GEODE v1.0.30

Infrastructure

• Partition the complete pytest collection into four file-preserving CI shards,
  retaining xdist loadfile scheduling and the existing offline test selection.
  The required Test check verifies every shard's successful result and disjoint
  collection coverage before enforcing the unchanged 75% combined branch/line
  coverage threshold. Documentation-only skips and architecture, Harbor, and
  installed-package checks remain mandatory under their existing conditions.
• Add a read-only check_repo_hygiene.py assert-write-workspace entry check
  that requires an owned topic worktree before independent writes, and treat an
  empty .owner as an orphan worktree. Preflight keeps each failing gate's full
  output in a log file. Contributor guidance adds a delegation return contract
  and a bounded CI-recovery budget with hand-off on exhaustion.

Changed

• Add code-change conduct to the shared agentic prompt and contributor entry
  point: async ownership, backend authority, preserved errors and redacted
  diagnostics, with observed cancellation and terminal persistence boundaries.

• Consolidate operator API-key entry in the auth-file owner with hidden terminal
  prompts, preserving externally supplied environment credentials. Remove
  duplicate environment/settings writes, the retired set_api_key and
  manage_auth model tools, and the unused global profile-tracking path.
  manage_login accepts nonsecret inspection and selection only.

• Treat heuristic task-preflight evidence as advisory suggestions in nested
  schema v2. Remove the session-wide row-presence check that mislabeled routing
  guesses as evidence requirements and could reuse another turn's records.
  Preserve final errors, observation history, and Verify/PostVerify/Stop policy.

• Resolve new-session credential policy and per-model plan accounts through one
  routing owner. Preserve each live session's concrete API/Subscription source,
  pass model-specific credentials and endpoints to SDK calls, and reject
  conflicting policy or unavailable explicit plans without billing fallback.
  Validate /login source before changing defaults and apply connected-session
  changes only after admission. Runtime source selection applies matching model
  roles after the complete tool batch while retaining effort and saved defaults.
  Share TOML parsing between configuration and
  CLI diagnostics, including explicit empty role values.

• Preserve the static prompt boundary on supported OpenAI Platform requests
  using developer content breakpoints while retaining implicit history caching.
  Forward supported upstream cache markers through OpenRouter and retain
  logical-session affinity across SDK connections using a hashed session ID.
  Preserve Codex, legacy OpenAI and automatic Z.AI cache contracts.

• Bound OpenAI Python to SDK 2 (>=2.45,<3) and Anthropic Python to SDK 0
  (>=0.116,<1) while preserving the verified transport and audit contracts.
  Share configured HTTP transport construction
  across OpenAI, GLM, and Codex while preserving Codex's disabled connection
  reuse and application-owned retries; record both SDK major-version migrations.

• Refresh Claude Messages contracts for Fable 5.1, Opus 5.5/5, and Sonnet 5
  through typed model records and one create/stream request builder. Preserve
  signed thinking, structured output, tool calls, and cache usage in streaming;
  retain hosted search usage. Validate output/effort/forced-tool limits, including
  auxiliary text completions, and update hosted web tool versions.
  Select the computer protocol from the typed request model and guard unknown
  generations until their native executor is supported.

• Align model selection, login routing and effort controls with the shared
  provider contracts checked on September 24. Ship Claude Opus 5.5, GPT-6 Sol
  and GLM-5.3 defaults while preserving explicit configuration; retain saved
  GLM Coding Plan profiles without inventing local call quotas for token credits.
  Preserve saved effort when reopening the picker and use each provider's own
  source for configured-model availability. Use GLM's native reasoning builder
  when the existing effort probe records its outgoing control.
  Update bilingual provider and authentication guidance with source-specific
  availability, current model specifications and pricing evidence.

• Run Reflection after each tool-result round and once before final delivery.
  Final semantic verification replaces the mechanical-only default; legacy
  cadence controls and off/rule_based/reflexion verifier settings are
  deprecated compatibility inputs. Privacy, deadline and cost guards remain;
  an unavailable judgment never becomes a verification pass. This increases
  judgment calls for configurations that previously skipped them. Native Harbor
  receipts distinguish the requested verifier label from its effective policy.
  Keep the model-free performance probe on that lifecycle and run the same
  performance gate during local preflight without relaxing its baseline.

Added

• Add the Score-S selection harness for frozen best-of pools. Every selector
  runs once per pool in both presentation orders at the existing judge
  boundary; dispatch records carry no grades, so sealed pools score only after
  unsealing through the alias map. Exact ties use the preregistered hash rule,
  and an invalid order or judge_error fallback counts as a wrong selection.
  Reports use oracle-best selection, regret, pool-random@1, oracle-coverage@4,
  selected success and gap closed (not-measurable at a zero denominator), never
  an IID pass@k label. Jev Score admission takes explicit, recorded sum and
  expectation tolerances, and selection cost keeps unknown usage null. Pools can
  dispatch up to four at a time with records byte-identical to sequential runs;
  each call has the panel timeout, and a call that times out or ends without a
  response is replaced once or stops the unit as a transport failure, while a
  response that breaks the contract stays a wrong answer. The Score expectation deviation behind the
  frozen tolerance is exact decimal, so an exact 0.03 or 0.04 no longer freezes
  one 0.01 step higher.
• Add Noul 2×2 end-to-end cells on the single existing candidate intervention:
  a runtime rule oracle recomputes both conditions from the judged state,
  planned gold must match each cell, labels stay outside payloads, and trial
  scoring counts unaccepted judgments as wrong.
• Add an opt-in live cascade arm C for the Choice final verdict: Jev decides
  when its admitted contract V1 q reaches the frozen τ, otherwise the same
  state escalates once to Astra as a separately observed call. Arm C needs an
  explicit engine and a τ on the preregistered grid, and the Harbor checker
  binds every judge call to its route and escalation.
• Add a host-scoped, hash-chained Jev cost ledger with the default $1 program cap, a
  $0.90 start limit and a sticky $0.95 stop. Missing usage is reserved, never
  zero. Explicit operator amendments can raise limits with a retained approval
  reference and digest while preserving the header, consumption, reservations,
  and sticky stops. A panel spend guard connects it to the verdict panel runner.
• Add paired concurrent execution columns to the handoff tables: slot, launch
  and agent-start skew, pair synchronization, concurrent trials and always
  unknown shared-account usage come from the private trial receipt, and
  overlapping calls from call-ledger intervals. Only same-slot synchronized
  pairs enter intra-pair latency comparison; success analysis keeps every pair.
• Add X1 binary acceptance scoring for external Choice verdicts: an accepted
  supported verdict accepts, another accepted verdict rejects, and an invalid
  output is wrong and never an acceptance against the human majority label. The
  analysis-only report gives the paired accuracy delta with cluster intervals,
  false acceptance and rejection, balanced accuracy, P(supported) AUROC, Jev's
  selective risk at the frozen τ on the receipt q, and McNemar b and c without a
  p-value, bound to analysis rows. Retained Choice-only attempts feed it through a
  command that records the aggregate, and a descriptive block adds calibration
  (raw and at the frozen temperature), error detection, risk–coverage, the frozen-τ
  cascade, strata and reference-verifier agreement.
• Connect U2s stability attempts to the stability metrics: selected panel
  judgments are grouped by engine, primitive and state across the four frozen
  variants, rejected or invalid judgments stay empty decisions, and a missing
  variant leaves the unit not measurable instead of being filled. A recorded
  aggregate binds jev_choice_pair_consistency, flip rates and, after
  unsealing, correct-pair consistency to analysis rows.
• Let the verdict panel runner run Choice alone (U3, X1a, X1) on authored or
  external splits, and add U3's paired latency mode: each state's Astra and Jev
  calls launch together with one pair in flight, receipts keep monotonic launch
  and completion times, and a launch skew above one second stops the unit. The
  latency report binds the within-pair median Jev − Astra delta with its
  manifest-seeded cluster interval and preregistered decision, and counts the
  excluded pairs by reason. Existing panel units keep their bytes.
• Add the intent-panel harness (U0c-i, U6a) to the verdict panel runner: a
  Choice-only unit with judgment="intent" sends each family of inbox items to
  the analyze_request helper with the E2E helper's own payload, questions,
  Astra request and admission; the tool's request and admission steps become
  shared methods with unchanged bytes. The intent report scores joint intent and
  target accuracy like the E2E intent runner, counts a rejected helper output as
  wrong for its whole family, and binds intent_joint_accuracy_delta with a
  family-cluster interval and the non-inferiority decision, the admission ratio
  and LABEL-RULES strata. Existing panel units keep their bytes.
• Add auxiliary repetition reliability to the judgment metrics: per-task
  combinatorial pass@n and pass^n with equal task weights, never a pooled rate.
  A frozen task × repetition plan is rejected with enumerated reasons (N_i < n,
  duplicate or unplanned repetitions, missing slots, contract mismatch across
  source revision, policy, reset, input, task and verifier digests, unknown
  outcomes). Repair rounds, question variants and candidates are not
  repetitions, and replacements keep their slot. The handoff table exporter
  writes task × arm rows and an arm × n summary with provenance for auxiliary
  analysis metrics under the unchanged schema, and the coverage check gates
  the set before aggregation. U2s pair consistency stays separate from flips.
• Add offline Harbor handoff evidence tools for audit and publication. Derived
  call, trial, pair and summary tables keep invalid cells, unknown usage and
  null latency, and keep the Astra subscription API-equivalent estimate, Jev
  tariff estimate and actual billed USD separate; billed USD stays null until a
  provider export is reconciled by request identity. A denominator coverage
  check rejects silently deselected planned cells, a reviewed projection stages
  digest trajectories behind the existing release gate, a pattern scan covers
  the other public report files, and an exact-merge read-back writes a receipt
  for artifact PRs. No tool calls a model.
• Extend System One admission to Score and Noul while preserving Choice-only
  consumers and native usage for completed invalid answers. Add opt-in matched
  candidate scoring and independent-condition verification diagnostics, with
  fixed action projections and Harbor primitive/receipt checks. Production
  candidate selection remains unchanged; new live comparisons require a frozen run.
• Return label probabilities from both matched-verdict engines (contract V1).
  The Astra arm's structured output carries the verdict and a probability for
  every label, or each Noul condition's probability of being true. One shared
  validator admits exact labels, finite probabilities, a 0.025 Choice-sum
  tolerance and an argmax verdict, and records the historical 1e-5 classification
  beside it. Criteria-order and paraphrase probes keep keys, labels and code
  decisions; the Harbor checker recomputes every V1 receipt field. Runtime Jev
  parsing keeps its strict tolerance.
• Add an authored verdict-panel cluster schema and builder. A frozen rule oracle
  recomputes each inbox state's contradiction and missing-evidence gold from its
  structured answer and observed lookups, rejects shapes outside the taxonomy,
  and checks the two-factor quad design. Rendering reuses the runtime inbox
  contract with opaque tool-call IDs. The builder writes per-split states,
  controlled Score pools and a split manifest; test gold, graded test pools and
  the alias map stay sealed while public test files use opaque aliases and
  ungraded pools. unseal must reproduce the sealed digest exactly.
• Add pre-registered judgment metrics: accuracy with invalid output as wrong,
  macro-F1, Brier, floored NLL, 10-bin ECE, rank AUROC, risk–coverage, flip rate
  and paired latency with unknown non-positive durations. Source-cluster
  bootstrap intervals use 2,000 manifest-seeded replicates. Selection-only
  temperature and offline cascade τ fitting produce a frozen selection record;
  paired Choice and Noul panel reports apply the non-inferiority decisions.
• Add a judgment-level verdict panel runner that calls the matched verifier
  directly for Choice and Noul on both engines in a Latin-square order, with
  bounded concurrency, pacing, heartbeat and two attempt files. Panel transport
  failures without a response are replaced exactly once, a failed replacement or
  a rate above 2% stops the unit, and quota, harness or route failures stop it.
  Separate frozen invalidation-rule texts keep the E2E no-replacement rule.
• Support Claude Opus 5.5's native computer toolset with serial execution,
  toolset-aware result replay and parameter validation before desktop actions.
  Withhold unsupported members; report native action errors and preserve
  legacy computer protocols. Retain billed usage when rejecting invalid
  responses without replaying actions. Fix horizontal scrolling, native macOS
  drag and wait deadlines; propagate helper-signing failures. Require the
  native helper source and build script in both wheel and source distributions.
• Add optional positive output-token and action-round limits to the one-tool
  Harbor adapter while preserving its defaults. Wrap-up requests respect a
  caller's smaller output ceiling. Auxiliary and subscription request limits
  remain distinct from a whole-runtime spending cap; provider V1 validation
  stays provisional until implementation is complete and its revision is frozen.
• Add credential-gated Jev judgment selection through /model judgment, its
  interactive picker and the existing natural-language switch_model tool.
  Explicit selection uses TypeSafe System One or OpenRouter's compatible
  endpoint without replacing the generative root model or effort. Missing
  credentials retain LLM judgment; configured request failures do not silently
  switch providers. Track Jev distributions separately from cognitive confidence,
  with native usage, provider-reported cost or an input-only tariff estimate.
  Redact TypeSafe and OpenRouter key formats in runtime and publication paths.
• Add an opt-in matched LLM/Jev final-verdict diagnostic using a shared evidence contract,
  criteria and fixed repair feedback while preserving Astra root/reflection/replan
  execution. Retain judgment provenance, malformed-response usage, observed repair
  consumption and input-only Jev tariff estimates separately from actual billing.
  Reconcile provider JSON-string and object tool inputs through the existing
  shared parser without changing retained evidence or accepting malformed inputs.
  Label shared repair text as verification feedback without attributing
  code-owned typed-verdict templates to a model.
• Extend the opt-in decision-handoff diagnostic with complete-candidate inboxes,
  batched interpretation and lookup, item-level verification, and observable
  rejudgment/correction/duplicate-lookup counts. Preserve original cohorts and
  keep recorded consumption separate from actual account charges.
• Add an opt-in, five-task Astra/Jev decision-handoff pilot: source-bound
  classification and extraction return data to the same Astra root AgenticLoop
  for read-only status lookup and independent fixture verification. Retain native
  mechanical verification, structured-decision usage in activity schema v10,
  bounded provider request IDs, HTTP-failure evidence and input-only Jev prices
  in USD and US cents, separate from actual billing. Check source drift around
  each arm; preserve observable decision failures separately from incomplete
  measurements, without token/dollar spending caps or runtime-default changes.
  Reuse the same evaluation runtime for an unassisted root control and an
  explicitly scoped Harbor profile, with independent task verification, retained
  failure exports, mixed-route/served-model checks and separate wrong-helper
  recovery evidence. This does not change runtime defaults or establish adoption.

Removed

• Retire deprecated Codex sign-in model choices (gpt-5.2, gpt-5.3-codex,
  gpt-5.4, and gpt-5.4-mini) from subscription selection and reject explicit
  requests before credential access. Keep valid API routes and historical
  pricing/evaluation records; never substitute another model or billing source.

• Reject confirmed retired models on the official Anthropic API before network
  submission, including hosted-search requests. Preserve active 4.5+ models and
  independently operated provider routes.

• Retire the opt-in IPC fast-chat bypass and its separate prompt/status event.
  GEODE_FAST_CHAT no longer changes routing: short conversational prompts use
  the normal agent loop, preserving conversation, lifecycle and usage/cache
  accounting instead of emitting display-only counters with a zero cost
  placeholder. Normal context, tools and verification may use more time/tokens;
  this does not reconstruct missing historical usage.

Fixed

• Preserve request-correlated IPC failures through terminal rendering, including
  failed stream delivery and incomplete operations. Keep cancellation scoped to
  its request and distinguish transport loss from confirmed completion.
  Deliver malformed-frame errors before closing and disconnect abandoned
  approval streams. Preserve ordinary task lookup keys during credential redaction.
  Error logs retain bounded request/session/category metadata; one shared
  scrubber covers known and labelled credentials across logs and error surfaces.

• Keep async hooks on their owning event loop and dispose of coroutine results
  returned by synchronous hooks after timeout. Preserve primary worker failures
  when checkpoint cleanup also fails; failed scheduled finalization no longer
  invokes a successful completion callback.

• Classify permanent provider HTTP rejections as terminal request failures,
  preserving timeout/conflict/rate-limit retries. Anthropic permission errors no
  longer become billing guidance. Login failures retain their actual tool-error
  category, and native OAuth rejects conflicting profile endpoints before write.

• Preserve session authority across credential and recovery failures. Shared
  key persistence rejects provider/owner conflicts and failed writes without
  publishing a new credential. Readiness and status follow actual routing and
  eligibility. External OAuth caches reflect replacement/deletion and reject
  stale publication; native login serializes attempts per store. Resume rebinds
  final and approval evidence to the selected session. Failed checkpoint status
  writes no longer advance the index, transition event or active pointer.

• Hash only typed provider reasoning ciphertext in candidate-intervention
  evidence, preserving the original response digest and strict secret checks
  on readable text and tool arguments. Export bounded intervention failures
  and reject affected trials without retrying completed provider calls.

• Preserve explicitly configured task instructions in bounded, redacted final
  verification context. Distinguish earlier repair attempts for the same request
  from retained observations that predate it, without forwarding ambient system
  memory or changing the verifier's acceptance rules.

• Preserve intent-helper strict-success rules in offline Harbor table exports
  when a frozen cell repeats its helper route as verification_engine.
  Reject conflicting frozen identities, retain unknown helper evidence and
  runner-result agreement checks, and leave matched-verdict rules unchanged.

• Record canonical session payload capture reductions explicitly so literal
  truncation markers in bounded verification feedback do not invalidate a
  faithful replay. Preserve conservative legacy checks and real clipping,
  redaction, omitted content, and nested reduction evidence.
  Keep content recovery hashes separate from full stored-payload integrity so
  capture metadata preserves exact session and offloaded-result recovery.

• Compare SystemOne probability sums and Score expectations, and matched LLM
  Choice sums, using the exact decimal representations of validated numbers.
  Inclusive tolerance boundaries no longer reject valid decisions due to binary
  rounding; genuine excesses, invalid types and non-finite values still fail
  admission, with the same sum boundary for both matched engines.

• Pass the explicitly configured Harbor handoff time budget through to both
  the root loop and its enclosing deadline, retaining the 180-second default.
  Reject non-finite or non-positive budgets and record the effective budget
  without changing model, effort, round, or verification-repair limits.

• Validate successful Harbor handoff exports against the runtime task termination
  contract instead of the provider end_turn stop reason. Ordinary natural
  completions retain their final-judge and oracle checks; cancelled, failed,
  unknown, mismatched or errored terminations cannot claim task success.

• Classify failed judgment calls with one frozen table in the verdict panel runner
  and the Score-S harness. An Astra connection failure raised by the OpenAI SDK
  and HTTP 408 or 5xx are transport failures replaced once; a 429 without a quota,
  billing, usage or plan code waits its Retry-After (30 s default, 120 s cap)
  outside measured latency and is replaced once; quota (BillingError, 402, a
  limit-coded 429), credential (401, 403) and request (400) failures stop the unit
  instead of being replaced, and Score-S no longer scores quota or harness
  failures as wrong selections.

• Align handoff-table strict success with the preregistered definition. A
  matched final-verdict trial no longer needs lookup conditions: native reward,
  admitted decisive judgments, consumed negative feedback and no false
  completion decide it, while intent helper trials keep the lookup conditions
  and also need observed helper admission without an LLM fallback and observed
  consumption of the helper result; an unobserved helper fact stays null.
  A separate lookup-inclusive column remains, and a runner's differing strict
  value is rejected instead of overwritten.

• Remove first-position bias from best-of selection: every judge failure path
  falls back to the content-addressed candidate, and matched Score ties use the
  preregistered hash of pool and candidate IDs instead of input order.

• Keep invalid or aborted evaluation attempts selected for analysis unless
  exactly one later same-surface attempt replaces them, so an unmeasurable
  primary cannot be hidden by deselection.

• Keep unobserved LLM call latency null instead of storing a 0.0 duration.
  Activity rows move to schema v12; earlier rows may still carry a filled 0.0.

• Stop the sealed verdict-panel test split from exposing author IDs. Public
  tool-call IDs were digests of the original state and call IDs, and the public
  Score pool order was keyed by them, so a public cluster ID let a guessed
  original ID be confirmed. Both now derive from the random public aliases and
  call positions only. Sealed gold, graded pools and the alias map are
  byte-identical; the public test states and pools change, so a held-out
  rebuild is required.

• Pass Anthropic structured-output schemas through the SDK's
  transform_schema before sending output_config.format. The API rejected
  the turn-verification judge schema with HTTP 400 because number
  minimum/maximum is unsupported; those constraints now move into the field
  description and GEODE's judge parser still rejects scores outside 0..1.
  Schemas the SDK cannot express (such as type arrays) fail before the request.

• Preserve the admitted model, source, effort and auxiliary policy through session
  checkpoints and child-worker requests. Validate resume selection before changing
  history, identity or checkpoint status; reject malformed saved records and keep
  the current validated selection for legacy checkpoints. Report the applied
  selection to the thin client without rereading unrelated process defaults.

• Exclude the Anthropic, OpenAI, OpenRouter and Z.AI API keys from Settings
repr() and str(), so failing pytest assertions and formatted settings
  objects no longer print credential values. The fields remain plain strings;
  the Typesafe key was already masked by SecretStr.

• Apply CLI model, effort, and concrete source selections to the owning daemon
  session before saving defaults, including named commands, role pickers, and
  fullscreen mode. Snapshot auxiliary model policy per session, reject
  unsuccessful or unsupported handshakes, and retain the previous selection and
  tool bindings when adoption fails. Project/global defaults no longer implicitly
  update other active sessions. Route runtime model/judgment tools through the
  same admitted record after their complete tool batch; status reports the actual
  session. Remove unused settings-drift code and its constructor flag.

• Apply explicit API-key selections and validated auth-file refreshes to the
  next OpenAI, Anthropic, GLM and OpenRouter PAYG SDK request, including adapters
  retained by existing sessions. Reuse persisted profile pins and ordering;
  preserve subscription routes, endpoint boundaries and environment fallbacks.
  Retire replaced clients until their owning event loop drains them.

• Change auth.toml through one locked transaction that edits the current file,
  writes it atomically and only then updates the running process. A stale thin
  client or worker copy no longer revives removed credentials or restores
  rotated tokens, and rejected or unsaved /login and OAuth changes report
  failure instead of success; /key warns when auth.toml was not updated.
  Loading never creates or rewrites the file: environment API keys stay in
  ~/.geode/.env instead of being copied into auth.toml on first use, and the
  ChatGPT plan tier is recorded with the tokens. Thin clients read and change
  login state through the daemon, keeping only key entry and browser logins
  local, and daemon /login results carry the command outcome; a local login
  asks the daemon to reload independently of local persistence. The dashboard, /login health and manage_login share one
  key-free snapshot that judges each credential against its own provider. Plan
  quotas show declared limits only because calls were never counted;
  manage_login returns interactive logins to the user. New installs with an
  OpenAI key and a Codex CLI login now follow the documented subscription
  default, because no PAYG plan is created implicitly; existing auth.toml plans
  keep their routing.

• Preserve explicit auth profile pins and priority order across auth.toml writes
  and fresh-process routing. Validate reload candidates before publication and
  reconcile deletions only for file-owned entries, retaining managed/environment
  credentials, unchanged health state and borrowed references. Write auth state
  atomically and materialize explicit OpenAI/GLM /key updates consistently.

• Bind effort-probe resume to the verified source revision and provider route,
  retaining older measurements without reusing unidentified results. Include
  configured OpenRouter models and inspect their actual Chat SDK serialization;
  preserve observed reasoning usage separately from missing values.

• Show only supported model effort choices and require an explicit valid choice
  before confirming or staging an incompatible saved effort. Preserve valid
  selections and cancellation without silently replacing settings. Validate
  reflection against the final primary effort before saving staged choices.

• Omit default temperature on known OpenAI reasoning models through OpenRouter,
  including effort=none, and reject unsupported custom sampling before dispatch.
  Preserve selected effort and endpoint routing constraints.

• Preserve selected reasoning effort through model selection, staged role picks
  and supported auxiliary requests. Reject unsupported model/effort combinations
  before dispatch instead of clamping, remapping or silently omitting the value;
  keep stored primary effort when the picker opens on another role.

• Route OpenRouter text summaries through the existing Chat Completions adapter,
  retaining its model/source identity, cache markers, session affinity and usage.
  Preserve supported OpenAI reasoning effort on this relay and forward requested
  JSON schemas with endpoint parameter enforcement instead of silently dropping them.

• Preserve retained task context in turn verification and tool-round reflection.
  Pass the derived compaction summary and earlier marked user corrections through
  one bounded projection, keeping current-request precedence, redaction and
  explicit omissions. Summary claims remain separate from observed tool results.

• Resolve check_status from the current request's readiness instead of a
  captured CLI startup report, preserving explicit audit overrides. Native
  hosts without CLI bootstrap use the shared credential check on each call,
  including API keys, subscription OAuth and profiles. This remains local
  readiness, not a successful provider request or billing check.

• Preserve matched earlier-turn tool evidence when judging resumed requests,
  with historical provenance, privacy protection and ambiguous-ID rejection.
  Share a bounded text budget across observations so complete short scripts
  and validation commands survive instead of always truncating inputs at 300
  characters. Reflection also receives the current approved request while
  retaining the session's initial goal. Judgment criteria, call budgets and
  external verifier authority remain unchanged.

• Use the selected model/provider/source and request output reserve for context
  admission. Treat 200K as soft local maintenance, recover boundedly from actual
  provider overflow, and avoid duplicate pre-request compaction decisions.
  Preserve original user input, causal tool pairs and native replay boundaries;
  reject stale/reentrant replacement and read-only hook rewrites. Exhaustion
  now returns a truthful local notice without another model call or a universal
  session-reset claim.
  Include native Anthropic compaction iterations in completed and streamed
  usage without double-counting top-level totals, retaining cache TTL subsets
  and explicit unknowns.

• Keep daemon /grill execution independent of CLI initialization by moving
  skill prompt rendering and grilling invocation to their runtime skill owners.
  Reuse that renderer for /geo while preserving prompt text, session control
  state, timeline events, and streaming results. Verify dynamically registered
  daemon handlers cannot import CLI modules, including through dependencies.

• Runtime MCP managers now own their connections and event bindings, including
  notification, calendar and gateway consumers. Another runtime's rollback or
  shutdown cannot close them. Restarted managers close each connection generation;
  failed closes retain the resource for retry after attempting sibling cleanup.
  Keep failed connection attempts owned and confirm child exit after forced
  termination before releasing process handles, pipes and scratch directories.

• Anthropic cache lifecycle and TTL accounting. Cache markers preserve signed thinking replay, reserve existing system/tool/message slots within the four-marker limit, and reject invalid TTL ordering before dispatch. Provider-reported one-hour writes reach runtime cost guards, durable activity schema 11, monthly usage and Harbor attempt metadata; missing historical TTL splits remain unknown. Validate the TTL subset before storing usage even when a provider-reported cost bypasses price estimation.

• Reload gateway bindings atomically after file deletion, replacement or edits
  with older modification times. Invalid reloads retain the last valid routing
  and retry after debounce; explicit empty merged rules revoke bindings. Stop
  the owned config watcher and remaining pollers even when one poller fails,
  including interruption or cancellation, then re-raise the original failure.
  Wake polling sleeps on shutdown; retain ownership and reject restart while a
  blocked callback prevents the previous watcher thread from stopping.

• Preserve thin Harbor cognitive-reflection usage by binding its middleware to the existing session event sink.

• Release partially constructed runtime resources before propagating the original
  failure, and retry incomplete shutdown without skipping sibling resources.
  Delegate the daemon's borrowed scheduler teardown to its runtime owner,
  including partial gateway startup failures.
  Restore turn attribution and adapter usage context after success, failure or
  cancellation, and serialize SDK client publication with credential invalidation.

• Close current and retired provider SDK clients on their owning event loop
  after its work settles. Credential rotation preserves in-flight calls;
  shutting down one runtime does not close clients shared with another.
  Preserve original failures and cancellation through bounded cleanup-error
  reporting, including normal CLI, gateway, worker and dreaming loop exits.
  Drain generators and SDK clients even when cancelled background work raises
  a control exception during shutdown, preserving the original failure. Failed
  client closes remain retryable while their owning event loop is still alive.
  Keep active client selection separate from cleanup ownership, including after
  credential invalidation or adapter replacement. Retain IPC worker and socket
  ownership when shutdown times out, reject restart while stopping, and report
  terminal cleanup failures to the daemon shutdown owner.

• Use the shared global config path resolver for Settings, config explanation,
  model-picker reads/writes/confirmation, MCP, gateway reload/watch, seed
  role/voter overrides, and evaluation config migration.
  GEODE_CONFIG_TOML now redirects global picker persistence and migration
  previews/writes while project writes and overlay precedence remain unchanged.

• Keep oversized-page omission notices stable across documentation build
  environments while retaining measured sizes in build logs and complete
  Markdown twins.

• Close runtime-state schema-bootstrap and failed connection candidates
  deterministically, including interrupted setup while preserving the original
  control exception. Release the cached SQLite connection during runtime
  shutdown, and serialize complete reads/writes with cleanup so other active
  hook bundles can reopen it without losing cumulative records. Roll back
  failed runtime-state writes before reusing the connection, discard it if
  rollback fails, and close SessionManager connections when schema initialization
  fails so a later write cannot commit a failed operation's pending changes.
  Close the checkpoint metadata connection even when its index write fails,
  while retaining the existing recoverable checkpoint behavior.

• Bind trajectory runtime-event references to each stored hook schema version
  and include session and physical-step correlation in the cohort digest.
  Preserve mixed-version history and pre-v5 tables without rewriting source
  rows or previously published artifacts.

• Admit native Astra final-verification calls in decision-handoff observations.
  Preserve requested and actual verifier modes separately, and require a complete
  source-reconciled final-verification boundary for explicitly opted-in current
  comparisons. Keep valid semantic failures distinct from success and preserve
  historical exports without filling missing verification evidence.

• Align OpenAI GPT-6 API and subscription model choices, reasoning controls,
  and published API output limits; keep subscription-only request restrictions
  separate and preserve reported token usage from API web search. Normalize
  both Responses streams through one translator with tool calls, reasoning,
  usage and replay metadata; reject transport EOF without a terminal response.

• Share the documented GLM request and streaming contracts across completion
  and text paths, including 5.3 reasoning, tools, and exact output limits.
  Preserve stream and hosted-search usage, and reject incomplete tool streams.
  Separate hybrid thinking capability from graded effort controls; reject GLM
  Coding Plan calls before credentials are read under the supported-tools policy.
  Remove unverified automatic GLM-5V grounding and its orphaned parser/client
  chain while retaining explicit provider/source-aware unavailability.

• Show the requested switch_model role and model hint in CLI/IPC approval
  details, including the primary-role default. Preserve exact values with JSON
  escaping so judgment-only approval can distinguish a root-model change;
  permission requirements and approval decisions remain unchanged.

• Validate the complete settings reload before updating the live singleton.
  Failed environment/TOML field validation, field preparation, or routing
  refresh preserves the previous Settings values; corrected reloads retain
  environment-over-TOML precedence and existing references.

• Refresh the 2026-09-24 OpenAI, Claude and Z.AI model tariffs/context limits; honor explicit Claude cache rates and full-request OpenAI long-context tiers. Keep active source choices separate from historical accounting and unavailable subscription routes.

• Preserve verifier failure instructions separately from the replanner's bounded
  candidate observation. The opt-in LLM/Jev diagnostic can now disclose one frozen
  candidate fault, retain native/effective output provenance, and check actual
  feedback consumption and repair without changing runtime defaults or verdicts.
  Preserve native refusal/incomplete responses and count bounded, accepted
  negative-judgment holds as valid diagnostic failures rather than invalid trials.

• Keep personal-data reflection suppression across conversation turns, resume
  and final judge, bound cognitive reflection by the root deadline, and preserve
  prior hypotheses when an auxiliary response has invalid list members. Count
  completed cognitive-reflection token/cache usage and reported cost in the
  existing tracker, including declined or malformed responses; do not charge
  middleware short-circuits or invent usage for interrupted calls.

• Preserve explicit LLM request purpose through middleware and join reflection
  calls separately in handoff accounting. Count schema-rejected inbox lookups
  and reject helper-error bypasses rather than reporting a later retry as an
  error-free success. Supersede affected historical experiment claims without
  deleting their original evidence. Reject root/reflection call-ID collisions
  and preserve requested verifier wire values for frozen Harbor source bundles.

• Resolve an explicit cross-provider judge model through the matching adapter
  without changing the root route or granting tool access. Persist the round
  of the last valid cognitive confidence update through session restore and
  display; remove an unsupported reflection strict-mode claim while preserving
  typed, finite client-side validation.

• Preserve three-digit source order IDs followed by Korean particles in the
  experimental decision helper's shared candidate parser, without admitting
  embedded ASCII identifiers or expanding the ID format. Keep frozen pre-fix
  measurements distinct from the corrected implementation.

• Reject incomplete full-content handoff trajectories before replay admission,
  while retaining failed exports for diagnosis. Support static offline Harbor
  Docker verification through the native no-network Compose overlay without
  relaxing network policy or modifying the installed Harbor dependency. Reject
  unsupported Harbor versions explicitly; run the native 0.22 contracts in an
  isolated CI environment without changing the audit extra's dependency lock.

• Reconcile exported usage against durable event identities independently of
  reader order, without discarding duplicate attempts or counter differences.

• Assign transported Harbor credentials to the actual container agent UID for
  both subscription and TypeSafe paths, including image-default users. Keep
  owner-only permissions and distinguish bootstrap/credential failures from
  execution without logging secret values.

• Preserve provider refusal/stop semantics through adapter translation and
  source/model-scoped Chat Completions reasoning replay through tool rounds and
  session resume. Separate Anthropic context-editing and compaction admission,
  and validate OpenAI strict output schemas before sending them.

• Include native replay payloads in conservative context-pressure estimates
  without double-counting normalized content or changing signed payloads.
  These estimates remain separate from provider usage and billing.

• Preserve fresh skill bodies through context reduction, append skill metadata
  when a wrapper lacks its slot, escape stored prompt data, and invalidate stale
  model-switch/preflight hints. Unknown surfaces no longer imply CLI access.

• Simplify shared prompt conduct around authorized action, proportional checks,
  and evidence-backed reporting. Candidate judging and reflection separate data
  from instructions; prompt text no longer claims universal cost guards or a
  fixed provider/tool ranking. Existing permissions and budgets remain authoritative.

• Substitute skill-catalog placeholders only inside the authored prompt baseline,
  preserving literal profile and identity data in runtime requests and diagnostic
  dumps. Keep all four selected GEODE identity sections instead of silently
  dropping later runtime constraints at a 40-line boundary.

• Gate Anthropic hosted tool search on documented model support and the actual
  official endpoint; keep cache-marked tools eager. Preserve native discovery
  history through subsequent requests and session persistence without treating
  server-side search as a local tool call. OpenRouter and GLM Chat Completions
  retain their existing eager, permission-filtered tool surface.

• Preserve sub-agent handler failures as failed results and lifecycle events;
  bind callback signatures before invocation so an internal TypeError never
  repeats work. Reject unsupported worker workspace isolation before execution,
  and carry effective audit/persona settings across worker process boundaries.

• Limit automatic LLM learning and dreaming to deliverable turn terminations
  without suppressing learning from verifier-rejected candidates or explicit
  session dreaming. Keep skill-catalog overrides on the shared XML renderer so
  triggers, usage guidance, escaping, and truncation remain consistent.

• Validate GLM Coding Plan subscription/provider/account identity before client
  creation. Escape persisted model settings, atomically update the exact TOML
  budget key across commented section boundaries, and reject retired or
  reader-only scaffold mutation kinds before policy I/O.

• Normalize JSON-string candidate-judge tool inputs across OpenAI and Anthropic
  routes, reject non-finite cognitive confidence during reflection and restore,
  and isolate final-verifier output schemas from task-specific output contracts.

• Require merge-only GitHub repository settings before PR integration and verify
  the resulting commit's exact base/head parents before reporting success.
  Retain the returned merge SHA on uncertain readback; never retry that write.
  Reject standalone main-to-develop sync PRs and require current main ancestry
  in the feature head before integration instead.

• Close static-analysis gaps across production Python, repository scripts,
  automation, and the public site. Enforce explicit production signatures,
  zero-warning site lint, workflow/shell checks, and macOS helper type checks;
  preserve HTTP redirect scheme checks and failed preflight prerequisites rather
  than reporting false success. Keep historical rendered portfolio content,
  dependency directions, coverage, complexity, and performance ratchets intact.

• Keep SQLite trigram capability probes in connection-local TEMP tables instead
  of repeatedly creating and dropping FTS shadow tables in the durable session
  database. Preserve caller transactions, existing tables, connection-specific
  capability checks, and checkpoint/timeline durability.

• Harden the architecture performance ratchet against non-finite, non-positive,
  malformed, or mismatched measurements before aggregation. Run deterministic
  FTS/checker contracts before the unchanged three-sample limits, and retain a
  separate bounded first-turn profile after failure without replacing the
  original failed result or relaxing the baseline.

• Unify automatic, model-switch, manual, and tool-triggered context operations under
  ContextWindowManager. Async downshifts compact on the previous route before switching;
  /compact --prune is the explicit lossful path, and UI/IPC results distinguish changed,
  unchanged, deferred, failed, and unsupported outcomes. Summary retries now apply only to
  confirmed context-overflow failures and preserve adapter/source error classes.

• Preserve token-cheap conversation history instead of pruning at 30 messages;
  keep messages on failed soft compaction and reserve prune fallback for explicit
  hard recovery. Retain all matching tool calls/results across compaction cuts,
  including parallel OpenAI results that are not adjacent to their call.

• Treat public hook handlers returning None as observation-only, without
  fabricated decisions or permission/verification errors. Record interrupted
  handlers as errors while preserving the original cancellation if audit
  delivery also fails.

• Isolate nested runtime-event payloads from observers; preserve cancellation
  through middleware and sub-agent stop auditing. Route model-switch compaction
  through the same public checkpoints as overflow compaction, reject ineffective
  instruction-only PreVerify strengthening, and correlate auxiliary LLM
  middleware with the actual call. Scope learning quotas and cursors to durable
  sessions, and stop turn-end notifications from deleting shared offload files.

• Preserve MCP write_file content exactly instead of inferring newline changes
  from cached reads or local files in the trace layer.

• Retain hook sink-close failures for final observation checks instead of
  reporting complete accounting after a failed flush. Attribute auxiliary
  calls to compaction, learning, dreaming, or context exhaustion while keeping
  legacy purpose values readable and request effort unchanged. Optionally
  reconcile Harbor exports against a closed, digest-checked source database;
  reject missing or altered canonical events even across consistent projections.
  A matched export does not establish physical-dispatch or billing coverage.

• Preserve unknown session-end summaries as null and bind selected Terminal-Bench
  metrics to verifier receipts and the frozen termination rule. Cancellation,
  internal holds, or runtime errors cannot become successful completion merely
  because a native exception is absent; raw verifier rewards remain unchanged.

• Distinguish no-tool ATIF, receipt-only, and prospectively excluded cells in
  Terminal-Bench Replay; missing action evidence no longer displays a zero
  tool-call count or implies the task never ran.

• Serialize shared session SQLite reads through cursor fetch and connection
  close using the existing write lock. Retain background dreaming failures
  that arrive while finished jobs are pruned, so settling cannot hide them.

• Preserve the owning loop's reasoning effort across reflection, candidate
  judging, worker delegation/resumption and wrap-up. Carry inherited effort
  through OpenAI reasoning-capable auxiliary text/search requests and their
  durable observations. Add an opt-in uniform-effort export check; historical
  missing or different efforts are not relabeled or repaired in place.
  Retain explicit worker overrides across idle resume in the existing
  collaboration store; legacy rows continue to inherit the caller's effort.

• Align runtime skill guidance with its admitted registry and authority limits;
  make the copy template loadable and report model-card injection from the
  assembled prompt instead of an unconditional telemetry flag.

• Fail documentation checks when a declared Markdown target or a requested
  HTTP probe dependency is missing, without emitting a false success receipt.

• Separate turn-final LLM verification usage from agent execution with the
  version 8 turn_verification purpose, preserving unknown historical usage.
  Persist bounded judge timeout reasons and retain native Harbor verification
  holds without a synthetic runtime exception; delivery and expansion gates
  remain closed while verification or observation is incomplete.

Removed

• Unused context-action event feedback handler; context policy and
  PreCompact/PostCompact remain the supported control path.

Infrastructure

• Fail the legacy-import ratchet when its Git comparison fails, and compare
  against the actual PR target or pre-push revision. Reject incomplete base
  arguments instead of treating them as an empty change set. Require the
  committed dependency lock for CI, Pages, install-smoke, and Petri validation;
  retain the release workflow's existing lock freshness check.
• Skip full Python tests and coverage only when the complete change set contains
  allowlisted documentation and generated public-doc files. Preserve required
  check identities, documentation/roadmap/inventory validation, and full testing
  for runtime, test, dependency, workflow, schema, and unrecognized paths.
• Share contributor instructions through Claude Code's native @AGENTS.md
  import. Check declared code/documentation/verification paths in the existing
  docs gate, and run focused scaffold checks for contributor-doc-only changes.