csv-sum | 6,249 → 8,032 (+1,783, ${red('+28.5%')}) |`), 'the row carries only the first-request delta, abs and painted pct')
+  assert.doesNotMatch(text, /prompt \/ step|Fixed per-request cost|The first request of a run carries no history/)
+
+  const noPrompt = renderReport(compareSummaries(
+    summary('bench-base', [metrics('csv-sum', 1000, true, { prompt: false })]),
+    summary('bench-ops', [metrics('csv-sum', 1000, true, { prompt: false })]),
+  ))
+  assert.match(noPrompt, /Skipped: neither side recorded `metrics\.prompt`/, 'no prompt data ⇒ the section says so instead of inventing numbers')
+  assert.doesNotMatch(noPrompt, /first request: base→ops/)
 })
 
 await test('the tool table keeps the per-side totals, splits them by task, and colours adoption', () => {
   const base = summary('bench-base', [metrics('csv-sum', 1000, true, { toolCallsByName: { ops_read: 2, bash: 1, write: 4 } })])
   const cand = summary('bench-ops', [metrics('csv-sum', 900, true, { toolCallsByName: { ops_read: 3, bash: 2, write: 4 } })])
-  const text = renderReport(compareSummaries(base, cand, { noiseFloorPct: 3.1, failOn: 'both' }), SOURCES)
-  assert.match(text, /^## Tool calls \(per-side overlap counts\)$/m)
+  const text = renderReport(compareSummaries(base, cand, { noiseFloorPct: 3.1, failOn: 'both' }))
+  assert.match(text, /^## Tool calls$/m)
   const headings = text.split('\n').filter((line) => line.startsWith('## '))
-  assert.equal(headings[1], '## Tool calls (per-side overlap counts)', 'the tool table sits directly under the per-task pair table: it is the first explanation of where the token Δ went')
-  assert.match(text, /^\| tool \| base \| cand \| csv-sum \|$/m, 'the base/cand totals stay, and each task adds a column')
+  assert.equal(headings[1], '## Tool calls', 'the tool table sits directly under the per-task pair table: it is the first explanation of where the token Δ went')
+  assert.match(text, /^\| tool \| base \| ops \| csv-sum \|$/m, 'the base/ops totals stay, and each task adds a column')
   assert.ok(text.includes(`| ops_read | 2 | ${green('3')} | 2 → ${green('3')} |`), 'an ops tool rising is green: the plugin replaced a built-in')
   assert.ok(text.includes(`| bash | 1 | ${red('2')} | 1 → ${red('2')} |`), 'a built-in rising is red: the candidate reached past the plugin')
   assert.ok(text.includes('| write | 4 | 4 | 4 → 4 |'), 'equal counts are not painted')
 
   // Falling is green for a built-in and red for an ops tool: adoption, not the sign.
   const closed = summary('bench-ops', [metrics('csv-sum', 900, true, { toolCallsByName: { ops_read: 3 } })])
-  const closedText = renderReport(compareSummaries(base, closed, { noiseFloorPct: 3.1, failOn: 'both' }), SOURCES)
+  const closedText = renderReport(compareSummaries(base, closed, { noiseFloorPct: 3.1, failOn: 'both' }))
   assert.ok(closedText.includes(`| bash | 1 | ${green('0')} | 1 → ${green('0')} |`), 'a built-in the candidate stopped calling is green')
   assert.ok(closedText.includes(`| write | 4 | ${green('0')} | 4 → ${green('0')} |`))
 
@@ -265,7 +259,7 @@ await test('the tool table keeps the per-side totals, splits them by task, and c
     summary('bench-ops', [metrics('csv-sum', 900, true, { toolCallsByName: { ops_read: 2 } })]),
     { noiseFloorPct: 3.1, failOn: 'both' },
   )
-  assert.ok(renderReport(declined, SOURCES).includes(`| ops_read | 5 | ${red('2')} | 5 → ${red('2')} |`), 'an ops tool falling is red: adoption moved backwards')
+  assert.ok(renderReport(declined).includes(`| ops_read | 5 | ${red('2')} | 5 → ${red('2')} |`), 'an ops tool falling is red: adoption moved backwards')
 
   // Each task keeps its own column; a tool nobody used in a task reads as a dash.
   const twoTasks = compareSummaries(
@@ -273,8 +267,8 @@ await test('the tool table keeps the per-side totals, splits them by task, and c
     summary('bench-ops', [metrics('csv-sum', 900, true, { toolCallsByName: { ops_read: 3 } }), metrics('api-rename', 900, true, { toolCallsByName: { ops_read: 4 } })]),
     { noiseFloorPct: 3.1, failOn: 'both' },
   )
-  const twoText = renderReport(twoTasks, SOURCES)
-  assert.match(twoText, /^\| tool \| base \| cand \| csv-sum \| api-rename \|$/m)
+  const twoText = renderReport(twoTasks)
+  assert.match(twoText, /^\| tool \| base \| ops \| csv-sum \| api-rename \|$/m)
   assert.ok(twoText.includes(`| ops_read | 3 | ${green('7')} | 1 → ${green('3')} | 2 → ${green('4')} |`), 'the count belongs to the task that made the call')
 })
 
@@ -282,18 +276,17 @@ await test('excluded pairs leave the report body but stay in the warnings, and t
   const base = summary('bench-base', [metrics('csv-sum', 1000, true), metrics('csv-sum', 1000, true), metrics('csv-sum', 1000, true)])
   const cand = summary('bench-ops', [metrics('csv-sum', 500, true), metrics('csv-sum', 100, false), metrics('csv-sum', 200, false)])
   const comparison = compareSummaries(base, cand, { noiseFloorPct: 3.1, failOn: 'pass-drop' })
-  const text = renderReport(comparison, SOURCES)
+  const text = renderReport(comparison)
   assertEnglish(text)
   assert.doesNotMatch(text, /## Excluded pairs/, 'the section is gone; the counts must not vanish with it')
   assert.ok(text.includes(`| csv-sum | 1,000 | 500 (${green('\u221250.0%')}) |`), 'the pair table still prices the one usable pair')
   assert.ok(text.includes('| 3/3→1/3 |'), 'the pass column counts every repeat, not only the usable pairs')
   assert.doesNotMatch(text, /pairs usable\/counted/, 'the usable/considered split no longer has a column')
-  assert.match(text, /- cost-pairs-excluded: 2 \(base 0, cand 2, both 0\)/, 'the warnings still carry how many pairs the cost statistics lost')
+  assert.ok(comparison.warnings.includes('cost-pairs-excluded: 2 (base 0, cand 2, both 0)'), 'the comparison document still carries how many pairs the cost statistics lost')
 
   const clean = compareSummaries(base, summary('bench-ops', base.results.map((entry) => ({ ...entry, usage: { ...entry.usage } }))), { noiseFloorPct: 3.1, failOn: 'none' })
-  const cleanText = renderReport(clean, SOURCES)
-  assert.match(cleanText, /No warnings\./, 'nothing excluded means nothing to warn about')
-  assertEnglish(cleanText)
+  assert.deepEqual(clean.warnings, [], 'nothing excluded means nothing to warn about')
+  assertEnglish(text)
 })
 
 await test('--fail-on gates individually, and a gate that cannot run abstains at exit 0', async () => {
@@ -321,7 +314,7 @@ await test('--fail-on gates individually, and a gate that cannot run abstains at
     const abstain = invoke([baseline, costlier, '--out', '-', '--fail-on', 'both'])
     assert.equal(await abstain.run(), EXIT.ok)
     assert.match(abstain.err(), /noise floor unknown ⇒ cost direction withheld/)
-    assert.match(abstain.text(), /noise-floor-unknown/)
+    assert.match(abstain.err(), /noise-floor-unknown/, 'the abstaining gate says so on stderr — the report prints no verdict prose')
   })
 })
 
@@ -409,14 +402,11 @@ await test('label, directory and file forms resolve to the same comparison', asy
     const byDir = invoke([baseDir, candDir, ...common])
     const byFile = invoke([path.join(baseDir, 'run.json'), path.join(candDir, 'run.json'), ...common])
     for (const cli of [byLabel, byDir, byFile]) assert.equal(await cli.run(), EXIT.ok)
-    // The comparison renders identically; the evidence section is the one place
-    // that echoes how each side was named (`spec`), which the caller chose.
-    const body = (text) => text.split('\n').filter((line) => !/^- (base|cand):/.test(line)).join('\n')
-    assert.equal(body(byLabel.text()), body(byDir.text()))
-    assert.equal(body(byFile.text()), body(byDir.text()), 'all three forms reach the same comparison')
-    assert.match(byLabel.text(), /- base:.*run\.json\(spec `bench-base`,run\)/)
-    assert.match(byDir.text(), /- base:.*run\.json\(spec `.*bench-base`,run\)/)
-    assert.ok(byDir.text().includes(`api-rename | 500 | 620 (${red('+24.0%')}) | 2 → 2 (${green('0.0%')}) | 1 → 1 (${green('0.0%')}) | 0 → 0 | 1/1→1/1 |`))
+    // The report carries no side paths, so the three resolution forms render
+    // byte-identically: nothing anywhere echoes how each side was named.
+    assert.equal(byLabel.text(), byDir.text())
+    assert.equal(byFile.text(), byDir.text(), 'all three forms reach the same comparison')
+    assert.ok(byDir.text().includes(`api-rename | 500 | 620 (${red('+24.0%')}) | 2 → 2 (${green('0.0%')}) | 1 → 1 (${green('0.0%')}) | 0.0s → 0.0s (${green('0.0%')}) | 0 → 0 | 1/1→1/1 |`))
 
     // A group is searched with --folder; the flat root is searched without it.
     assert.equal((await invoke(['bench-base', 'bench-ops', '--runs', runs, ...common]).run()), EXIT.ok)
@@ -484,13 +474,12 @@ await test('--noise measures the floor in the call, and a missing prompt degrade
     assert.equal(doc.noiseFloor.method, 'aa-max-abs-task-pct')
     assert.equal(doc.noiseFloor.pct, 4, '+50% clears the measured 4% floor')
     assert.equal(doc.gate.regressionFailed, true)
-    assert.match(renderReport(doc, SOURCES), /method `aa-max-abs-task-pct`/)
 
     // A row with no prompt capture cannot support attribution: the core records that,
     // and the report has no attribution section left to hedge in.
     const bare = compareSummaries(summary('bench-base', [metrics('csv-sum', 1000, true, { prompt: false })]), summary('bench-ops', [metrics('csv-sum', 900, true, { prompt: false })]), { noiseFloorPct: 3.1 })
     assert.equal(bare.overhead.comparable, false, 'the core marks the split incomparable')
-    const text = renderReport(bare, SOURCES)
+    const text = renderReport(bare)
     assert.doesNotMatch(text, /Token attribution|fixed overhead per request/)
     assertEnglish(text)
   })
diff --git a/test/bench-conditions.test.mjs b/test/bench-conditions.test.mjs
new file mode 100644
index 00000000..ed0e6eca
--- /dev/null
+++ b/test/bench-conditions.test.mjs
@@ -0,0 +1,174 @@
+/** Conditions govern actual routing, archives and pairing; no model request is made. */
+import fs from 'node:fs'
+import path from 'node:path'
+import { EventEmitter } from 'node:events'
+import { PassThrough } from 'node:stream'
+import { parse } from 'yaml'
+import { JSDOM } from 'jsdom'
+import { renderConfigDump } from '@deepseek-ai/dsh-app-boot'
+import { assert, test, report, withTempDir, waitFor } from './lib/harness.mjs'
+import { main as runMain, parseRunArgs, dumpProfileConfig } from '../bench/run.mjs'
+import { main as compareMain, renderReport } from '../bench/compare.mjs'
+import { compareSummaries } from '../bench/lib/compare-core.mjs'
+import { planConditions, conditionOf, writeConditionPatch, assertEffectiveCondition } from '../bench/lib/condition.mjs'
+import { runSession } from '../bench/run/session.mjs'
+import { validateRun } from '../bench/run/seal.mjs'
+import { renderPanel } from '../bench/report/panel.mjs'
+
+const route = { provider: 'bench-server', model: 'old-model', reasoningEffort: 'off' }
+const overlayText = JSON.stringify([{ id: 'agent-default-model', config: route }])
+const entry = { kind: 'js', file: path.join(path.sep, 'fake', 'dsh.js') }
+const task = { id: 'condition-fixture', title: 'condition fixture', prompt: 'Write answer.txt', repeat: 1, timeoutMs: 1000,
+  fixture: { generator: 'grepTree', params: { dirs: 1, filesPerDir: 1, linesPerFile: 1, needleFiles: 1 } },
+  verify: [{ type: 'fileExists', path: 'answer.txt' }] }
+const json = file => JSON.parse(fs.readFileSync(file, 'utf8'))
+const sink = () => { const lines = []; return { lines, out: line => lines.push(line), err: line => lines.push(line) } }
+
+await test('repeatable CLI flags form a Cartesian matrix and malformed efforts fail before work', () => {
+  const options = parseRunArgs(['--model', 'a', '--model', 'b', '--reasoning-effort', 'low', '--reasoning-effort', 'high'])
+  const values = planConditions(options, 'overlay', () => overlayText)
+  assert.deepEqual(values.map(value => [value.model, value.reasoningEffort]), [['a', 'low'], ['a', 'high'], ['b', 'low'], ['b', 'high']])
+  assert.ok(values.every(value => value.provider === route.provider))
+  assert.throws(() => parseRunArgs(['--reasoning-effort', 'medium']), /off, low, high, max/)
+  assert.throws(() => parseRunArgs(['--model', '--reasoning-effort', 'high']), /needs a value/)
+  assert.deepEqual(planConditions(parseRunArgs([]), null, () => { throw new Error('must not read'); }), [null])
+  assert.equal(conditionOf({ meta: { model: 'legacy-label' } }), null)
+  const expected = { ...route, reasoningEffort: 'high' }
+  assert.throws(() => assertEffectiveCondition(overlayText, expected), /does not match requested/)
+  assert.throws(() => assertEffectiveCondition(JSON.stringify([{ id: 'agent-default-model', disabled: true, config: expected }]), expected), /does not match requested/)
+  assert.doesNotThrow(() => assertEffectiveCondition(JSON.stringify([{ id: 'agent-default-model', config: expected }]), expected))
+})
+
+await test('the final patch replaces the complete route while preserving the input overlay', () => withTempDir('conditions-patch', root => {
+  const overlay = path.join(root, 'llm.patch.yml')
+  fs.writeFileSync(overlay, overlayText)
+  const condition = planConditions(parseRunArgs(['--model', 'DeepSeek-V4.1-Flash', '--reasoning-effort', 'high']), overlay)[0]
+  const file = writeConditionPatch(path.join(root, 'run'), condition)
+  assert.deepEqual(parse(fs.readFileSync(file, 'utf8')), [{ id: 'agent-default-model', config: condition }])
+  assert.equal(fs.readFileSync(overlay, 'utf8'), overlayText)
+  assert.throws(() => writeConditionPatch(path.join(root, 'run'), condition), /EEXIST/)
+  assert.throws(() => planConditions(parseRunArgs(['--model', 'x']), null), /provider/)
+}))
+
+await test('an unapplied condition is refused before a measured session starts', () => withTempDir('conditions-refuse', async root => {
+  const tasksDir = path.join(root, 'tasks'), overlay = path.join(root, 'llm.yml'), output = sink()
+  fs.mkdirSync(tasksDir); fs.writeFileSync(path.join(tasksDir, 'condition.task.json'), JSON.stringify(task)); fs.writeFileSync(overlay, overlayText)
+  let sessions = 0
+  const code = await runMain(['--out', path.join(root, 'run'), '--llm-patch', overlay, '--model', 'new-model', '--reasoning-effort', 'high'], {
+    ...output, tasksDir, installSignals: false, resolveEntry: () => entry,
+    dumpProfileConfig: () => overlayText,
+    runSession: () => { sessions++; throw new Error('must not run') },
+  })
+  assert.equal(code, 1)
+  assert.equal(sessions, 0)
+  assert.match(output.lines.join('\n'), /Composed agent-default-model route does not match requested condition/)
+}))
+
+await test('matrix show prints every condition without allocating output or invoking a host', () => withTempDir('conditions-show', async root => {
+  const tasksDir = path.join(root, 'tasks'), out = path.join(root, 'matrix'), output = sink()
+  fs.mkdirSync(tasksDir); fs.writeFileSync(path.join(tasksDir, 'condition.task.json'), JSON.stringify(task))
+  assert.equal(await runMain(['--show', '--out', out, '--no-llm-patch', '--provider', 'p', '--model', 'a', '--model', 'b', '--reasoning-effort', 'high'], {
+    ...output, tasksDir, resolveEntry: () => { throw new Error('must not invoke host') },
+  }), 0)
+  assert.equal(fs.existsSync(out), false)
+  assert.equal(output.lines.filter(line => line.startsWith('[matrix] ') && /\/2:/.test(line)).length, 2)
+}))
+
+await test('interrupting one sweep stops the remaining matrix conditions', () => withTempDir('conditions-interrupt', async root => {
+  const tasksDir = path.join(root, 'tasks'), out = path.join(root, 'matrix'), output = sink()
+  fs.mkdirSync(tasksDir); fs.writeFileSync(path.join(tasksDir, 'condition.task.json'), JSON.stringify(task))
+  let sweeps = 0
+  const code = await runMain(['--out', out, '--no-llm-patch', '--provider', 'p', '--model', 'a', '--model', 'b', '--no-report'], {
+    ...output, tasksDir, installSignals: false, resolveEntry: () => entry,
+    dumpProfileConfig: (_entry, _profile, context) => fs.readFileSync(context.conditionPatch, 'utf8'),
+    sweep: (_spec, options) => {
+      sweeps++; options.interrupt.stopped = true
+      return { interrupted: true, failures: [], completedSessions: 0, plannedSessions: 2, pairs: 1, noise: null }
+    },
+  })
+  assert.equal(code, 1)
+  assert.equal(sweeps, 1, 'an interrupt applies to the whole matrix, including conditions not yet started')
+  assert.equal(json(path.join(out, 'matrix.json')).groups.length, 1)
+}))
+
+await test('a complete matrix uses identical routing patches in both arms and archives each condition', () => withTempDir('conditions-matrix', async root => {
+  const tasksDir = path.join(root, 'tasks'), out = path.join(root, 'matrix'), overlay = path.join(root, 'llm.yml')
+  fs.mkdirSync(tasksDir); fs.writeFileSync(path.join(tasksDir, 'condition.task.json'), JSON.stringify(task)); fs.writeFileSync(overlay, overlayText)
+  const baseConfig = path.join(root, 'base.yml')
+  fs.writeFileSync(baseConfig, JSON.stringify([{ id: 'agent-default-model', name: 'fixture-router', config: route }]))
+  const calls = [], dumps = [], output = sink()
+  const patches = args => args.flatMap((arg, index) => arg === '--patch' ? [args[index + 1]] : [])
+  const run = await runMain(['--out', out, '--llm-patch', overlay, '--model', 'a', '--model', 'b', '--reasoning-effort', 'low', '--reasoning-effort', 'high', '--seal'], {
+    ...output, tasksDir, installSignals: false, resolveEntry: () => entry, now: () => Date.UTC(2026, 9, 25),
+    dumpProfileConfig: (entry, profile, context) => dumpProfileConfig(entry, profile, { ...context, run(_command, args) {
+      const files = patches(args)
+      assert.equal(files.length, 2)
+      assert.equal(files[0], overlay)
+      const stdout = renderConfigDump('dsh', baseConfig, files.map(file => ({ label: path.basename(file), patches: parse(fs.readFileSync(file, 'utf8')) })), line => { throw new Error(line) })
+      const config = parse(stdout)[0].config
+      dumps.push({ profile, files, config })
+      return { status: 0, stdout, stderr: 'diagnostic is not configuration' }
+    } }),
+    runSession: (spec, options) => runSession(spec, { ...options, workspaceRoot: root, spawn(_command, args, processOptions) {
+      const files = patches(args), config = parse(fs.readFileSync(files[1], 'utf8'))[0].config
+      calls.push({ arm: spec.arm, files, config })
+      const child = new EventEmitter(); child.stdout = new PassThrough(); child.stderr = new PassThrough(); child.pid = 123
+      setImmediate(() => {
+        fs.writeFileSync(path.join(processOptions.cwd, 'answer.txt'), 'done')
+        child.stdout.end(JSON.stringify({ type: 'status', phase: 'step_end', step: 1, usage: { inputTokens: 10, outputTokens: 1, cacheReadTokens: 0, cacheWriteTokens: 0 } }) + '\n')
+        child.stderr.end(); setImmediate(() => child.emit('close', 0))
+      })
+      return child
+    } }),
+  })
+  assert.equal(run, 0, output.lines.join('\n'))
+  assert.equal(calls.length, 8); assert.equal(dumps.length, 8)
+  const manifest = json(path.join(out, 'matrix.json'))
+  assert.equal(manifest.groups.length, 4)
+  for (const [index, group] of manifest.groups.entries()) {
+    const left = calls[index * 2], right = calls[index * 2 + 1]
+    assert.deepEqual(left.files, right.files)
+    assert.deepEqual(left.config, group.condition)
+    assert.deepEqual(left.files, dumps[index * 2].files)
+    const sealed = json(path.join(out, group.directory, 'run.json'))
+    assert.deepEqual(sealed.meta.condition, group.condition)
+    assert.equal(sealed.meta.model, group.condition.model)
+    assert.equal(validateRun(sealed).ok, true)
+    for (const side of ['base', 'cand']) {
+      assert.deepEqual(json(path.join(out, group[side])).condition, group.condition)
+      const dump = fs.readFileSync(path.join(path.dirname(path.join(out, group[side])), 'dump-config.txt'), 'utf8')
+      assert.deepEqual(parse(dump)[0].config, group.condition)
+    }
+    const paths = ['base', 'cand'].map(side => path.join(path.dirname(path.join(out, group[side])), 'dump-config.txt'))
+    assert.deepEqual(fs.readFileSync(paths[0]), fs.readFileSync(paths[1]))
+  }
+  const reportOut = sink()
+  assert.equal(await compareMain(['--matrix', out, '--json'], reportOut), 0)
+  const combined = JSON.parse(reportOut.lines[0])
+  assert.equal(combined.comparableAcrossConditions, false)
+  assert.equal(combined.comparisons.length, 4)
+  assert.equal(combined.totals, undefined)
+  const markdown = sink()
+  assert.equal(await compareMain(['--matrix', out], markdown), 0)
+  assert.match(markdown.lines[0], /Cross-condition results are not comparable/)
+  assert.equal(markdown.lines[0].match(/^## Condition /gm).length, 4)
+  assert.equal(markdown.lines[0].match(/^# /gm).length, 1)
+  const mismatch = sink()
+  assert.equal(await compareMain([path.join(out, manifest.groups[0].base), path.join(out, manifest.groups[1].cand)], mismatch), 2)
+  assert.match(mismatch.lines.join('\n'), /"reasoningEffort":"low"/)
+  assert.match(mismatch.lines.join('\n'), /"reasoningEffort":"high"/)
+  const left = json(path.join(out, manifest.groups[0].base)), right = json(path.join(out, manifest.groups[0].cand))
+  delete left.condition; delete right.condition
+  assert.equal(compareSummaries(left, right).condition, null)
+  assert.match(renderReport(compareSummaries(left, right)), /Condition: unknown/)
+  assert.throws(() => compareSummaries(left, { ...right, condition: manifest.groups[0].condition }), /Conditions differ.*unknown/)
+  const docPath = path.join(out, manifest.groups[0].directory, 'run.json')
+  const panel = renderPanel({ runJsonPath: docPath, outDir: path.dirname(docPath) })
+  const dom = new JSDOM(fs.readFileSync(panel.htmlPath, 'utf8'), { runScripts: 'dangerously', beforeParse(window) {
+    window.fetch = async () => ({ ok: true, json: async () => json(docPath) })
+  } })
+  try { await waitFor(() => dom.window.document.body.textContent.includes('"reasoningEffort":"low"')); }
+  finally { dom.window.close() }
+}))
+
+report('bench-conditions')
diff --git a/test/bench-platform.test.mjs b/test/bench-platform.test.mjs
new file mode 100644
index 00000000..9f549d51
--- /dev/null
+++ b/test/bench-platform.test.mjs
@@ -0,0 +1,95 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { assert, report, test, withTempDir } from './lib/harness.mjs'
+import { parseArgs as setupArgs } from '../bench/setup/profile.mjs'
+import { preflight } from '../bench/setup/preflight.mjs'
+import { compareSummaries } from '../bench/lib/compare-core.mjs'
+import { main as compare, renderReport } from '../bench/compare.mjs'
+import { componentFacts } from '../bench/lib/environment.mjs'
+import { dumpProfileConfig, profileFingerprints } from '../bench/run.mjs'
+import { main as setup } from '../bench/setup.mjs'
+
+await test('POSIX setup never probes Windows module directories or pins PowerShell', () => {
+  for (const platform of ['linux', 'darwin']) {
+    const options = setupArgs(['--plugin', 'none', '--dry-run'], { platform })
+    assert.equal(options.pinShell, null)
+    const lines = []
+    const result = preflight(options, { platform, log: line => lines.push(line),
+      env: { PSModulePath: 'C:\\Core;C:\\Windows', SystemRoot: 'C:\\Windows' },
+      isDirectory: () => { throw new Error('Windows probe on POSIX') } })
+    assert.equal(result.outcomes.modulePath, 'skipped')
+    assert.equal(result.problems.length, 0)
+    assert.match(lines.join('\n'), /skipped.*Windows/)
+  }
+})
+
+await test('platform mismatch refuses pairing before statistics, including A/A inputs', () => {
+  const base = { meta: { platform: 'linux-x64' }, results: [] }
+  const cand = { meta: { platform: 'darwin-arm64' }, results: [] }
+  assert.throws(() => compareSummaries(base, cand), /linux-x64.*darwin-arm64/)
+  assert.throws(() => compareSummaries(base, base, { noise: { base, cand } }), /platform/)
+  const diagnostic = compareSummaries(base, cand, { allowCrossPlatform: true })
+  assert.match(renderReport(diagnostic), /not a plugin effect/)
+  assert.equal(diagnostic.environment.crossPlatform, true)
+  assert.doesNotThrow(() => compareSummaries({ results: [] }, { results: [] }))
+})
+
+await test('compare CLI returns 2 for different platforms and requires an explicit override', async () => {
+  await withTempDir('bench-platform-', async dir => {
+    const files = ['base', 'cand'].map(name => path.join(dir, `${name}.json`))
+    for (const [i, file] of files.entries()) fs.writeFileSync(file, JSON.stringify({ format: 'dsh-ops-bench-summary-v1', meta: { platform: ['linux-x64', 'win32-x64'][i] }, results: [] }))
+    const lines = []
+    const io = { out: line => lines.push(line), err: line => lines.push(line) }
+    assert.equal(await compare([...files, '--out', '-'], io), 2)
+    assert.match(lines.join('\n'), /linux-x64.*win32-x64/)
+    lines.length = 0
+    assert.equal(await compare([...files, '--out', '-', '--allow-cross-platform'], io), 0)
+    assert.match(lines.join('\n'), /not a plugin effect/)
+  })
+})
+
+await test('composed component facts distinguish disabled, absent and unevaluated rows', () => {
+  const dump = '- id: dsh-ops-shell\n  disabled: false\n- id: dsh-ops-discovery\n  config:\n    enabled: false\n- id: dsh-ops-panel\n  disabled: process.platform !== "win32"\n'
+  const facts = componentFacts(dump)
+  assert.equal(facts.shell, 'enabled')
+  assert.equal(facts.discovery, 'disabled')
+  assert.equal(facts.panel, 'unknown')
+  assert.equal(facts.ptc, 'absent')
+  const arms = [{ side: 'base', profile: 'base' }, { side: 'cand', profile: 'cand' }]
+  profileFingerprints(arms, { dump: () => dump })
+  assert.deepEqual(arms[0].components, facts)
+  assert.deepEqual(arms[1].components, facts)
+  assert.equal(componentFacts('bad: [').shell, 'unknown')
+  assert.equal(componentFacts('- id: dsh-ops-shell\n- id: dsh-ops-shell\n').shell, 'unknown')
+})
+
+await test('Linux and macOS dry-run traverse setup without executing or writing profiles', async () => {
+  await withTempDir('bench-posix-setup-', async dir => {
+    const example = path.join(dir, 'example.yml')
+    fs.writeFileSync(example, '[]\n')
+    for (const platform of ['linux', 'darwin']) {
+      const home = path.join(dir, platform)
+      const lines = []
+      const code = await setup(['--dsh-home', home, '--plugin', 'none', '--dry-run'], {
+        platform, arch: 'x64', env: {}, entry: { kind: 'exe', file: 'fixture-dsh' },
+        overlay: path.join(dir, 'overlay.yml'), overlayExample: example,
+        invoke: () => { throw new Error('dry-run spawned the host') },
+        out: line => lines.push(line), err: line => lines.push(line),
+      })
+      assert.equal(code, 0, lines.join('\n'))
+      assert.match(lines.join('\n'), /skipped: Windows PowerShell pin/)
+      assert.match(lines.join('\n'), /skipped: Windows PSModulePath/)
+      assert.equal(fs.existsSync(home), false)
+    }
+  })
+})
+
+await test('host diagnostics cannot contaminate component configuration parsing', () => {
+  const text = dumpProfileConfig({ kind: 'exe', file: 'fixture-dsh' }, 'bench', { run: () => ({
+    status: 0, stdout: '- id: dsh-ops-shell\n', stderr: 'Warning: diagnostic, not configuration\n',
+  }) })
+  assert.equal(componentFacts(text).shell, 'enabled')
+  assert.doesNotMatch(text, /Warning/)
+})
+
+report('bench-platform')
diff --git a/test/bench-run-session.test.mjs b/test/bench-run-session.test.mjs
index 5ddb2111..f997b0d5 100644
--- a/test/bench-run-session.test.mjs
+++ b/test/bench-run-session.test.mjs
@@ -203,6 +203,14 @@ await test('archive + metrics + trace: NDJSON appended verbatim, usage folded, t
     assert.deepEqual(row.toolCallsByName, { read: 1 })
     assert.deepEqual(row.usage, { inputTokens: 10, outputTokens: 5, cacheReadTokens: 2, cacheWriteTokens: 1, reasoningTokens: 0 })
     assert.equal(row.usageReported, false, 'one step without usage degrades the whole row instead of understating it')
+    assert.deepEqual(row.prompt, {
+      reported: false,
+      firstStep: 13,
+      median: 13,
+      max: 13,
+      total: 13,
+      perTurn: [{ turn: 1, tokens: 13 }],
+    }, 'the first request is 10+2+1 prompt tokens; the step without usage keeps the summary incomplete')
     assert.equal(row.turnEndReason, 'completed')
     assert.equal(row.verifyPassed, false, 'the fake child wrote no answer, so the check fails')
 
@@ -224,6 +232,29 @@ await test('archive + metrics + trace: NDJSON appended verbatim, usage folded, t
   })
 })
 
+await test('the fold records the prompt shape: first request, per-step sizes, per-turn firsts', async () => {
+  await withTempDir('bench-session-prompt', async (root) => {
+    const events = [
+      { type: 'status', phase: 'step_end', step: 1, turn: 1, usage: { inputTokens: 10, outputTokens: 5, cacheReadTokens: 2, cacheWriteTokens: 1 } },
+      { type: 'status', phase: 'step_end', step: 2, turn: 1, usage: { inputTokens: 40, outputTokens: 5, cacheReadTokens: 0, cacheWriteTokens: 0 } },
+      { type: 'status', phase: 'step_end', step: 3, turn: 2, usage: { inputTokens: 100, outputTokens: 5, cacheReadTokens: 0, cacheWriteTokens: 0 } },
+    ]
+    const rig = spawnRig((child) => child.emitFrom({ events, stderr: '', exit: 0 }))
+    const row = await runSession(
+      { task: { ...TASK, verify: [{ type: 'fileExists', path: 'answer.txt' }] }, repeatIndex: 1 },
+      optionsFor(root, { spawn: rig.spawn }),
+    )
+    assert.deepEqual(row.prompt, {
+      reported: true,
+      firstStep: 13,
+      median: 40,
+      max: 100,
+      total: 153,
+      perTurn: [{ turn: 1, tokens: 13 }, { turn: 2, tokens: 100 }],
+    }, 'prompt size is input + cacheRead + cacheWrite per step; each turn contributes its first request')
+  })
+})
+
 await test('timeout: timedOut true, exit null, and the kill is recorded in the archive', async () => {
   await withTempDir('bench-session-timeout', async (root) => {
     const killed = []
diff --git a/test/bench-schedule.test.mjs b/test/bench-schedule.test.mjs
index 23814dcb..3441ccf0 100644
--- a/test/bench-schedule.test.mjs
+++ b/test/bench-schedule.test.mjs
@@ -12,10 +12,11 @@
 
 import fs from 'node:fs'
 import path from 'node:path'
+import { createHash } from 'node:crypto'
 
 import { assert, report, test, tick, withTempDir } from './lib/harness.mjs'
 import { SUMMARY_FORMAT, armOrder, planPairs, planSessions, repeatsById, runSweep } from '../bench/run/schedule.mjs'
-import { buildArms, exitFor, main, parseRunArgs, prepareDirs } from '../bench/run.mjs'
+import { buildArms, exitFor, main, parseRunArgs, prepareDirs, profileFingerprints, sealSweep } from '../bench/run.mjs'
 import { EXIT } from '../bench/cli.mjs'
 
 const LABEL = 'bench-schedule'
@@ -27,6 +28,9 @@ const NOW = () => Date.UTC(2026, 9, 18, 3, 4, 5)
 /** A launcher that is never executed: the injected runSession stands in for P7. */
 const ENTRY = { file: path.join(path.sep, 'fake', 'node_modules', '@deepseek-ai', 'dsh', 'lib', 'bin.js'), kind: 'js' }
 
+/** The fingerprints a rigged sweep would otherwise have to dump out of a real dsh. */
+const HASHES = { base: 'a'.repeat(64), cand: 'b'.repeat(64) }
+
 /** The two arms of a normal sweep. */
 const ARMS = [
   { side: 'base', label: 'bench-base', profile: 'bench-base' },
@@ -383,7 +387,7 @@ await test('parseRunArgs reads the runner flags, keeps the CLI validation, and r
   assert.throws(() => parseRunArgs(['--out', 'x', '--folder', 'g'], { runsDir: '/tmp' }), /drop --folder/)
 
   const plain = parseRunArgs([], { runsDir: '/tmp' })
-  assert.equal(plain.repeat, 3)
+  assert.equal(plain.repeat, 1)
   assert.equal(plain.repeatExplicit, false)
   assert.equal(plain.aa, false)
   assert.deepEqual(buildArms(plain).map((arm) => arm.label), ['bench-base', 'bench-ops'])
@@ -396,7 +400,7 @@ await test('parseRunArgs reads the runner flags, keeps the CLI validation, and r
   assert.equal(dirs.dirs.cand, path.join('/tmp', 'runs', 'benchmark-test-07', '2026-10-18T03-04-05Z-bench-ops'))
 })
 
-await test('main: --show prints the flip without running; a missing seal refuses before any spawn', async () => {
+await test('main: --show prints the flip without running; a requested seal with an unreadable profile refuses before any spawn', async () => {
   await withTempDir('bench-main-flags', async (root) => {
     const tasks = tasksDir(root)
     const runsDir = path.join(root, 'runs')
@@ -408,13 +412,17 @@ await test('main: --show prints the flip without running; a missing seal refuses
     assert.equal(scripted.calls.length, 0, '--show never spawns')
     assert.equal(out.lines.out.filter((line) => line.includes('base → cand') || line.includes('bench-base → bench-ops')).length, 1)
     assert.equal(out.lines.out.filter((line) => line.includes('bench-ops → bench-base')).length, 1)
-    assert.match(out.text(), /benchmark-test-01/)
+    assert.match(out.text(), /benchmark-\d{4}-\d{2}-\d{2}-\d{2}/)
     assert.match(out.text(), /show only/)
 
-    const noSeal = sink()
-    assert.equal(await main([], { ...base, ...noSeal, seal: undefined }), EXIT.pending)
-    assert.match(noSeal.both(), /sealing is not wired in this slice yet/)
-    assert.match(noSeal.both(), /P8a/)
+    // Sealing is opt-in, so `--seal` is what asks for the fingerprint; a launcher whose dump
+    // fails is refused before any session, so a requested seal can never turn out to be
+    // impossible after the tokens are spent.
+    const refused = sink()
+    const noDump = () => { throw new Error('dump-config unavailable') }
+    assert.equal(await main(['--seal'], { ...base, ...refused, resolveEntry: () => ENTRY, dumpProfileConfig: noDump }), EXIT.failure)
+    assert.match(refused.both(), /dump-config unavailable/)
+    assert.match(refused.both(), /no token was spent/)
     assert.equal(scripted.calls.length, 0, 'an unsealable sweep spends no token')
 
     const badFlag = sink()
@@ -434,7 +442,7 @@ await test('main: a sealed A/A sweep exits 0 with the measured floor; a broken o
     const aaOut = sink()
     const overlay = overlayIn(root)
     const scripted = rig({ tokens: (spec) => (spec.arm === 'bench-base-aa' && spec.repeatIndex === 1 ? 120 : 100) })
-    const code = await main(['--aa', '--repeat', '2'], {
+    const code = await main(['--seal', '--aa', '--repeat', '2'], {
       ...aaOut,
       tasksDir: tasks,
       runsDir,
@@ -443,6 +451,7 @@ await test('main: a sealed A/A sweep exits 0 with the measured floor; a broken o
       resolveEntry: () => ENTRY,
       installSignals: false,
       now: NOW,
+      profileHashes: HASHES,
       seal: (context) => ({ path: path.join(context.dirs.base, '..', 'run.json') }),
     })
     assert.equal(code, EXIT.ok)
@@ -452,7 +461,7 @@ await test('main: a sealed A/A sweep exits 0 with the measured floor; a broken o
 
     const brokenOut = sink()
     const broken = rig({ fail: (spec) => spec.arm === 'bench-ops' })
-    const brokenCode = await main([], {
+    const brokenCode = await main(['--seal'], {
       ...brokenOut,
       tasksDir: tasks,
       runsDir,
@@ -462,6 +471,7 @@ await test('main: a sealed A/A sweep exits 0 with the measured floor; a broken o
 
       installSignals: false,
       now: NOW,
+      profileHashes: HASHES,
       seal: () => ({ path: 'run.json' }),
     })
     assert.equal(brokenCode, EXIT.failure)
@@ -475,7 +485,7 @@ await test('main: Ctrl-C during a session stops the sweep, reports it, and exits
     const interrupt = { stopped: false, child: null, pid: null }
     const out = sink()
     const scripted = rig({ onCall: () => { interrupt.stopped = true } })
-    const code = await main(['--repeat', '2'], {
+    const code = await main(['--seal', '--repeat', '2'], {
       ...out,
       tasksDir: tasks,
       runsDir: path.join(root, 'runs'),
@@ -485,19 +495,27 @@ await test('main: Ctrl-C during a session stops the sweep, reports it, and exits
       interrupt,
       installSignals: false,
       now: NOW,
+      profileHashes: HASHES,
       seal: () => ({}),
     })
     assert.equal(code, EXIT.failure)
     assert.match(out.text('err'), /interrupted/)
     assert.equal(scripted.calls.length, 1)
+    const group = path.join(root, 'runs', fs.readdirSync(path.join(root, 'runs'))[0])
+    assert.equal(
+      fs.readdirSync(group).filter((name) => name.startsWith('DSH-OPS Benchmark Report')).length, 0,
+      'an interrupted sweep writes no report: a partial run is not a comparison',
+    )
+    assert.match(out.text(), /not written \(a partial sweep is not a comparison\)/)
   })
 })
 
-await test('main --no-seal runs anyway and says out loud that no run.json was written', async () => {
+await test('main: a sweep is unsealed by default and --seal opts in', async () => {
   await withTempDir('bench-main-noseal', async (root) => {
     const out = sink()
     const scripted = rig()
-    const code = await main(['--no-seal', '--repeat', '1'], {
+    let sealed = 0
+    const code = await main(['--repeat', '1'], {
       ...out,
       tasksDir: tasksDir(root, 1),
       runsDir: path.join(root, 'runs'),
@@ -506,16 +524,78 @@ await test('main --no-seal runs anyway and says out loud that no run.json was wr
       resolveEntry: () => ENTRY,
       installSignals: false,
       now: NOW,
+      dumpProfileConfig: () => '- id: dsh-ops-shell\n  disabled: false\n',
+      seal: () => { sealed += 1; return {} },
     })
     assert.equal(code, EXIT.ok)
-    assert.match(out.text(), /no — run\.json was not written/)
+    assert.equal(sealed, 0, 'no seal was asked for, so nothing was sealed')
+    assert.match(out.text(), /no — not requested \(--seal writes run\.json\)/)
     assert.equal(scripted.calls.length, 2, 'both arms still ran')
+    const group = path.join(root, 'runs', fs.readdirSync(path.join(root, 'runs'))[0])
+    const armDir = fs.readdirSync(group).find((name) => name.endsWith('bench-base'))
+    assert.ok(fs.existsSync(path.join(group, armDir, 'summary.json')), 'the per-arm summary is the artifact the report reads')
+    const summary = JSON.parse(fs.readFileSync(path.join(group, armDir, 'summary.json'), 'utf8'))
+    assert.equal(summary.components.shell, 'enabled', 'unsealed summaries still preserve component configuration')
+    assert.equal(summary.switches.shell.enabled, true)
+    assert.equal(summary.candidateSwitches.shell.enabled, true, 'both sides share the candidate conditions for pairing')
+    assert.equal(summary.meta.platform, `${process.platform}-${process.arch}`)
+    assert.equal(fs.existsSync(path.join(group, 'run.json')), false, 'nothing sealed this sweep')
+    const reports = fs.readdirSync(group).filter((name) => name.startsWith('DSH-OPS Benchmark Report') && name.endsWith('.md'))
+    assert.equal(reports.length, 1, 'a finished sweep writes its own report into the group folder')
+    const report = fs.readFileSync(path.join(group, reports[0]), 'utf8')
+    assert.match(report, /^# DSH-OPS Benchmark Report/)
+    assert.match(report, /csv-sum/, 'the rendered table carries the tasks the sweep measured')
+    assert.match(out.text(), /\[ab\] report  : .*DSH-OPS Benchmark Report/)
+
+    // `--no-seal` still means off, so an old command line keeps working unchanged.
+    const explicit = sink()
+    const again = rig()
+    assert.equal(await main(['--no-seal', '--repeat', '1'], {
+      ...explicit,
+      tasksDir: tasksDir(root, 1),
+      runsDir: path.join(root, 'runs'),
+      llmOverlay: overlayIn(root),
+      runSession: again.runSession,
+      resolveEntry: () => ENTRY,
+      installSignals: false,
+      now: NOW,
+      seal: () => { throw new Error('--no-seal must never seal') },
+      profileHashes: HASHES,
+    }), EXIT.ok)
+    assert.match(explicit.text(), /no — not requested/)
+  })
+})
+
+await test('main: a finished sweep writes the report by default and --no-report skips it', async () => {
+  await withTempDir('bench-main-report', async (root) => {
+    const runsRoot = path.join(root, 'runs')
+    const base = { tasksDir: tasksDir(root, 1), runsDir: runsRoot, llmOverlay: overlayIn(root), resolveEntry: () => ENTRY, installSignals: false, now: NOW, profileHashes: HASHES }
+    const groups = () => fs.readdirSync(runsRoot)
+
+    const out = sink()
+    const scripted = rig()
+    assert.equal(await main(['--repeat', '1'], { ...base, ...out, runSession: scripted.runSession }), EXIT.ok)
+    const firstName = groups()[0]
+    assert.equal(
+      fs.readdirSync(path.join(runsRoot, firstName)).filter((name) => name.startsWith('DSH-OPS Benchmark Report')).length, 1,
+      'the default sweep leaves its report in the group folder',
+    )
+
+    const off = sink()
+    const again = rig()
+    assert.equal(await main(['--repeat', '1', '--no-report'], { ...base, ...off, runSession: again.runSession }), EXIT.ok)
+    const secondName = groups().find((name) => name !== firstName)
+    assert.equal(
+      fs.readdirSync(path.join(runsRoot, secondName)).filter((name) => name.startsWith('DSH-OPS Benchmark Report')).length, 0,
+      '--no-report keeps the group folder free of reports',
+    )
+    assert.match(off.text(), /not written \(--no-report\)/)
   })
 })
 
 await test('main: the sweep injects the operator overlay by default, records it, and refuses without one', async () => {
   await withTempDir('bench-main-overlay', async (root) => {
-    const runner = { tasksDir: tasksDir(root, 1), runsDir: path.join(root, 'runs'), resolveEntry: () => ENTRY, installSignals: false, now: NOW }
+    const runner = { tasksDir: tasksDir(root, 1), runsDir: path.join(root, 'runs'), resolveEntry: () => ENTRY, installSignals: false, now: NOW, profileHashes: HASHES }
     const overlay = overlayIn(root)
 
     // The default is the file `setup` creates, every session is handed it, and the archived
@@ -523,7 +603,7 @@ await test('main: the sweep injects the operator overlay by default, records it,
     const seeded = sink()
     const scripted = rig()
     let sealed = null
-    const code = await main(['--repeat', '1'], {
+    const code = await main(['--seal', '--repeat', '1'], {
       ...runner, ...seeded, runSession: scripted.runSession, llmOverlay: overlay,
       seal: (context) => { sealed = context; return { path: 'run.json' } },
     })
@@ -575,4 +655,44 @@ await test('main: the sweep injects the operator overlay by default, records it,
   })
 })
 
+await test('main: --seal fingerprints both arms and hands them to the seal', async () => {
+  const hashes = profileFingerprints(ARMS, { entry: ENTRY, dump: (_entry, profile) => `composed ${profile}` })
+  assert.deepEqual(hashes, {
+    base: createHash('sha256').update('composed bench-base').digest('hex'),
+    cand: createHash('sha256').update('composed bench-ops').digest('hex'),
+  }, 'each arm is fingerprinted from its own dumped configuration')
+  assert.throws(() => profileFingerprints(ARMS, { entry: ENTRY, dump: () => '   ' }), /printed nothing/)
+
+  await withTempDir('bench-main-fingerprint', async (root) => {
+    const out = sink()
+    const scripted = rig()
+    let sealed = null
+    const code = await main(['--seal', '--repeat', '1'], {
+      ...out,
+      tasksDir: tasksDir(root, 1),
+      runsDir: path.join(root, 'runs'),
+      llmOverlay: overlayIn(root),
+      runSession: scripted.runSession,
+      resolveEntry: () => ENTRY,
+      installSignals: false,
+      now: NOW,
+      dumpProfileConfig: (_entry, profile) => `composed ${profile}`,
+      seal: (context) => { sealed = context; return { path: 'run.json' } },
+    })
+    assert.equal(code, EXIT.ok)
+    assert.equal(sealed.arms.base.profileHash, hashes.base, 'the seal receives the dumped fingerprint')
+    assert.equal(sealed.arms.cand.profileHash, hashes.cand)
+    assert.match(out.text(), /\[ab\] profile : bench-base [0-9a-f]{12}/, 'the sweep names both fingerprints')
+    assert.equal(scripted.calls.length, 2, 'both arms still ran')
+  })
+})
+
+await test('sealSweep hands sealRun the two arm directories as a list', async () => {
+  const context = { dirs: { base: path.join('X', 'base'), cand: path.join('X', 'cand') }, arms: { base: {}, cand: {} }, meta: { mode: 'ab' } }
+  const seen = sealSweep(context, (options) => options)
+  assert.deepEqual(seen.dirs, [path.join('X', 'base'), path.join('X', 'cand')], 'the map becomes the list sealRun folds')
+  assert.equal(seen.meta.mode, 'ab', 'the rest of the context is passed through')
+  assert.deepEqual(sealSweep({ ...context, dirs: ['a', 'b'] }, (options) => options).dirs, ['a', 'b'], 'a list stays a list')
+})
+
 report(LABEL)
diff --git a/test/bench-seal.test.mjs b/test/bench-seal.test.mjs
index ca6fe77c..7f7dd53c 100644
--- a/test/bench-seal.test.mjs
+++ b/test/bench-seal.test.mjs
@@ -28,8 +28,8 @@ const SEALED_AT = new Date(NOW).toISOString()
 
 /** The two sides, with the fingerprints the contract requires. */
 const ARMS = {
-  base: { label: 'bench-base', profile: 'bench-base', profileHash: 'a'.repeat(64) },
-  cand: { label: 'bench-ops', profile: 'bench-ops', profileHash: 'b'.repeat(64) },
+  base: { label: 'bench-base', profile: 'bench-base', profileHash: 'a'.repeat(64), switches: {} },
+  cand: { label: 'bench-ops', profile: 'bench-ops', profileHash: 'b'.repeat(64), switches: { panel: { enabled: true } } },
 }
 
 /** A string that exists only in a non-milestone trace lane, so "not inlined" is provable. */
@@ -163,6 +163,8 @@ await test('sealRun writes one schema-valid run.json and reports where it went',
     assert.equal(validation.ok, true)
     assert.equal(document.meta.arms.base.label, 'bench-base')
     assert.equal(document.meta.arms.cand.profileHash, ARMS.cand.profileHash)
+    assert.deepEqual(document.arms.base.switches, {})
+    assert.deepEqual(document.arms.cand.switches, ARMS.cand.switches)
     assert.equal(document.verify.checks, 2)
     assert.equal(document.verify.passed, 2)
     assert.equal(document.verify.failed, 0)
diff --git a/test/bench-setup-preflight.test.mjs b/test/bench-setup-preflight.test.mjs
index ebaf7e49..5a48a006 100644
--- a/test/bench-setup-preflight.test.mjs
+++ b/test/bench-setup-preflight.test.mjs
@@ -220,7 +220,7 @@ await test('the preflight reports the poisoned PSModulePath as a warning with th
     const isDirectory = (file) => file === path.win32.join(CORE, 'Microsoft.PowerShell.Security')
     const options = { baseProfile: 'bench-base', candProfile: 'bench-ops', permissionMode: 'danger-full-access', plugin: 'local', noBuildCheck: true }
     const lines = []
-    const dirty = preflight(options, { home: path.join(dir, 'home'), env: poisoned, platform: 'linux', arch: 'x64', log: (line) => lines.push(line), isDirectory })
+    const dirty = preflight(options, { home: path.join(dir, 'home'), env: poisoned, platform: 'win32', arch: 'x64', log: (line) => lines.push(line), isDirectory })
     assert.equal(dirty.ok, true, 'a poisoned module path is a warning, not a refusal')
     assert.equal(dirty.outcomes.modulePath, 'poisoned')
     assert.equal(dirty.warnings.length, 1)
@@ -228,7 +228,7 @@ await test('the preflight reports the poisoned PSModulePath as a warning with th
     assert.match(lines.join('\n'), /search order: 1\. C:\\Program Files\\PowerShell\\7\\Modules/)
     assert.match(lines.join('\n'), /preflight: PSModulePath/)
 
-    const clean = preflight(options, { home: path.join(dir, 'home'), env: { SystemRoot: 'C:\\Windows' }, platform: 'linux', arch: 'x64' })
+    const clean = preflight(options, { home: path.join(dir, 'home'), env: { SystemRoot: 'C:\\Windows' }, platform: 'win32', arch: 'x64' })
     assert.equal(clean.outcomes.modulePath, 'clean')
     assert.deepEqual(clean.warnings, [])
   })
@@ -466,10 +466,11 @@ await test('the poisoned PSModulePath reaches main as a warning and never blocks
   await withTempDir('bench-pre-main-module-', async (dir) => {
     const fx = fixture(dir)
     const io = fx.io({
+      platform: 'win32',
       env: { SystemRoot: 'C:\\Windows', PSModulePath: `${CORE};${IN_BOX}` },
       isDirectory: (file) => file === path.win32.join(CORE, 'Microsoft.PowerShell.Security'),
     })
-    const code = await main(['--dsh-home', fx.home, '--no-pin', '--dry-run'], io)
+    const code = await main(['--dsh-home', fx.home, '--no-pin', '--dry-run', '--no-build-check'], io)
     assert.equal(code, 0, fx.err())
     assert.match(fx.err(), /cmd\.exe/)
     assert.match(fx.out(), /preflight: PSModulePath/)
diff --git a/test/bench-switches.test.mjs b/test/bench-switches.test.mjs
new file mode 100644
index 00000000..ae1136c8
--- /dev/null
+++ b/test/bench-switches.test.mjs
@@ -0,0 +1,151 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { parse } from 'yaml'
+import { renderConfigDump } from '@deepseek-ai/dsh-app-boot'
+import { JSDOM } from 'jsdom'
+import { assert, report, test, withTempDir, waitFor } from './lib/harness.mjs'
+import { extractSwitches, planSwitchPatch, configureSwitches } from '../bench/setup/switches.mjs'
+import { main as setup } from '../bench/setup.mjs'
+import { compareSummaries } from '../bench/lib/compare-core.mjs'
+import { main as compareMain, renderReport } from '../bench/compare.mjs'
+import { renderPanel } from '../bench/report/panel.mjs'
+import { switchesFromDump } from '../bench/lib/switches.mjs'
+
+await test('switch parser validates repeatable names and replacement vocabulary', () => {
+  assert.deepEqual(extractSwitches(['--dry-run', '--switch', 'ptc=false', '--switch=hide-official=all']).switches,
+    { ptc: { enabled: false }, 'hide-official': { enabled: true, replaceTools: ['glob', 'grep', 'read'] } })
+  for (const argv of [['--switch', 'oops'], ['--switch', 'ptc=maybe'], ['--switch', 'hide-official=write'], ['--switch', 'ptc', '--switch', 'ptc=false']]) assert.throws(() => extractSwitches(argv))
+})
+
+await test('planning is idempotent and preserves foreign rows plus inherited component settings', () => {
+  const before = '# preserve me\n- id: unrelated\n  config:\n    value: 9\n'
+  const switches = extractSwitches(['--switch', 'discovery', '--switch', 'hide-official=all']).switches
+  const composed = [{ id: 'dsh-ops-discovery', config: { maxResults: 7, required: true, enabled: false } }]
+  const plan = planSwitchPatch(before, switches, { composed })
+  assert.ok(plan.text.startsWith(before))
+  assert.deepEqual(parse(plan.text).find(row => row.id === 'dsh-ops-discovery').config, { maxResults: 7, required: true, enabled: true })
+  assert.equal(planSwitchPatch(plan.text, switches, { composed }).changed, false)
+  assert.throws(() => planSwitchPatch('- id: dsh-ops-ptc\n  disabled: true\n', { ptc: { enabled: true } }), /force/)
+  assert.equal(parse(planSwitchPatch('- id: dsh-ops-ptc\n  disabled: true\n', { ptc: { enabled: true } }, { force: true }).text)[0].disabled, false)
+  assert.throws(() => planSwitchPatch('- id: dsh-ops-ptc\n- id: dsh-ops-ptc\n', { ptc: { enabled: true } }), /Duplicate/)
+})
+
+await test('setup accepts switches in dry-run without launching a host or editing either profile', async () => {
+  await withTempDir('switch-dry-', async dir => {
+    const lines = [], example = path.join(dir, 'example.yml')
+    fs.writeFileSync(example, '[]\n')
+    const code = await setup(['--dsh-home', dir, '--plugin', 'none', '--no-pin', '--no-permission-mode', '--dry-run', '--switch', 'hide-official=all'], {
+      entry: { file: 'fixture-dsh', kind: 'exe' }, overlay: path.join(dir, 'llm.yml'), overlayExample: example,
+      invoke: () => { throw new Error('dry-run invoked host') }, out: line => lines.push(line), err: line => lines.push(line),
+    })
+    assert.equal(code, 0, lines.join('\n'))
+    assert.match(lines.join('\n'), /candidate switches.*hide-official/)
+    assert.equal(fs.existsSync(path.join(dir, 'profiles')), false)
+  })
+})
+
+await test('candidate preparation preserves baseline and refuses blocked or unproven readiness', async () => {
+  await withTempDir('switch-ready-', async dir => {
+    for (const profile of ['base', 'cand']) fs.mkdirSync(path.join(dir, 'profiles', profile), { recursive: true })
+    const base = path.join(dir, 'profiles/base/cordis.patch.yml'), cand = path.join(dir, 'profiles/cand/cordis.patch.yml')
+    fs.writeFileSync(base, '# baseline sentinel\n[]\n'); fs.writeFileSync(cand, '[]\n')
+    const calls = [], options = { candProfile: 'cand', force: false, dryRun: false }
+    const context = { home: dir, prefix: [], overlay: path.join(dir, 'missing'), log: () => {}, invoke: args => {
+      calls.push(args)
+      assert.equal(args[args.indexOf('--profile') + 1], 'cand')
+      return args.includes('--dump-config') ? { status: 0, stdout: fs.readFileSync(cand, 'utf8') }
+        : { status: 0, stdout: '{"type":"status","phase":"turn_end","reason":{"kind":"completed"}}\n' }
+    } }
+    configureSwitches(options, context, { ptc: { enabled: true } })
+    assert.equal(fs.readFileSync(base, 'utf8'), '# baseline sentinel\n[]\n')
+    assert.equal(calls.filter(args => args.includes('--json')).length, 1)
+    const good = context.invoke
+    for (const output of ['READINESS_BLOCKED', 'READY', '{"type":"turn_end","reason":"completed"}', '{"type":"status","phase":"turn_end","reason":{"kind":"failed"}}']) {
+      context.invoke = args => args.includes('--dump-config') ? good(args) : { status: 0, stdout: output }
+      assert.throws(() => configureSwitches(options, context, { ptc: { enabled: true } }), /issues\/207/)
+    }
+  })
+})
+
+await test('candidate switch conditions differ across sweeps, never across the two arms of one sweep', () => {
+  const switches = { ptc: { enabled: true } }
+  const base = { results: [], switches: {}, candidateSwitches: switches }
+  const cand = { results: [], switches, candidateSwitches: switches }
+  assert.doesNotThrow(() => compareSummaries(base, cand))
+  assert.throws(() => compareSummaries(base, { ...cand, candidateSwitches: { ptc: { enabled: false } } }), /Candidate switches differ/)
+  assert.match(renderReport(compareSummaries(base, cand)), /Candidate switches/)
+})
+
+await test('dynamic and non-mapping configuration is refused before candidate planning', () => {
+  for (const config of [{ expression: 'dynamic()' }, [true], 'unknown', 9]) {
+    assert.throws(() => planSwitchPatch('[]\n', { panel: { enabled: true } }, {
+      force: true, composed: [{ id: 'dsh-ops-panel', config }],
+    }), /manual|mapping|dynamic/)
+  }
+})
+
+await test('panel and shell activation respect legacy switches and explicit overrides', () => {
+  for (const [name, key] of [['panel', 'capture'], ['shell', 'publishBashTool']]) {
+    const before = `- id: dsh-ops-${name}\n  disabled: false\n  config:\n    ${key}: false\n    custom: 700\n`
+    assert.equal(switchesFromDump(before)[name].enabled, false)
+    assert.throws(() => planSwitchPatch(before, { [name]: { enabled: true } }), /force/)
+    const plan = planSwitchPatch(before, { [name]: { enabled: true } }, { force: true })
+    assert.equal(parse(plan.text)[0].config[key], true)
+    assert.equal(parse(plan.text)[0].config.custom, 700)
+    assert.equal(switchesFromDump(plan.text)[name].enabled, true)
+  }
+})
+
+await test('unevaluated and malformed activation config remains unknown in archived facts', () => {
+  for (const name of ['panel', 'shell', 'discovery']) {
+    for (const config of ['!!js dynamic()', '[]', 'false']) {
+      assert.equal(switchesFromDump(`- id: dsh-ops-${name}\n  config: ${config}\n`)[name].enabled, null)
+    }
+    assert.equal(switchesFromDump(`- id: dsh-ops-${name}\n  disabled: true\n  config: !!js dynamic()\n`)[name].enabled, false)
+  }
+})
+
+await test('official host composition retains inherited settings and applies only candidate switches', async () => {
+  await withTempDir('switch-compose-', async dir => {
+    const baseConfig = path.join(dir, 'base.yml'), candidatePatch = path.join(dir, 'candidate.yml')
+    fs.writeFileSync(baseConfig, JSON.stringify([
+      { id: 'dsh-ops-panel', name: 'panel-fixture', disabled: true, config: { capture: false, maxFrames: 17 } },
+      { id: 'dsh-ops-hide-official', name: 'hide-fixture', disabled: true, config: { replaceTools: [] } },
+    ]))
+    const render = patches => renderConfigDump('dsh', baseConfig, patches, line => { throw new Error(line) })
+    const baseline = render([]), wanted = extractSwitches(['--switch', 'panel', '--switch', 'hide-official=all']).switches
+    const plan = planSwitchPatch('[]\n', wanted, { composed: parse(baseline) })
+    fs.writeFileSync(candidatePatch, plan.text)
+    const candidate = render([{ label: 'candidate', patches: parse(fs.readFileSync(candidatePatch, 'utf8')) }])
+    assert.deepEqual(switchesFromDump(candidate), wanted)
+    assert.equal(parse(candidate).find(row => row.id === 'dsh-ops-panel').config.maxFrames, 17)
+    assert.equal(render([]), baseline)
+  })
+})
+
+await test('CLI refuses differing candidate switches and the panel renders the archived set', async () => {
+  await withTempDir('switch-report-', async dir => {
+    const files = ['base', 'cand'].map(side => path.join(dir, `${side}.json`))
+    const switches = { ptc: { enabled: true } }, lines = []
+    for (const [index, file] of files.entries()) fs.writeFileSync(file, JSON.stringify({ format: 'dsh-ops-bench-summary-v1', results: [], candidateSwitches: { ptc: { enabled: index === 0 } } }))
+    assert.equal(await compareMain([...files, '--out', '-'], { out: line => lines.push(line), err: line => lines.push(line) }), 2)
+    assert.match(lines.join('\n'), /Candidate switches differ/)
+    assert.match(lines.join('\n'), /"enabled":true/)
+    assert.match(lines.join('\n'), /"enabled":false/)
+    const arms = { base: { label: 'base', profile: 'base', profileHash: 'a', switches: {} }, cand: { label: 'cand', profile: 'cand', profileHash: 'b', switches } }
+    const run = { schemaVersion: 1, meta: { arms }, arms, results: [] }
+    const file = path.join(dir, 'run.json'); fs.writeFileSync(file, JSON.stringify(run))
+    const panel = renderPanel({ runJsonPath: file, outDir: dir })
+    const dom = new JSDOM(fs.readFileSync(panel.htmlPath, 'utf8'), { runScripts: 'dangerously', beforeParse(window) {
+      window.fetch = async () => ({ ok: true, json: async () => run })
+    } })
+    try { await waitFor(() => {
+      const failure = dom.window.document.getElementById('fallback-error').textContent
+      assert.equal(failure, '')
+      return dom.window.document.body.textContent.includes('Candidate switches: {"ptc":{"enabled":true}}')
+    }) }
+    finally { dom.window.close() }
+  })
+})
+
+report('bench-switches')
diff --git a/test/capabilities.test.mjs b/test/capabilities.test.mjs
index 868c3fac..2f65aade 100644
--- a/test/capabilities.test.mjs
+++ b/test/capabilities.test.mjs
@@ -65,9 +65,10 @@ await test('business file and batch definitions retain their original serialized
   assert.ok(batch.output.schema.oneOf.every(branch => branch.properties.status))
 })
 
-await test('file parameter help changes no structural schema constraints', () => {
+await test('file parameter schemas preserve their reviewed structural constraints', () => {
+  // #384 intentionally adds the optional exactTotal boolean; all other constraints remain pinned.
   const hash = createHash('sha256').update(JSON.stringify(withoutDescriptions(fileParameters))).digest('hex')
-  assert.equal(hash, '572d173fa3ca83606448134b591f4aa8b40b225f236b68a47b011ae177863590')
+  assert.equal(hash, '637df1383940fa6fdb2d65a68e67ce1e333a7e2ecbfceff5ffef7a4c1133ea8b')
 })
 
 await test('native registration consumes the catalogue while execute values stay unchanged', async () => {
diff --git a/test/catalogue-consistency.test.mjs b/test/catalogue-consistency.test.mjs
new file mode 100644
index 00000000..6376636d
--- /dev/null
+++ b/test/catalogue-consistency.test.mjs
@@ -0,0 +1,83 @@
+/** Shared catalogue facts must reach publication, configuration and native dispatch. */
+import fs from 'node:fs'
+import { CAPABILITIES, FILE_CAPABILITIES, PTC_CAPABILITIES, CONTINUATION_TOOLS, OBSERVED_READ_TOOLS, PTC_RESIDENT_TOOLS, DISCOVERY_TOOL_NAME } from '../lib/capabilities/registry.js'
+import { PTC_RESIDENT_TOOLS as actualResidents, PTC_LOADABLE_TOOLS } from '../lib/ptc/config.js'
+import { RAW_OFFICIAL_REPLACEMENTS, OFFICIAL_REPLACEMENT_NAMES } from '../lib/capabilities/replacements.js'
+import { OFFICIAL_REPLACEMENTS } from '../lib/official-tool-catalog.js'
+import { Config as shellConfig, NON_EDITABLE_CONFIG_KEYS } from '../lib/components/shell/index.js'
+import { Config as discoveryConfig } from '../lib/components/discovery/index.js'
+import { CORE_CONFIG_KEYS, resolveDiscoveryConfig } from '../lib/config.js'
+import { DISCOVERY_CONFIG_KEYS } from '../lib/discovery/config.js'
+import { resolvePanelConfig } from '../lib/components/panel/index.js'
+import { resolveTuiConfig } from '../lib/components/tui/index.js'
+import { publicToolName, renderToolingPolicy } from '../lib/policy.js'
+import { decodeContinuation } from '../lib/modes/ptc/continuation.js'
+import { componentChecks, defaultChecks } from '../scripts/lib/catalogue-checks.mjs'
+import { assert, test, report, withTempDir } from './lib/harness.mjs'
+import { requireWorker, callTool, envelopeOf } from './lib/boundary.mjs'
+requireWorker('catalogue-consistency')
+
+await test('adapter publication and retrieval classes agree with the catalogue', () => {
+  assert.equal(actualResidents, PTC_RESIDENT_TOOLS)
+  assert.deepEqual(actualResidents, ['inspect_local_file', 'result'])
+  assert.deepEqual(PTC_LOADABLE_TOOLS, [...FILE_CAPABILITIES, ...PTC_CAPABILITIES].filter(entry => entry.ptcAvailability === 'discoverable').map(entry => entry.rawName))
+  assert.deepEqual(CAPABILITIES.filter(entry => entry.ptcAvailability === 'resident').map(entry => entry.rawName), ['inspect_local_file', 'result', 'load_sdk'])
+  assert.deepEqual(OBSERVED_READ_TOOLS, ['inspect_local_file', 'read_files'])
+  for (const entry of CAPABILITIES) {
+    const token = 'ops-next-v1:' + JSON.stringify({ version: 1, tool: entry.rawName, args: entry.rawName === 'result' ? { action: 'page' } : {} })
+    assert.equal(Boolean(decodeContinuation(token)), CONTINUATION_TOOLS.includes(entry.rawName), entry.rawName)
+  }
+  assert.match(renderToolingPolicy({ published: [publicToolName(DISCOVERY_TOOL_NAME)] }), new RegExp(publicToolName(DISCOVERY_TOOL_NAME)))
+})
+
+await test('replacement choices have one browser-safe raw-name source', () => {
+  assert.deepEqual(OFFICIAL_REPLACEMENT_NAMES, Object.keys(OFFICIAL_REPLACEMENTS))
+  for (const name of OFFICIAL_REPLACEMENT_NAMES) assert.equal(OFFICIAL_REPLACEMENTS[name], publicToolName(RAW_OFFICIAL_REPLACEMENTS[name]))
+})
+
+await test('every accepted settings field is described or explicitly excluded', () => {
+  assert.deepEqual([...Object.keys(shellConfig.dict), ...NON_EDITABLE_CONFIG_KEYS].sort(), [...CORE_CONFIG_KEYS].sort())
+  assert.deepEqual(Object.keys(discoveryConfig.dict).sort(), [...DISCOVERY_CONFIG_KEYS].sort())
+  for (const [config, input] of [[shellConfig, { allowSystemShellFallback: true }], [discoveryConfig, { required: true, denyCredentialReads: false, binaryPath: 'fixture' }]]) {
+    const normalized = config['~standard'].validate(input)
+    assert.equal(normalized.issues, undefined)
+    for (const [key, value] of Object.entries(input)) {
+      assert.equal(config.dict[key].meta.volatile, true)
+      assert.equal(normalized.value[key], value)
+    }
+  }
+})
+
+await test('component declaration checks reject entry, target, tool, default and command drift', () => {
+  const rows = JSON.parse(fs.readFileSync(new URL('../dsh-plugin.json', import.meta.url))).contributes['x-components']
+  const failed = values => componentChecks(values).filter(([okay]) => !okay)
+  assert.deepEqual(failed(rows), [])
+  for (const [id, key, value] of [
+    ['shell', 'entry', 'wrong'], ['file', 'targets', []], ['discovery', 'tools', []],
+    ['panel', 'tools', ['rogue']], ['tui', 'defaultEnabled', true], ['hide-official', 'retainedOfficialCommand', { win32: 'bash' }],
+  ]) {
+    const changed = structuredClone(rows)
+    changed.find(row => row.id === `dsh-ops-${id}`)[key] = value
+    assert.ok(failed(changed).length > 0, `${id}.${key}`)
+  }
+})
+
+await test('valid but mismatched panel, TUI and discovery defaults fail the declaration gate', () => {
+  for (const [name, resolve, key, changed] of [['panel', resolvePanelConfig, 'textLimit', 4000], ['tui', resolveTuiConfig, 'recentLimit', 4], ['discovery', resolveDiscoveryConfig, 'maxResults', 4]]) {
+    const value = resolve({})[key]
+    assert.ok(defaultChecks(name, { [key]: value }, resolve).every(([okay]) => okay))
+    resolve({ [key]: changed }) // a merely valid value must not be confused with the default
+    assert.equal(defaultChecks(name, { [key]: changed }, resolve)[0][0], false)
+  }
+})
+
+await test('every catalogue worker name reaches an implemented Rust dispatch branch', () => withTempDir('catalogue-dispatch', async root => {
+  const unknown = envelopeOf(await callTool('not_a_capability', {}, { root }), assert)
+  assert.match(unknown.error.message, /Unknown capability/)
+  for (const entry of [...FILE_CAPABILITIES, ...PTC_CAPABILITIES]) {
+    const value = envelopeOf(await callTool(entry.rawName, {}, { root }), assert)
+    assert.doesNotMatch(value.error?.message ?? '', /Unknown capability/, entry.rawName)
+    assert.notEqual(value.error?.code, 'POLICY_DENIED', `${entry.rawName}: pre-dispatch denial hides coverage`)
+  }
+}))
+report('catalogue-consistency')
diff --git a/test/discovery-incremental.test.mjs b/test/discovery-incremental.test.mjs
new file mode 100644
index 00000000..85288667
--- /dev/null
+++ b/test/discovery-incremental.test.mjs
@@ -0,0 +1,360 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { createScope } from '@deepseek-ai/dsh-scope'
+import Subprocess from '@deepseek-ai/dsh-subprocess-local'
+import Sandbox from '@deepseek-ai/dsh-sandbox-local'
+import * as discovery from '../lib/discovery/index.js'
+import { isPresentationProbe } from '../lib/presentation.js'
+import { assert, test, report, waitFor, withTempDir } from './lib/harness.mjs'
+import { bootHost, scopedToolNames, shutdown } from './lib/host.mjs'
+import { WORKER, requireWorker } from './lib/boundary.mjs'
+
+requireWorker('discovery-incremental')
+const DISCOVER = 'ops_discover_tools'
+const tick = () => new Promise(resolve => setImmediate(resolve))
+const visible = (ctx, agent, name = DISCOVER) => scopedToolNames(ctx, agent).includes(name)
+const step = (ctx, agent) => ctx.waterfall('agent/pre-step', {
+  agent, messages: [], turn: 1, step: 1, signal: new AbortController().signal,
+}, async () => ({ kind: 'continue' }))
+const call = (ctx, agent, name, args) => ctx.get('tools').execute({
+  agent, name, arguments: args, callId: 'incremental', signal: new AbortController().signal,
+})
+
+async function setup(dir, config = {}) {
+  const { ctx } = await bootHost()
+  const agents = [], counts = new Map()
+  ctx.provide('agents', { list: () => agents })
+  await ctx.plugin(Subprocess); await ctx.plugin(Sandbox)
+  const policyRow = await ctx.plugin(inner => inner.provide('sandboxPolicy', {
+    resolve: ({ session } = {}) => ({
+      mode: session?.mode ?? 'workspace-write', workspaceRoot: session?.header.cwd ?? dir, sessionId: session?.id,
+    }),
+  }))
+  const prompt = ctx.get('systemPrompt')
+  prompt.section({ name: 'incremental-counter', order: 10, text: context => {
+    if (isPresentationProbe(context)) counts.set(context.scope, (counts.get(context.scope) ?? 0) + 1)
+    return ''
+  } })
+  const mount = (target = ctx, extra = {}) => target.plugin({
+    apply(inner) { discovery.apply(inner, { binaryPath: WORKER, required: true, ...config, ...extra }) },
+  })
+  const row = await mount()
+  async function mint(parent) {
+    const id = 'incremental-' + agents.length
+    const agent = { id, session: { id, mode: 'workspace-write', header: { cwd: dir } } }
+    await (parent?.ctx ?? ctx).plugin({ inject: ['tools'], apply(inner) {
+      agent.ctx = createScope(inner, agent, parent ? { parent } : undefined).ctx
+    } })
+    agents.push(agent)
+    await ctx.serial('agent/created', { agent })
+    return agent
+  }
+  const flush = async agent => { await prompt.assemble({ scope: agent }); await tick() }
+  return { ctx, prompt, row, policyRow, agents, counts, mint, mount, flush }
+}
+
+await test('adding an agent probes it once and never reassembles unchanged agents', () => withTempDir('discovery-incremental', async dir => {
+  const host = await setup(dir)
+  const { ctx, counts, mint, flush } = host
+  try {
+    const old = []
+    for (let i = 0; i < 12; i++) old.push(await mint())
+    await flush(old[0]); counts.clear()
+    let promptChanges = 0, toolChanges = 0
+    ctx.on('system-prompt/change', () => { ++promptChanges })
+    ctx.on('tools/change', () => { ++toolChanges })
+    const added = await mint()
+    await flush(added)
+    const oldCount = old.reduce((sum, agent) => sum + (counts.get(agent) ?? 0), 0)
+    console.log(`  added agent: old=${oldCount}, new=${counts.get(added) ?? 0}, old agents=${old.length}`)
+    console.log(`  real registration events: prompt=${promptChanges}, tools=${toolChanges}`)
+    assert.equal(oldCount, 0, 'agent/created must not reassemble unrelated agents')
+    assert.equal(counts.get(added), 1)
+    assert.equal(promptChanges, 0, 'the per-row prompt provider must not be registered per agent')
+    assert.ok(toolChanges > 0, 'the counted path must include real host tool registration')
+    assert.ok(old.every(agent => visible(ctx, agent)) && visible(ctx, added))
+    counts.clear()
+    await ctx.serial('agent/disposed', { agent: added }); await flush(old[0])
+    assert.equal([...counts.values()].reduce((a, b) => a + b, 0), 0, 'disposal does not invalidate surviving presentation')
+  } finally { await shutdown(ctx) }
+}))
+
+await test('a pre-step probes only its own agent once while committing pending tools', () => withTempDir('discovery-incremental', async dir => {
+  const { ctx, counts, mint, flush } = await setup(dir)
+  try {
+    const owner = await mint(), other = await mint()
+    await call(ctx, owner, DISCOVER, { query: 'select:ops_stat' })
+    await flush(owner); counts.clear()
+    await step(ctx, owner); await flush(owner)
+    console.log(`  pre-step: owner=${counts.get(owner) ?? 0}, other=${counts.get(other) ?? 0}`)
+    assert.equal(counts.get(owner), 1, 'pre-step and its reconcile share one presentation probe')
+    assert.equal(counts.get(other) ?? 0, 0)
+    assert.equal(visible(ctx, owner, 'ops_stat'), true)
+    assert.equal(visible(ctx, other, 'ops_stat'), false)
+  } finally { await shutdown(ctx) }
+}))
+
+await test('prompt registry and runtime config changes invalidate cached presentation', () => withTempDir('discovery-incremental', async dir => {
+  const { ctx, prompt, mint, flush } = await setup(dir)
+  try {
+    const owner = await mint()
+    let ptc = false
+    const dynamic = await ctx.plugin({ inject: ['systemPrompt'], apply(inner) {
+      inner.on('internal/update', (config, _noSave, _next) => { ptc = config.ptc })
+      inner.systemPrompt.section({ name: 'tools:ptc-only', order: 20, text: () => ptc ? 'PTC only' : '' })
+    } })
+    await flush(owner)
+    dynamic.update({ ptc: true }, true); await flush(owner)
+    assert.equal(visible(ctx, owner), false, 'in-place runtime update has no prompt registration event')
+    dynamic.update({ ptc: false }, true); await flush(owner)
+    assert.equal(visible(ctx, owner), true)
+    await dynamic.dispose()
+    const lift = prompt.section({ name: 'tools:ptc-only', order: 20, text: 'PTC only' })
+    await flush(owner)
+    assert.equal(visible(ctx, owner), false)
+    lift(); await flush(owner)
+    assert.equal(visible(ctx, owner), true)
+  } finally { await shutdown(ctx) }
+}))
+
+await test('runtime invalidation waits for the real asynchronous Fiber restart to finish', () => withTempDir('discovery-incremental', async dir => {
+  const { ctx, prompt, mint, flush } = await setup(dir)
+  let release
+  try {
+    const owner = await mint()
+    let ptc = false, entered
+    const entering = new Promise(resolve => { entered = resolve })
+    const blocked = new Promise(resolve => { release = resolve })
+    prompt.section({ name: 'tools:ptc-only', order: 20, text: () => ptc ? 'PTC only' : '' })
+    const dynamic = await ctx.plugin({ async apply(_inner, config) {
+      if (config.ptc) { entered(); await blocked }
+      ptc = config.ptc
+    } }, { ptc: false })
+    await flush(owner)
+    dynamic.update({ ptc: true }, true)
+    await entering
+    await flush(owner)
+    assert.equal(visible(ctx, owner), true, 'pending configuration still has its old value')
+    release(); await dynamic; await tick()
+    assert.equal(visible(ctx, owner), false, 'invalidate after next() resolves, not just after it returns a Promise')
+    dynamic.update({ ptc: false }, true)
+    await dynamic; await flush(owner)
+    assert.equal(visible(ctx, owner), true)
+  } finally { release?.(); await shutdown(ctx) }
+}))
+
+await test('Native, PTC and both mode changes retain scoped ownership and restore on unload', () => withTempDir('discovery-incremental', async dir => {
+  const { ctx, mint, mount, flush } = await setup(dir)
+  try {
+    ctx.provide('ptcRuntime', { language: 'typescript' })
+    const parent = await mint(), child = await mint(parent), sibling = await mint()
+    const lift = parent.ctx.tools.presentAs('ptc')
+    await flush(parent); await flush(child)
+    assert.equal(visible(ctx, parent), false); assert.equal(visible(ctx, child), false)
+    assert.equal(visible(ctx, sibling), true)
+    const both = child.ctx.tools.presentAs('both')
+    await flush(child)
+    assert.equal(visible(ctx, child), true)
+    const second = await mount(child.ctx, { alwaysLoaded: ['stat'] })
+    await waitFor(() => visible(ctx, child, 'ops_stat'))
+    assert.equal(visible(ctx, sibling, 'ops_stat'), false)
+    const cached = ctx.get('tools').get('ops_stat', child)
+    await second.dispose(); await flush(child)
+    assert.equal(visible(ctx, child, 'ops_stat'), false)
+    assert.equal((await cached.execute({ path: '.' }, { agent: child })).status, 'rejected')
+    both(); lift(); await flush(parent); await flush(child)
+    assert.equal(visible(ctx, parent), true); assert.equal(visible(ctx, child), true)
+  } finally { await shutdown(ctx) }
+}))
+
+await test('session authority changes refresh only that session and live calls use its cwd', () => withTempDir('discovery-incremental', async dir => {
+  const { ctx, counts, mint, flush } = await setup(dir, { alwaysLoaded: ['stat', 'write_file'] })
+  try {
+    const owner = await mint(), other = await mint()
+    fs.writeFileSync(path.join(dir, 'sample'), 'first')
+    const childDir = path.join(dir, 'changed'); fs.mkdirSync(childDir)
+    fs.writeFileSync(path.join(childDir, 'sample'), 'different')
+    await flush(owner); counts.clear()
+    owner.session.mode = 'read-only'; owner.session.header.cwd = childDir
+    await ctx.serial('session/event', owner.session, { type: 'sandbox/mode', data: { mode: 'read-only' } })
+    await flush(owner)
+    assert.equal(visible(ctx, owner, 'ops_write_file'), false)
+    assert.equal(visible(ctx, other, 'ops_write_file'), true)
+    assert.equal(counts.get(other) ?? 0, 0, 'session-local policy invalidation must not probe a sibling')
+    assert.equal((await call(ctx, owner, 'ops_stat', { path: 'sample' })).value.bytes, 9)
+    assert.equal((await call(ctx, owner, 'ops_write_file', { path: 'new', content: 'denied' })).isError, true)
+  } finally { await shutdown(ctx) }
+}))
+
+await test('service unload and reload discard cached failures and stale registrations', () => withTempDir('discovery-incremental', async dir => {
+  const { ctx, policyRow, mint, flush } = await setup(dir)
+  try {
+    const owner = await mint()
+    const cached = ctx.get('tools').get(DISCOVER, owner)
+    await policyRow.dispose()
+    assert.equal(visible(ctx, owner), false)
+    assert.equal((await cached.execute({ query: 'stat' }, { agent: owner })).status, 'rejected')
+    await ctx.plugin(inner => inner.provide('sandboxPolicy', {
+      resolve: ({ session }) => ({ mode: 'read-only', workspaceRoot: session.header.cwd, sessionId: session.id }),
+    }))
+    await flush(owner)
+    assert.equal(visible(ctx, owner), true)
+    assert.notEqual(ctx.get('tools').get(DISCOVER, owner), cached)
+  } finally { await shutdown(ctx) }
+}))
+
+await test('same agent with changed session cwd or policy is reprobed even without an event', () => withTempDir('discovery-incremental', async dir => {
+  const { ctx, prompt, counts, mint, flush } = await setup(dir)
+  try {
+    const owner = await mint(), other = await mint()
+    prompt.section({ name: 'tools:ptc-only', order: 20, text: ({ scope }) =>
+      scope.session.mode === 'read-only' || scope.session.header.cwd !== dir ? 'PTC only' : '' })
+    await flush(owner); counts.clear()
+    owner.session.header.cwd = path.join(dir, 'changed')
+    await mint()
+    assert.equal(visible(ctx, owner), false)
+    assert.ok(counts.get(owner) > 0, 'changed cwd must invalidate the owner; withdrawal may rebuild its SDK')
+    assert.equal(counts.get(other) ?? 0, 0)
+    owner.session.header.cwd = dir; await mint()
+    assert.equal(visible(ctx, owner), true)
+    owner.session.mode = 'read-only'; await mint()
+    assert.equal(visible(ctx, owner), false)
+    owner.session.mode = 'workspace-write'; await mint()
+    assert.equal(visible(ctx, owner), true)
+  } finally { await shutdown(ctx) }
+}))
+
+await test('external tool registration and disposal invalidate presentation, not just schemas', () => withTempDir('discovery-incremental', async dir => {
+  const { ctx, prompt, mint, flush } = await setup(dir)
+  try {
+    const owner = await mint(), tools = ctx.get('tools')
+    prompt.section({ name: 'tools:ptc-only', order: 20, text: () => tools.get('presentation_switch') ? 'PTC only' : '' })
+    await flush(owner)
+    const lift = tools.register({ name: 'presentation_switch', description: '', parameters: { type: 'object' },
+      output: { schema: {}, render: () => [] }, execute: () => ({}) })
+    await flush(owner)
+    assert.equal(visible(ctx, owner), false)
+    lift(); await flush(owner)
+    assert.equal(visible(ctx, owner), true)
+  } finally { await shutdown(ctx) }
+}))
+
+await test('unsignalled dynamic providers are fresh at pre-step and cached-definition execution', () => withTempDir('discovery-incremental', async dir => {
+  const { ctx, prompt, mint, flush } = await setup(dir)
+  try {
+    const owner = await mint()
+    let ptc = false
+    prompt.section({ name: 'tools:ptc-only', order: 20, text: () => ptc ? 'PTC only' : '' })
+    await flush(owner)
+    const cached = ctx.get('tools').get(DISCOVER, owner)
+    ptc = true
+    assert.equal((await cached.execute({ query: 'stat' }, { agent: owner })).status, 'rejected')
+    assert.equal(visible(ctx, owner), false)
+    ptc = false
+    await step(ctx, owner)
+    assert.equal(visible(ctx, owner), true, 'no registry event is required at the model-step boundary')
+    ptc = true
+    await step(ctx, owner)
+    assert.equal(visible(ctx, owner), false)
+  } finally { await shutdown(ctx) }
+}))
+
+await test('an invalidation during asynchronous assembly cannot publish the retired result', () => withTempDir('discovery-incremental', async dir => {
+  const { ctx, prompt, mint, flush } = await setup(dir)
+  let release
+  try {
+    const owner = await mint()
+    let ptc = false, hold = false, entered
+    const entering = new Promise(resolve => { entered = resolve })
+    const blocked = new Promise(resolve => { release = resolve })
+    prompt.section({ name: 'tools:ptc-only', order: 20, text: () => ptc ? 'PTC only' : '' })
+    await flush(owner)
+    ctx.on('system-prompt/assemble', async (_assembly, context, next) => {
+      if (isPresentationProbe(context) && context.scope === owner && hold) {
+        hold = false; entered(); await blocked
+      }
+      return next()
+    })
+    hold = true
+    await ctx.serial('tools/change'); await entering
+    ptc = true
+    await ctx.serial('tools/change')
+    release(); await flush(owner)
+    assert.equal(visible(ctx, owner), false)
+    ptc = false; await ctx.serial('tools/change'); await flush(owner)
+    assert.equal(visible(ctx, owner), true)
+  } finally { release?.(); await shutdown(ctx) }
+}))
+
+await test('overlapping agent creation preserves new work without reprobes of old agents', () => withTempDir('discovery-incremental', async dir => {
+  const { ctx, counts, mint, flush } = await setup(dir)
+  let release
+  try {
+    const old = await mint()
+    await flush(old); counts.clear()
+    let entered, hold = true
+    const entering = new Promise(resolve => { entered = resolve })
+    const blocked = new Promise(resolve => { release = resolve })
+    ctx.on('system-prompt/assemble', async (_assembly, context, next) => {
+      if (isPresentationProbe(context) && context.scope !== old && hold) {
+        hold = false; entered(); await blocked
+      }
+      return next()
+    })
+    const first = mint()
+    await entering
+    const second = mint()
+    release()
+    const added = await Promise.all([first, second])
+    await flush(old)
+    assert.equal(counts.get(old) ?? 0, 0)
+    for (const agent of added) {
+      assert.equal(counts.get(agent), 1)
+      assert.equal(visible(ctx, agent), true)
+    }
+  } finally { release?.(); await shutdown(ctx) }
+}))
+
+await test('optional PTC runtime mount and unmount refresh failed both-mode probes', () => withTempDir('discovery-incremental', async dir => {
+  const { ctx, mint, flush } = await setup(dir)
+  try {
+    const owner = await mint()
+    const lift = owner.ctx.tools.presentAs('both')
+    // Without a runtime the host rejects this presentation before its waterfall.
+    await waitFor(() => !visible(ctx, owner))
+    const mountRuntime = () => ctx.plugin(inner => inner.provide('ptcRuntime', { language: 'typescript' }))
+    const runtime = await mountRuntime()
+    await flush(owner)
+    assert.equal(visible(ctx, owner), true)
+    await runtime.dispose()
+    await waitFor(() => !visible(ctx, owner))
+    await mountRuntime(); await flush(owner)
+    assert.equal(visible(ctx, owner), true)
+    lift()
+  } finally { await shutdown(ctx) }
+}))
+
+await test('unloading during a probe cannot resurrect registrations or leave change listeners', () => withTempDir('discovery-incremental', async dir => {
+  const { ctx, row, counts, mint } = await setup(dir)
+  let release
+  try {
+    const owner = await mint(), cached = ctx.get('tools').get(DISCOVER, owner)
+    let entered, hold = true
+    const entering = new Promise(resolve => { entered = resolve })
+    const blocked = new Promise(resolve => { release = resolve })
+    ctx.on('system-prompt/assemble', async (_assembly, context, next) => {
+      if (isPresentationProbe(context) && hold) { hold = false; entered(); await blocked }
+      return next()
+    })
+    await ctx.serial('tools/change'); await entering
+    const closing = row.dispose()
+    release(); await closing
+    assert.equal(visible(ctx, owner), false)
+    assert.equal((await cached.execute({ query: 'stat' }, { agent: owner })).status, 'rejected')
+    counts.clear()
+    await ctx.serial('tools/change'); await ctx.serial('system-prompt/change'); await tick()
+    assert.equal(counts.size, 0)
+  } finally { release?.(); await shutdown(ctx) }
+}))
+
+report('discovery-incremental')
diff --git a/test/discovery-probe-memo.test.mjs b/test/discovery-probe-memo.test.mjs
new file mode 100644
index 00000000..99e30b52
--- /dev/null
+++ b/test/discovery-probe-memo.test.mjs
@@ -0,0 +1,54 @@
+/** Discovery uses attributed OPS changes locally and conservatively probes unknown host notifications. */
+import { createScope } from '@deepseek-ai/dsh-scope'
+import Sandbox from '@deepseek-ai/dsh-sandbox-local'
+import Subprocess from '@deepseek-ai/dsh-subprocess-local'
+import * as discovery from '../lib/components/discovery/index.js'
+import { withToolChange } from '../lib/tool-changes.js'
+import { isPresentationProbe } from '../lib/presentation.js'
+import { assert, test, report, wait, withTempDir } from './lib/harness.mjs'
+import { bootHost, shutdown } from './lib/host.mjs'
+
+const foreignTool = name => ({
+  name,
+  description: `probe memo fixture ${name}`,
+  parameters: { type: 'object', properties: {} },
+  output: { schema: { type: 'object' }, render: () => [] },
+  execute: async () => ({ content: 'ok' }),
+})
+
+await test('an attributed unrelated scope change skips probes but unknown host notifications stay fresh', () => withTempDir('discovery', async dir => {
+  const { ctx } = await bootHost()
+  try {
+    await ctx.plugin(Subprocess)
+    await ctx.plugin(Sandbox, {})
+    await ctx.plugin(inner => inner.provide('sandboxPolicy', {
+      resolve: ({ session }) => ({ mode: session.mode, workspaceRoot: session.header.cwd, sessionId: session.id }),
+    }))
+    await ctx.plugin(discovery, { required: true })
+    const agent = { id: 'probe-memo', session: { id: 'probe-memo', mode: 'danger-full-access', header: { cwd: dir } } }
+    await ctx.plugin({ inject: ['tools'], apply(inner) { agent.ctx = createScope(inner, agent).ctx } })
+    await ctx.serial('agent/created', { agent, source: 'startup' })
+
+    const prompt = ctx.get('systemPrompt'), assemble = prompt.assemble.bind(prompt)
+    let probes = 0
+    prompt.assemble = context => { if (isPresentationProbe(context)) ++probes; return assemble(context) }
+    try {
+      // A real registration moves the surface, so the first reconcile owes (and makes) a probe.
+      const registered = ctx.get('tools').register(foreignTool('probe_memo_alpha'))
+      await wait(300)
+      const settled = probes
+      assert.ok(settled > 0, 'a registry change probes the agent at least once (precondition)')
+      // Package-owned sibling changes carry exact scope attribution; they cannot
+      // affect this root agent, unlike an unknown external prompt/tool provider.
+      await withToolChange([{}], () => ctx.serial('tools/change', {}))
+      await wait(300)
+      assert.equal(probes, settled, 'unrelated OPS registration must not re-probe')
+      await ctx.serial('tools/change', {})
+      await wait(300)
+      assert.ok(probes > settled, 'unknown registry notifications conservatively invalidate the verdict')
+      registered()
+    } finally { prompt.assemble = assemble }
+  } finally { await shutdown(ctx) }
+}))
+
+report('discovery-probe-memo')
diff --git a/test/docs-facts.test.mjs b/test/docs-facts.test.mjs
index 229da2b6..3aabf918 100644
--- a/test/docs-facts.test.mjs
+++ b/test/docs-facts.test.mjs
@@ -51,4 +51,21 @@ await test('the discovery allowedTools example is exactly the discoverable catal
   }
 })
 
+// #300: a published checksum without its object is not a contract — the notes said
+// `SHA-256` and meant the worker in one release, the archive in the next. The docs now
+// have to name both objects, and the checker they recommend has to be a real script.
+await test('docs name the object of each published checksum and keep the checker', () => {
+  const releaseProcess = read('docs/release-process.md')
+  // Both clauses are unique to the stated contract: `SHA256SUMS` already appears as a
+  // build artifact elsewhere, so matching the word alone would stay green on a revert.
+  assert.match(releaseProcess, /authoritative in `SHA256SUMS`/u)
+  assert.match(releaseProcess, /never defines a checksum/u)
+  assert.doesNotMatch(releaseProcess, /正文为准/u)
+  for (const file of ['docs/troubleshooting.md', 'docs/常见问题.md']) {
+    assert.match(read(file), /native-runtime\.mjs check --root package --platform/u, `${file} lost the in-package checker`)
+  }
+  assert.equal(fs.existsSync(path.join(PACKAGE_ROOT, 'bin/native-runtime.mjs')), true,
+    'the checker the docs recommend no longer exists')
+})
+
 report('docs-facts')
diff --git a/test/file-contract.test.mjs b/test/file-contract.test.mjs
index 2d4bea77..defa60b5 100644
--- a/test/file-contract.test.mjs
+++ b/test/file-contract.test.mjs
@@ -9,7 +9,7 @@ const fields = tool => Object.fromEntries(Object.entries(PARAMETERS[tool].proper
 await test('grep, glob and replace parameters are pinned exactly', () => {
   assert.deepEqual(fields('grep'), {
     path: 'string', pattern: 'string', glob: 'array', outputMode: 'string', caseInsensitive: 'boolean',
-    lineNumbers: 'boolean', beforeContext: 'integer', afterContext: 'integer', multiline: 'boolean', offset: 'integer', limit: 'integer', continuation: 'string',
+    lineNumbers: 'boolean', beforeContext: 'integer', afterContext: 'integer', multiline: 'boolean', offset: 'integer', limit: 'integer', exactTotal: 'boolean', continuation: 'string',
   })
   assert.deepEqual(fields('glob'), { path: 'string', pattern: 'array', outputMode: 'string', sort: 'string', offset: 'integer', limit: 'integer', continuation: 'string' })
   assert.deepEqual(fields('replace'), { path: 'string', pattern: 'string', replacement: 'string', glob: 'array', maxReplacements: 'integer', dryRun: 'boolean' })
diff --git a/test/host-metadata.test.mjs b/test/host-metadata.test.mjs
new file mode 100644
index 00000000..90f3b9f0
--- /dev/null
+++ b/test/host-metadata.test.mjs
@@ -0,0 +1,54 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { pathToFileURL, fileURLToPath } from 'node:url'
+import { parse } from 'yaml'
+import { composeBundle } from '../scripts/lib/compose-bundle.mjs'
+import { assert, test, report, PACKAGE_ROOT } from './lib/harness.mjs'
+
+// The normal gate uses its locked host. An isolated published-host installation
+// can run exactly the same assertions without replacing the repository's graph.
+const boot = await import(process.env.DSH_OPS_TEST_HOST_BOOT
+  ? pathToFileURL(path.resolve(process.env.DSH_OPS_TEST_HOST_BOOT)).href
+  : '@deepseek-ai/dsh-app-boot')
+const pkg = JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT, 'package.json'), 'utf8'))
+const components = ['shell', 'file', 'background', 'ptc', 'discovery', 'panel', 'tui', 'hide-official']
+const patch = parse(fs.readFileSync(path.join(PACKAGE_ROOT, 'cordis.patch.yml'), 'utf8'))
+
+await test(`explicit host compatibility is consistent and bounded (${boot.getDshRuntimeVersion()})`, () => {
+  assert.equal(typeof pkg.engines.dsh, 'string')
+  assert.equal(pkg.engines.dsh, pkg.peerDependencies['@deepseek-ai/dsh'])
+  // Exercise each declared range through the actual host evaluator. Older hosts
+  // read peers, newer hosts prefer engines, so test both independently.
+  for (const range of [pkg.engines.dsh, pkg.peerDependencies['@deepseek-ai/dsh']]) {
+    const candidate = { name: pkg.name, version: pkg.version, engines: { dsh: range }, peerDependencies: { '@deepseek-ai/dsh': range } }
+    for (const version of ['0.2.0-rc.2', '0.2.1-rc.2']) assert.equal(boot.evaluatePluginCompatibility(candidate, {}, version), undefined)
+    for (const version of ['0.2.0-rc.1', '0.2.1-rc.3', '0.3.0']) assert.ok(boot.evaluatePluginCompatibility(candidate, {}, version), `must not claim ${version}`)
+  }
+})
+
+await test('component resources resolve and the host reads bilingual text plus icon bytes', () => {
+  for (const component of components) {
+    const name = `${pkg.name}/${component}`
+    const iconFile = fileURLToPath(import.meta.resolve(`${name}/icon`))
+    const icon = fs.readFileSync(iconFile)
+    assert.ok(icon.length > 0 && icon.length <= 256 * 1024)
+    assert.deepEqual(icon.subarray(0, 8), Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]))
+    const metadata = boot.readPluginMeta(name, import.meta.url)
+    assert.ok(metadata, name)
+    assert.ok(metadata.title.en && metadata.title.zh, name)
+    assert.ok(metadata.description.en && metadata.description.zh, name)
+    assert.match(metadata.icon, /^data:image\/png;base64,/)
+    assert.deepEqual(Buffer.from(metadata.icon.split(',')[1], 'base64'), icon)
+  }
+})
+
+await test('the host composes every shipped row and refuses a missing override target', () => {
+  const rows = composeBundle([patch], boot.composeEntries)
+  assert.deepEqual(rows.map(row => row.id), components.filter(name => name !== 'background').map(name => `dsh-ops-${name}`))
+  const upstream = [{ insert: [{ id: 'upstream', name: 'cordis:fixture' }] }]
+  const override = [{ id: 'upstream', config: { enabled: true } }]
+  assert.equal(composeBundle([upstream, patch, override], boot.composeEntries).find(row => row.id === 'upstream').config.enabled, true)
+  assert.throws(() => composeBundle([patch, override], boot.composeEntries), /entry.*upstream.*not found/)
+})
+
+report('host-metadata')
diff --git a/test/lib/bash-ipc-processes.mjs b/test/lib/bash-ipc-processes.mjs
new file mode 100644
index 00000000..38bed36c
--- /dev/null
+++ b/test/lib/bash-ipc-processes.mjs
@@ -0,0 +1,56 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import Subprocess from '@deepseek-ai/dsh-subprocess-local'
+import Sandbox from '@deepseek-ai/dsh-sandbox-local'
+import { bootHost, shutdown } from './host.mjs'
+import { assert } from './harness.mjs'
+import { prepareWorkspace } from '../../lib/workspace-preparation.js'
+
+/** Keep one real MSYS root alive while independent roots reopen its shared section. */
+export async function independentBashRoots(runtime, root) {
+  const { ctx } = await bootHost()
+  const handles = []
+  const signal = AbortSignal.timeout(30_000)
+  try {
+    await ctx.plugin(Subprocess)
+    await ctx.plugin(Sandbox, {})
+    const policy = { mode: 'workspace-write', workspaceRoot: root, sessionId: 'bash-ipc-roots' }
+    await prepareWorkspace(policy)
+    const start = async (command, stdin = { data: '' }) => {
+      const confined = await ctx.get('sandbox').confine([runtime.file, '-c', command], policy, signal)
+      const handle = ctx.get('subprocess').spawn({ argv: confined.argv, cwd: root, env: runtime.env,
+        graceMs: 1000, stdio: { stdin, stdout: { maxBytes: 4096 }, stderr: { maxBytes: 4096 } }, signal })
+      handles.push(handle)
+      return handle
+    }
+    const holder = await start("printf 'HOLD_READY'; read -r answer", 'pipe')
+    let settled = false
+    const holderOutcome = holder.done.finally(() => { settled = true })
+    // Observation waits do not retry commands or mask startup failures.
+    const deadline = Date.now() + 10_000
+    while (!settled && Date.now() < deadline && !holder.collected.stdout.readFrom(0).text.includes('HOLD_READY')) {
+      await new Promise(resolve => setTimeout(resolve, 10))
+    }
+    assert.equal(holder.collected.stdout.readFrom(0).text, 'HOLD_READY', holder.collected.stderr.readFrom(0).text)
+    assert.equal(settled, false, 'the first independent MSYS root must still own its shared section')
+    const results = await Promise.all(Array.from({ length: 8 }, async (_, index) => {
+      const child = await start(`printf 'ROOT_${index}'; printf '${index}' > inside-${index}.txt`)
+      const outcome = await child.done
+      return { index, outcome, stdout: child.collected.stdout.readFrom(0).text, stderr: child.collected.stderr.readFrom(0).text }
+    }))
+    for (const { index, outcome, stdout, stderr } of results) {
+      assert.equal(outcome.exitCode, 0, `independent root ${index}: ${stderr}`)
+      assert.equal(stdout, `ROOT_${index}`, stderr)
+      assert.equal(fs.readFileSync(path.join(root, `inside-${index}.txt`), 'utf8'), String(index))
+    }
+    const denied = await start("printf forbidden > ../outside.txt")
+    assert.notEqual((await denied.done).exitCode, 0, 'IPC compatibility must not grant filesystem writes')
+    assert.equal(fs.existsSync(path.join(root, '../outside.txt')), false)
+    holder.stdin.end('done\n')
+    assert.equal((await holderOutcome).exitCode, 0)
+  } finally {
+    for (const handle of handles) handle.terminate()
+    await Promise.allSettled(handles.map(handle => handle.done))
+    await shutdown(ctx)
+  }
+}
diff --git a/test/lib/discovery.mjs b/test/lib/discovery.mjs
index 706ffc89..0ba6f836 100644
--- a/test/lib/discovery.mjs
+++ b/test/lib/discovery.mjs
@@ -8,10 +8,11 @@ import Subprocess from '@deepseek-ai/dsh-subprocess-local'
 import * as discovery from '../../lib/components/discovery/index.js'
 import { definition } from '../../lib/file/contract.js'
 import { publicToolName } from '../../lib/policy.js'
+import { DISCOVERY_TOOL_NAME } from '../../lib/capabilities/registry.js'
 import { assert, test, waitFor, withTempDir } from './harness.mjs'
 import { bootHost, registryHasOwnRegister, scopedToolNames, shutdown } from './host.mjs'
 
-const DISCOVER = publicToolName('discover_tools')
+const DISCOVER = publicToolName(DISCOVERY_TOOL_NAME)
 async function boot(config = {}) {
   const { ctx } = await bootHost()
   await ctx.plugin(Subprocess)
diff --git a/test/linux-scope.test.mjs b/test/linux-scope.test.mjs
index 1c37410a..adaf334f 100644
--- a/test/linux-scope.test.mjs
+++ b/test/linux-scope.test.mjs
@@ -88,7 +88,7 @@ function stageRuntime(root, { target, bytes = Buffer.from('synthetic worker byte
 }
 
 await test('every foreign target is refused by name, naming the supported set', async () => {
-  for (const target of ['darwin-x64', 'linux-arm64', 'win32-arm64', 'linux-riscv64', 'openharmony-arm64']) {
+  for (const target of ['linux-arm64', 'win32-arm64', 'linux-riscv64', 'openharmony-arm64', 'darwin-riscv64']) {
     const [platform, arch] = target.split('-')
     await withTempDir(`linux-scope-${target}`, async root => {
       let error = null
@@ -96,11 +96,11 @@ await test('every foreign target is refused by name, naming the supported set',
       try { resolved = resolveWorker({}, { packageRoot: stagePackage(root), platform, arch, env: {} }) } catch (caught) { error = caught }
       assert.equal(resolved, null, `${target} resolved to ${resolved}`)
       assert.ok(error, `${target} was allowed`)
-      assert.match(error.message, /Windows x64, Linux x64 and macOS Apple Silicon/)
+      assert.match(error.message, /Windows x64, Linux x64 and macOS/)
       assert.ok(error.message.includes(target), `the message must name ${target}: ${error.message}`)
     })
   }
-  assert.deepEqual([...PLATFORMS], ['win32-x64', 'linux-x64', 'darwin-arm64'])
+  assert.deepEqual([...PLATFORMS], ['win32-x64', 'linux-x64', 'darwin-arm64', 'darwin-x64'])
   assert.equal(workerName('win32'), 'dsh-ops-worker.exe')
   assert.equal(workerName('linux'), 'dsh-ops-worker')
 })
@@ -150,7 +150,7 @@ await test('package.json, the resolver and the plugin manifest declare the same
   const components = PLUGIN.contributes?.['x-components'] ?? []
   const ptc = components.find(component => component.id === 'dsh-ops-ptc')
   assert.ok(ptc, 'the PTC component row is missing from contributes.x-components')
-  assert.deepEqual([...PLATFORMS], ['win32-x64', 'linux-x64', 'darwin-arm64'], 'only the approved target pairs are supported')
+  assert.deepEqual([...PLATFORMS], ['win32-x64', 'linux-x64', 'darwin-arm64', 'darwin-x64'], 'only the approved target pairs are supported')
   assert.deepEqual(manifest.os, ['win32', 'linux', 'darwin'])
   assert.deepEqual(ptc.platforms, ['win32', 'linux', 'darwin'])
   assert.deepEqual(ptc.architectures, ['x64', 'arm64'])
diff --git a/test/probe-isolation.test.mjs b/test/probe-isolation.test.mjs
new file mode 100644
index 00000000..b66d8286
--- /dev/null
+++ b/test/probe-isolation.test.mjs
@@ -0,0 +1,234 @@
+/** A real host hook that never answers must not serialize unrelated roots. */
+import { createScope, scopeChainOf } from '@deepseek-ai/dsh-scope'
+import * as ptc from '../lib/ptc/index.js'
+import * as discovery from '../lib/discovery/index.js'
+import { isPresentationProbe } from '../lib/presentation.js'
+import { bootHost, shutdown } from './lib/host.mjs'
+import { assert, test, report, TEST_HOME } from './lib/harness.mjs'
+
+const flush = async () => { for (let i = 0; i < 5; i++) await new Promise(resolve => setImmediate(resolve)) }
+const deferred = () => { let resolve; const promise = new Promise(done => { resolve = done }); return { promise, resolve } }
+async function bounded(promise, label) {
+  let timer
+  try { return await Promise.race([promise, new Promise((_, reject) => { timer = setTimeout(() => reject(new Error(label)), 2000) })]) }
+  finally { clearTimeout(timer) }
+}
+function mint(ctx, id, parent) {
+  const agent = { id, session: { id, mode: 'danger-full-access', header: { cwd: TEST_HOME } } }
+  agent.ctx = createScope(ctx, agent, parent ? { parent } : undefined).ctx
+  return agent
+}
+for (const [mode, plugins] of [['native', [discovery]], ['ptc', [ptc]], ['native', [discovery, ptc]], ['ptc', [discovery, ptc]]]) await test(`unanswered ${mode} probe with ${plugins.length} component(s) does not block another root or unload (#359)`, async () => {
+  const { ctx, tools, prompt } = await bootHost({ toolsMode: mode })
+  const held = deferred(), entered = deferred()
+  let blocker, blocked = true, components = [], creation
+  try {
+    await ctx.plugin(inner => {
+      inner.provide('subprocess', { spawn() { throw new Error('publication test must not execute a worker') } })
+      inner.provide('sandboxPolicy', { resolve: ({ session }) => ({ mode: session.mode, workspaceRoot: TEST_HOME, sessionId: session.id }) })
+      inner.provide('ptcRuntime', { language: 'typescript' })
+    })
+    // This is the public production waterfall, not a replaced assemble method.
+    // It deliberately ignores the cancellation signal, like an uncooperative plugin.
+    ctx.on('system-prompt/assemble', async (_assembly, context, next) => {
+      if (blocked && context.scope === blocker && isPresentationProbe(context)) { entered.resolve(); await held.promise }
+      return next()
+    })
+    for (const plugin of plugins) components.push(await ctx.plugin(plugin, { binaryPath: process.execPath, required: true }))
+    blocker = mint(ctx, 'unanswered')
+    creation = ctx.serial('agent/created', { agent: blocker })
+    await bounded(entered.promise, 'the controlled host probe was not reached')
+    const healthy = mint(ctx, 'healthy')
+    await bounded(ctx.serial('agent/created', { agent: healthy }), 'one unanswered probe blocked an independent root')
+    const ownName = mode === 'ptc' ? 'ops_load_sdk' : 'ops_discover_tools'
+    assert.ok(tools.get(ownName, healthy), 'the unrelated root publishes its own capability')
+    assert.equal(tools.get(ownName, blocker), undefined, 'an unanswered initial probe grants no capability')
+    await bounded(prompt.assemble({ scope: healthy }), 'the unrelated root cannot assemble')
+    const retained = tools.get(ownName, healthy)
+    healthy.session.mode = 'unsupported'
+    ctx.emit('session/event', healthy.session, { type: 'sandbox/mode' })
+    await flush()
+    await bounded(prompt.assemble({ scope: healthy }), 'authority reconciliation waits on the blocked root')
+    if (mode === 'native') assert.equal(tools.get(ownName, healthy), undefined, 'authority downgrade withdraws Native publication')
+    await bounded(ctx.serial('agent/disposed', { agent: healthy }), 'the unrelated root cannot dispose')
+    const result = await bounded(retained.execute({}, { agent: healthy, signal: new AbortController().signal }), 'a retired callback waits on the blocked root')
+    assert.equal(result.status, 'rejected')
+    await bounded(ctx.serial('agent/disposed', { agent: blocker }), 'disposal must cancel its own unanswered probe wait')
+    await bounded(creation, 'cancelled creation cannot settle')
+    // A second hung creation is cancelled by component unload, not by its host hook.
+    blocker = mint(ctx, 'unload-unanswered')
+    creation = ctx.serial('agent/created', { agent: blocker })
+    await flush()
+    await bounded(Promise.all(components.map(component => component.dispose())), 'unload waits forever for a host hook')
+    await bounded(creation, 'unloaded creation cannot settle')
+    blocked = false; held.resolve(); await flush()
+    assert.equal(tools.get(ownName, blocker), undefined, 'a late host result cannot publish after unload')
+    assert.equal(tools.get(ownName, healthy), undefined)
+  } finally { blocked = false; held.resolve(); await creation; await shutdown(ctx) }
+})
+for (const [mode, plugin, ownName] of [['native', discovery, 'ops_discover_tools'], ['ptc', ptc, 'ops_load_sdk']]) await test(`late ${mode} probe cannot overwrite a newer presentation`, async () => {
+  const { ctx, tools, prompt } = await bootHost({ toolsMode: mode })
+  const held = deferred(), entered = deferred()
+  let first = true, agent, creation
+  try {
+    await ctx.plugin(inner => {
+      inner.provide('subprocess', { spawn() { throw new Error('publication test must not execute a worker') } })
+      inner.provide('sandboxPolicy', { resolve: ({ session }) => ({ mode: session.mode, workspaceRoot: TEST_HOME }) })
+      inner.provide('ptcRuntime', { language: 'typescript' })
+    })
+    ctx.on('system-prompt/assemble', async (_assembly, context, next) => {
+      const result = await next()
+      if (first && context.scope === agent && isPresentationProbe(context)) {
+        first = false; entered.resolve(); await held.promise
+      }
+      return result
+    })
+    await ctx.plugin(plugin, { binaryPath: process.execPath, required: true })
+    agent = mint(ctx, 'changed-during-probe')
+    creation = ctx.serial('agent/created', { agent })
+    await bounded(entered.promise, 'the old probe did not capture its presentation')
+    await agent.ctx.plugin({ inject: ['tools'], apply(inner) { inner.tools.presentAs(mode === 'ptc' ? 'native' : 'ptc') } })
+    // A real configuration notification cancels the old generation. The new
+    // generation must complete without releasing the obsolete host response.
+    ctx.emit('tools/change')
+    await bounded(creation, 'new presentation still waits on the obsolete host response')
+    await bounded(prompt.assemble({ scope: agent }), 'new presentation cannot settle')
+    assert.equal(tools.get(ownName, agent), undefined)
+    held.resolve(); await flush()
+    assert.equal(tools.get(ownName, agent), undefined, 'the obsolete presentation must not republish its tools')
+  } finally { held.resolve(); await creation; await shutdown(ctx) }
+})
+for (const [mode, plugin, ownName] of [['native', discovery, 'ops_discover_tools'], ['ptc', ptc, 'ops_load_sdk']]) await test(`cancelled ${mode} assembly cannot withdraw a newer publication`, async () => {
+  const { ctx, tools, prompt } = await bootHost({ toolsMode: mode })
+  const held = deferred(), entered = deferred()
+  let agent, first = true
+  try {
+    await ctx.plugin(inner => {
+      inner.provide('subprocess', { spawn() { throw new Error('publication test must not execute a worker') } })
+      inner.provide('sandboxPolicy', { resolve: ({ session }) => ({ mode: session.mode, workspaceRoot: TEST_HOME }) })
+      inner.provide('ptcRuntime', { language: 'typescript' })
+    })
+    await ctx.plugin(plugin, { binaryPath: process.execPath, required: true })
+    agent = mint(ctx, 'late-withdrawal')
+    await ctx.serial('agent/created', { agent })
+    await prompt.assemble({ scope: agent })
+    assert.ok(tools.get(ownName, agent))
+    // Install inside the component's withdrawal guard: its await next() must
+    // reject obsolete authority as well as the reconciliation commit itself.
+    ctx.on('system-prompt/assemble', async (_assembly, context, next) => {
+      const result = await next()
+      if (first && context.scope === agent && isPresentationProbe(context)) {
+        first = false; entered.resolve(); await held.promise
+      }
+      return result
+    })
+    const switched = await agent.ctx.plugin({ inject: ['tools'], apply(inner) { inner.tools.presentAs(mode === 'ptc' ? 'native' : 'ptc') } })
+    await bounded(entered.promise, 'the old withdrawal was not reached')
+    await switched.dispose()
+    ctx.emit('tools/change')
+    await bounded(prompt.assemble({ scope: agent }), 'restored presentation still waits on obsolete withdrawal')
+    const restored = tools.get(ownName, agent)
+    assert.ok(restored)
+    held.resolve(); await flush()
+    assert.equal(tools.get(ownName, agent), restored, 'the cancelled waterfall must not clear the current registration')
+  } finally { held.resolve(); await shutdown(ctx) }
+})
+for (const [mode, plugin, ownName] of [['native', discovery, 'ops_discover_tools'], ['ptc', ptc, 'ops_load_sdk']]) await test(`${mode} inheritance family waits together without blocking another root`, async () => {
+  const { ctx, tools, prompt } = await bootHost({ toolsMode: mode })
+  let child, gate, creation
+  const releases = []
+  try {
+    await ctx.plugin(inner => {
+      inner.provide('subprocess', { spawn() { throw new Error('publication test must not execute a worker') } })
+      inner.provide('sandboxPolicy', { resolve: ({ session }) => ({ mode: session.mode, workspaceRoot: TEST_HOME }) })
+      inner.provide('ptcRuntime', { language: 'typescript' })
+    })
+    await ctx.plugin(plugin, { binaryPath: process.execPath, required: true })
+    const parent = mint(ctx, 'parent')
+    await ctx.serial('agent/created', { agent: parent }); await prompt.assemble({ scope: parent })
+    const previous = tools.get(ownName, parent)
+    assert.ok(previous)
+    ctx.on('system-prompt/assemble', async (_assembly, context, next) => {
+      if (gate && context.scope === child && isPresentationProbe(context)) {
+        const current = gate; current.entered.resolve(); await current.held.promise
+      }
+      return next()
+    })
+    const hold = () => { gate = { held: deferred(), entered: deferred() }; releases.push(gate.held.resolve); return gate }
+    const first = hold()
+    child = mint(parent.ctx, 'child', parent)
+    assert.deepEqual(scopeChainOf(child), [child, parent], 'the production host sees the intended dependency')
+    creation = ctx.serial('agent/created', { agent: child })
+    await bounded(first.entered.promise, 'the child probe did not enter')
+    let parentReady = false
+    const waitingParent = prompt.assemble({ scope: parent }).then(() => { parentReady = true })
+    const other = mint(ctx, 'independent')
+    await bounded(ctx.serial('agent/created', { agent: other }), 'dependent family blocked independent creation')
+    const independent = tools.get(ownName, other)
+    assert.ok(independent)
+    await flush()
+    assert.equal(parentReady, false, 'a parent must await its dependent family publication')
+    assert.equal(tools.get(ownName, parent), previous, 'the family has not partially republished')
+    gate = undefined; first.held.resolve()
+    await bounded(Promise.all([creation, waitingParent]), 'the released family did not commit')
+    const childOwned = tools.get(ownName, child)
+    assert.ok(childOwned)
+    const second = hold()
+    child.session.mode = 'read-only'
+    ctx.emit('session/event', child.session, { type: 'sandbox/mode' })
+    await bounded(second.entered.promise, 'the child revalidation did not enter')
+    const retiringFamily = prompt.assemble({ scope: parent })
+    await bounded(ctx.serial('agent/disposed', { agent: child }), 'child disposal did not cancel the dependent family wait')
+    await bounded(retiringFamily, 'the surviving parent cannot settle after child disposal')
+    const afterDisposal = tools.get(ownName, child)
+    assert.notEqual(afterDisposal, childOwned, 'the disposed child loses its own definition')
+    gate = undefined; second.held.resolve(); await flush()
+    assert.equal(tools.get(ownName, child), afterDisposal, 'a late child response cannot resurrect owned tools')
+    const denied = await childOwned.execute({}, { agent: child, signal: new AbortController().signal })
+    assert.equal(denied.error.code, 'POLICY_DENIED', 'an inherited parent definition does not authorize a retired child')
+    assert.ok(tools.get(ownName, parent))
+    assert.equal(tools.get(ownName, other), independent, 'family cancellation preserves the unrelated root definition')
+  } finally { gate = undefined; for (const release of releases) release(); await creation; await shutdown(ctx) }
+})
+for (const [mode, plugin, ownName] of [['native', discovery, 'ops_discover_tools'], ['ptc', ptc, 'ops_load_sdk']]) await test(`${mode} aborted fresh probes cannot consume selections or queue new ones`, async () => {
+  const { ctx, tools, prompt } = await bootHost({ toolsMode: mode })
+  let gate, agent
+  const releases = []
+  const step = signal => ctx.waterfall('agent/pre-step', { agent, messages: [], turn: 1, step: 1, signal }, async () => ({ kind: 'continue' }))
+  const request = name => mode === 'ptc' ? { tools: [name] } : { query: 'select:ops_' + name }
+  try {
+    await ctx.plugin(inner => {
+      inner.provide('subprocess', { spawn() { throw new Error('publication test must not execute a worker') } })
+      inner.provide('sandboxPolicy', { resolve: ({ session }) => ({ mode: session.mode, workspaceRoot: TEST_HOME }) })
+      inner.provide('ptcRuntime', { language: 'typescript' })
+    })
+    await ctx.plugin(plugin, { binaryPath: process.execPath, required: true })
+    agent = mint(ctx, 'abort-fresh')
+    await ctx.serial('agent/created', { agent }); await prompt.assemble({ scope: agent })
+    const entry = tools.get(ownName, agent)
+    assert.equal((await entry.execute(request('stat'), { agent, signal: new AbortController().signal })).status, 'completed')
+    ctx.on('system-prompt/assemble', async (_assembly, context, next) => {
+      if (gate && context.scope === agent && isPresentationProbe(context)) {
+        const current = gate
+        assert.equal(context.signal, current.controller.signal, 'fresh probes forward the active turn/call signal')
+        current.entered.resolve(); await current.held.promise
+      }
+      return next()
+    })
+    const hold = () => { gate = { held: deferred(), entered: deferred(), controller: new AbortController() }; releases.push(gate.held.resolve); return gate }
+    const pendingStep = hold(), stepping = step(pendingStep.controller.signal)
+    await bounded(pendingStep.entered.promise, 'the fresh step probe was not reached')
+    pendingStep.controller.abort(); gate = undefined; pendingStep.held.resolve(); await stepping
+    await prompt.assemble({ scope: agent })
+    assert.equal(tools.get('ops_stat', agent), undefined, 'an aborted step does not publish a queued selection')
+    await step(new AbortController().signal); await prompt.assemble({ scope: agent })
+    assert.ok(tools.get('ops_stat', agent), 'the next valid step can consume the preserved selection')
+    const pendingCall = hold(), calling = tools.get(ownName, agent).execute(request('grep'), { agent, signal: pendingCall.controller.signal })
+    await bounded(pendingCall.entered.promise, 'the fresh call probe was not reached')
+    pendingCall.controller.abort(); gate = undefined; pendingCall.held.resolve()
+    assert.equal((await calling).error.code, 'POLICY_DENIED')
+    await step(new AbortController().signal); await prompt.assemble({ scope: agent })
+    assert.equal(tools.get('ops_grep', agent), undefined, 'an aborted call never queues a new selection')
+  } finally { gate = undefined; for (const release of releases) release(); await shutdown(ctx) }
+})
+report('probe-isolation')
diff --git a/test/ptc-departure.test.mjs b/test/ptc-departure.test.mjs
new file mode 100644
index 00000000..3a047223
--- /dev/null
+++ b/test/ptc-departure.test.mjs
@@ -0,0 +1,59 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { createScope } from '@deepseek-ai/dsh-scope'
+import Subprocess from '@deepseek-ai/dsh-subprocess-local'
+import Sandbox from '@deepseek-ai/dsh-sandbox-local'
+import FileSystem from '@deepseek-ai/dsh-fs-local'
+import NodePtc from '@deepseek-ai/dsh-ptc-runtime-node'
+import * as ptc from '../lib/ptc/index.js'
+import { isPresentationProbe } from '../lib/presentation.js'
+import { assert, test, report, wait, waitFor, withTempDir } from './lib/harness.mjs'
+import { bootHost, shutdown } from './lib/host.mjs'
+import { WORKER, requireWorker } from './lib/boundary.mjs'
+requireWorker('ptc-departure')
+let sequence = 0
+const names = (ctx, agent) => ctx.get('tools').schemas(agent).map(tool => tool.name).sort()
+// A stall must fail the check, not hang the suite: the timer is cleared so it cannot
+// outlive the race and keep the process alive past report().
+const bounded = async (work, ms) => { let timer; try { return await Promise.race([work, new Promise(resolve => { timer = setTimeout(() => resolve('timeout'), ms) })]) } finally { clearTimeout(timer) } }
+async function setup(dir) {
+  const { ctx } = await bootHost()
+  const agents = []; ctx.provide('agents', { list: () => agents })
+  await ctx.plugin(Subprocess); await ctx.plugin(Sandbox); await ctx.plugin(FileSystem); await ctx.plugin(NodePtc)
+  await ctx.plugin(inner => inner.provide('sandboxPolicy', { resolve: ({ session } = {}) => ({ mode: session?.mode ?? 'workspace-write', workspaceRoot: dir, sessionId: session?.id }) }))
+  await ctx.plugin(ptc, { binaryPath: WORKER, required: true })
+  async function mint(mode = 'native') {
+    const id = 'departure-' + ++sequence, agent = { id, session: { id, mode: 'workspace-write', header: { cwd: dir }, append() {}, read() { return [] } } }
+    agent.ctx = createScope(ctx, agent).ctx
+    await agent.ctx.plugin({ inject: ['tools'], apply(inner) { inner.tools.presentAs(mode) } })
+    agents.push(agent)
+    await ctx.serial('agent/created', { agent })
+    return agent
+  }
+  return { ctx, mint }
+}
+// A presentation probe assembles the whole prompt, so counting probe assemblies is how a
+// pass that skips agents is told apart from one that walks every agent again.
+await test('an agent departure republishes without re-probing the survivors', () => withTempDir('ptc-departure', async dir => {
+  const { ctx, mint } = await setup(dir)
+  try {
+    const prompt = ctx.get('systemPrompt'), assemble = prompt.assemble.bind(prompt)
+    let probes = 0
+    prompt.assemble = context => { if (isPresentationProbe(context)) ++probes; return assemble(context) }
+    try {
+    const keep = await mint('ptc'), leave = await mint('ptc')
+    await waitFor(() => names(ctx, keep).includes('run_code') && names(ctx, leave).includes('run_code'))
+    await wait(200)
+    const before = probes
+    const settled = await bounded(ctx.serial('agent/disposed', { agent: leave }).then(() => 'done'), 5000)
+    assert.equal(settled, 'done', 'a departure must not stall its own event')
+    assert.equal(probes, before, 'a departure names no agent to probe, so the survivors keep the verdict they already have')
+    assert.ok(names(ctx, keep).includes('run_code'), 'the surviving agent keeps the PTC surface the departure left intact')
+    // run_code stays visible: presentAs('ptc') is the departing scope's own layer,
+    // while the PTC row's own APIs are what a departure must withdraw.
+    assert.equal(names(ctx, keep).filter(name => name.startsWith('ops_')).includes('ops_load_sdk'), true)
+    assert.equal(names(ctx, leave).filter(name => name.startsWith('ops_')).includes('ops_load_sdk'), false)
+    } finally { prompt.assemble = assemble }
+  } finally { await shutdown(ctx) }
+}))
+report('ptc-departure')
diff --git a/test/ptc-sdk.test.mjs b/test/ptc-sdk.test.mjs
index 353507ec..52a5b17c 100644
--- a/test/ptc-sdk.test.mjs
+++ b/test/ptc-sdk.test.mjs
@@ -10,6 +10,7 @@ import { assert, test, report, withTempDir, waitFor } from './lib/harness.mjs'
 import { bootHost, shutdown } from './lib/host.mjs'
 import { WORKER, requireWorker } from './lib/boundary.mjs'
 import * as ptc from '../lib/ptc/index.js'
+import { withToolChange } from '../lib/tool-changes.js'
 import { mountNativeCatalogue } from './lib/native-catalogue.mjs'
 import { resolvePtcConfig } from '../lib/config.js'
 import { sdkDefinition, requestedApis } from '../lib/ptc/sdk.js'
@@ -182,4 +183,53 @@ await test('nearer overlapping PTC rows own their scopes without duplicate regis
     } finally { await shutdown(ctx) }
   })
 })
+await test('same-surface both to ptc and unsignalled prompt flips publish the resident SDK', async () => {
+  await withTempDir('ptc-verdict-transition', async root => {
+    const {ctx,agent}=await setup(root)
+    try {
+      const owner=await agent('both')
+      assert.equal(visible(ctx,owner).includes('ops_load_sdk'),false)
+      owner.lift()
+      await owner.ctx.plugin({inject:['tools'],apply(inner){owner.lift=inner.tools.presentAs('ptc')}})
+      await step(ctx,owner)
+      assert.ok(visible(ctx,owner).includes('ops_load_sdk'))
+      let collapse=false
+      const other=await agent('both')
+      // A waterfall can alter presentation without a tool-registry event.
+      ctx.on('system-prompt/assemble',async (_a,context,next)=>{
+        const result=await next()
+        if(context.scope!==other || !collapse)return result
+        return {...result,tools:result.tools.filter(t=>t.name==='run_code'),sections:[...result.sections,{name:'tools:ptc-only',text:'PTC only'}]}
+      })
+      collapse=true
+      await step(ctx,other)
+      assert.ok(visible(ctx,other).includes('ops_load_sdk'),'fresh verdict change must publish even with no pending SDK selection')
+    } finally {await shutdown(ctx)}
+  })
+})
+await test('nested foreign ancestor masks cannot borrow an unrelated OPS attribution', async () => {
+  await withTempDir('ptc-nested-mask',async root=>{
+    const {ctx,agent}=await setup(root,{native:true})
+    try {
+      const parent=await agent(),child=await agent('native',parent),unrelated=await agent()
+      await waitFor(()=>ctx.get('tools').get('ops_read_files',child)!==undefined)
+      const retained=ctx.get('tools').get('ops_read_files',child)
+      let parentTools, unrelatedTools
+      await parent.ctx.plugin({inject:['tools'],apply(inner){parentTools=inner.tools}})
+      await unrelated.ctx.plugin({inject:['tools'],apply(inner){unrelatedTools=inner.tools}})
+      let mask,armed=true
+      ctx.on('tools/change',()=>{
+        if(!armed)return
+        armed=false
+        mask=parentTools.restrict({deny:['ops_read_files']})
+      })
+      const remove=withToolChange([unrelated],()=>unrelatedTools.register({name:'nested_trigger',description:'fixture',parameters:{type:'object'},output:{schema:{type:'object'},render:()=>[]},execute:async()=>({})}))
+      await waitFor(()=>ctx.get('tools').get('ops_read_files',child)===undefined,{timeoutMs:5000,what:'nested foreign restriction'})
+      const stale=await retained.execute({files:[{path:'never-read'}]},{agent:child,signal:new AbortController().signal})
+      assert.equal(stale.error.code,'POLICY_DENIED')
+      mask();remove()
+      await waitFor(()=>ctx.get('tools').get('ops_read_files',child)!==undefined)
+    } finally {await shutdown(ctx)}
+  })
+})
 report('ptc-sdk')
diff --git a/test/ptc-surface.test.mjs b/test/ptc-surface.test.mjs
new file mode 100644
index 00000000..0dc21591
--- /dev/null
+++ b/test/ptc-surface.test.mjs
@@ -0,0 +1,149 @@
+/**
+ * The probe's memo key must cost less than the assembly it skips.
+ *
+ * `surfaceOf` names the tools a scope can see, and both PTC rows use that name list to
+ * decide whether a presentation verdict is still current. The key is therefore read once
+ * per tracked agent per reconcile, while the work it skips is one prompt assembly. Reading
+ * it through `schemas()` deep-copies every visible schema, which on this host costs more
+ * than the assembly: the memo then loses time on every pass instead of saving any.
+ *
+ * These checks pin the shape rather than a wall-clock number, so they hold on any host.
+ */
+import { createScope } from '@deepseek-ai/dsh-scope'
+import { bootHost, shutdown } from './lib/host.mjs'
+import { assert, test, report } from './lib/harness.mjs'
+import { surfaceOf, surfaceNames } from '../lib/surface.js'
+
+/** A registered tool whose schema is big enough that a deep copy is measurable. */
+const tool = name => ({
+  name,
+  description: `surface probe fixture ${name}`,
+  parameters: {
+    type: 'object',
+    properties: Object.fromEntries(Array.from({ length: 12 }, (_, index) => [`field_${index}`, {
+      type: 'object',
+      description: `nested option group ${index} of ${name}, long enough that a deep copy shows up`,
+      properties: { mode: { type: 'string', enum: ['fast', 'safe', 'strict'] } }
+    }]))
+  },
+  output: { schema: { type: 'object', properties: { ok: { type: 'boolean' } } }, render: () => [] },
+  execute: async () => ({ content: 'ok' })
+})
+
+/**
+ * Wrap `schemas` so a call is counted, leaving `this` bound to the real registry.
+ *
+ * The registry reaches its own methods through a scoped proxy that rebinds `this` only
+ * for a call arriving on the proxy itself, so an arrow replacement would break every
+ * internal call as well and count nothing.
+ * @param tools - the registry to observe.
+ * @returns the running count of `schemas` calls.
+ */
+function countSchemas (tools) {
+  const calls = { count: 0 }
+  const original = tools.schemas
+  tools.schemas = function (...args) { ++calls.count; return original.apply(this, args) }
+  return calls
+}
+
+/**
+ * Wrap `view` so a call is counted, with the same `this` care as {@link countSchemas}.
+ * @param tools - the registry to observe.
+ * @returns the running count of `view` calls.
+ */
+function countViews (tools) {
+  const views = { count: 0 }
+  const original = tools.view
+  tools.view = function (...args) { ++views.count; return original.apply(this, args) }
+  return views
+}
+
+await test('a surface read does not deep-copy schemas', () => withScope(async ({ tools, key, calls }) => {
+  calls.count = 0
+  const surface = surfaceOf(tools, key)
+  assert.equal(calls.count, 0, 'reading the surface must not project schemas; a deep copy per agent per pass is the cost this memo exists to avoid')
+  assert.deepEqual(surfaceNames(surface).sort(), ['alpha', 'beta'], 'the surface names every visible tool')
+}))
+
+await test('a surface read does not re-read the view once per name', () => withScope(async ({ tools, key, views }) => {
+  // `tools.get()` and `tools.schemas()` each rebuild the whole scope view, so pairing them
+  // per name would make the key O(names²) — the shape main shipped, and the reason this
+  // module reads one view and takes identity off the objects it already holds.
+  views.count = 0
+  const surface = surfaceOf(tools, key)
+  assert.equal(views.count, 1, 'one view read must produce both the names and their identities')
+  assert.equal(surfaceNames(surface).length, 2, 'the surface still describes every visible tool')
+}))
+
+await test('a surface read agrees with schemas() for the same scope', () => withScope(async ({ tools, key }) => {
+  const projected = tools.schemas(key).map(schema => schema.name)
+  assert.deepEqual(surfaceNames(surfaceOf(tools, key)), projected, 'the memo key must name exactly what schemas() projects, in the same order')
+}))
+
+await test('a surface read follows the tools a scope gains and loses', () => withScope(async ({ tools, key }) => {
+  const before = surfaceOf(tools, key)
+  const dispose = tools.register(tool('gamma'))
+  try {
+    assert.notEqual(surfaceOf(tools, key), before, 'a new registration changes the surface, so the verdict is re-probed')
+    assert.ok(surfaceNames(surfaceOf(tools, key)).includes('gamma'), 'the new tool is named')
+  } finally { dispose() }
+  assert.equal(surfaceOf(tools, key), before, 'disposing the registration restores the previous surface')
+}))
+
+await test('a same-named replacement moves the surface', () => withScope(async ({ tools, key, agent }) => {
+  // A scoped registration shadows the global definition of the same name. The name set is
+  // unchanged, yet the definition a publish captures in its shadow closure is a different
+  // object, so the key has to move: a names-only key caches a verdict for a surface that no
+  // longer exists and publishes nothing on the change that owed a republish.
+  const before = surfaceOf(tools, key)
+  const fiber = await scoped(agent, scopedTools => scopedTools.register(tool('alpha')))
+  try {
+    assert.notEqual(surfaceOf(tools, key), before, 'a same-named shadow replaces the definition, which is a surface change')
+    assert.deepEqual(surfaceNames(surfaceOf(tools, key)), surfaceNames(before), 'and it is not a name change — the names alone would have missed it')
+  } finally { await fiber.dispose() }
+  assert.equal(surfaceOf(tools, key), before, 'lifting the shadow restores the previous surface')
+}))
+
+await test('a host without a reachable view still names the surface', () => withScope(async ({ tools, key }) => {
+  // The fallback is the correctness branch: a host whose view this module cannot reach must
+  // still produce the same key, paying the deep copy rather than returning a wrong verdict.
+  // Run against a stand-in registry, since deleting `view` from the real one is not possible.
+  const projected = tools.schemas(key).map(schema => schema.name)
+  const noView = { schemas: scope => tools.schemas(scope) }
+  assert.deepEqual(surfaceNames(surfaceOf(noView, key)), projected, 'the fallback names exactly what schemas() projects')
+}))
+
+/**
+ * Mount a plugin on the agent's scope and act on the registry from inside it.
+ *
+ * A scoped registration or restriction refuses the host's unscoped context, and the
+ * registry's scope tag lives on the context a plugin receives — not on the service object
+ * `ctx.get('tools')` returns, whose `scopeOf` is undefined. Going through a plugin is
+ * therefore the only way to reach a scoped registry.
+ * @param agent - the scoped context to mount on.
+ * @param act - receives that context's scoped registry.
+ * @returns the plugin's disposable fiber.
+ */
+async function scoped (agent, act) {
+  return agent.plugin({ inject: ['tools'], apply (inner) { act(inner.tools) } })
+}
+
+/**
+ * Boot a host with the fixture tools registered and one scoped agent.
+ * @param {Function} body - the check to run against that host.
+ */
+async function withScope (body) {
+  const { ctx } = await bootHost()
+  try {
+    const tools = ctx.get('tools')
+    tools.register(tool('alpha'))
+    tools.register(tool('beta'))
+    // `key` is what `view()` takes; the context only carries it. Passing the context
+    // silently reads the global layer, which is how a scoped shadow can go unseen.
+    const key = { id: 'surface-' + Math.random() }
+    const scope = createScope(ctx, key)
+    await body({ ctx, tools, key, agent: scope.ctx, calls: countSchemas(tools), views: countViews(tools) })
+  } finally { await shutdown(ctx) }
+}
+
+report('ptc-surface')
diff --git a/test/ptc.test.mjs b/test/ptc.test.mjs
index 9251099a..af22601c 100644
--- a/test/ptc.test.mjs
+++ b/test/ptc.test.mjs
@@ -387,7 +387,7 @@ try {
   fs.cpSync(runtimeDir,path.join(isolatedPackage,'runtime',`${process.platform}-${process.arch}`),{recursive:true})
   assert.throws(() => resolveWorker({}, {platform:'linux',arch:'arm64'}), /unsupported runtime target/)
   assert.throws(() => resolveWorker({}, {platform:'win32',arch:'arm64'}), /unsupported runtime target/)
-  assert.throws(() => resolveWorker({}, {platform:'darwin',arch:'x64'}), /unsupported runtime target/)
+  assert.throws(() => resolveWorker({}, {platform:'darwin',arch:'riscv64'}), /unsupported runtime target/)
   assert.ok(resolveWorker({}, {packageRoot:isolatedPackage}).startsWith(isolatedPackage))
   console.log('ok: installed runtime resolves without binaryPath or source build tree')
   const real = new Context(); real.logger.level = 0
diff --git a/test/release-scope.test.mjs b/test/release-scope.test.mjs
index c4945658..f792c2ff 100644
--- a/test/release-scope.test.mjs
+++ b/test/release-scope.test.mjs
@@ -10,7 +10,7 @@ function header(target) {
   const bytes = Buffer.alloc(80)
   if (target === 'win32-x64') { bytes.write('MZ'); bytes.writeUInt32LE(64,60); bytes.writeUInt32LE(0x4550,64); bytes.writeUInt16LE(0x8664,68) }
   if (target === 'linux-x64') { Buffer.from([127,69,76,70,2,1]).copy(bytes); bytes.writeUInt16LE(62,18) }
-  if (target === 'darwin-arm64') { bytes.writeUInt32LE(0xfeedfacf,0); bytes.writeUInt32LE(0x100000c,4) }
+  if (target === 'darwin-arm64' || target === 'darwin-x64') { bytes.writeUInt32LE(0xfeedfacf,0); bytes.writeUInt32LE(target.endsWith('x64') ? 0x1000007 : 0x100000c,4) }
   return bytes
 }
 function fixture(root, targets = PLATFORMS) {
@@ -41,15 +41,21 @@ function run(root, name='check-release.mjs', args=[]) {
   const result=spawnSync(process.execPath,[path.join(root,'bin',name),...(name==='native-runtime.mjs'?['check']:[]),'--root',root,...args],{encoding:'utf8'})
   return {status:result.status,out:`${result.stdout}${result.stderr}`}
 }
-await test('all three paired targets and Windows IPC close successfully',async()=>withTempDir('release-all',root=>{
+await test('all four paired targets and Windows IPC close successfully',async()=>withTempDir('release-all',root=>{
   fixture(root); const result=run(root); assert.equal(result.status,0,result.out); assert.match(result.out,/Release closure OK/)
 }))
+await test('an Intel-only staged closure validates its Mach-O worker and receipt (#371)',async()=>withTempDir('release-intel',root=>{
+  fixture(root,['darwin-x64'])
+  const result=run(root,'native-runtime.mjs',['--platform','darwin-x64'])
+  assert.equal(result.status,0,result.out)
+  assert.match(result.out,/darwin-x64/)
+}))
 await test('each missing target fails strict release while staged source checks remain local',async()=>withTempDir('release-missing',root=>{
   fixture(root,['linux-x64']); assert.equal(run(root,'native-runtime.mjs',['--staged']).status,0)
-  const result=run(root); assert.notEqual(result.status,0); assert.match(result.out,/missing win32-x64, darwin-arm64/)
+  const result=run(root); assert.notEqual(result.status,0); assert.match(result.out,/missing win32-x64, darwin-arm64, darwin-x64/)
 }))
-await test('every foreign target is rejected including Intel Mac',async()=>withTempDir('release-foreign',root=>{
-  fixture(root); for(const target of ['darwin-x64','win32-arm64','linux-arm64']) {
+await test('every foreign target is rejected',async()=>withTempDir('release-foreign',root=>{
+  fixture(root); for(const target of ['win32-arm64','linux-arm64','darwin-riscv64']) {
     const result=run(root,'native-runtime.mjs',['--platform',target]); assert.notEqual(result.status,0); assert.match(result.out,/Unsupported target/)
   }
 }))
@@ -62,13 +68,13 @@ await test('Windows worker without IPC cannot pass',async()=>withTempDir('releas
   const result=run(root); assert.notEqual(result.status,0); assert.match(result.out,/requires its Bash IPC/)
 }))
 await test('half-staged and unexpected targets are never silently skipped',async()=>withTempDir('release-stray',root=>{
-  fixture(root); fs.mkdirSync(path.join(root,'runtime/darwin-x64')); assert.match(run(root).out,/Unexpected runtime targets/)
-  fs.rmSync(path.join(root,'runtime/darwin-x64'),{recursive:true}); fs.unlinkSync(path.join(root,'runtime/darwin-arm64/provenance.json'))
+  fixture(root); fs.mkdirSync(path.join(root,'runtime/darwin-riscv64')); assert.match(run(root).out,/Unexpected runtime targets/)
+  fs.rmSync(path.join(root,'runtime/darwin-riscv64'),{recursive:true}); fs.unlinkSync(path.join(root,'runtime/darwin-arm64/provenance.json'))
   assert.match(run(root,'native-runtime.mjs',['--staged']).out,/Half-staged runtime/)
 }))
 await test('manifest exact targets, npm platform filters and shell pins must agree',async()=>withTempDir('release-drift',root=>{
   fixture(root); const file=path.join(root,'dsh-plugin.json'), manifest=JSON.parse(fs.readFileSync(file,'utf8'))
-  manifest.contributes['x-components'].find(c=>c.id==='dsh-ops-ptc').targets.push('darwin-x64')
+  manifest.contributes['x-components'].find(c=>c.id==='dsh-ops-ptc').targets.push('win32-arm64')
   fs.writeFileSync(file,JSON.stringify(manifest)); assert.match(run(root).out,/disagree/)
 }))
 await test('release closure requires the pinned Bash payload and refuses a PowerShell dependency', async () => withTempDir('release-shell-dep', root => {
diff --git a/test/review-snapshot.test.mjs b/test/review-snapshot.test.mjs
new file mode 100644
index 00000000..57807e66
--- /dev/null
+++ b/test/review-snapshot.test.mjs
@@ -0,0 +1,146 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { reviewSnapshot, renderSnapshot, validateSnapshot } from '../lib/review/snapshot.js'
+import { probeMerge } from '../lib/review/merge.js'
+import { assert, test, report, withTempDir, PACKAGE_ROOT } from './lib/harness.mjs'
+
+const BASE = '1'.repeat(40), HEAD = '2'.repeat(40)
+const pr = () => ({ number: 12, title: 'Review fixture', url: 'https://github.com/example/project/pull/12', state: 'OPEN',
+  isDraft: false, reviewDecision: 'REVIEW_REQUIRED', additions: 3, deletions: 1, changedFiles: 2,
+  headRefOid: HEAD, baseRefOid: BASE, baseRefName: 'main', headRepository: { nameWithOwner: 'contributor/project' },
+  maintainerCanModify: false, author: { login: 'contributor' },
+  files: { nodes: [{ path: '.github/workflows/ci.yml' }, { path: 'package-lock.json' }], pageInfo: { hasNextPage: false } },
+  closingIssuesReferences: { pageInfo: { hasNextPage: false }, nodes: [{ number: 4, url: 'https://github.com/example/project/issues/4',
+    assignees: { nodes: [], pageInfo: { hasNextPage: false } }, comments: { pageInfo: { hasPreviousPage: false }, nodes: [
+      { author: { login: 'contributor' }, body: 'I am taking this issue; scoped fix follows.', url: 'https://github.com/example/project/issues/4#comment' },
+    ] } }] } })
+
+function github({ metadata = pr(), missingRun = false, failure = false, jobCount = 1 } = {}) {
+  const calls = []
+  const runner = async (file, args) => {
+    calls.push([file, ...args])
+    assert.equal(file, 'gh')
+    assert.deepEqual(args.slice(0, 3), ['api', '--hostname', 'github.com'])
+    if (failure) return { code: 1, stdout: '', stderr: 'authentication unavailable' }
+    const endpoint = args[3]
+    let value
+    if (endpoint.endsWith('/commits/main')) value = { sha: BASE }
+    else if (endpoint === 'graphql') {
+      const query = args.find(arg => arg.startsWith('query='))
+      assert.equal([...query].filter(char => char === '{').length, [...query].filter(char => char === '}').length, 'GraphQL request must be balanced')
+      value = { data: { repository: { pullRequest: metadata } } }
+    }
+    else if (endpoint.includes('/runs?')) {
+      assert.ok(endpoint.includes('/actions/workflows/ci.yml/'), 'base and PR must compare the same workflow')
+      const event = endpoint.includes('event=push') ? 'push' : 'pull_request', commit = event === 'push' ? BASE : HEAD
+      value = { workflow_runs: [
+        { id: 99, event: 'workflow_dispatch', head_sha: commit, created_at: '2026-10-25', conclusion: 'success', pull_requests: [{ number: 12 }] },
+        { id: 98, event, head_sha: '3'.repeat(40), created_at: '2026-10-24', conclusion: 'success', pull_requests: [{ number: 12 }] },
+        ...missingRun ? [] : [{ id: event === 'push' ? 10 : 20, event, head_sha: commit, status: 'completed',
+          conclusion: event === 'push' ? 'failure' : 'success', name: 'Cross-platform validation',
+          html_url: `https://github.com/example/project/actions/runs/${event === 'push' ? 10 : 20}`,
+          run_attempt: 2, created_at: '2026-10-23', pull_requests: [{ number: 12 }] }],
+      ] }
+    } else if (endpoint.includes('/jobs?')) value = { total_count: jobCount, jobs: Array.from({ length: Math.min(jobCount, 50) }, () => ({ name: 'linux', status: 'completed', conclusion: endpoint.includes('/10/') ? 'failure' : 'success' })) }
+    else throw new Error(`Unexpected endpoint ${endpoint}`)
+    return { code: 0, stdout: JSON.stringify(value), stderr: '' }
+  }
+  return { runner, calls }
+}
+
+await test('snapshot separates base failure from exact PR-event evidence and preserves fork/claim facts', async () => {
+  const { runner, calls } = github()
+  const snapshot = await reviewSnapshot({ repo: 'example/project', prs: [12, 12] }, runner)
+  assert.equal(snapshot.status, 'completed')
+  assert.equal(snapshot.prs.length, 1)
+  assert.equal(snapshot.base.ci.conclusion, 'failure')
+  const row = snapshot.prs[0]
+  assert.equal(row.ci.conclusion, 'success'); assert.equal(row.ci.event, 'pull_request'); assert.equal(row.ci.headSha, HEAD)
+  assert.equal(row.ci.attempt, 2); assert.equal(row.ci.jobs[0].name, 'linux')
+  assert.equal(row.headRepo, 'contributor/project'); assert.equal(row.maintainerCanModify, false)
+  assert.equal(row.reviewDecision, 'REVIEW_REQUIRED')
+  assert.deepEqual(row.risks, ['dependencies', 'workflows'])
+  assert.equal(row.issues[0].claimStatus, 'possible_claim_comments')
+  assert.match(row.issues[0].claims[0].excerpt, /taking/)
+  assert.equal(row.merge.status, 'unknown'); assert.match(row.merge.reason, /No --checkout/)
+  assert.equal(calls.filter(call => call.includes('graphql')).length, 1)
+})
+
+await test('missing runs, bounded evidence and API failures stay partial or unknown, never green', async () => {
+  const missing = await reviewSnapshot({ repo: 'example/project', prs: [12] }, github({ missingRun: true }).runner)
+  assert.equal(missing.status, 'partial'); assert.equal(missing.prs[0].ci.status, 'unknown')
+  const metadata = pr(); metadata.files.pageInfo.hasNextPage = true
+  metadata.closingIssuesReferences.nodes[0].comments.pageInfo.hasPreviousPage = true
+  const bounded = await reviewSnapshot({ repo: 'example/project', prs: [12] }, github({ metadata }).runner)
+  assert.equal(bounded.status, 'partial'); assert.equal(bounded.prs[0].filesTruncated, true)
+  assert.equal(bounded.prs[0].issues[0].truncated, true)
+  const manyJobs = await reviewSnapshot({ repo: 'example/project', prs: [12] }, github({ jobCount: 51 }).runner)
+  assert.equal(manyJobs.status, 'partial'); assert.equal(manyJobs.base.ci.jobsTruncated, true)
+  assert.equal(manyJobs.prs[0].ci.jobsTruncated, true); assert.equal(manyJobs.prs[0].ci.jobs.length, 50)
+  const failed = await reviewSnapshot({ repo: 'example/project', prs: [12] }, github({ failure: true }).runner)
+  assert.equal(failed.status, 'partial'); assert.equal(failed.prs[0].status, 'unknown')
+  assert.match(failed.prs[0].reason, /authentication/)
+})
+
+await test('invalid input is refused before subprocesses and oversized rendering retains recovery guidance', async () => {
+  let called = false
+  await assert.rejects(reviewSnapshot({ repo: '../../outside', prs: [12] }, async () => { called = true }), /owner\/name/)
+  assert.equal(called, false)
+  assert.throws(() => validateSnapshot({ repo: 'a/b', prs: [1, 2, 3, 4, 5, 6] }), /1–5/)
+  assert.throws(() => validateSnapshot({ repo: 'a/b', prs: [0] }), /positive/)
+  const snapshot = await reviewSnapshot({ repo: 'example/project', prs: [12] }, github().runner)
+  snapshot.prs[0].title = 'x'.repeat(100_000)
+  const output = renderSnapshot(snapshot)
+  assert.ok(Buffer.byteLength(output) <= 64 * 1024)
+  const bounded = JSON.parse(output)
+  assert.equal(bounded.outputTruncated, true); assert.equal(bounded.prs[0].headSha, HEAD)
+  assert.match(bounded.prs[0].omitted, /request fewer PRs/)
+  const cli = spawnSync(process.execPath, [path.join(PACKAGE_ROOT, 'bin/dsh-ops.mjs'), 'review', 'snapshot', '--bad'], { encoding: 'utf8' })
+  assert.equal(cli.status, 1); assert.equal(JSON.parse(cli.stdout).status, 'failed')
+})
+
+await test('isolated merge probes cannot invoke source/global drivers or mutate source objects and refs', async () => {
+  await withTempDir('review-merge', async root => {
+    const source = path.join(root, 'source.git'), empty = path.join(root, 'empty'), template = path.join(root, 'template')
+    fs.writeFileSync(empty, ''); fs.mkdirSync(template)
+    const env = { ...process.env, GIT_CONFIG_GLOBAL: empty, GIT_CONFIG_NOSYSTEM: '1' }
+    const git = (args, input) => {
+      const result = spawnSync('git', args, { env, input, encoding: 'utf8' })
+      assert.equal(result.status, 0, result.stderr)
+      return result.stdout.trim()
+    }
+    git(['init', '--bare', `--template=${template}`, source])
+    const inRepo = (args, input) => git(['--git-dir', source, ...args], input)
+    const blob = value => inRepo(['hash-object', '-w', '--stdin'], value)
+    const attributes = blob('file.txt merge=hostile\n')
+    const commit = (value, parent) => {
+      const tree = inRepo(['mktree'], `100644 blob ${attributes}\t.gitattributes\n100644 blob ${blob(value)}\tfile.txt\n`)
+      return inRepo(['hash-object', '-w', '-t', 'commit', '--stdin'], `tree ${tree}\n${parent ? `parent ${parent}\n` : ''}author Fixture <fixture@example.test> 1 +0000\ncommitter Fixture <fixture@example.test> 1 +0000\n\nfixture\n`)
+    }
+    const base = commit('base\n'), ours = commit('ours\n', base), theirs = commit('theirs\n', base)
+    inRepo(['update-ref', 'refs/heads/fixture', ours])
+    const marker = path.join(root, 'driver-ran'), script = path.join(root, 'driver.mjs')
+    fs.writeFileSync(script, `import fs from 'node:fs'; fs.writeFileSync(${JSON.stringify(marker)}, 'unsafe');`)
+    const driver = `"${process.execPath.replaceAll('\\', '/')}" "${script.replaceAll('\\', '/')}"`
+    inRepo(['config', 'merge.hostile.driver', driver])
+    const before = inRepo(['count-objects', '-v']), refs = inRepo(['show-ref'])
+    const previous = process.env.GIT_CONFIG_COUNT
+    process.env.GIT_CONFIG_COUNT = '1'; process.env.GIT_CONFIG_KEY_0 = 'merge.hostile.driver'; process.env.GIT_CONFIG_VALUE_0 = driver
+    try {
+      const clean = await probeMerge(source, base, base)
+      assert.equal(clean.status, 'clean', JSON.stringify(clean))
+      const conflict = await probeMerge(source, ours, theirs)
+      assert.equal(conflict.status, 'conflicts', JSON.stringify(conflict)); assert.deepEqual(conflict.files, ['file.txt'])
+      const absent = await probeMerge(source, ours, 'f'.repeat(40))
+      assert.equal(absent.status, 'unknown'); assert.match(absent.reason, /not available locally/)
+      assert.equal(fs.existsSync(marker), false, 'source and inherited custom drivers must never execute')
+    } finally {
+      if (previous === undefined) delete process.env.GIT_CONFIG_COUNT; else process.env.GIT_CONFIG_COUNT = previous
+      delete process.env.GIT_CONFIG_KEY_0; delete process.env.GIT_CONFIG_VALUE_0
+    }
+    assert.equal(inRepo(['show-ref']), refs)
+    assert.equal(inRepo(['count-objects', '-v']), before, 'only the isolated object store may receive merge objects')
+  })
+})
+report('review-snapshot')
diff --git a/test/search-early-exit.test.mjs b/test/search-early-exit.test.mjs
new file mode 100644
index 00000000..fb4e4386
--- /dev/null
+++ b/test/search-early-exit.test.mjs
@@ -0,0 +1,119 @@
+/** Opt-in bounded grep must keep prefix rows without inventing exhaustive totals. */
+import fs from 'node:fs'
+import path from 'node:path'
+import { assert, test, report, withTempDir } from './lib/harness.mjs'
+import { callWorker, request, envelopeOf, requireWorker } from './lib/boundary.mjs'
+requireWorker('search-early-exit')
+const grep = async (root, args = {}) => envelopeOf(await callWorker(JSON.stringify(
+  request('grep', { path: root, pattern: 'hit', limit: 2, ...args }, { root }),
+)), assert)
+const seed = root => {
+  for (let i = 0; i < 8; i++) fs.writeFileSync(path.join(root, `${i}.txt`), 'before\nhit one\nhit two\nhit three\nafter\n')
+}
+const incomplete = value => {
+  assert.equal(value.status, 'completed', JSON.stringify(value))
+  assert.equal(value.scanComplete, false)
+  assert.equal(value.complete, false)
+  assert.equal(value.truncatedBy, 'row-limit')
+  for (const field of ['matchedTotal', 'total', 'omitted', 'continuation']) assert.equal(value[field], undefined, field)
+  assert.match(value.nextAction, /exactTotal=true/)
+  assert.match(value.nextAction, /lower bound/)
+}
+
+await test('bounded content stops within the first file and returns the same contextual prefix', async () => {
+  await withTempDir('grep-early-content', async root => {
+    seed(root)
+    for (const extra of [{}, { multiline: true }, { offset: 1, beforeContext: 1, afterContext: 1 }]) {
+      const full = await grep(root, extra), bounded = await grep(root, { ...extra, exactTotal: false })
+      incomplete(bounded)
+      assert.deepEqual(bounded.items, full.items)
+      assert.equal(bounded.pageComplete, true)
+      assert.equal(bounded.scannedFiles, 1)
+      assert.equal(full.scannedFiles, 8)
+      assert.equal(bounded.matchedObserved, (extra.offset ?? 0) + 2)
+      assert.equal(full.matchedTotal, 24)
+    }
+  })
+})
+
+await test('bounded file/count modes stop at file rows and retain exact per-file counts', async () => {
+  await withTempDir('grep-early-file-modes', async root => {
+    seed(root)
+    for (const outputMode of ['count', 'files_with_matches']) {
+      const args = { outputMode, offset: 1 }
+      const full = await grep(root, args), bounded = await grep(root, { ...args, exactTotal: false })
+      incomplete(bounded)
+      assert.deepEqual(bounded.items, full.items)
+      assert.equal(bounded.scannedFiles, 3)
+      assert.equal(bounded.matchedObserved, 9)
+      assert.equal(bounded.nextOffset, 3)
+      if (outputMode === 'count') assert.deepEqual(bounded.items.map(item => item.count), [3, 3])
+    }
+  })
+})
+
+await test('summary and exhausted bounded scans still report actual exact totals', async () => {
+  await withTempDir('grep-early-exhausted', async root => {
+    seed(root)
+    for (const extra of [{ outputMode: 'summary' }, { limit: 50 }, { outputMode: 'files_with_matches', limit: 50 }, { pattern: 'absent' }]) {
+      const full = await grep(root, extra), bounded = await grep(root, { ...extra, exactTotal: false })
+      assert.equal(bounded.scanComplete, true)
+      assert.equal(bounded.matchedTotal, full.matchedTotal)
+      assert.equal(bounded.total, full.total)
+      assert.deepEqual(bounded.items, full.items)
+      assert.equal(bounded.scannedFiles, full.scannedFiles)
+    }
+  })
+})
+
+await test('exact-total defaults and current continuation binding remain enforced', async () => {
+  await withTempDir('grep-early-cursor', async root => {
+    seed(root)
+    const omitted = await grep(root), explicit = await grep(root, { exactTotal: true })
+    assert.equal(omitted.matchedTotal, explicit.matchedTotal)
+    assert.deepEqual(omitted.items, explicit.items)
+    const next = await grep(root, { exactTotal: true, continuation: explicit.continuation })
+    assert.equal(next.scanComplete, true)
+    assert.equal(next.matchedTotal, 24)
+    const stale = await grep(root, { exactTotal: false, continuation: explicit.continuation })
+    assert.equal(stale.error.code, 'SEARCH_STALE')
+    const invalid = await grep(root, { exactTotal: 'false' })
+    assert.equal(invalid.status, 'error')
+  })
+})
+
+await test('invalid encoding can hide matching ASCII and stays a gap unless filtered out', async () => {
+  await withTempDir('grep-early-encoding', async root => {
+    fs.writeFileSync(path.join(root, 'a.txt'), Buffer.concat([Buffer.from('hit hidden\n'), Buffer.from([0xff])]))
+    fs.writeFileSync(path.join(root, 'b.txt'), 'hit visible\nhit again\nhit last\n')
+    fs.writeFileSync(path.join(root, 'excluded.bin'), Buffer.from([0xff]))
+    const full = await grep(root, { glob: ['*.txt'] })
+    assert.equal(full.scanComplete, false)
+    assert.equal(full.matchedTotal, undefined)
+    assert.equal(full.matchedObserved, 3)
+    assert.equal(full.skipReasons['invalid-encoding'], 1)
+    assert.equal(full.skipReasons.pattern, 1)
+    assert.equal(full.failed, 0)
+    const bounded = await grep(root, { exactTotal: false, glob: ['*.txt'] })
+    incomplete(bounded)
+    assert.equal(bounded.skipReasons['invalid-encoding'], 1)
+    assert.match(bounded.nextAction, /reported scan gaps/)
+    const filtered = await grep(root, { glob: ['b.txt'] })
+    assert.equal(filtered.scanComplete, true)
+    assert.equal(filtered.matchedTotal, 3)
+  })
+})
+
+await test('bounded partial-line output never suggests advancing past the missing suffix', async () => {
+  await withTempDir('grep-early-output', async root => {
+    fs.writeFileSync(path.join(root, 'a.txt'), `hit${'\\"😀'.repeat(100000)}\nhit next\n`)
+    const value = await grep(root, { exactTotal: false, limit: 1 })
+    incomplete(value)
+    assert.equal(value.pageComplete, false)
+    assert.equal(value.nextOffset, 0)
+    assert.equal(value.items[0].truncatedInLine, true)
+    assert.match(value.nextAction, /partly displayed/)
+  })
+})
+
+report('search-early-exit')
diff --git a/test/session-incremental.test.mjs b/test/session-incremental.test.mjs
new file mode 100644
index 00000000..260f0a5c
--- /dev/null
+++ b/test/session-incremental.test.mjs
@@ -0,0 +1,56 @@
+/** Real host counters for #333: unrelated sessions keep their publications and probes. */
+import { createScope } from '@deepseek-ai/dsh-scope'
+import * as discovery from '../lib/discovery/index.js'
+import * as ptc from '../lib/ptc/index.js'
+import { mountSessionBash } from '../lib/session-shells.js'
+import { isPresentationProbe } from '../lib/presentation.js'
+import { bootHost, shutdown } from './lib/host.mjs'
+import { assert, test, report, withTempDir } from './lib/harness.mjs'
+import { WORKER, requireWorker } from './lib/boundary.mjs'
+requireWorker('session-incremental')
+const flush = async () => { for(let i=0;i<4;i++) await new Promise(resolve => setImmediate(resolve)) }
+
+for (const mode of ['native', 'ptc']) await test(`new ${mode} sessions preserve unrelated definitions with bounded probes and registry events`, () => withTempDir('incremental-composition', async dir => {
+  const {ctx,tools,prompt} = await bootHost()
+  const agents=[], counts=new Map()
+  ctx.provide('agents',{list:()=>agents})
+  try {
+    await ctx.plugin(inner=>{
+      inner.provide('subprocess',{spawn(){throw new Error('counter test must not execute tools')}})
+      inner.provide('sandboxPolicy',{resolve:({session})=>({mode:'danger-full-access',workspaceRoot:dir,sessionId:session.id})})
+      inner.provide('ptcRuntime',{language:'typescript'})
+    })
+    ctx.effect(()=>prompt.section({name:'incremental:counter',order:6000,text:context=>{
+      if(isPresentationProbe(context)) counts.set(context.scope,(counts.get(context.scope)??0)+1)
+      return ''
+    }}))
+    await ctx.plugin({inject:['tools'],apply(inner){mountSessionBash(inner,{publishBashTool:true},{bash:{available:true,file:process.execPath,source:'explicit',detail:'never executed'}})}})
+    await ctx.plugin(discovery,{binaryPath:WORKER,required:true})
+    await ctx.plugin(ptc,{binaryPath:WORKER,required:true})
+    let changes=0;ctx.on('tools/change',()=>{changes++})
+    for(let i=0;i<16;i++){
+      const agent={id:mode+'-'+i,session:{id:mode+'-'+i,header:{cwd:dir}}}
+      agent.ctx=createScope(ctx,agent).ctx
+      // This preset declaration is a real external registry/prompt change, not an
+      // OPS attach. Settle it before measuring the lifecycle cost the PR fixes.
+      if(mode==='ptc') await agent.ctx.plugin({inject:['tools'],apply(inner){inner.tools.presentAs('ptc')}})
+      await flush()
+      const identities=agents.map(a=>['ops_bash','ops_load_sdk','ops_discover_tools'].map(name=>tools.get(name,a)))
+      counts.clear(); changes=0;agents.push(agent)
+      await ctx.serial('agent/created',{agent});await flush()
+      const old=agents.slice(0,-1)
+      assert.equal(old.reduce((sum,a)=>sum+(counts.get(a)??0),0),0,'attach must not assemble old roots')
+      old.forEach((a,j)=>['ops_bash','ops_load_sdk','ops_discover_tools'].forEach((name,k)=>assert.equal(tools.get(name,a),identities[j][k],name+' identity must survive sibling creation')))
+      assert.ok((counts.get(agent)??0)<=4,'fresh probes are bounded independently of tracked sessions')
+      assert.ok(changes<=6,`registration event count ${changes} must not grow with sessions`)
+      assert.ok(tools.get('ops_bash',agent))
+      assert.ok(tools.get(mode==='ptc'?'ops_load_sdk':'ops_discover_tools',agent))
+    }
+    const leave=agents.pop(), survivor=agents[0], sdk=tools.get('ops_load_sdk',survivor)
+    await flush();counts.clear()
+    await ctx.serial('agent/disposed',{agent:leave});await flush()
+    assert.equal(agents.reduce((sum,a)=>sum+(counts.get(a)??0),0),0,'independent departure must not re-probe survivors')
+    assert.equal(tools.get('ops_load_sdk',survivor),sdk)
+  } finally {await shutdown(ctx)}
+}))
+report('session-incremental')
diff --git a/test/session-lifecycle.test.mjs b/test/session-lifecycle.test.mjs
new file mode 100644
index 00000000..91d89a77
--- /dev/null
+++ b/test/session-lifecycle.test.mjs
@@ -0,0 +1,138 @@
+import { createScope } from '@deepseek-ai/dsh-scope'
+import { SessionStore } from '@deepseek-ai/dsh-session'
+import { mountSessionBash } from '../lib/session-shells.js'
+import * as ptc from '../lib/ptc/index.js'
+import * as discovery from '../lib/discovery/index.js'
+import * as hiding from '../lib/official-tool-hiding.js'
+import { NativeFileTools } from '../lib/file/runtime.js'
+import { bootHost, shutdown } from './lib/host.mjs'
+import { assert, test, report, TEST_HOME } from './lib/harness.mjs'
+
+const flush = async () => { for (let i = 0; i < 4; i++) await new Promise(resolve => setImmediate(resolve)) }
+async function setup() {
+  const host = await bootHost()
+  await host.ctx.plugin(inner => {
+    inner.provide('subprocess', { spawn() { throw new Error('publication tests must not execute') } })
+    inner.provide('sandboxPolicy', { resolve: ({ session }) => ({ mode: session.mode, workspaceRoot: TEST_HOME }) })
+    inner.provide('ptcRuntime', { language: 'typescript' })
+  })
+  return host
+}
+function mint(ctx, id, mode = 'danger-full-access') {
+  const agent = { id, session: { id, mode, header: { cwd: TEST_HOME } } }
+  agent.ctx = createScope(ctx, agent).ctx
+  return agent
+}
+
+await test('Bash publication and disposal leave the real SessionStore append boundary (#386)', async () => {
+  const { ctx, tools, prompt } = await setup()
+  await ctx.plugin(SessionStore)
+  const warnings = []
+  ctx.logger.warn = message => { warnings.push(String(message)) }
+  try {
+    const component = await ctx.plugin({ inject: ['tools'], apply(inner) {
+      mountSessionBash(inner, { publishBashTool: true }, { bash: { available: true, file: process.execPath, source: 'explicit' } })
+    } })
+    const session = ctx.get('sessions').create('append-window', { meta: { cwd: TEST_HOME } })
+    session.mode = 'danger-full-access'
+    const agent = { id: session.id, session }
+    agent.ctx = createScope(ctx, agent).ctx
+    let creation, disposal, writes = 0, retire = false, observer
+    // A real registry notification appends a valid session event, as host
+    // observers can. No register method or SessionStore guard is replaced.
+    ctx.on('tools/change', () => { session.append('turn/start', { turn: ++writes }) })
+    ctx.on('session/event', (seen, event) => {
+      if (seen !== session || event.type !== 'sandbox/mode') return
+      assert.throws(() => session.append('turn/start', { turn: 99 }), /append cannot reenter/)
+      if (!creation) creation = ctx.serial('agent/created', { agent })
+      if (retire) disposal = ctx.serial('agent/disposed', { agent })
+      // Asynchronous observers may outlive publication; the actual host releases
+      // its synchronous guard without awaiting them.
+      observer = new Promise(resolve => setImmediate(resolve))
+      return observer
+    })
+    session.append('sandbox/mode', { mode: session.mode })
+    await creation
+    const retained = tools.get('ops_bash', agent)
+    assert.ok(retained, 'awaited agent creation includes deferred publication')
+    assert.equal(writes, 1, 'the real registry change appends only after the outer mode event completes')
+    session.mode = 'read-only'
+    session.append('sandbox/mode', { mode: session.mode })
+    const denied = await retained.execute({ command: 'must not run', description: 'Check deferred withdrawal' }, { agent, signal: new AbortController().signal })
+    assert.equal(denied.status, 'failed', 'retained callbacks observe revoked authority before deferred cleanup')
+    assert.match(denied.error, /AUTHORITY_CHANGED|EXECUTOR_UNAVAILABLE/)
+    await flush()
+    assert.equal(tools.get('ops_bash', agent), undefined)
+    session.mode = 'danger-full-access'
+    session.append('sandbox/mode', { mode: session.mode })
+    const first = await prompt.assemble({ scope: agent })
+    assert.ok(first.tools.some(tool => tool.name === 'ops_bash'), 'the first assembly waits and rebuilds its pre-hook snapshot')
+    retire = true
+    session.append('sandbox/mode', { mode: session.mode })
+    await disposal; await observer; await flush()
+    assert.equal(tools.get('ops_bash', agent), undefined, 'disposal requested by an append observer also defers writes')
+    assert.deepEqual(warnings, [], 'the host reports no contained reentry or lifecycle failure')
+    const waiting = mint(ctx, 'unload-before-publication')
+    const created = ctx.serial('agent/created', { agent: waiting })
+    await component.dispose(); await created; await flush()
+    assert.equal(tools.get('ops_bash', waiting), undefined, 'unload cancels publication queued by creation')
+  } finally { await shutdown(ctx) }
+})
+
+await test('PTC presentation waterfall accepts sections without pre-attached tools (#387)', async () => {
+  const { ctx, tools, prompt } = await setup()
+  try {
+    await ctx.plugin(ptc, { binaryPath: process.execPath, required: true })
+    const agent = mint(ctx, 'presentation-only')
+    await agent.ctx.plugin({ inject: ['tools'], apply(inner) { inner.tools.presentAs('ptc') } })
+    await ctx.serial('agent/created', { agent }); await flush()
+    await prompt.assemble({ scope: agent }); await flush()
+    const before = tools.get('ops_load_sdk', agent)
+    assert.ok(before)
+    const assembly = await prompt.assemble({ scope: agent })
+    const { tools: wire, ...presentation } = assembly
+    assert.deepEqual(wire.map(tool => tool.name), ['run_code'])
+    // rc.3 runs this public waterfall with PromptPresentation, then attaches
+    // the authoritative tools snapshot after all listeners have returned.
+    const result = await ctx.waterfall('system-prompt/assemble', presentation, { scope: agent }, async () => presentation)
+    assert.equal(result, presentation)
+    assert.equal(Object.hasOwn(result, 'tools'), false)
+    assert.equal(tools.get('ops_load_sdk', agent), before, 'a valid PTC projection is retained')
+    const selected = await before.execute({ tools: ['stat'] }, { agent, signal: new AbortController().signal })
+    assert.equal(selected.status, 'completed')
+  } finally { await shutdown(ctx) }
+})
+await test('first prompt waits for delayed discovery before selected replacement validation (#375)', async () => {
+  const { ctx, prompt } = await setup()
+  const entered = Promise.withResolvers(), release = Promise.withResolvers()
+  const original = NativeFileTools.prototype.start
+  NativeFileTools.prototype.start = async function (...args) {
+    entered.resolve(); await release.promise
+    return original.apply(this, args)
+  }
+  let created, assembling
+  try {
+    ctx.tools.register({ name: 'read', description: 'official read', parameters: { type: 'object' },
+      output: { schema: { type: 'string' }, render: () => [] }, execute: async () => 'unused' })
+    await ctx.plugin(hiding, { replaceTools: ['read'] })
+    await ctx.plugin(discovery, { binaryPath: process.execPath, required: true, enabled: false,
+      allowedTools: ['inspect_local_file'], alwaysLoaded: ['inspect_local_file'] })
+    const agent = mint(ctx, 'cold-start')
+    await ctx.plugin({ inject: ['tools'], apply(inner) { agent.ctx = createScope(inner, agent).ctx } })
+    created = ctx.serial('agent/created', { agent })
+    await entered.promise
+    let settled = false
+    assembling = prompt.assemble({ scope: agent }).finally(() => { settled = true })
+    void assembling.catch(() => {}) // Awaited below; keep an early rejection owned while checking the pending state.
+    await new Promise(resolve => setImmediate(resolve))
+    assert.equal(settled, false, 'the first prompt cannot treat pending publication as bad configuration')
+    release.resolve()
+    await created
+    const first = await assembling
+    assert.deepEqual(first.tools.map(tool => tool.name), ['ops_inspect_local_file'])
+  } finally {
+    release.resolve(); NativeFileTools.prototype.start = original
+    await Promise.allSettled([created, assembling]); await shutdown(ctx)
+  }
+})
+report('session-lifecycle')
diff --git a/test/settings-host.test.mjs b/test/settings-host.test.mjs
index 326b0739..1cb9e125 100644
--- a/test/settings-host.test.mjs
+++ b/test/settings-host.test.mjs
@@ -65,12 +65,14 @@ await test('real discovery form validates pool/always-loaded atomically and relo
   }, { allowedTools: ['glob', 'grep'], alwaysLoaded: [], binaryPath: '/preserved/worker' })
   try {
     const before = snapshot(), count = mounts
-    assert.deepEqual(Object.keys(before.value).sort(), ['allowedTools', 'alwaysLoaded', 'enabled', 'maxResults'])
-    await mutate([set('allowedTools', ['glob']), set('alwaysLoaded', ['glob'])], before.revision)
+    assert.deepEqual(Object.keys(before.value).sort(), ['allowedTools', 'alwaysLoaded', 'binaryPath', 'denyCredentialReads', 'enabled', 'maxResults', 'required'])
+    await mutate([set('allowedTools', ['glob']), set('alwaysLoaded', ['glob']), set('required', true), set('denyCredentialReads', false)], before.revision)
     assert.deepEqual(observed.allowedTools, ['glob'])
     assert.deepEqual(observed.alwaysLoaded, ['glob'])
     assert.equal(mounts, count + 1)
     assert.equal(observed.binaryPath, '/preserved/worker')
+    assert.equal(observed.required, true)
+    assert.equal(observed.denyCredentialReads, false)
     const saved = fs.readFileSync(patchPath, 'utf8'), current = snapshot()
     await assert.rejects(mutate([set('alwaysLoaded', ['grep'])], current.revision), /must be in allowedTools/)
     await assert.rejects(mutate([set('allowedTools', ['pdf'])], current.revision), /unavailable capability/)
@@ -93,6 +95,9 @@ await test('real shell form persists executor selection without erasing ordinary
     assert.equal(observed.publishBashTool, false)
     assert.equal(observed.shellPolicy, 'deny-host-shell')
     assert.equal(observed.allowSystemShellFallback, false)
+    await mutate([set('allowSystemShellFallback', true), set('extraGuidance', 'Use the configured executor.')], snapshot().revision)
+    assert.equal(observed.allowSystemShellFallback, true)
+    assert.equal(observed.extraGuidance, 'Use the configured executor.')
     const saved = fs.readFileSync(patchPath, 'utf8')
     await assert.rejects(mutate([set('bashPath', '')], snapshot().revision), /non-empty string/)
     assert.equal(fs.readFileSync(patchPath, 'utf8'), saved)
diff --git a/test/shells-bash-run.test.mjs b/test/shells-bash-run.test.mjs
index 2375d8bd..bd4a5052 100644
--- a/test/shells-bash-run.test.mjs
+++ b/test/shells-bash-run.test.mjs
@@ -50,7 +50,7 @@ await test('ops_bash runs the resolved bash as `bash -c <command>` through ctx.s
     // The spawn env is the overrides as they must reach a child given THIS host environment: a
     // host that sets `LC_ALL` gets it neutralized (see the locale case below).
     assert.deepEqual(spawned.env, shellEnvOverrides(process.env))
-    assert.equal(spawned.stdio.stdin, 'ignore')
+    assert.deepEqual(spawned.stdio.stdin, { data: '' })
     assert.equal(typeof spawned.stdio.stdout.maxBytes, 'number')
     assert.equal(typeof spawned.stdio.stderr.maxBytes, 'number')
     assert.equal(spawned.stdio.stdout.spill.maxBytes, spawned.stdio.stderr.spill.maxBytes)
@@ -177,7 +177,7 @@ await test('ops_bash executes a script_path without embedding its contents in ar
 
     assert.deepEqual(specs[0].argv, [bash, script])
     assert.equal(specs[0].cwd, dir)
-    assert.equal(specs[0].stdio.stdin, 'ignore')
+    assert.deepEqual(specs[0].stdio.stdin, { data: '' })
   })
 })
 
diff --git a/test/shells-incremental.test.mjs b/test/shells-incremental.test.mjs
new file mode 100644
index 00000000..500bd232
--- /dev/null
+++ b/test/shells-incremental.test.mjs
@@ -0,0 +1,60 @@
+import { createScope } from '@deepseek-ai/dsh-scope'
+import { assert, test, report } from './lib/harness.mjs'
+import { bootHost, shutdown } from './lib/host.mjs'
+import { mountSessionBash } from '../lib/session-shells.js'
+const flush = () => new Promise(resolve => setImmediate(resolve))
+
+async function setup() {
+  const { ctx, tools } = await bootHost()
+  await ctx.plugin(inner => {
+    inner.provide('subprocess', { spawn() { throw new Error('publication test must not execute') } })
+    inner.provide('sandboxPolicy', { resolve: ({ session }) => ({ mode: session.mode, workspaceRoot: process.env.DSH_HOME }) })
+  })
+  await ctx.plugin({ inject: ['tools'], apply(inner) {
+    mountSessionBash(inner, { publishBashTool: true }, { bash: { available: true, file: process.execPath, source: 'explicit', detail: 'publication only' } })
+  } })
+  const mint = async (id, parent, mode = 'danger-full-access') => {
+    const agent = { id, session: { id, mode, header: { cwd: process.env.DSH_HOME } } }
+    agent.ctx = createScope(parent?.ctx ?? ctx, agent, parent ? { parent } : undefined).ctx
+    await ctx.serial('agent/created', { agent })
+    await flush()
+    return agent
+  }
+  return { ctx, tools, mint }
+}
+await test('unrelated attach and disposal preserve existing Bash definitions and bounded notifications', async () => {
+  const {ctx, tools, mint} = await setup()
+  try {
+    const old = []
+    for(let i=0;i<12;i++) old.push(await mint('old-'+i))
+    const before = old.map(a => tools.get('ops_bash', a))
+    let changes = 0; const off = ctx.on('tools/change', () => { changes++ })
+    const added = await mint('new')
+    assert.deepEqual(old.map(a => tools.get('ops_bash', a)), before)
+    assert.equal(changes, 1, 'only the new Bash registration changes')
+    await ctx.serial('agent/disposed', {agent:added})
+    assert.equal(changes, 2, 'only the departed Bash registration changes')
+    old.forEach((a,i) => assert.equal(tools.get('ops_bash',a),before[i]))
+    off()
+  } finally { await shutdown(ctx) }
+})
+await test('authority transitions preserve siblings and masks on restricted descendants', async () => {
+  const {ctx,tools,mint} = await setup()
+  try {
+    const parent=await mint('parent'), child=await mint('child',parent,'read-only'), sibling=await mint('sibling')
+    const stable=tools.get('ops_bash',sibling)
+    assert.equal(tools.get('ops_bash',child), undefined, 'restricted child cannot inherit parent Bash without sandbox')
+    parent.session.mode='read-only'
+    await ctx.serial('session/event',parent.session,{type:'sandbox/mode'})
+    await flush()
+    assert.equal(tools.get('ops_bash',parent),undefined)
+    assert.equal(tools.get('ops_bash',sibling),stable)
+    parent.session.mode='danger-full-access'
+    await ctx.serial('session/event',parent.session,{type:'sandbox/mode'})
+    await flush()
+    assert.ok(tools.get('ops_bash',parent))
+    assert.equal(tools.get('ops_bash',child),undefined)
+    assert.equal(tools.get('ops_bash',sibling),stable)
+  } finally {await shutdown(ctx)}
+})
+report('shells-incremental')
diff --git a/test/shells-input.test.mjs b/test/shells-input.test.mjs
new file mode 100644
index 00000000..75580a63
--- /dev/null
+++ b/test/shells-input.test.mjs
@@ -0,0 +1,58 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+import Subprocess from '@deepseek-ai/dsh-subprocess-local'
+import { privateRuntimePath } from '../lib/bash-ipc.js'
+import { pinnedBashExecutable } from '../lib/shells/pinned.js'
+import { bashToolDefinition } from '../lib/shells/tool.js'
+import { assert, report, test, withTempDir } from './lib/harness.mjs'
+import { bootHost, shutdown } from './lib/host.mjs'
+
+const bash = process.platform === 'win32'
+  ? pinnedBashExecutable({ file: process.env.DSH_OPS_TEST_BASH }) : '/bin/bash'
+
+await test('private MSYS PATH preserves caller tool precedence after required usr/bin (#364)', async () => {
+  await withTempDir('shell-path', async root => {
+    const caller = path.join(root, 'caller tools'), runtime = path.join(root, 'runtime')
+    for (const directory of [caller, ...['usr/bin', 'ucrt64/bin', 'cmd'].map(part => path.join(runtime, part))]) {
+      fs.mkdirSync(directory, { recursive: true })
+      fs.writeFileSync(path.join(directory, 'ops-path-probe'), 'exit 0\n', { mode: 0o755 })
+    }
+    fs.unlinkSync(path.join(runtime, 'usr/bin/ops-path-probe'))
+    const env = { ...process.env, PATH: privateRuntimePath(runtime, caller) }
+    const locate = () => {
+      const result = spawnSync(bash, ['--noprofile', '--norc', '-c', 'command -v ops-path-probe'], { env, encoding: 'utf8' })
+      assert.equal(result.status, 0, result.stderr)
+      return result.stdout.trim().replaceAll('\\', '/')
+    }
+    assert.match(locate(), /\/caller tools\/ops-path-probe$/, 'caller tool must precede optional bundled programs')
+    fs.writeFileSync(path.join(runtime, 'usr/bin/ops-path-probe'), 'exit 0\n', { mode: 0o755 })
+    assert.match(locate(), /\/runtime\/usr\/bin\/ops-path-probe$/, 'required private MSYS directory stays first')
+    assert.equal(privateRuntimePath(runtime, '').split(path.delimiter).includes(''), false, 'do not add current-directory lookup when inherited PATH is empty')
+  })
+})
+
+await test('Bash receives a closed empty pipe and observes EOF without reading Windows NUL (#372)', async () => {
+  await withTempDir('shell-stdin', async root => {
+    const { ctx } = await bootHost()
+    try {
+      await ctx.plugin(Subprocess)
+      const definition = bashToolDefinition({ file: bash, source: 'config', subprocess: ctx.get('subprocess') })
+      const result = await definition.execute({
+        command: "if [[ -p /dev/stdin ]]; then printf pipe; elif [[ -S /dev/stdin ]]; then printf socket; else printf device; fi; IFS= read -r line; printf ':%s' \"$?\"",
+        workdir: root, timeoutMs: 10_000,
+      })
+      assert.equal(result.status, 'completed', JSON.stringify(result))
+      // Node's POSIX stdio 'pipe' can be a Unix socket; both are distinct from /dev/null.
+      if (process.platform === 'win32') assert.equal(result.stdout.text, 'pipe:1', 'MSYS fd 0 must be a pipe already at EOF')
+      else assert.match(result.stdout.text, /^(pipe|socket):1$/, 'POSIX batch input must be a stream already at EOF')
+      assert.equal(result.stderr.text, '')
+      const script = path.join(root, 'empty-input.sh')
+      fs.writeFileSync(script, "IFS= read -r line; printf 'eof:%s' \"$?\"\n")
+      const scripted = await definition.execute({ script_path: script, workdir: root, timeoutMs: 10_000 })
+      assert.equal(scripted.status, 'completed', JSON.stringify(scripted))
+      assert.equal(scripted.stdout.text, 'eof:1', 'script_path must also see immediate EOF')
+    } finally { await shutdown(ctx) }
+  })
+})
+report('shells-input')
diff --git a/test/shells-json-digest.test.mjs b/test/shells-json-digest.test.mjs
new file mode 100644
index 00000000..7bb2acde
--- /dev/null
+++ b/test/shells-json-digest.test.mjs
@@ -0,0 +1,157 @@
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import { getEncoding } from 'js-tiktoken'
+import { createJsonDigestProjection, jsonDigest } from '../lib/shells/json-digest.js'
+import { hostForeground, renderHostBash } from '../lib/shells/host-contract.js'
+import { hostBashDefinition } from '../lib/shells/host-tool.js'
+import { bashToolDefinition } from '../lib/shells.js'
+import { assert, report, test, withTempDir } from './lib/harness.mjs'
+import { bootHost, shutdown } from './lib/host.mjs'
+
+const raw = JSON.stringify({ items: Array.from({ length: 1200 }, (_, index) => ({ index, status: index === 1199 ? 'failed' : 'ok', name: 'item name '.repeat(8) })) })
+const call = (extra = {}) => ({ token: Symbol('call'), signal: new AbortController().signal, ...extra })
+const value = file => hostForeground({ exitCode: 0, timedOut: false, timeoutMs: 1000,
+  stdout: { text: raw.slice(-65536), truncated: true, spillPath: file }, stderr: { text: 'stderr is preserved', truncated: false } })
+const outcome = value => ({ isError: false, value, content: [{ type: 'text', text: renderHostBash(value) }] })
+
+await test('large JSON has bounded samples, error examples, recovery and measured token reduction', () => {
+  const text = jsonDigest(raw, '/private/original.log')
+  assert.match(text, /lossy samples, not an exhaustive error check/)
+  assert.match(text, /"length":1200/); assert.match(text, /"status":"failed"/)
+  assert.match(text, /full output: "\/private\/original.log"/)
+  const encoding = getEncoding('cl100k_base')
+  const before = encoding.encode(raw.slice(-65536)).length, after = encoding.encode(text).length
+  console.log(`  JSON fixture cl100k_base: ${before} -> ${after} tokens`)
+  assert.ok(after < before * 0.8)
+  assert.ok(Buffer.byteLength(text) < 4600)
+})
+
+await test('malformed, scalar, tiny, oversized and excessive-summary JSON keep raw rendering', () => {
+  for (const text of ['{"broken":', 'x'.repeat(9000), JSON.stringify('a'.repeat(9000)), '{}', ' '.repeat(2 * 1024 * 1024 + 1),
+    JSON.stringify(Object.fromEntries(Array.from({ length: 20 }, (_, n) => ['k'.repeat(1000) + n, 'v'.repeat(1000)])))]) assert.equal(jsonDigest(text, '/full'), undefined)
+})
+
+await test('Native projection reads intact spill but keeps the canonical result and stderr unchanged', async () => {
+  await withTempDir('json-digest', async dir => {
+    const file = path.join(dir, 'stdout.log'); await fs.writeFile(file, raw)
+    const original = value(file), snapshot = structuredClone(original), exec = call(), projection = createJsonDigestProjection()
+    await projection.prepare(original, exec)
+    const content = projection.projectContent(exec, outcome(original))
+    assert.match(content[0].text, /JSON summary/); assert.match(content[0].text, /stderr is preserved/)
+    assert.match(content[0].text, /\[exit code: 0\]$/)
+    assert.deepEqual(original, snapshot); assert.equal(await fs.readFile(file, 'utf8'), raw)
+    assert.equal(projection.projectContent(exec, { isError: false }), undefined)
+  })
+})
+
+await test('nested SDK calls, failures, absent spills and cancellation keep original content', async () => {
+  await withTempDir('json-digest-fallback', async dir => {
+    const file = path.join(dir, 'stdout.log'); await fs.writeFile(file, raw)
+    const cancelled = new AbortController(); cancelled.abort()
+    for (const [original, exec] of [[value(file), call({ parent: Symbol('ptc') })], [value(file), {}],
+      [{ ...value(file), exitCode: 2, status: 'failed' }, call()], [value(file), call({ signal: cancelled.signal })],
+      [{ ...value(file), stopped: 'cancelled' }, call()], [{ ...value(file), stdout: { text: raw, truncated: false } }, call()]]) {
+      const projection = createJsonDigestProjection(), snapshot = structuredClone(original)
+      await projection.prepare(original, exec)
+      if (exec.token) assert.equal(projection.projectContent(exec, { isError: false }), undefined)
+      assert.deepEqual(original, snapshot)
+    }
+    for (const result of [{ isError: true }, { isError: false }]) {
+      const projection = createJsonDigestProjection(), controller = new AbortController(), exec = call({ signal: controller.signal })
+      await projection.prepare(value(file), exec)
+      if (!result.isError) controller.abort()
+      assert.equal(projection.projectContent(exec, result), undefined)
+    }
+  })
+})
+
+await test('missing, invalid UTF-8, malformed and over-budget spill files fail open', async () => {
+  await withTempDir('json-digest-spills', async dir => {
+    for (const bytes of [Buffer.alloc(9000, 0xff), Buffer.from('{'.repeat(9000)), Buffer.alloc(2 * 1024 * 1024 + 1, 32)]) {
+      const file = path.join(dir, 'stdout.log'); await fs.writeFile(file, bytes)
+      const projection = createJsonDigestProjection(), exec = call()
+      await projection.prepare(value(file), exec)
+      assert.equal(projection.projectContent(exec, { isError: false }), undefined)
+    }
+    for (const file of [path.join(dir, 'missing'), dir, 'relative.log']) {
+      const projection = createJsonDigestProjection(), exec = call()
+      await projection.prepare(value(file), exec)
+      assert.equal(projection.projectContent(exec, { isError: false }), undefined)
+    }
+  })
+})
+
+await test('published host definition prepares content after foreground execution without changing its schema/value', async () => {
+  await withTempDir('json-digest-host', async dir => {
+    const file = path.join(dir, 'stdout.log'); await fs.writeFile(file, raw)
+    const result = value(file), exec = call({ agent: { session: { id: 'digest', header: { cwd: dir } } } })
+    const base = bashToolDefinition({ file: process.execPath, source: 'config' })
+    const ctx = { get: name => name === 'sandboxPolicy' ? { resolve: () => ({ mode: 'danger-full-access' }) } : undefined }
+    const definition = hostBashDefinition(ctx, base, async () => ({ started: true, result: async () => result }), () => dir)
+    const canonical = await definition.execute({ command: 'produce-json', description: 'Produce a large JSON result' }, exec)
+    assert.deepEqual(canonical, result)
+    assert.equal(definition.output.render({}, canonical)[0].text, renderHostBash(result))
+    assert.match(definition.projectContent(exec, outcome(canonical))[0].text, /JSON summary/)
+  })
+})
+
+await test('real host registry applies Native projection and preserves nested SDK content and values', async () => {
+  await withTempDir('json-digest-registry', async dir => {
+    const file = path.join(dir, 'stdout.log'); await fs.writeFile(file, raw)
+    const { ctx, tools } = await bootHost(), agent = { session: { id: 'digest-registry', header: { cwd: dir } } }
+    try {
+      const original = value(file), base = bashToolDefinition({ file: process.execPath, source: 'config' })
+      const shellCtx = { get: name => name === 'sandboxPolicy' ? { resolve: () => ({ mode: 'danger-full-access' }) } : undefined }
+      const definition = hostBashDefinition(shellCtx, base, async () => ({ started: true, result: async () => original }), () => dir)
+      let nested
+      await ctx.plugin({ inject: ['tools'], apply(inner) {
+        inner.tools.register(definition)
+        inner.tools.register({ name: 'digest_transport_fixture', description: 'Nested execution fixture',
+          parameters: { type: 'object', properties: {} }, output: { schema: { type: 'object' }, render: () => [] },
+          async execute(_args, exec) {
+            nested = await tools.execute({ agent, name: definition.name, callId: 'nested-digest', parent: exec.token,
+              arguments: { command: 'produce-json', description: 'Produce a large JSON result' }, signal: exec.signal })
+            return {}
+          },
+        })
+      } })
+      const result = await tools.execute({ agent, name: definition.name, callId: 'native-digest',
+        arguments: { command: 'produce-json', description: 'Produce a large JSON result' }, signal: new AbortController().signal })
+      assert.equal(result.isError, false)
+      assert.deepEqual(result.value, original)
+      assert.match(result.content[0].text, /JSON summary/)
+      const transport = await tools.execute({ agent, name: 'digest_transport_fixture', callId: 'outer-digest', arguments: {}, signal: new AbortController().signal })
+      assert.equal(transport.isError, false); assert.equal(nested.isError, false)
+      assert.deepEqual(nested.value, original)
+      assert.equal(nested.content[0].text, renderHostBash(original))
+      for (const [decision, expected] of [
+        [{ kind: 'accept', content: [{ type: 'text', text: 'policy redacted' }] }, 'policy redacted'],
+        [{ kind: 'accept', value: { ...original, stdout: { text: 'policy replaced value', truncated: false } } }, 'policy replaced value'],
+        [{ kind: 'block', feedback: [{ type: 'text', text: 'policy blocked' }] }, 'policy blocked'],
+      ]) {
+        const stop = ctx.on('tools/post-execute', async () => decision)
+        try {
+          const result = await tools.execute({ agent, name: definition.name, callId: `policy-${expected}`,
+            arguments: { command: 'produce-json', description: 'Produce a large JSON result' }, signal: new AbortController().signal })
+          assert.ok(result.content[0].text.includes(expected))
+          assert.doesNotMatch(result.content[0].text, /JSON summary/)
+          assert.equal(result.isError, decision.kind === 'block')
+        } finally { stop() }
+      }
+    } finally { await shutdown(ctx) }
+  })
+})
+
+await test('pre-projection replacements cannot reuse a prepared summary from different content or value', async () => {
+  await withTempDir('json-digest-policy', async dir => {
+    const file = path.join(dir, 'stdout.log'); await fs.writeFile(file, raw)
+    for (const mutate of [result => ({ ...result, content: [{ type: 'text', text: 'redacted' }] }),
+      result => ({ ...result, value: { ...result.value, stdout: { text: 'changed', truncated: false } } })]) {
+      const original = value(file), exec = call(), projection = createJsonDigestProjection()
+      await projection.prepare(original, exec)
+      assert.equal(projection.projectContent(exec, mutate(outcome(original))), undefined)
+    }
+  })
+})
+
+report('shells-json-digest')
diff --git a/test/shells-presentation.test.mjs b/test/shells-presentation.test.mjs
new file mode 100644
index 00000000..a6f7ef09
--- /dev/null
+++ b/test/shells-presentation.test.mjs
@@ -0,0 +1,58 @@
+import { bashToolDefinition } from '../lib/shells.js'
+import { hostBashDefinition } from '../lib/shells/host-tool.js'
+import { hostForeground, hostFailure } from '../lib/shells/host-contract.js'
+import { assert, report, test } from './lib/harness.mjs'
+
+const base = bashToolDefinition({ file: process.execPath, source: 'config' })
+const definition = hostBashDefinition({}, base, () => { throw Error('presentation must not execute') }, () => undefined)
+const args = { command: 'printf first\nprintf second', description: 'Print two separate output lines', workdir: 'project' }
+const present = value => definition.presentResult(args, JSON.parse(JSON.stringify({
+  content: definition.output.render(args, value), isError: false,
+  meta: definition.output.presentationMeta(args, value),
+})))
+
+await test('published shell definition presents multiline commands and session-relative cwd', () => {
+  assert.deepEqual(definition.presentCall(args), { card: 'terminal', title: args.command, description: args.description, cwd: 'project' })
+  assert.deepEqual(definition.presentCall({ script_path: 'two words.sh' }), { card: 'terminal', title: 'two words.sh' })
+  assert.equal(Object.hasOwn(definition.presentCall({ command: 'pwd', workdir: ' ' }), 'cwd'), false)
+  for (const value of [null, [], {}, { command: 3 }, { command: 'x', script_path: 'y' }]) assert.equal(definition.presentCall(value), undefined)
+})
+
+await test('durable shell cards preserve captured output and a genuine zero exit', () => {
+  const value = hostForeground({ exitCode: 0, timeoutMs: 10, timedOut: false,
+    stdout: { text: 'first\nsecond', truncated: false }, stderr: { text: 'notice', truncated: false } })
+  const view = present(value)
+  assert.equal(view.card, 'terminal'); assert.equal(view.exitCode, 0)
+  assert.equal(view.output, definition.output.render(args, value)[0].text)
+  assert.match(view.output, /\[stderr\]\nnotice/)
+  assert.deepEqual(definition.output.presentationMeta(args, value), { opsShell: { exitCode: 0 } })
+})
+
+await test('signals and infrastructure failures never invent a successful exit', () => {
+  const killed = hostForeground({ signal: 'SIGTERM', cancelled: true, timeoutMs: 10, timedOut: false,
+    stdout: { text: 'tail', truncated: true, spillPath: '/private/full.log' }, stderr: { text: '', truncated: false } })
+  const view = present(killed)
+  assert.equal(view.signal, 'SIGTERM'); assert.equal(Object.hasOwn(view, 'exitCode'), false)
+  assert.match(view.output, /full output: \/private\/full.log/)
+  const failed = present(hostFailure('EXECUTOR_UNAVAILABLE: unavailable'))
+  assert.equal(Object.hasOwn(failed, 'exitCode'), false)
+  assert.match(failed.output, /EXECUTOR_UNAVAILABLE/)
+})
+
+await test('background and promoted cards retain job guidance without claiming completion', () => {
+  for (const value of [{ kind: 'background', jobId: 'job-1', label: 'Build project' },
+    { kind: 'promoted', jobId: 'job-1', label: 'Build project', timeoutMs: 10, output: 'still working' }]) {
+    const view = present(value)
+    assert.match(view.output, /job-1/)
+    assert.equal(Object.hasOwn(view, 'exitCode'), false)
+    assert.equal(Object.hasOwn(view, 'signal'), false)
+    assert.deepEqual(definition.output.presentationMeta(args, value), {})
+  }
+})
+
+await test('replay without metadata never infers process status from output', () => {
+  const view = definition.presentResult({}, { content: [{ type: 'text', text: '[exit code: 0]' }], isError: true })
+  assert.deepEqual(view, { card: 'terminal', output: '[exit code: 0]' })
+})
+
+report('shells-presentation')
diff --git a/test/standard-mode-costs.test.mjs b/test/standard-mode-costs.test.mjs
new file mode 100644
index 00000000..fa733bc6
--- /dev/null
+++ b/test/standard-mode-costs.test.mjs
@@ -0,0 +1,128 @@
+/**
+ * The name-only read this branch introduces: `visibleNames` must not deep-copy schemas.
+ *
+ * `visibleTools` and the host-shell denial gate used `schemas()`, which deep-copies every
+ * visible definition's parameters — on the published host 34.2 ms for 258 tools at the
+ * issue's own surface shape — just to keep the names. The view reports the same names,
+ * in the same order, for ~0.043 ms. These checks pin the shape rather than a wall-clock
+ * number, so they hold on any host.
+ *
+ * The discovery pre-step probe is deliberately NOT memoized and stays out of this file: it
+ * is the path by which a presentation that flips without the names moving corrects itself
+ * (see `test/ptc-sdk.test.mjs`, the same-layer handoff case), so its assembly per step is
+ * load-bearing, not overhead.
+ */
+import { createScope } from '@deepseek-ai/dsh-scope'
+import { bootHost, shutdown } from './lib/host.mjs'
+import { assert, test, report, waitFor } from './lib/harness.mjs'
+import { applyComponent } from '../lib/index.js'
+import { visibleNames } from '../lib/surface.js'
+
+/** A registered tool whose schema is big enough that a deep copy is measurable. */
+const tool = name => ({
+  name,
+  description: `visible names fixture ${name}`,
+  parameters: {
+    type: 'object',
+    properties: Object.fromEntries(Array.from({ length: 12 }, (_, index) => [`field_${index}`, {
+      type: 'object',
+      description: `nested option group ${index} of ${name}, long enough that a deep copy shows up`,
+      properties: { mode: { type: 'string', enum: ['fast', 'safe', 'strict'] } }
+    }]))
+  },
+  output: { schema: { type: 'object', properties: { ok: { type: 'boolean' } } }, render: () => [] },
+  execute: async () => ({ content: 'ok' })
+})
+
+await test('a name-only read does not project schemas', () => withRegistry(async ({ tools, key, calls }) => {
+  calls.count = 0
+  const names = visibleNames(tools, key)
+  assert.equal(calls.count, 0, 'reading visible names must not deep-copy schemas; the tooling sections pay this per assembly')
+  assert.deepEqual(names, ['alpha', 'beta'], 'the names come back in view order')
+}))
+
+await test('a name-only read matches the schemas() projection for every scope shape', () => withRegistry(async ({ tools, key }) => {
+  for (const scope of [key, undefined]) {
+    const projected = tools.schemas(scope).map(schema => schema.name)
+    assert.deepEqual(visibleNames(tools, scope), projected, `names must match the projection for ${scope === undefined ? 'the global layer' : 'a scoped key'}`)
+  }
+}))
+
+await test('a host without a reachable view still names the tools', () => withRegistry(async ({ tools, key }) => {
+  // The fallback is the correctness branch: a host whose view this module cannot reach
+  // must still produce the same names, paying the copy rather than returning nothing.
+  const projected = tools.schemas(key).map(schema => schema.name)
+  const noView = { schemas: scope => tools.schemas(scope) }
+  assert.deepEqual(visibleNames(noView, key), projected, 'the fallback names exactly what schemas() projects')
+}))
+
+await test('a tooling section renders from view names, not a projection', () => withRegistry(async ({ ctx, tools, key }) => {
+  // The shell/file tooling sections run on every assembly. Reading them through the
+  // projection deep-copies every schema to keep a handful of owned names; a revert to
+  // `schemas()` makes `projected` non-zero here.
+  let projected = 0
+  const original = tools.schemas
+  tools.schemas = function (...args) { ++projected; return original.apply(this, args) }
+  const dispose = ctx.systemPrompt.section({
+    name: 'tooling:shell', order: 100, interpolate: false,
+    text: context => visibleNames(tools, context.scope).filter(name => name === 'alpha').join(', ') || '(none)'
+  })
+  try {
+    const first = await ctx.systemPrompt.assemble({ scope: key })
+    const second = await ctx.systemPrompt.assemble({ scope: key })
+    assert.equal(projected, 0, 'a name-only section must not project schemas, at any assembly')
+    assert.ok(first.sections.some(each => each.name === 'tooling:shell' && each.text.includes('alpha')), 'the section names the owned tool')
+    assert.ok(second.sections.some(each => each.name === 'tooling:shell' && each.text.includes('alpha')), 'and keeps naming it on the next assembly')
+  } finally { dispose(); tools.schemas = original }
+}))
+
+
+await test('the host-shell denial gate restricts without projecting schemas', () => withRegistry(async ({ ctx }) => {
+  // `installHostShellDenial` names the host's shell tools to deny them for each agent.
+  // It shares the name-only read, so it must not deep-copy either: a revert to `schemas()`
+  // makes `projected` non-zero here while the restriction itself keeps working either way.
+  ctx.get('tools').register({
+    name: 'bash', description: 'foreign host shell fixture', parameters: { type: 'object', properties: {} },
+    output: { schema: { type: 'object' }, render: () => [] }, execute: async () => ({ content: 'ok' }),
+  })
+  let projected = 0
+  const tools = ctx.get('tools')
+  const original = tools.schemas
+  tools.schemas = function (...args) { ++projected; return original.apply(this, args) }
+  let fiber
+  try {
+    fiber = await applyComponent(ctx, { shellPolicy: 'deny-host-shell', publishBashTool: false }, 'shell')
+    const target = { id: 'denied-' + Math.random(), session: { id: 'denied', mode: 'danger-full-access', header: { cwd: process.cwd() } } }
+    await ctx.plugin({ inject: ['tools'], apply(inner) { target.ctx = createScope(inner, target).ctx } })
+    await ctx.serial('agent/created', { agent: target, source: 'startup' })
+    // The wait itself must read through the view: `scopedToolNames` projects, and the
+    // wait's own projection would be indistinguishable from the gate's.
+    await waitFor(() => !visibleNames(tools, target).includes('bash'), { timeoutMs: 5000, what: 'bash denied' })
+    assert.equal(projected, 0, 'denying the host shell must not project schemas; the gate runs per agent')
+    assert.ok(original.call(tools).map(schema => schema.name).includes('bash'), 'the host layer keeps the tool; only the scope is denied')
+  } finally {
+    tools.schemas = original
+    await fiber?.dispose()
+  }
+}))
+
+/**
+ * Boot a host with the fixture tools registered and one scoped key.
+ * @param {Function} body - the check to run against that host.
+ */
+async function withRegistry (body) {
+  const { ctx } = await bootHost()
+  try {
+    const tools = ctx.get('tools')
+    tools.register(tool('alpha'))
+    tools.register(tool('beta'))
+    const key = { id: 'names-' + Math.random() }
+    createScope(ctx, key)
+    const original = tools.schemas
+    const calls = { count: 0 }
+    tools.schemas = function (...args) { ++calls.count; return original.apply(this, args) }
+    try { await body({ ctx, tools, key, calls }) } finally { tools.schemas = original }
+  } finally { await shutdown(ctx) }
+}
+
+report('standard-mode-costs')
diff --git a/test/tool-changes.test.mjs b/test/tool-changes.test.mjs
new file mode 100644
index 00000000..fd9bb7ed
--- /dev/null
+++ b/test/tool-changes.test.mjs
@@ -0,0 +1,18 @@
+import { assert, test, report } from './lib/harness.mjs'
+import { toolChangeScopes, withToolChange } from '../lib/tool-changes.js'
+await test('scope attribution is synchronous, nested global changes stay conservative, and throws restore the outer scope', () => {
+  const a={}, b={}
+  assert.equal(toolChangeScopes(),undefined)
+  withToolChange([a],()=>{
+    assert.deepEqual(toolChangeScopes(),[a])
+    withToolChange([b],()=>assert.deepEqual(toolChangeScopes(),[a,b]))
+    withToolChange([],()=>{
+      assert.deepEqual(toolChangeScopes(),[])
+      withToolChange([b],()=>assert.deepEqual(toolChangeScopes(),[]))
+    })
+    assert.throws(()=>withToolChange([b],()=>{throw new Error('cleanup')}),/cleanup/)
+    assert.deepEqual(toolChangeScopes(),[a])
+  })
+  assert.equal(toolChangeScopes(),undefined)
+})
+report('tool-changes')