qargi 0.2.14

Fixed

• The agent test runs serially after the parallel pool following checkpoint2 8a7a675's lone timeout at 678s without assertion failures (137 steps passed; suite total 2554s). Its agent code and test match 408b8ae, whose lead DONE passed in 440.82s. This scheduling mitigation lengthens the serial tail without changing cases, limits, budgets or recorded durations; it establishes neither a root cause nor a performance guarantee.
• Conformance case 15 checks prepare's original-root plain-path diagnostics and unchanged scratch/TMP parent entries; runtime coverage is the symlink real-path branch only, not runtime plain paths or prepare real paths. Redirect fixtures read TMP through the trusted registry reader and stop on unknown labels or move/link failures, with focused negative probes. These are fixture checks, not product containment or qualification evidence.
• Signal cancellation tests exercise regular and symlinked runtime executables using dispatch's real path, failing promptly on an executable-path mismatch in the timed exec-child wait while retaining readiness, PID and group assertions without changing limits.
• Both guard test selections and the local-run workflow test run serially after the suite's parallel pool to mitigate contention observed at checkpoint1 e77c682. Reduced-concurrency reproductions passed; this scheduling mitigation increases the serial tail without changing cases, limits, budgets or recorded durations, and does not establish a root cause or guarantee performance.
• Codex spawn guidance fits the existing 393-word provider-notes budget while retaining prepared defaults, override and identity qualifications, drift refusal and sandbox guidance.
• The running-signal lifecycle test targets the runtime child's wait after proving its readiness and PID, so prepared-profile resolution subprocesses cannot receive the injection; cancellation and process-group shutdown remain required.
• Provider acceptance tests distinguish logical command profiles from stale in-session member rows and verify prepared high effort, unsupported override refusals, policy drift and supported explicit tier/effort overrides.
• Command conformance uses one bound provider definition for prepare and run, retaining private request authority. Hidden-path coverage checks prepare's refusal and runtime's independent recheck after member paths are redirected into a hidden place.
• local run retrieves the prepared-command marker with the required registry filter when its configured provider becomes unavailable, preserving re-prepare guidance without an unbound-variable diagnostic. Refusal leaves the private request intact and starts no member.
• local run --model uses the provider's established pattern search semantics, so repeating a prepared out-of-tier model accepted by a prefix pattern works without override capability verification.
• Command-mode agent models text and JSON now use the same profile resolver as agent for, showing logical bases, selected model IDs or aliases, requested effort levels and sources without member registration warnings or legacy roles/lead selections. JSON retains existing keys and profile metadata and adds command mode, selected, requested_effort and logical-base markers; native effort_control remains separate from the requested level. Refused entries remain visible with their reasons. The intentional never-dispatched lead row is informational, without a refusal or warning; agent for --profile lead still refuses. Empty tier aliases fall back to the ID, as command dispatch does. Member registration and alias flags apply to in-session rows. Row flags do not fail the display, but command-mode extension composition or load errors may fail the command.
• local prepare resolves explicit and implicit command profiles before making run artifacts and retains the request in lead-owned private lifecycle authority. local run uses its requested model and effort when each option is omitted, rejects runtime/mode/catalog/profile/policy drift with reprepare guidance, and permits explicit changes only after current catalog and effective capability checks. Null effort controls remain omitted with a note; requests do not claim observed identity. RUN and saved request files are inspection mirrors. Existing records without requests retain their documented behavior without adopting member files.
• agent for selects dispatch mode without composing extensions, preserving in-session resolution's existing handling of extension errors. Command runtimes still validate the project's enabled extensions.
• Command-mode agent for refuses malformed non-null profiles containers and selected entries before normalization can inherit shipped defaults or choose a class fallback. An absent or null profiles container uses shipped defaults, consistent with project validation. Present profile fields follow the project rules for bases, known-role ability lists, purpose, allowed keys, model, tier and effort; null selected entries and null field values are refused. Unrelated profile entries do not block resolution.
• agent for resolves command-runtime profiles to logical worker/reviewer bases without member files or registration, using the runtime's catalog and ignoring legacy member model/effort answers. Invalid profile models, tiers and effort levels are refused. Text output and JSON's model // model_id select the alias only when the catalog reference says use: alias and the tier has one; inline models and use: id select the ID. JSON marks command mode. Effort remains the requested level, including when the runtime has no native control.
• local close again names the applied branch and rewrite remedy when refusing a completed authoritative apply; unfinished applies still refuse early.
• Help, the manual and verification guidance qualify discard ownership and quiescence guarantees as lifecycle protections; legacy recovery remains explicitly weaker.
• Lifecycle cleanup completes bookkeeping after an already removed work directory’s parent changes or its tombstone is recreated, preserving foreign entries. Replacements are reported only when observed through the original parent.
• A process reaped while /proc/PID/stat is open can return ESRCH; lifecycle probing now treats it as PID absence, like a missing file, only while /proc remains available. Other evidence errors stay unknown and process-group completion still requires the kernel absence check.
• Interrupted lifecycle cleanup preserves and reports replacements at original RUN/TMP names after staging or deletion, then completes original tombstone deletion and exact registry bookkeeping. Owned tombstones recover crashes before phase commit; pre-stage replacements and foreign/unowned tombstones still refuse. Internal TMP completion is recorded before RUN staging, so recovery never traverses a replacement RUN or its symlink target to inspect old TMP paths.
• Genuinely unmarked registered legacy runs again support warned local clean --discard, and ordinary clean where the released checks permit it, including applied/stale batches. Registry-sourced TMP confinement and one-filesystem deletion remain; this weaker recovery proves no process quiescence and creates no lifecycle authority. Missing/corrupt marked state and stripped markers with private lifecycle remnants still refuse.
• local prepare again accepts symlinked, relative and ..-containing QARGI_RUN_TMP parents. It resolves the parent before creating directories and consistently records and displays the canonical TMP path; repointing the alias later does not redirect cleanup. Hidden-path checks still inspect actual paths.

Changed

• Clean authorizes retained evidence before deleting TMP or RUN. Prepare records private directory identities; interrupted cleanup stages owned tombstones and refuses source replacements before staging. Missing ownership evidence for marked runs requires manual recovery.
• Process-group completion requires a kernel absence report. A changing process listing or zombie-only sample cannot authorize retry or cleanup; runner diagnostics identify busy or unknown groups without claiming live survivors.
• A full verification history refuses before publishing a new snapshot; identical observations still consume no history.
• Lifecycle safety guidance is generated from the canonical help source, keeping the manual and command help consistent.
• Structural review can inspect unsuccessful attempts as diagnostic evidence; it explicitly says that inspection is not acceptance, and verification and apply still refuse their output.
• A signal received after a local member finishes no longer marks its private attempt cancelled, so completed output can be verified.
• Cleanup diagnostics explicitly name retained cleaned registry evidence; covering shell expectations retain branch, worktree, scrub and registry assertions under the conservative lifecycle policy.
• Retry epochs precede ref collection, including slow remote queries; lead-written report manifests take their base commit from private prepared authority.
• Lifecycle clean records owned atomic tombstones before deletion and keeps its cleaned registry row. Repeating clean resumes interruptions before or after registry and lifecycle-state removal without adopting orphan paths or implicitly discarding retained evidence.
• Save staging is limited to one privately recorded directory per run and recovered after owner death without leaving a copy child. Unknown or replaced staging refuses cleanup; retained-copy limits count directories, not bytes.
• Unfinished lifecycle applies refuse resume and cleanup after their parent dies because Git-child termination is unknown. Completed Git work marked built retains supported bookkeeping recovery; hooks still receive no lifecycle lock.
• Dispatch installs signal handling before committing begin, records caught prelaunch cancellation as not-started, and refuses unknown process evidence.
• Lifecycle verification refuses changed accepted output and unsuccessful dispatch output; apply scrubs its private copy even after review check. Stale cleanup preserves retained evidence after a failed retry and directory loss. Historical lead-owned runs directories upgrade safely to private permissions.
• New local preparations publish lifecycle: 1 only after recording immutable refs, epoch and base commit in private lead state. Dispatch, verify, apply, close and clean share the lifecycle lock; active or unknown members refuse all acceptance and cleanup, including discard. Members, Git helpers, scrubs and background renewers do not inherit that lock.
• Runtime retries commit a fresh strict attempt before dispatch metadata, transcript or report changes. Dry-run and preflight refusal preserve earlier evidence; setup/spawn failures after the boundary leave an unverified not-started attempt. Applied, closed and cleaned work cannot be retried. Legacy runs retain explicitly warned inspection/recovery but require re-preparation for actual runtime dispatch; missing or corrupt new state fails closed.
• Verification and saved-copy selection use private attempt authority and per-save generation nonces. Earlier copies are retained before replacements, failed saves require re-verification, and repeated live or saved observation reuses the accepted product while advancing the private ref baseline. Byte-identical observations do not consume history. Apply and scrub use the prepared base commit and accepted saved output; open-run and feature gates ignore forged verification/application mirrors. Retention is bounded to 32 copies and 32 historical verifications per attempt, with 256 attempts per preparation.
• The lifecycle guide documents the conservative unknown-spawn refusal, Linux process-group evidence, escaped-session limitations, and recovery after directory loss. Execution completion, descendant termination and product acceptance remain distinct.