From 06afed92bad799fba6437ed353f797c7c26d384c Mon Sep 17 00:00:00 2001
From: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
Date: Wed, 28 Oct 2026 01:43:51 +0800
Subject: [PATCH] docs(release): document 2.2.0 upgrade and optional
 capabilities

Signed-off-by: LoopX Agent <337587101+loopx-agent@users.noreply.github.com>
---
 docs/product/releases/v2.2.0.md | 561 ++++++++++++++++++++++++++++++++
 1 file changed, 561 insertions(+)
 create mode 100644 docs/product/releases/v2.2.0.md

diff --git a/docs/product/releases/v2.2.0.md b/docs/product/releases/v2.2.0.md
new file mode 100644
index 0000000000..7546c08474
--- /dev/null
+++ b/docs/product/releases/v2.2.0.md
@@ -0,0 +1,561 @@
+# LoopX 2.2.0
+
+## Release Decision
+
+**Who should upgrade:** Canonical 2.x users of research history, managed conversations, scheduled reports or native/Windows hosts should upgrade for the changed reading and recovery paths. Operators with unsupported legacy authority must prepare migration first; a production owner may remain on its current version until that is complete.
+
+**What this release solves:** Research evidence was difficult to trace across saved versions; complete reports and recovered requests could lose their original delivery context; races and stale fixtures obscured the actual work and its qualification. This release improves those concrete paths while retaining independent acceptance and effect readback.
+
+**Breaking changes:** Yes for pre-canonical integrations: ordinary unmigrated authority-read fallbacks and retired protocol/legacy bridge formats are removed. Follow the existing explicit backup/migration/recovery contract before use. Existing canonical File/SQLite Goals retain their selected authority; an upgrade does not migrate data or add another writer. Unconfigured new Goals still create SQLite with hard leases. Differential context and Explore device mode remain off by default. Controller/executor-session RFCs are proposals, not shipped two-Agent orchestration.
+
+**How to verify:** Expect loopx 2.2.0 and the correct installation owner/runtime. Open an existing Goal and verify one original result/source or the complete original report; registration, a saved setting and a completed Todo are not delivery proof.
+
+**Contributors:** Release maintenance by @huangruiteng and @loopx-agent; concrete community contributions appear above and below, derived from the previous formal tag v2.1.1 and merged PR metadata.
+
+```bash
+loopx --version
+loopx doctor --deep
+loopx dashboard
+```
+
+### Highlights
+
+- **Read research from result to original evidence.** Open an existing Goal’s Research view for saved findings, original-record search, version comparison and complete citations; generating a new analysis remains explicit. [#7051](https://github.com/loopx-project/loopx/pull/7051), [#7129](https://github.com/loopx-project/loopx/pull/7129), [#7370](https://github.com/loopx-project/loopx/pull/7370), [#7412](https://github.com/loopx-project/loopx/pull/7412), [#7444](https://github.com/loopx-project/loopx/pull/7444), [#7451](https://github.com/loopx-project/loopx/pull/7451).
+- **Receive a complete scheduled report in the original conversation.** Explicit daily/weekly settings bind the prepared steward or existing managed Agent; only independent full-body readback acknowledges delivery. [#7179](https://github.com/loopx-project/loopx/pull/7179), [#7267](https://github.com/loopx-project/loopx/pull/7267), [#7432](https://github.com/loopx-project/loopx/pull/7432), [#7488](https://github.com/loopx-project/loopx/pull/7488).
+- **Continue safely after interruption.** Original-request recovery rechecks source and current work; queued claim, expiry and stop races retain the actual terminal ledger. Unknown effects still require readback. [#7399](https://github.com/loopx-project/loopx/pull/7399), [#7477](https://github.com/loopx-project/loopx/pull/7477), [#7505](https://github.com/loopx-project/loopx/pull/7505), [#7504](https://github.com/loopx-project/loopx/pull/7504).
+- **Choose context and exploration explicitly.** Codex differential context and device Explore mode default off; both reuse existing owners and preserve full recovery and Goal overrides. [#7311](https://github.com/loopx-project/loopx/pull/7311), [#7334](https://github.com/loopx-project/loopx/pull/7334), [#7421](https://github.com/loopx-project/loopx/pull/7421), [#7392](https://github.com/loopx-project/loopx/pull/7392), [#7509](https://github.com/loopx-project/loopx/pull/7509).
+- **Keep Windows and native-account ownership visible.** Signed Windows update support, IANA timezones, UTF-8 state and read-only login-holder inspection improve their existing journeys. [#6854](https://github.com/loopx-project/loopx/pull/6854), [#7454](https://github.com/loopx-project/loopx/pull/7454), [#7453](https://github.com/loopx-project/loopx/pull/7453), [#7469](https://github.com/loopx-project/loopx/pull/7469).
+
+### Replan Fixes
+
+- A lawful semantic replan can record a native child decision and close out an existing reported operation while ordinary delivery remains denied. [#7484](https://github.com/loopx-project/loopx/pull/7484).
+- Captured review context and same-obligation recovery retain current facts and original-Turn closeout; a successor Todo alone does not settle the review. [#7269](https://github.com/loopx-project/loopx/pull/7269), [#7426](https://github.com/loopx-project/loopx/pull/7426), [#7249](https://github.com/loopx-project/loopx/pull/7249).
+- Scoped approval permits explicitly independent lawful work while preserving the outstanding decision and its limits. [#7440](https://github.com/loopx-project/loopx/pull/7440).
+
+## State Kernel & Control Plane
+
+Canonical state, complete Todo reads and shared decision ownership stay with their typed owners. Read-only status follows the canonical source runtime; runtime aliases do not create a different authority. Goal creation can resume its original operation without erasing later writes. [#6874](https://github.com/loopx-project/loopx/pull/6874), [#7325](https://github.com/loopx-project/loopx/pull/7325), [#7462](https://github.com/loopx-project/loopx/pull/7462), [#7411](https://github.com/loopx-project/loopx/pull/7411), [#7298](https://github.com/loopx-project/loopx/pull/7298), [#7381](https://github.com/loopx-project/loopx/pull/7381), [#7496](https://github.com/loopx-project/loopx/pull/7496).
+
+Replan, outcome review, terminal refusal and original settlement retain their own identities. Required Host work does not grant ordinary delivery; no-write failures preserve their original source and journal. [#7484](https://github.com/loopx-project/loopx/pull/7484), [#7486](https://github.com/loopx-project/loopx/pull/7486), [#7452](https://github.com/loopx-project/loopx/pull/7452), [#7470](https://github.com/loopx-project/loopx/pull/7470).
+
+## Capabilities & Workflows
+
+The Research workspace now leads with results, saved reports and readable questions, then original history, measurements and citations. Search and comparison reuse saved display language while exports preserve original records. New analysis preparations persist the current faithful localized guidance; existing frozen methods, failures and usage remain unchanged. This ships an analysis producer and packaged reader; evaluator calibration and scientific treatment effects remain separate. [#7051](https://github.com/loopx-project/loopx/pull/7051), [#7129](https://github.com/loopx-project/loopx/pull/7129), [#7370](https://github.com/loopx-project/loopx/pull/7370), [#7412](https://github.com/loopx-project/loopx/pull/7412), [#7423](https://github.com/loopx-project/loopx/pull/7423), [#7428](https://github.com/loopx-project/loopx/pull/7428), [#7444](https://github.com/loopx-project/loopx/pull/7444), [#7451](https://github.com/loopx-project/loopx/pull/7451).
+
+Original-session daily/weekly reports reuse the existing calendar, native Task/Turn, independent validator and complete-body delivery owner. Known prelaunch refusals or cached validated output recover only their permitted remaining work; unknown generation or send effects are retained. The separate completed-Task repeat mode remains an experimental backend/configuration slice. [#7173](https://github.com/loopx-project/loopx/pull/7173), [#7179](https://github.com/loopx-project/loopx/pull/7179), [#7267](https://github.com/loopx-project/loopx/pull/7267), [#7288](https://github.com/loopx-project/loopx/pull/7288), [#7418](https://github.com/loopx-project/loopx/pull/7418), [#7449](https://github.com/loopx-project/loopx/pull/7449), [#7458](https://github.com/loopx-project/loopx/pull/7458).
+
+Retained completed tasks and steward requests can be searched; displayed team report sources can be downloaded. Project peer requests preserve the original conversation and complete brief, without granting coordinator authority. [#7041](https://github.com/loopx-project/loopx/pull/7041), [#7048](https://github.com/loopx-project/loopx/pull/7048), [#7228](https://github.com/loopx-project/loopx/pull/7228), [#7419](https://github.com/loopx-project/loopx/pull/7419), [#7495](https://github.com/loopx-project/loopx/pull/7495).
+
+## Quality & Testing
+
+Release regression fixtures initialize actual canonical authority once, use real CAS for later source changes, retain unique settlement/replay assertions and verify frozen historical bytes independently. Required checks, model qualification and final release qualification remain separate from PR count or a green synthetic test. [#7459](https://github.com/loopx-project/loopx/pull/7459), [#7499](https://github.com/loopx-project/loopx/pull/7499), [#7502](https://github.com/loopx-project/loopx/pull/7502), [#7506](https://github.com/loopx-project/loopx/pull/7506), [#7507](https://github.com/loopx-project/loopx/pull/7507).
+
+The release’s final same-source qualification receipt and channel readbacks belong to the [formal GitHub release](https://github.com/loopx-project/loopx/releases/tag/v2.2.0). A candidate source or this usage document alone is not a passing release receipt. Historical failed, skipped and interrupted attempts are retained separately.
+
+## Benchmarks & Integrations
+
+Native benchmark outcomes preserve terminal provider failures and partial results, work-phase deadlines, effective model routes and frozen source/profile identity. New heartbeat/Turn runs default to resume; an explicit fresh control remains available. SForge dependency selection is frozen per new cohort, and retry/context/checkpoint options remain explicit. No benchmark job is launched by this release procedure. [#7036](https://github.com/loopx-project/loopx/pull/7036), [#7061](https://github.com/loopx-project/loopx/pull/7061), [#7072](https://github.com/loopx-project/loopx/pull/7072), [#7090](https://github.com/loopx-project/loopx/pull/7090), [#7281](https://github.com/loopx-project/loopx/pull/7281), [#7294](https://github.com/loopx-project/loopx/pull/7294), [#7400](https://github.com/loopx-project/loopx/pull/7400).
+
+Pi pauses future automatic work on real interactive/RPC input while retaining that input’s processing. DSH source installation, native account ownership, Windows timezone/Unicode and signed desktop updates have their own provider/platform boundaries. The DSH plugin has an independent version; this Python release does not silently replace its published beta artifact. [#7401](https://github.com/loopx-project/loopx/pull/7401), [#6862](https://github.com/loopx-project/loopx/pull/6862), [#7222](https://github.com/loopx-project/loopx/pull/7222), [#6854](https://github.com/loopx-project/loopx/pull/6854), [#7454](https://github.com/loopx-project/loopx/pull/7454), [#7497](https://github.com/loopx-project/loopx/pull/7497), [#7469](https://github.com/loopx-project/loopx/pull/7469).
+
+This release makes no new benchmark-score, long-horizon outcome or total-cost improvement claim. A new matched stable-versus-candidate outcome experiment is therefore not claimed as executed. Existing studies and the updated [long-horizon research narrative](https://github.com/loopx-project/loopx/blob/v2.2.0/apps/presentation/site/public/blog/edgebench-feedback-and-memory/index.html) retain their own sources, cohorts and limitations; process visibility and restored state alone do not establish benefit.
+
+## Documentation & Compatibility
+
+Use Python 3.11+ and Node.js 22.22.3+; Node 24 LTS is recommended. Follow the original pip/pipx/uv-tool/archive owner. New Goal defaults and old Goal migration are different operations: existing authority, leases and explicit overrides are retained. Unmigrated operational reads fail visibly; prepare a saved backup and the explicit reviewed migration. [#7032](https://github.com/loopx-project/loopx/pull/7032), [#7381](https://github.com/loopx-project/loopx/pull/7381), [#7441](https://github.com/loopx-project/loopx/pull/7441).
+
+Native differential context requires qualified host lifecycle delivery, not merely hook discovery or saved settings. Research checkpoints remain CLI/Host stage; repeated Task mode and controller/executor proposals do not establish a complete unified Agent frontend. [#7338](https://github.com/loopx-project/loopx/pull/7338), [#7409](https://github.com/loopx-project/loopx/pull/7409), [#7429](https://github.com/loopx-project/loopx/pull/7429), [#7416](https://github.com/loopx-project/loopx/pull/7416), [#7288](https://github.com/loopx-project/loopx/pull/7288).
+
+## Community Contributors
+
+- [@BigDataDZ](https://github.com/BigDataDZ) — Windows installation, timezone, Unicode and PowerShell correctness; canonical and packaged regression journeys. [#7454](https://github.com/loopx-project/loopx/pull/7454), [#7453](https://github.com/loopx-project/loopx/pull/7453), [#7222](https://github.com/loopx-project/loopx/pull/7222), [#6862](https://github.com/loopx-project/loopx/pull/6862), [#6805](https://github.com/loopx-project/loopx/pull/6805), [#7441](https://github.com/loopx-project/loopx/pull/7441), [#7364](https://github.com/loopx-project/loopx/pull/7364), [#7232](https://github.com/loopx-project/loopx/pull/7232), [#7230](https://github.com/loopx-project/loopx/pull/7230), [#7225](https://github.com/loopx-project/loopx/pull/7225), [#7326](https://github.com/loopx-project/loopx/pull/7326).
+- [@Dante-dan](https://github.com/Dante-dan) — session/run-bound manual diagnostics. [#7349](https://github.com/loopx-project/loopx/pull/7349).
+- [@Duang777](https://github.com/Duang777) — Goal identifier validation, equivalent lease scopes and regression prerequisites. [#7192](https://github.com/loopx-project/loopx/pull/7192), [#7204](https://github.com/loopx-project/loopx/pull/7204), [#7209](https://github.com/loopx-project/loopx/pull/7209).
+- [@JasonBuildAI](https://github.com/JasonBuildAI) — completed-Turn stop races, interrupted canonical creation, signed Windows updates, DSH launch guidance and Unicode/privacy repairs. [#7477](https://github.com/loopx-project/loopx/pull/7477), [#7381](https://github.com/loopx-project/loopx/pull/7381), [#6854](https://github.com/loopx-project/loopx/pull/6854), [#7473](https://github.com/loopx-project/loopx/pull/7473), [#7247](https://github.com/loopx-project/loopx/pull/7247), [#7251](https://github.com/loopx-project/loopx/pull/7251), [#7439](https://github.com/loopx-project/loopx/pull/7439).
+- [@Jiaqiiii523](https://github.com/Jiaqiiii523) — attached-conversation regressions and Lark upload acknowledgement. [#7293](https://github.com/loopx-project/loopx/pull/7293), [#7395](https://github.com/loopx-project/loopx/pull/7395).
+- [@Jim-jimu](https://github.com/Jim-jimu) — Pi input-driven pause and Explore input/zero-evidence semantics. [#7401](https://github.com/loopx-project/loopx/pull/7401), [#7303](https://github.com/loopx-project/loopx/pull/7303), [#7143](https://github.com/loopx-project/loopx/pull/7143), [#7239](https://github.com/loopx-project/loopx/pull/7239).
+- [@hhyykk](https://github.com/hhyykk) — shared TypeScript decision ownership, complete canonical reads, recovery, queued-session ownership and explicit source-content pins. [#7462](https://github.com/loopx-project/loopx/pull/7462), [#7325](https://github.com/loopx-project/loopx/pull/7325), [#7298](https://github.com/loopx-project/loopx/pull/7298), [#6874](https://github.com/loopx-project/loopx/pull/6874), [#6855](https://github.com/loopx-project/loopx/pull/6855), [#7321](https://github.com/loopx-project/loopx/pull/7321), [#7386](https://github.com/loopx-project/loopx/pull/7386), [#7136](https://github.com/loopx-project/loopx/pull/7136), [#7137](https://github.com/loopx-project/loopx/pull/7137), [#7131](https://github.com/loopx-project/loopx/pull/7131).
+- [@mikamikasuki](https://github.com/mikamikasuki) — Lark timestamp precision and encoded local-path redaction. [#6084](https://github.com/loopx-project/loopx/pull/6084), [#5978](https://github.com/loopx-project/loopx/pull/5978).
+- [@songoow](https://github.com/songoow) — mobile task modality, managed observer ownership, report routing and offline analysis cancellation. [#7410](https://github.com/loopx-project/loopx/pull/7410), [#7354](https://github.com/loopx-project/loopx/pull/7354), [#7353](https://github.com/loopx-project/loopx/pull/7353), [#7352](https://github.com/loopx-project/loopx/pull/7352), [#7415](https://github.com/loopx-project/loopx/pull/7415).
+- [@steven-kid](https://github.com/steven-kid) — original evidence search and revision comparison, retained-work search and report downloads. [#7370](https://github.com/loopx-project/loopx/pull/7370), [#7129](https://github.com/loopx-project/loopx/pull/7129), [#7228](https://github.com/loopx-project/loopx/pull/7228), [#7041](https://github.com/loopx-project/loopx/pull/7041), [#7048](https://github.com/loopx-project/loopx/pull/7048), [#7297](https://github.com/loopx-project/loopx/pull/7297).
+- [@xianth123](https://github.com/xianth123) — single-owner periodic-report field rules and NoKV qualification. [#7210](https://github.com/loopx-project/loopx/pull/7210), [#7155](https://github.com/loopx-project/loopx/pull/7155).
+
+## Optional Capability Activation & Use
+
+The commands below assume the stated source checkout or an installed 2.2.0 CLI. Set identifiers/directories to the existing authorized object; viewing a setting does not enable it.
+
+### Research reports and original evidence
+
+**Activation:** Open an existing Goal’s Research view. Ask its authorized Agent to register a fixed source pack, then explicitly generate the selected report. New default preparations use synthesis revision 2 and the current faithful localized display guidance; optional synthesis revisions 3/4 need a successor pack. Opening history, search, comparisons and citations is read-only.
+
+**Validation:** Read the original source and revision beside the saved finding; inspect missing coverage, negative evidence, usage and the selected pack’s status. Saved translations can be searched and compared; exports retain original matching records.
+
+**Disable / rollback:** Cancel by the original analysis directory. For subsequent work select the earlier pack/configuration or a legacy encoding/synthesis setting; retain original successes, failures and usage. An uncertain running operation needs original-result readback before retry.
+
+**Authority boundary:** Sources must be authorized and hash-verified. Explicit generation can call the configured model and incur fees; a citation validates binding, not entailment, scientific validity or permission to run a proposed experiment. Existing frozen requests are not silently upgraded.
+
+**Docs:** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/docs/reference/trajectory-assessment.md)
+
+```bash
+loopx dashboard
+loopx benchmark trajectory-packs --goal-id "$GOAL_ID" --format json
+loopx benchmark trajectory-assessment-status --directory "$ANALYSIS_DIR" --format json
+# Explicit cancellation of that original operation:
+loopx benchmark trajectory-assessment-cancel --directory "$ANALYSIS_DIR" --format json
+```
+### Codex differential context
+
+**Activation:** Default off. In Settings → This machine → Capabilities → Differential context → Codex, switch on through the existing exact-revision transaction. Supported native Codex App heartbeat, SSH Goal and explicit benchmark heartbeat consumers also require their exact native hook/configuration setup for the next supported session. A saved preference alone does not initialize a loaded thread.
+
+**Validation:** Read back the machine setting, render context-config for the actual Goal/Agent, then verify native lifecycle delivery and complete digest-bound pages. Setup and hooks/list discovery alone do not prove actual delta use or model retention.
+
+**Disable / rollback:** Switch off in the same editor, or explicitly pass --context-delivery off. Remove generated hooks, developer instructions and output overrides when removing native setup; restore previous host values. Retain the same full capture for recovery.
+
+**Authority boundary:** POSIX native continuity only. Native full/continuation reads use the existing 64000-byte profile; complete JSON records in mixed stdout still require trusted capture verification. Missing/uncertain continuity restores the same complete original; presentation never reruns admission or grants new work. MCP and Claude machine parsers explicitly retain raw output. No measured fee or outcome reduction is claimed.
+
+**Docs:** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/docs/reference/required-work-context.md#machine-default)
+
+```bash
+loopx machine-config inspect
+loopx quota context-config --codex-app --goal-id "$GOAL_ID" --agent-id "$AGENT_ID"
+# Raw internal/machine consumption and explicit off:
+loopx --format json quota should-run --goal-id "$GOAL_ID" --agent-id "$AGENT_ID" --context-delivery off
+```
+### Explore device defaults
+
+**Activation:** Default off. In Settings → Device → Explore Harness select Off, Evidence or Planning, preview and apply. Only mode is inherited live by existing/new Goals without an explicit override; profile, composition and execution permissions stay Goal-owned.
+
+**Validation:** Inspect the effective mode and its source in Goal settings. Material graph, result log and rollout must use the same selected runtime. Configuration alone does not prove evidence adoption.
+
+**Disable / rollback:** Set device mode Off for inheriting Goals. Keep a particular Goal off with its explicit mode; Restore inheritance or configure-goal --clear-explore-configuration removes that Goal’s Explore override through the existing preview/apply path.
+
+**Authority boundary:** Planning supplies evidence and branch guidance. It grants no spawn, lease, quota, credential, scheduler or external-publication authority; those retain their independent owners.
+
+**Docs:** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/loopx/capabilities/explore/README.md#machine-default)
+
+```bash
+loopx machine-config inspect
+loopx configure-goal --goal-id "$GOAL_ID" --clear-explore-configuration
+```
+### Original-session scheduled reports
+
+**Activation:** Opt in explicitly. For a bound managed Agent, open Goal settings → Capability center → Periodic reports, choose weekly-progress and the existing Report conversation, then set a daily/weekly calendar and optional first date before preview/apply. For the prepared private steward, use Settings → Lark → its original steward → Native periodic monitoring. Preparing identity alone enables neither path.
+
+**Validation:** Reload the saved destination/calendar and inspect the original conversation. Read this period’s full report must return the complete matching body; task completion, model output or a send attempt alone is insufficient. Private Lark delivery has its own complete-part readback.
+
+**Disable / rollback:** Pause with Enable off in that same configuration. Keep frozen/unknown attempts for original recovery; do not retarget or resend them. Clear a known failed independent window only through its qualified existing transaction; clearing does not replay the failed period.
+
+**Authority boundary:** Generation uses the selected actor’s authorization, lease and quota and may cost model tokens. The receiver is fixed by the original binding; unread or newly added sources do not authorize a different audience. Arbitrary natural-language recurring tasks and the complete unified Agent journey remain separate acceptance work.
+
+**Docs:** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/docs/product/periodic-reports.md)
+
+```bash
+loopx --version
+loopx doctor --deep
+loopx dashboard
+```
+### Repeating a completed native Task
+
+**Activation:** Experimental backend/configuration slice. In the existing Goal settings JSON editor explicitly configure periodic_report with enabled=true, profile_preset=session-task, the actual managed-session route and an already completed source_todo_id; set the native calendar and apply its exact preview revision. The canonical document contains the complete configuration.
+
+**Validation:** Read back that configuration and the same managed Session’s scheduled_task inspection. A due period requires independent Task validation, native settlement and the full original Core answer before acknowledgement.
+
+**Disable / rollback:** Set enabled=false to pause while retaining the plan and evidence. Retire a known failed window only through the supported clear transaction. Do not downgrade an owner with retained session-task windows to a runtime that cannot read their completion receipts.
+
+**Authority boundary:** No arbitrary new task description, script, validation argv or external destination is accepted. It reuses an authorized completed Task, native scope/lease/quota and original Session. This is not complete frontend acceptance or demonstrated production scheduled adoption.
+
+**Docs:** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/docs/product/periodic-reports.md#repeat-an-existing-native-task-in-a-managed-session)
+
+```bash
+loopx doctor --deep
+loopx dashboard
+```
+### Native Codex account handoff
+
+**Activation:** Install the optional package in the same Python environment, restart its serving App/Chat owner, then explicitly enable automatic switching in Settings → Model provider → Native Codex accounts. Client quit/restart and force quit remain separate permissions, off unless authorized.
+
+**Validation:** Use status and clients, then inspect the settings page’s fresh account allowance and Login holders. An App and CLI watch sharing one policy elect one observer; a diagnostic responsible PID is not termination authority.
+
+**Disable / rollback:** Turn automatic switching off; turn restart/force permissions off independently. Inspect and reconcile retained service-restoration intent through the original native owner after a partial failure. Disabling observation does not erase an in-flight credential transaction.
+
+**Authority boundary:** The native account owner and macOS/POSIX requirements remain. Only verified original process/service identities can be restarted; unmanaged or unknown holders remain holds. No account purchase, reset-credit use, arbitrary process termination or replay of submitted jobs is granted.
+
+**Docs:** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/packages/loopx-codex-provider-routing/NATIVE.md)
+
+```bash
+python3 -m pip install ./packages/loopx-codex-provider-routing
+loopx-codex-accounts status
+loopx-codex-accounts clients
+```
+### Explicit research checkpoints
+
+**Activation:** CLI/Host stage, explicitly invoked. Prepare a quiescent settled canonical source, a qualified native Codex profile, complete declared workspace artifacts and a fresh physical checkpoint destination. Preview capture without --execute, then execute only the reviewed request.
+
+**Validation:** Verify the returned checkpoint SHA before separately admitting a fresh receiver and adopting context under current claim/lease. Check native cursor, source/profile witness, declared artifact bytes and original settlement; captured history itself grants no work.
+
+**Disable / rollback:** Omit future checkpoint requests/controller activation to disable capture. Keep captured points and uncertain original operations intact; use the original identity for recovery. Receiver model/effort changes require explicit destination configuration while retaining the sealed source profile.
+
+**Authority boundary:** Not arbitrary Host support, a process-memory snapshot, automatic ordinary-Goal capture or disaster recovery. Export storage must preserve case/Unicode filename distinctions. Only declared artifacts are captured; private credentials are not made public by capture. The packaged ordinary-user frontend remains unfinished.
+
+**Docs:** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/docs/reference/research-checkpoint.md)
+
+```bash
+loopx research-checkpoint capture --help
+loopx --format json research-checkpoint verify --root "$CHECKPOINT_ROOT" --expected-sha256 "$CAPTURE_DIGEST"
+```
+### Benchmark source and provider profiles
+
+**Activation:** Per-command opt-in in a separate authorized experiment. Prepare/freeze the SForge source cohort with the documented source command; select a full source SHA for reproducibility. New heartbeat/Turn defaults resume, while explicit fresh remains a control. Context delivery and HTTP429 retry windows are separate explicit flags; retry default is zero.
+
+**Validation:** Read the frozen source receipt, actual runtime route, original phase deadline and typed native outcome. Failed/usage-limited/unknown native work retains partial_result.json and never becomes a completed final_result.json.
+
+**Disable / rollback:** Use a new log directory and explicit prior SHA/config for a new comparison; do not replace an existing cohort. Omit context-delivery and set retry window to zero to retain ordinary full/pass-through behavior. Preserve previous attempts and budget clocks.
+
+**Authority boundary:** Source preparation does not launch a worker or judge. Model/job/evaluation access and budget require the experiment’s own authorization. Judge/task/scoring source, actual complete costs and feedback must match before comparison; changing defaults does not qualify historical scores or grant extra evaluations. No new benchmark job is part of this release.
+
+**Docs:** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/benchmark/edgebench/README.md)
+
+```bash
+python3 -m benchmark.edgebench.source --help
+python3 -m benchmark.edgebench.run --help
+```
+### Explicit source-content pins
+
+**Activation:** Opt in only by recording an accepted file path and content sha256 in that Goal’s existing private authority_sources entry. A source-reference hash is different. Ordinary bootstrap --goal-doc remains mutable and never creates a content pin by filename or discovery.
+
+**Validation:** Run the existing Goal-scoped check/status after pinning; changed, missing or unreadable accepted bytes must remain visible. The read-only filesystem adapter does not repair the file or update the accepted hash.
+
+**Disable / rollback:** Restore the accepted file bytes, or use the existing authorized registry revision to update/remove that explicit content pin. Keep other authority sources and private registry boundaries intact.
+
+**Authority boundary:** No software-policy auto-discovery, AST/regex obligation enforcement, document lock or memory write is introduced. Pinning a file grants no execution or publication permission.
+
+**Docs:** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/docs/architecture.md)
+
+```bash
+loopx --registry "$GOAL_REGISTRY" check
+```
+### Desktop preview and signed updates
+
+**Activation:** Install the matching verified desktop artifact from the release. Windows signed updates require the NSIS installation and main channel; MSI and stable-channel Windows updates remain manual/unavailable. A build without the updater needs one explicit replacement. Existing macOS background preparation is applied on the next normal open; it does not restart an active workspace.
+
+**Validation:** Read the App shell version, selected channel, signed feed and its qualified service/runtime identity. Check for updates retains its own result independently of local startup. CLI identity cannot qualify the native shell.
+
+**Disable / rollback:** Keep the current verified App if an update is unavailable or fails. Use only the platform’s qualified native recovery/update path; Windows App rollback/repair remains manual or unavailable. Preserve its original maintenance journal on uncertain outcomes.
+
+**Authority boundary:** Desktop is preview distribution. Minisign update verification is distinct from Windows Authenticode, Apple notarization and local installation qualification. Windows may show SmartScreen. Installation and updates do not grant Goal/provider authority or replay interrupted business work.
+
+**Docs:** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/apps/desktop/loopx-control-plane/README.md)
+
+```bash
+gh release view v2.2.0 --repo loopx-project/loopx
+loopx --version
+loopx doctor --deep
+```
+### DSH source plugin
+
+**Activation:** Source-only compatibility changes belong to the independently versioned DSH plugin. From the matching release checkout, enter packages/dsh-loopx-plugin and run its documented install.sh against one explicit DSH home/host; inspect that host’s config before launch. Existing published beta packages keep their frozen content.
+
+**Validation:** Start the selected DSH host and invoke its installed loopx skill in that exact Session. Resolve the unique Goal/Agent binding before relying on GoalBar or Driver; installation alone never activates continuation.
+
+**Disable / rollback:** Remove dsh-loopx-plugin from the same host/profile. This stops its Driver and GoalBar without deleting LoopX state, bindings or skills. Only remove the isolated runtime after DSH has stopped and the plugin has been removed.
+
+**Authority boundary:** The source dependency/MCP overrides do not patch a separately installed DSH binary. The native Session owns input and tools; only LoopX admission can authorize subsequent work. Plugin installation grants no provider key or independent scheduler/Goal authority.
+
+**Docs:** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/packages/dsh-loopx-plugin/README.md)
+
+```bash
+cd packages/dsh-loopx-plugin
+./install.sh
+# Use the same qualified DSH host/profile for removal:
+dsh plugin --profile web remove dsh-loopx-plugin
+```
+### Session-bound reliability diagnostics
+
+**Activation:** Experimental passive L1 observation remains default off. Use the separate documented dsh-loopx-plugin/observer entry only for an explicitly authorized original Session. For a current manual read, supply the exact provider/observer/session and typed run_identity binding, current as-of time and maximum observation age.
+
+**Validation:** Read status with its integrity receipt from the same ledger observation. Stale, mismatched, corrupt or incomplete evidence stays unavailable; an empty or old ledger is not proof of a healthy current run.
+
+**Disable / rollback:** Disable the separate observer entry to stop new observation and retain its ledger/receipt. Omitting expected-binding requests legacy readback rather than a current binding-qualified diagnosis; do not relabel that as a current pass.
+
+**Authority boundary:** The observer cannot send, schedule, gate, retry, stop, resume or modify worker state. It retains content-free diagnostic records, not raw conversation/tool bodies. Adapter fidelity, measured overhead and the P0 exit gate remain separately unqualified.
+
+**Docs:** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/loopx/capabilities/reliability_diagnostics/README.md)
+
+```bash
+loopx reliability-diagnostics status --goal-id "$GOAL_ID" --with-receipt --format json --expected-binding "$EXPECTED_BINDING_JSON" --as-of "$AS_OF" --max-observation-age-ms 60000
+```
+
+## Install / Update
+
+For a new PyPI installation:
+
+```bash
+python3 -m pip install --upgrade 'loopx==2.2.0'
+loopx workflow-skills --install
+loopx slash-commands --install
+loopx --version
+loopx doctor --deep
+```
+
+For an existing installation, finish active work, run update check and plan, then apply through the same owner. Read App and running Bot/service identities independently after restart; CLI success does not prove their activation. Preserve unknown operations and retained native journals before rollback. Desktop artifacts remain preview distribution; platform-specific installation, signing and update evidence is reported separately in the formal release.
+
+## 中文摘要
+
+沿原结果找到研究证据，让报告与恢复工作回到原会话。打开已有 Goal 的「研究」可阅读、搜索和比较保存记录；新分析、周期生成与账号切换仍须显式启用。升级、验证命令见上方。
+
+### 升级决策
+
+**谁需要升级：**使用研究历程、受管会话、周期报告与原生／Windows 宿主的 canonical 2.x 用户。仍依赖旧 Markdown authority 的集成须先准备迁移，生产 owner 可在完成前保留当前版本。
+
+**解决了什么：**原始证据难以跨版本追踪，完整报告与恢复请求可能丢失原投递上下文，竞态和过期 fixture 又掩盖真实工作状态。本版修复这些路径，验收与业务效果仍须独立读回。
+
+**是否有破坏性变更：**有。移除未迁移普通 authority 读 fallback 与退休协议／legacy bridge。先按既有备份、显式迁移与恢复契约处理。已有 canonical File／SQLite Goal 保留原 authority，不自动迁移或新增 writer；未配置的新 Goal 仍默认 SQLite／hard lease。差分上下文和本机 Explore mode 默认关闭；controller／executor-session RFC 仍是提案。
+
+**如何验证：**CLI 应显示 loopx 2.2.0，doctor 核对安装 owner／runtime；进入已有 Goal 对照一项原结果、原来源或完整原报告。保存配置、注册与 Todo 完成都不等于交付。
+
+**贡献者：**发布维护为 @huangruiteng、@loopx-agent；社区归因来自 v2.1.1 到候选源码及实际 merged PR，详见下方。
+
+### 状态内核与控制面
+
+完整 Todo 读取与共享决策复用 typed owner，status 沿 canonical source runtime 路由，原 Goal 创建可在中断后接续，不抹掉后续写入。replan、outcome review 与原结算保留身份；必须执行 Host 不等于普通交付授权。[#6874](https://github.com/loopx-project/loopx/pull/6874), [#7325](https://github.com/loopx-project/loopx/pull/7325), [#7462](https://github.com/loopx-project/loopx/pull/7462), [#7411](https://github.com/loopx-project/loopx/pull/7411), [#7298](https://github.com/loopx-project/loopx/pull/7298), [#7381](https://github.com/loopx-project/loopx/pull/7381), [#7496](https://github.com/loopx-project/loopx/pull/7496), [#7484](https://github.com/loopx-project/loopx/pull/7484), [#7486](https://github.com/loopx-project/loopx/pull/7486), [#7452](https://github.com/loopx-project/loopx/pull/7452), [#7470](https://github.com/loopx-project/loopx/pull/7470)。
+
+### 能力与工作流
+
+研究页先展示结果、报告与问题，再深入历史、数量与原引用；搜索和比较复用保存译文，导出原记录。新准备持久化忠实本地化指导，旧冻结方法、失败与用量保留。交付分析 producer 和打包 reader，科学校准另验。[#7051](https://github.com/loopx-project/loopx/pull/7051), [#7129](https://github.com/loopx-project/loopx/pull/7129), [#7370](https://github.com/loopx-project/loopx/pull/7370), [#7412](https://github.com/loopx-project/loopx/pull/7412), [#7423](https://github.com/loopx-project/loopx/pull/7423), [#7428](https://github.com/loopx-project/loopx/pull/7428), [#7444](https://github.com/loopx-project/loopx/pull/7444), [#7451](https://github.com/loopx-project/loopx/pull/7451)。
+
+显式日／周报告沿原会话、原 Task／Turn 与独立验证和完整正文送达 owner；已知准入拒绝或缓存的合格结果仅恢复原许可剩余步骤，未知业务／发送效果继续保留。完成 Task 的周期复用仍是实验性 backend／配置阶段。历史工作搜索、团队报告下载及原项目会话 peer 请求继续保留真实来源与完整 brief。[#7173](https://github.com/loopx-project/loopx/pull/7173), [#7179](https://github.com/loopx-project/loopx/pull/7179), [#7267](https://github.com/loopx-project/loopx/pull/7267), [#7288](https://github.com/loopx-project/loopx/pull/7288), [#7418](https://github.com/loopx-project/loopx/pull/7418), [#7449](https://github.com/loopx-project/loopx/pull/7449), [#7458](https://github.com/loopx-project/loopx/pull/7458), [#7041](https://github.com/loopx-project/loopx/pull/7041), [#7048](https://github.com/loopx-project/loopx/pull/7048), [#7228](https://github.com/loopx-project/loopx/pull/7228), [#7419](https://github.com/loopx-project/loopx/pull/7419), [#7495](https://github.com/loopx-project/loopx/pull/7495)。
+
+### 质量与测试
+
+fixture 一次初始化真实 canonical authority，后续走 CAS，保留唯一结算／回放和历史原字节断言。合成测试、PR 验证和最终发布资格分开；[正式发布页](https://github.com/loopx-project/loopx/releases/tag/v2.2.0)记录统一源码凭证及渠道读回，本文和候选本身不证明通过。历史失败、跳过和中断单独保留。[#7459](https://github.com/loopx-project/loopx/pull/7459), [#7499](https://github.com/loopx-project/loopx/pull/7499), [#7502](https://github.com/loopx-project/loopx/pull/7502), [#7506](https://github.com/loopx-project/loopx/pull/7506), [#7507](https://github.com/loopx-project/loopx/pull/7507)。
+
+### 基准与集成
+
+native benchmark 保留失败、partial result、阶段截止、实际模型路由和冻结 source／profile；新 heartbeat／Turn 默认 resume，显式 fresh 对照保留。source cohort、重试、差分和 checkpoint 均有独立边界，本发布不启动 benchmark。Pi 真实交互／RPC 输入暂停后续自动工作。DSH 有独立版本，源码兼容不代表已替换其公开 beta 包；Windows、原生账号及签名桌面更新各自验收。[#7036](https://github.com/loopx-project/loopx/pull/7036), [#7061](https://github.com/loopx-project/loopx/pull/7061), [#7072](https://github.com/loopx-project/loopx/pull/7072), [#7090](https://github.com/loopx-project/loopx/pull/7090), [#7281](https://github.com/loopx-project/loopx/pull/7281), [#7294](https://github.com/loopx-project/loopx/pull/7294), [#7400](https://github.com/loopx-project/loopx/pull/7400), [#7401](https://github.com/loopx-project/loopx/pull/7401), [#6862](https://github.com/loopx-project/loopx/pull/6862), [#7222](https://github.com/loopx-project/loopx/pull/7222), [#6854](https://github.com/loopx-project/loopx/pull/6854), [#7454](https://github.com/loopx-project/loopx/pull/7454), [#7497](https://github.com/loopx-project/loopx/pull/7497), [#7469](https://github.com/loopx-project/loopx/pull/7469)。
+
+本版不提出新的 benchmark 分数、长程效果或完整成本提升主张，也不声称执行了新的 stable／candidate 匹配效果实验。既有研究保留原 cohort 和限制；状态保留或过程可见不能独自证明收益。
+
+### 文档与兼容性
+
+Python 3.11+、Node 22.22.3+（推荐 24 LTS）。沿原安装 owner 更新；已有状态、lease 与覆盖保留。新 Goal 默认和旧 Goal 迁移不同，普通未迁移读取会显式拒绝。原生差分需要实际生命周期验证；checkpoint、重复 Task 和 controller／executor 的阶段范围不能冒充完整产品旅程。[#7032](https://github.com/loopx-project/loopx/pull/7032), [#7381](https://github.com/loopx-project/loopx/pull/7381), [#7441](https://github.com/loopx-project/loopx/pull/7441), [#7338](https://github.com/loopx-project/loopx/pull/7338), [#7409](https://github.com/loopx-project/loopx/pull/7409), [#7429](https://github.com/loopx-project/loopx/pull/7429), [#7416](https://github.com/loopx-project/loopx/pull/7416), [#7288](https://github.com/loopx-project/loopx/pull/7288)。
+
+### 社区贡献者
+
+- [@BigDataDZ](https://github.com/BigDataDZ) — Windows 安装、时区、Unicode 与 PowerShell，以及 canonical 和打包旅程回归. [#7454](https://github.com/loopx-project/loopx/pull/7454), [#7453](https://github.com/loopx-project/loopx/pull/7453), [#7222](https://github.com/loopx-project/loopx/pull/7222), [#6862](https://github.com/loopx-project/loopx/pull/6862), [#6805](https://github.com/loopx-project/loopx/pull/6805), [#7441](https://github.com/loopx-project/loopx/pull/7441), [#7364](https://github.com/loopx-project/loopx/pull/7364), [#7232](https://github.com/loopx-project/loopx/pull/7232), [#7230](https://github.com/loopx-project/loopx/pull/7230), [#7225](https://github.com/loopx-project/loopx/pull/7225), [#7326](https://github.com/loopx-project/loopx/pull/7326).
+- [@Dante-dan](https://github.com/Dante-dan) — 绑定准确会话与运行证据的手动诊断. [#7349](https://github.com/loopx-project/loopx/pull/7349).
+- [@Duang777](https://github.com/Duang777) — Goal 标识校验、等价 lease 范围与回归前置. [#7192](https://github.com/loopx-project/loopx/pull/7192), [#7204](https://github.com/loopx-project/loopx/pull/7204), [#7209](https://github.com/loopx-project/loopx/pull/7209).
+- [@JasonBuildAI](https://github.com/JasonBuildAI) — 已完成 Turn 的停止竞态、canonical 创建恢复、Windows 签名更新、DSH 启动说明及 Unicode／隐私修复. [#7477](https://github.com/loopx-project/loopx/pull/7477), [#7381](https://github.com/loopx-project/loopx/pull/7381), [#6854](https://github.com/loopx-project/loopx/pull/6854), [#7473](https://github.com/loopx-project/loopx/pull/7473), [#7247](https://github.com/loopx-project/loopx/pull/7247), [#7251](https://github.com/loopx-project/loopx/pull/7251), [#7439](https://github.com/loopx-project/loopx/pull/7439).
+- [@Jiaqiiii523](https://github.com/Jiaqiiii523) — 原生绑定会话回归与飞书上传确认. [#7293](https://github.com/loopx-project/loopx/pull/7293), [#7395](https://github.com/loopx-project/loopx/pull/7395).
+- [@Jim-jimu](https://github.com/Jim-jimu) — Pi 输入暂停，以及 Explore 输入与零证据语义. [#7401](https://github.com/loopx-project/loopx/pull/7401), [#7303](https://github.com/loopx-project/loopx/pull/7303), [#7143](https://github.com/loopx-project/loopx/pull/7143), [#7239](https://github.com/loopx-project/loopx/pull/7239).
+- [@hhyykk](https://github.com/hhyykk) — 共享 TypeScript 决策归属、完整 canonical 读取、恢复、排队会话归属与显式来源内容固定. [#7462](https://github.com/loopx-project/loopx/pull/7462), [#7325](https://github.com/loopx-project/loopx/pull/7325), [#7298](https://github.com/loopx-project/loopx/pull/7298), [#6874](https://github.com/loopx-project/loopx/pull/6874), [#6855](https://github.com/loopx-project/loopx/pull/6855), [#7321](https://github.com/loopx-project/loopx/pull/7321), [#7386](https://github.com/loopx-project/loopx/pull/7386), [#7136](https://github.com/loopx-project/loopx/pull/7136), [#7137](https://github.com/loopx-project/loopx/pull/7137), [#7131](https://github.com/loopx-project/loopx/pull/7131).
+- [@mikamikasuki](https://github.com/mikamikasuki) — 飞书时间戳精度与编码本地路径脱敏. [#6084](https://github.com/loopx-project/loopx/pull/6084), [#5978](https://github.com/loopx-project/loopx/pull/5978).
+- [@songoow](https://github.com/songoow) — 移动任务交互、受管观察者归属、报告路由与离线分析取消. [#7410](https://github.com/loopx-project/loopx/pull/7410), [#7354](https://github.com/loopx-project/loopx/pull/7354), [#7353](https://github.com/loopx-project/loopx/pull/7353), [#7352](https://github.com/loopx-project/loopx/pull/7352), [#7415](https://github.com/loopx-project/loopx/pull/7415).
+- [@steven-kid](https://github.com/steven-kid) — 原始证据搜索与版本比较、历史工作搜索及报告下载. [#7370](https://github.com/loopx-project/loopx/pull/7370), [#7129](https://github.com/loopx-project/loopx/pull/7129), [#7228](https://github.com/loopx-project/loopx/pull/7228), [#7041](https://github.com/loopx-project/loopx/pull/7041), [#7048](https://github.com/loopx-project/loopx/pull/7048), [#7297](https://github.com/loopx-project/loopx/pull/7297).
+- [@xianth123](https://github.com/xianth123) — 周期报告字段规则与 NoKV 资格的单一归属. [#7210](https://github.com/loopx-project/loopx/pull/7210), [#7155](https://github.com/loopx-project/loopx/pull/7155).
+
+### 可选能力启用与使用
+
+#### Research reports and original evidence
+
+**启用：** 进入已有 Goal 的「研究」，让已授权 Agent 准备固定来源 pack，再显式生成所选报告。新默认准备使用 synthesis 第2版与当前忠实本地化指导；第3／4版需显式接续 pack。打开历史、搜索、比较或引用只读。
+
+**验证：** 对照保存的发现、原始来源与记录版本，核对负结果、缺失覆盖、用量和 pack 状态。搜索与比较复用已保存译文，导出保留匹配的原记录。
+
+**停用 / 回退：** 按原 analysis 目录取消。后续可选回旧 pack／配置，或显式旧 encoding／synthesis；保留原成功、失败与用量。结果不明时先读回原操作再决定重试。
+
+**权限边界：** 来源须有授权并通过完整 hash 校验。显式生成可调用模型和计费；引用绑定不证明内容蕴含、科学有效性，也不授权实验。旧冻结请求不会自动升级。
+
+**文档：** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/docs/reference/trajectory-assessment.md)
+
+```bash
+loopx dashboard
+loopx benchmark trajectory-packs --goal-id "$GOAL_ID" --format json
+loopx benchmark trajectory-assessment-status --directory "$ANALYSIS_DIR" --format json
+# Explicit cancellation of that original operation:
+loopx benchmark trajectory-assessment-cancel --directory "$ANALYSIS_DIR" --format json
+```
+#### Codex differential context
+
+**启用：** 默认关闭。在「设置 → 本机 → 能力 → 差分上下文 → Codex」开启，沿原精确 revision 事务保存。受支持的 Codex App heartbeat、SSH Goal 与显式 benchmark heartbeat，还须为下一次受支持会话完成准确 hooks／配置。保存偏好不初始化已载入线程。
+
+**验证：** 读回机器设置，针对实际 Goal／Agent 生成 context-config，并验证原生生命周期和完整 digest 绑定分页。设置成功或 hooks/list 可发现不等于实际差分使用、模型保留。
+
+**停用 / 回退：** 在同一编辑器关闭，或显式 --context-delivery off；撤回原生设置时删除所生成 hooks、developer instructions 与输出覆盖，恢复旧宿主值。保留原完整 capture 供恢复。
+
+**权限边界：** 原生连续性当前仅支持 POSIX。原生完整／后续读取使用既有 64000-byte profile；混合 stdout 中完整 JSON 记录仍须通过 trusted capture 验证。不确定或丢失连续性时恢复同一完整原件；展示不重新准入、不新增工作权。MCP／Claude 机器解析仍读 raw output；不声明费用或效果改善。
+
+**文档：** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/docs/reference/required-work-context.md#machine-default)
+
+```bash
+loopx machine-config inspect
+loopx quota context-config --codex-app --goal-id "$GOAL_ID" --agent-id "$AGENT_ID"
+# Raw internal/machine consumption and explicit off:
+loopx --format json quota should-run --goal-id "$GOAL_ID" --agent-id "$AGENT_ID" --context-delivery off
+```
+#### Explore device defaults
+
+**启用：** 默认关闭。在「设置 → 本机 → Explore Harness」选择关闭、证据或规划，预览并应用。仅 mode 由无显式覆盖的已有／新 Goal 实时继承；profile、组合与执行权限仍属于 Goal。
+
+**验证：** 在 Goal 设置核对有效 mode 及来源；材料图、结果日志和 rollout 须来自同一选定 runtime。配置成功不证明证据被采用。
+
+**停用 / 回退：** 把本机 mode 设为 Off 可关闭继承者；特定 Goal 可显式 Off。「恢复继承」或 configure-goal --clear-explore-configuration 沿原预览／应用事务删除该 Goal 的 Explore 覆盖。
+
+**权限边界：** Planning 提供证据与分支指导，不授予 spawn、lease、quota、凭据、调度或对外发布权；各自 owner 继续决定。
+
+**文档：** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/loopx/capabilities/explore/README.md#machine-default)
+
+```bash
+loopx machine-config inspect
+loopx configure-goal --goal-id "$GOAL_ID" --clear-explore-configuration
+```
+#### Original-session scheduled reports
+
+**启用：** 须显式启用。已有受管 Agent 在「Goal 设置 → 能力中心 → 周期报告」选 weekly-progress、已有「报告会话」，设置日／周日历和可选首日后预览／应用。已准备的私有管家走「设置 → 飞书 → 原管家 → 原生定期监控」；仅准备身份不会开启。
+
+**验证：** 重新载入收件会话、日历与执行状态；从原会话打开「本期完整报告」，核对完整匹配正文。Task 完成、模型输出或发送尝试都不能替代送达；私聊另核对全部正文分段。
+
+**停用 / 回退：** 在同一配置关闭 Enable 暂停。保留冻结或未知操作走原恢复，不改目的地、不重复发送。已知独立失败窗口仅沿既有合格事务清理，不能重跑该失败周期。
+
+**权限边界：** 生成遵循原 actor 的授权、lease 和 quota，并可消耗模型 token。目的地绑定原会话；未读或新增来源不授予新收件范围。任意自然语言周期任务及完整统一 Agent 旅程仍有独立验收。
+
+**文档：** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/docs/product/periodic-reports.md)
+
+```bash
+loopx --version
+loopx doctor --deep
+loopx dashboard
+```
+#### Repeating a completed native Task
+
+**启用：** 实验性 backend／配置阶段。沿既有 Goal 设置 JSON 编辑器显式配置 periodic_report：enabled=true、profile_preset=session-task、实际 managed-session 路由与已完成的 source_todo_id，再设原生日历并应用精确预览 revision。完整对象见规范文档。
+
+**验证：** 读回同一配置及原 managed Session 的 scheduled_task 检查；每期须独立 Task 验证、native 结算和完整 Core 答复均读回后才确认。
+
+**停用 / 回退：** 设 enabled=false 暂停并保留计划、证据；已知失败窗口仅走支持的清理事务。仍有 session-task 窗口时，不降级为无法读取该完成回执的旧 owner。
+
+**权限边界：** 不能输入任意新任务、脚本、validation argv 或外部目的地；复用已授权完成 Task 的范围、lease、quota 和原 Session。此阶段不等于完整前端验收或生产定时采用。
+
+**文档：** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/docs/product/periodic-reports.md#repeat-an-existing-native-task-in-a-managed-session)
+
+```bash
+loopx doctor --deep
+loopx dashboard
+```
+#### Native Codex account handoff
+
+**启用：** 在同一 Python 环境安装可选包并重启实际 App／Chat owner；在「设置 → 模型 Provider → Codex 原生账号」显式开启自动切换。客户端退出／重启和强退仍是独立权限，未授权时关闭。
+
+**验证：** 用 status、clients 及页面的最新额度和「登录占用」读回；共享同一策略的 App／CLI watch 只选出一个 observer。诊断中的责任 PID 不等于可终止身份。
+
+**停用 / 回退：** 关闭自动切换，独立关闭重启／强退。部分失败后沿原 native owner 核对并恢复服务 intent；停止观察不删除进行中的凭据事务。
+
+**权限边界：** 保留 native 账号 owner、macOS／POSIX 前置；仅可重启身份核验通过的原进程／服务，未知或无托管 owner 的占用继续等待。不购买额度、不使用重置券、不任意杀进程、不重放业务。
+
+**文档：** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/packages/loopx-codex-provider-routing/NATIVE.md)
+
+```bash
+python3 -m pip install ./packages/loopx-codex-provider-routing
+loopx-codex-accounts status
+loopx-codex-accounts clients
+```
+#### Explicit research checkpoints
+
+**启用：** CLI／Host 阶段，须显式调用。准备已静止、已结算的 canonical 源、合格 native Codex profile、完整声明的工作区文件和全新物理目录。先不加 --execute 预览，再仅执行已核对请求。
+
+**验证：** 先验证返回的 checkpoint SHA，再独立准入新 receiver，在当前 claim／lease 下采用上下文；核对 native cursor、source／profile witness、声明文件 bytes 和原结算。捕获的历史不授予工作权。
+
+**停用 / 回退：** 后续不提供 checkpoint 请求／controller 即停用。保留原点与未知操作，按原身份恢复。receiver 的 model／effort 切换需显式目标配置，并保留密封源 profile。
+
+**权限边界：** 不涵盖任意 Host、进程内存、普通 Goal 自动捕获或灾难恢复。导出卷须保留大小写／Unicode 文件名差异；只捕获声明文件，不因捕获而公开凭据。普通用户打包前端仍未完成。
+
+**文档：** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/docs/reference/research-checkpoint.md)
+
+```bash
+loopx research-checkpoint capture --help
+loopx --format json research-checkpoint verify --root "$CHECKPOINT_ROOT" --expected-sha256 "$CAPTURE_DIGEST"
+```
+#### Benchmark source and provider profiles
+
+**启用：** 仅在另一个已授权实验中按命令启用。沿规范 source 命令准备／冻结 SForge cohort，复现时指定完整 SHA。新 heartbeat／Turn 默认 resume，显式 fresh 仍保留为对照；差分与 HTTP429 重试窗口独立显式指定，重试默认零。
+
+**验证：** 读回冻结 source receipt、实际模型路由、原阶段截止时间与 typed native outcome。failed／usage_limited／unknown 仅保留 partial_result.json，不能伪装成完成的 final_result.json。
+
+**停用 / 回退：** 新对照使用新 log 目录和显式旧 SHA／配置，不替换既有 cohort。省略差分、重试窗口设零可保留完整传输／直通行为；保留旧尝试和预算时钟。
+
+**权限边界：** source 准备不启动 worker 或 judge。模型、job、评估与预算须由实验独立授权；比较须对齐 judge／task／scoring 源、完整实耗和反馈。改默认值不重认证历史分数、不增加评估次数；本发布不启动新 benchmark。
+
+**文档：** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/benchmark/edgebench/README.md)
+
+```bash
+python3 -m benchmark.edgebench.source --help
+python3 -m benchmark.edgebench.run --help
+```
+#### Explicit source-content pins
+
+**启用：** 仅通过既有私有 Goal authority_sources 条目显式记录已接受的 path 与内容 sha256。source-reference hash 是另一类值；普通 bootstrap --goal-doc 仍可变，不按文件名或扫描自动固定内容。
+
+**验证：** 固定后运行原 Goal 范围 check／status；内容变动、缺失或不可读须可见。只读文件 adapter 不修文件、不更新接受的 hash。
+
+**停用 / 回退：** 恢复已接受 bytes，或沿既有授权 registry revision 更新／删除该显式内容 pin；保留其他来源与私有 registry 边界。
+
+**权限边界：** 不引入软件策略自动发现、AST／regex 义务执行、文档锁或 memory 写入；固定来源不授予执行／发布权。
+
+**文档：** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/docs/architecture.md)
+
+```bash
+loopx --registry "$GOAL_REGISTRY" check
+```
+#### Desktop preview and signed updates
+
+**启用：** 从正式 Release 安装匹配且校验通过的桌面制品。Windows 签名更新限 NSIS 安装和 main channel；MSI 与 Windows stable 更新仍手动／不可用。无 updater 的旧 build 需显式替换一次。macOS 后台准备在下一次正常打开应用时生效，不重启活跃工作区。
+
+**验证：** 分别核对 App shell 版本、channel、签名 feed 及合格 service／runtime 身份；检查更新保留独立结果，不替代本地启动读回。CLI 版本不能证明 native shell。
+
+**停用 / 回退：** 更新不可用或失败时保留当前合格 App，仅走对应平台已资格化的 native 恢复／更新路径；Windows App 回退／修复仍手动或不可用。结果不明时保留原维护 journal。
+
+**权限边界：** 桌面仍是预览。minisign 更新校验与 Windows Authenticode、Apple notarization、本机安装资格分别判断；Windows 可能显示 SmartScreen。安装／更新不授予 Goal／provider 权限，也不重放中断业务。
+
+**文档：** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/apps/desktop/loopx-control-plane/README.md)
+
+```bash
+gh release view v2.2.0 --repo loopx-project/loopx
+loopx --version
+loopx doctor --deep
+```
+#### DSH source plugin
+
+**启用：** 本版源码兼容修复属于独立版本的 DSH plugin。从相应 release checkout 进入 packages/dsh-loopx-plugin，针对一个明确 DSH home／host 执行规范 install.sh，启动前读回该 host 配置。既有已发布 beta 包内容保持冻结。
+
+**验证：** 在所选 DSH host 的准确 Session 调用已安装 loopx skill，核对唯一 Goal／Agent 绑定后再依赖 GoalBar／Driver；仅安装不激活自动继续。
+
+**停用 / 回退：** 从同一 host／profile 移除 dsh-loopx-plugin，停止其 Driver／GoalBar，不删除 LoopX 状态、绑定或 skills。仅在 DSH 停止且 plugin 移除后清理独立 runtime。
+
+**权限边界：** 源码 dependency／MCP override 不修补另装的 DSH binary。原 Session 拥有输入与工具，仅 LoopX 准入决定后续工作；安装不授予 provider key 或独立调度／Goal 权限。
+
+**文档：** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/packages/dsh-loopx-plugin/README.md)
+
+```bash
+cd packages/dsh-loopx-plugin
+./install.sh
+# Use the same qualified DSH host/profile for removal:
+dsh plugin --profile web remove dsh-loopx-plugin
+```
+#### Session-bound reliability diagnostics
+
+**启用：** 实验性被动 L1 观察仍默认关闭，仅对显式授权的原 Session 使用规范中独立 dsh-loopx-plugin/observer 入口。当前手动读取须提供准确 provider／observer／session、typed run_identity、当前 as-of 和最大观测年龄。
+
+**验证：** 从同一次 ledger 观察读取 status 与 integrity receipt；过期、错绑定、损坏或不完整保留 unavailable。空或旧 ledger 不证明当前运行健康。
+
+**停用 / 回退：** 停用独立 observer 入口可停止新观察，保留 ledger／receipt。省略 expected-binding 只是 legacy readback，不能改称当前绑定资格通过。
+
+**权限边界：** Observer 不能发送、调度、gate、retry、stop、resume 或改 worker state；仅保留无内容诊断，不收原会话／工具正文。Adapter fidelity、实测开销与 P0 exit 仍独立待验。
+
+**文档：** [Versioned contract](https://github.com/loopx-project/loopx/blob/v2.2.0/loopx/capabilities/reliability_diagnostics/README.md)
+
+```bash
+loopx reliability-diagnostics status --goal-id "$GOAL_ID" --with-receipt --format json --expected-binding "$EXPECTED_BINDING_JSON" --as-of "$AS_OF" --max-observation-age-ms 60000
+```
+
+### 安装与完成核对
+
+沿上方安装／更新命令操作。核对 CLI 与 App／服务的独立版本和 owner、一项原结果／原报告的完整返回，以及所启用 provider 的停用路径。先保留未知操作与 native journal，再决定回退；桌面包仍为预览，各平台签名、安装和更新证据以正式发布页为准。