[zts212653]

Daily public export on sync/daily, ready under the maintainer's standing green-CI merge authorization.

Candidate c31ec3c8ae2da6dce41cf2c43772d6dddf58b3e3; fixed source 74a2c2e89c743a904063caa7491fef9584d852c3; public base 5941b402ed273eb9f3e6e1c0d5ee4cf3839c71dd. Published and tested merge trees both equal c45d4aa2a7ee3aea43908b162f9148bc50818099.

Native privacy, secret, intake, export-contract and preservation checks passed: 867 pass, zero block/override, 173 exact decisions (162 preserved public files, 5 reviewed deletions, 6 source media ports). All16,130 published entries and65 canonical transformations were verified. The credential-file and HTTP/Host checks, obsolete test retirement, and desktop installation repair match independently reviewed source. The desktop keeps public version 1.14.0 while packaging its new helper. Of the previous decisions, 172 remain unchanged; the old desktop whole-file preservation is replaced by its canonical projection and the obsolete test gets an explicit deletion decision. The previous candidate's Linux failure remains historical evidence.

CI, Windows Smoke, macOS Preview Lifecycle all succeeded on this exact candidate, with4 required checks passed. Nine original API archives match GitHub digests and the latest producer jobs; all2,901 planned files in seven lanes are covered. Actual Lint confirms 201 MCP tools, zero additions/removals, a current baseline matching the canonical registry, and the current startup-isolation checks. The reported description change versus the protected public base is +1488 characters / +273 cl100k tokens. File-level API coverage is not a claim of zero skipped subtests.

Source behavior and preservation choices received independent review, bridged to this output by exact landing and canonical transformation proofs. No live data/runtime operation or tagged release is part of this sync. Local source_full and temporary-public full suites were skipped under daily CI policy.

Scope and validation

• Behavior: the complete frozen public export is covered by its current three-platform CI and the full API test plan; migration notes describe the actual affected surfaces.
• Data: 162 exact public preservations, five reviewed deletions and six source media ports are individually verified. No live user-state migration is part of this sync.
• Security: native privacy, secret, intake and contract gates passed; no override or relaxed production assertion is used.
• Contract: independent source reviews are bridged to this candidate by exact landing and full canonical projection proofs.
• Merge authority: this owned daily sync follows the maintainer's standing authorization after complete current CI and artifact verification. Tagged release and deployment remain separate actions.

Migration notes

This sync advances the complete published source from public 5941b402 to the fixed e4ff96f1 product input, including the separately reviewed member-authority, export-closure and desktop installation-write corrections. Install matching API, shared, MCP and Web builds together. These notes describe the candidate's behavior; hosted checks and the actual published tree still determine acceptance. Publication does not activate a running installation or constitute a tagged release.

The owner can now choose whether unlabeled process notes appear in the whole reply or in its execution record. Whole replies remain the default. This setting changes the view, retains the original text and is saved per owner. The authenticated configuration endpoint rejects a changed owner instead of silently saving for somebody else; unreadable or unconfirmed preferences remain explicit failures. Refresh the Web client after upgrading so its reply rendering and API preference contract agree.

Message search reconnects declared decisions, original context and quotations to the existing reader and composer. Missing decider/date information remains unknown. The recent-work directory is an opt-in view on the existing thread-list callback, with a bounded cursor and activity cutoff. A cursor requires that view; directory visibility does not transfer task ownership. Optional thread-roadmap bindings require a readable source message, a visible existing project/file and the expected revision. Conflicting edits are rejected; revocation preserves the binding's tombstone. Existing callers can continue using ordinary thread listing and metadata without these options.

Works and file cards retain immediate file operations while the verified owner opens. Images join videos in the existing local file-info, reveal and open adapters. The direct local Human, registered-root, symlink, media-type, regular-file and action-time checks remain. The old video-only source module and its test are replaced by the local-media versions; this is not removal of those HTTP operations. Documents, scripts, applications, disguised files and directories remain refused by that adapter. Matching Web/API builds are needed for opening-preview actions and focus handoff.

Workspace HTML preview adds an authenticated prepare/revoke flow and directory-scoped asset reads. Preview assets remain sandboxed, without an authenticated page principal or credentialed CORS. File-to-Work resolution requires the existing content identity and source/version scope; it does not grant a new filesystem root. Close and reopen a preview after upgrading rather than relying on a stale preview handle.

Managed MCP launch and provider handling now carry invocation-bound credentials and the correct deployment, capability and workspace roots across Claude, Codex and ACP carriers. Member tool families use the current runtime member registry and the configured ACP/capability policy, including disabled/unknown-member denial. A stale separate catalogue cannot grant tools or reject a real configured member. Shared transport and its supported stdio rollback keep the same invocation authority; iCode retains its HTTP carrier. Upgrade the API/MCP/carrier pieces together and start a fresh invocation when changing transport. Do not reuse credentials from an earlier deployment or turn. Preview capability reads do not gain implicit write authority.

The API startup watchlist includes current MCP wiring, worktree notices and optional CPU diagnostics. Worktree notices report lifecycle facts; they are not a cleanup authorization. CPU capture is opt-in through the existing CAT_CAFE_CPU_CAPTURE_ONCE=1 source setting and is started after the HTTP listener is available. Current CPU modules and consumers live under infrastructure/telemetry/cpu; the two old top-level module paths are retired. The reviewed lease, privacy and default-off behavior is preserved. This sync does not enable diagnostics, start a debugger listener, or require clearing user data. Sidebar phase timing and bounded provider diagnostics improve observation without changing ownership or making a failure successful. The broadcast-delivery watchlist implementation is unchanged in this cut.

The public environment template, lockfile, existing public CI workflows and other explicitly retained community content remain at the current public bytes. The public F290/F317 specifications and ownership index are retained; private installation reports, pending SSH acceptance and runtime recovery records are not new public support promises. Portable worktree commands/tests and the inert, explicitly activated anchor hook receive their checked export dependencies; the private cycle publisher stays out of the public package scripts.

Desktop installation writes are kept in the selected instance state and build staging locations. The packaged Web server uses its instance-specific cache location; project provider directories are created within the selected project mirror. The packaging inputs include the new provider-directory helper, and both desktop build scripts apply the checked Web staging profile. Existing installed-layout validation remains required on Windows and macOS. The export keeps the existing public desktop version1.14.0 while adding that helper; it does not bump a release version, install a desktop package or prove the four distribution artifacts accepted.

The site adds the already-landed bilingual “One Night, Woven” and “Pick a Few, Take Them Anywhere” demos, with their posters and existing site/catalogue references. Their six binary files match the source publication commits. The latter demonstrates selection, export and forwarding; no new permission is granted by the demo. Plugin settings also carry the current status and narrow-screen presentation fixes. Source publication does not prove a plugin's live stability or a complete companion/Collective journey.

No manual data migration, user-state deletion, credential reset or runtime activation is performed by this sync. Follow the normal build/deployment procedure for the complete matching candidate. The prospective detector footprint is 27 route-file/watchlist changes; it counts files, not 27 newly introduced endpoints. The final native behavior report must be checked against these notes before the candidate is accepted.

Migration-note addendum — developer documentation: the source-owned docs/architecture/ownership/cells/worktree-storage.md ships with the portable worktree implementation in this sync. The retained public ownership index does not yet list this cell. Its discussion of daily diagnostic slots and some anchors describe internal automation whose daily-cycle-* scripts and operator guide are not included in the public package. The cell is architectural context, not an additional available public command or a grant to clean up worktrees. Existing public package scripts remain the authority for runnable commands.

The detector rerun against the final public Git tree reports27 route-file/watchlist changes and an unchanged public environment template. Its earlier native pre-restoration report is retained separately.

[小星星·砚砚/gpt-6-astra🐾]

[zts212653]

Merge evidence verified for c31ec3c8ae2da6dce41cf2c43772d6dddf58b3e3 (tree c45d4aa2a7ee3aea43908b162f9148bc50818099).

Current Linux, Windows and macOS workflows succeeded; all four required checks passed. Nine original API archives match GitHub digests and the latest producer jobs, covering all 2,901 planned files across seven lanes. Actual Lint passed MCP governance and the 61 + 9 + 1 startup checks; file coverage is not a zero-skipped-subtest claim.

Six independent source approvals remain applicable through exact source landing, preservation and canonical projection evidence. The final source is 74a2c2e89c743a904063caa7491fef9584d852c3. All 16,130 published mode/blob entries and 173 decisions are verified, including the desktop public-version projection and 65 postprocessing changes. The previous failed candidate remains preserved as historical evidence.

E1–E5: current candidate/base/tested merge tree match; source review and accepted scope continuity hold; no unresolved relevant findings; actual required checks and complete artifacts passed. Review source: independent local peers. Head changes since review are the verified canonical public export and subsequent PR metadata only. Next gate owner: the daily maintainer. This is an owned sync, not a third-party change or tagged release.

[小星星·砚砚/gpt-6-astra🐾]

[zts212653]

Post-merge provenance correction: #1726 is merged as a8a8ae9e465f66815a41e8d9e0bcd39673d98cd4, and its complete tree c45d4aa2a7ee3aea43908b162f9148bc50818099 is identical to the accepted candidate and tested merge tree.

GitHub's default squash message reused an old commit message from the long-lived sync branch, including historical source/base trailers. Those trailers do not describe this publication. The merged .sync-provenance.json, final PR body and native receipt agree on the actual source 74a2c2e89c743a904063caa7491fef9584d852c3 and public base 5941b402ed273eb9f3e6e1c0d5ee4cf3839c71dd. The accepted candidate was c31ec3c8ae2da6dce41cf2c43772d6dddf58b3e3.

This corrects the record; the published files match the validated tree.

[小星星·砚砚/gpt-6-astra🐾]