[sunrioa]

Summary

Refs #8, next-phase E1 in the approved plan and E implementation plan.

Keep automatic coordinator notifications small without hiding the worker's full output from the user:

• Bound the whole encoded notification to 6 KiB, including JSON escaping and the display label. Preserve exact source references, short deterministic excerpts, pending-interaction correlation and explicit omission/unknown states. Excerpts are unverified task data, not semantic summaries, successful objective verification or permission.
• Apply the same projection to historical notifications in the canonical WorkHub Coordination replay path. Match structured Host provenance, not a prose prefix; leave durable RuntimeEvents, tool arguments, full task output and compact-checkpoint coverage/digests unchanged. Ordinary Sessions, including copied notification text, retain their existing replay behavior.
• Keep full results in the scoped task view and explicit WorkHubResult/WorkHubEvidence reads. Do not add a summarizer model, new scheduler/store, UI-stream model wakeup, or change Session permissions, model, working directory or independent-task FIFO.
• Fix an existing evidence test's ordering fence to observe both source selection and the actual producer HTTP request before exercising restart/cancellation. Its 10-second deadline and assertions are unchanged; no retry was added.

Compatibility and migration

Only the Coordination Session's provider projection moves from v2 to v3; ordinary Session continuation proofs stay on v2. Released v1/v2 facts remain decodable, but an old Coordination proof cannot silently authorize a changed v3 replay. Runtime Host compatibility epoch advances from 219 to 220.

SQLite runtime schema 21 extends the continuation-claim projection constraint to v3. It preserves existing claim rows/proofs, keys, foreign-key behavior and the fresh-Turn index; it does not rewrite old proof versions. The migration tests cover a real pre-upgrade v1/v2 database, v3 admission, v4 rejection and reopening.

Verification

• A new independent Codex session reviewed exact head 55125ad267b1a23b3da145030877c87bae99d50a: no reportable P0–P3 findings. It independently reran all six suites below and 4,096 encoding probes (largest notification 5,920 bytes), plus replay/claim migration, fresh-Turn uniqueness and foreign-key cascade checks. This is AI review, not human approval.
• Hosted code CI 38479923422 passed on this exact head, first attempt, including Linux sandbox smoke, Runtime Host, published-baseline durable-state qualification and the installed CLI release candidate. Dependency audit passed. The planner skipped visual/Electron/Storybook paths for this backend-only diff. The optional upstream Copilot request initially failed because this fork has no upstream-specific token; the workflow's existing copilot-skip opt-out was then used and its new run skipped that request. No test workflow, secret or branch protection was changed.
• Final affected-workspace run: 12,582 passed, 0 failed, 34 existing skips. Core 926; Storage 1,565 (+8 skips); Runtime 3,728 (+14); Runtime Host 2,352 (+12); Desktop 3,298; UI 713. Workspaces ran with the existing namespaced runner at concurrency 1.
• Production build, full typecheck, lint, format, staged whitespace/ASF headers, epoch guard and its 17 tests passed.
• Release checks 217/217, strict-base renderer architecture 165/165, both CI-scoped Knip checks, Windows skip inventory (120 declarations), Astryx inventory/tests (332 files / 23 tests), locale hygiene and unchanged E2E budget passed.
• Production Host + local HTTP + SQLite restart test: a 190,030-byte full worker result stays intact; its automatic encoded notification is 1,743 bytes. Restart replay preserves stable system/tool prefixes, uses no extra summarizer call, and records zero compactions in this fixture.
• Actual old-to-new upgrade experiment: the released b4c359666 Host persists a 17,489-byte historical notification; the updated Host replays 2,252 bytes. The raw legacy Run hash and full source output remain unchanged, with one source invocation and one new coordinator request, not a source wakeup.

Earlier verification exposed the missing SQLite v3 constraint and clipped interaction IDs; both were fixed and the same recovery/interaction assertions pass. An earlier concurrent batch also failed an unchanged Storage lease-order case and two unchanged Host candidate-snapshot cases. Those cases and both full suites passed separately; a clean exact-base full run passed as well, so a deterministic main-branch reproduction or precise transient cause is not claimed. The final scoped run above passed without adding retries or relaxing deadlines. Those earlier results are retained in the local validation record.

The HTTP fixture reports input/cache usage to verify transport accounting, not real-provider cache savings. Its latency is local-only and price is unknown for the fixture model. No paid-provider cost improvement, new Windows execution capability, or new visual/Electron acceptance result is claimed by E1. Cold-work fresh-container continuation and final phase convergence remain the separate E2 work tracked in #8.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: OpenAI Codex assisted with source inspection, implementation, tests and this description under the repository owner's automation request. Material commits carry Generated-by: OpenAI Codex; independent Codex review is not presented as human approval.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

简体中文

摘要

关联 #8，完成已批准方案的 E1：精简自动送入协调模型的结果上下文，同时保留用户可查看的完整执行结果。

• 整条通知按编码后 6 KiB 限制，包括 JSON 转义和显示名称。保留精确来源引用、简短确定性节选、待处理交互关联及明确的省略／未知状态。节选不是语义摘要、目标验收结论或授权。
• 历史通知通过同一个 WorkHub 协调会话模型重放入口精简，依据结构化 Host 来源而非文字前缀。原始 RuntimeEvent、工具参数、完整任务结果和压缩 checkpoint 的覆盖／摘要值不变。普通 Session 及其中复制的通知文本维持原行为。
• 完整结果仍可在任务现场和显式 WorkHubResult／WorkHubEvidence 读取中获取。不新增摘要模型、调度器、存储或 UI 流引发的模型唤醒；不改变权限、模型、工作目录和独立任务 FIFO。
• 既有证据测试在执行重启／取消前，同时等待来源选定与实际 producer HTTP 请求；保留原 10 秒期限和断言，不增加重试。

兼容和迁移

仅协调会话的 provider replay 从 v2 升至 v3，普通 Session 的续接证明仍使用 v2。旧 v1/v2 记录可读取，但旧协调会话证明不能冒充已变化的 v3 重放。Host 兼容 epoch 为 219 → 220。

SQLite schema 21 扩展续接 claim 的版本约束，保留旧记录、证明、键、外键行为和 fresh-Turn 索引，不改写旧证明版本；覆盖真实旧数据库升级、v3 写入、拒绝 v4 及再次打开。

验证

• 新开的独立 Codex 会话审查精确提交 55125ad267b1a23b3da145030877c87bae99d50a，未发现可报告 P0–P3；独立重跑六套件，并验证 4,096 组编码极值（最大通知 5,920 字节）、重放／claim 升级、fresh-Turn 唯一性及外键级联。这是 AI 审查，不是人工批准。
• 该精确提交的远端代码 CI 38479923422 首次运行通过，覆盖 Linux sandbox、Host、已发布基线的持久化升级资格和已安装 CLI 候选；依赖审计通过。本次后端范围由规划器跳过可视化／Electron／Storybook。可选的上游 Copilot 请求最初因 fork 未配置上游专用令牌失败，随后使用工作流既有的 copilot-skip 选项，新运行跳过该请求；没有修改测试工作流、密钥或分支保护。
• 最终六工作区回归：12,582 通过、0 失败、34 个既有跳过。Core 926；Storage 1,565（跳过 8）；Runtime 3,728（14）；Host 2,352（12）；Desktop 3,298；UI 713。使用既有隔离临时目录 runner，工作区并发为 1。
• 生产构建、全量 typecheck、lint、格式、暂存空白／ASF、epoch guard 及 17 项测试通过。
• Release 217/217、严格基线架构 165/165、两个 CI 范围 Knip、Windows inventory、Astryx inventory／测试、语言卫生及未增加的 E2E 预算通过。
• 实际生产 Host／本机 HTTP／SQLite 重启链路中，190,030 字节完整 worker 输出保持不变，自动通知为 1,743 字节；system／tools 前缀保持稳定，没有额外摘要调用，本例无压缩。
• 使用已发布 b4c3596 Host 写入旧数据，再由新 Host 打开：17,489 字节的旧通知在模型请求中变为 2,252 字节；原 Run 哈希和来源全文不变，没有唤醒来源或增加摘要模型调用。

早期验证发现 v3 缺少 SQLite 约束支持、交互 ID 被裁掉，均已修复并通过原恢复／交互断言。早期并发批次还出现一个未修改的 Storage lease 顺序用例及两个未修改的 Host 候选快照用例失败；单独用例及完整套件随后通过，清洁精确基线的完整测试也通过，不能声称已证明主分支稳定复现或确定瞬时原因。最终范围的完整回归如上通过，未增加重试或放宽期限，早期记录保留在本地验证材料中。

HTTP 固定响应中的缓存用量和延迟仅用于本地链路验证，不代表真实供应商缓存／成本收益；测试模型没有已登记价格。E1 不宣称新的 Windows 执行能力或新的可视化／Electron 验收结果。冷任务新容器续接和最终收敛仍属于 #8 后续 E2，E 阶段尚未全部完成。

AI 说明同上：OpenAI Codex 在仓库所有者授权下参与实现、验证和描述；独立 AI 审查不冒充人工批准。