Merge pull request #1551 from deepseek-harness/worktree/context-source-cards

feat(web): split context injection into producer-declared forms
2026-08-06 12:53:03 +08:00
parent 0865926c38 851fe793c4
commit 8c65d2da3d
79 changed files with 1993 additions and 277 deletions
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-04-web-context-source-and-steer-marks.md
+2026-08-04-web-context-source-and-steer-marks.md: 9070ea6ed34fffecd9fd2b90275bd31155100c75
+2026-08-04-web-context-source-and-steer-marks.zh.md: 9d7c7c0a34587071e281ff8b2cb77e359a1580c1
@@ -0,0 +1,49 @@
+# Agent Note: Web transcript marks context source, recall, and steering
+
+Status: implemented
+
+English | [中文](2026-08-04-web-context-source-and-steer-marks.zh.md)
+
+## Problem
+
+Everything a producer adds to the model-facing conversation reached the Web transcript as one of two anonymous shapes. Every logged non-user `user/message` — the skill catalog, the runtime snapshot, reconciled `AGENTS.md` instructions, a guard notice, a subagent report, a cross-session snapshot — collapsed into one identical `上下文注入` row, so a reader could not tell what had been added without expanding each row and reading raw JSON. Mid-turn steering was worse: it rendered in exactly the bubble a turn-opening prompt uses, leaving the transcript unable to say which message interrupted a running turn.
+
+The distinctions are already durable. `user/message.source` is the merge-extensible provenance every producer must supply, while `agent/inbox/spliced` records whether an identified message entered and left `next-turn` or `next-step`; only the presentation discarded them. The terminal transcript this Web UI replaced did name each card's producer, so the Web surface was a regression for the same log.
+
+## Decision
+
+The transcript names all three roles a non-prompt message can play — injected context, recalled session, and steering.
+
+`TranscriptAdapter` and the history fold attach a `provenance` view to every `ContextMessageNode`, computed by `contextProvenance()` from the durable source alone. It returns a `role` (`inject`, or `recall` for a cross-session snapshot) and a `label` naming the producer. `ContextInjectionRow` titles itself from the role and shows the label beside that title in `ToolRow`'s summary geometry, so the collapsed row already answers what was added and by whom; the 141px scrollport and truncation bound are unchanged from the [disclosure decision](2026-07-30-web-context-injection-disclosure.md). What renders inside that scrollport is chosen by the independent form axis added in the [context form decision](2026-08-05-context-form-vocabulary.md).
+
+**The label is read out of the log, never from a client-side table of producer names.** `workspace-instructions` is named by the distinct instruction paths it reconciled, `session-reference` by the titles of the sessions it read, a plugin source by its logged plugin id, and any other source by its own `kind` — the documented default arm for a merge-extensible union. A source carrying no readable kind degrades to an unnamed injection. A new or renamed producer is therefore identifiable without a client release, no label can go stale against the code, and a resumed, forked, or foreign log projects exactly like a live session.
+
+`recall` covers `session-reference` because that is the one shipped source that lifts another session's material into this one. No Web leaf mounts `dsh-session-reference` today — it had only a terminal host — so the arm exists for log portability rather than for a bundled producer, and it is exercised by unit coverage rather than an assembled Web scenario.
+
+`MessageItem` captions durable and pending steering bubbles with `插话`. The runtime replays durable `agent/inbox/spliced` events and projects a user-origin `user/message` as `SteeringMessageNode` when that same message identity was claimed from `next-step`; a queued-turn claim stays a `UserMessageNode`, and a non-user next-step message stays context. This reverses one clause of [no steer entry or interjection chrome](../simplification/2026-07-31-web-ui-no-steer-entry-or-interjection-chrome.md), which removed the badge because the composer could not steer and the label named a gesture users could not perform. The composer gained a Steer gesture afterwards without amending that note; this decision supplies the product decision its reintroduction clause required, and corrects the stale facts left in it. The caption is the only steering chrome here: composer modes, the Queue dock's strict-steer action, and pending-steering lifecycle stay with their own owners.
+
+## Alternatives considered
+
+**Localize producer names in the client.** A dictionary keyed by plugin id would read better than `@deepseek-ai/dsh-system-prompt`, but it drifts silently on every rename, needs a client change per new producer, and cannot name a producer from a foreign log at all. Provenance the log already carries is worth more than prose the client invents.
+
+**Register presentations per source kind.** The disclosure decision deferred a keyed context-view slot until source-owned presentations emerged. Naming a row is not a distinct presentation, and a registry keyed on mounted producers would fail exactly where it matters — a resumed log whose producer is no longer mounted still has to render.
+
+**Compute the role and label on the host.** The host would have to attach a view to each event copy, duplicating what the durable source already states and adding a wire field per context message. The projection derives it once per node instead, where the transcript's other derived facts live.
+
+**Give steering its own row instead of a captioned bubble.** Steering is a user message that arrived mid-turn; a separate row shape would break the right-aligned reading rhythm and duplicate the bubble's copy and branch actions for no new information.
+
+**Extend the trajectory table with the same names.** Out of scope: the table's context cell has its own text derivation, and the issue asks for the conversation surface.
+
+## Testing
+
+- `packages/client/runtime` unit coverage pins each provenance arm, the label fallbacks when a name field is missing, empty, or wrongly typed, the unnamed degradation for a source with no readable kind, and steering reconstruction on reset and live append paths.
+- `packages/client/ui-conversation` jsdom coverage pins the role title, the producer label beside it, the label's survival while expanded, the roleless header, and the steering caption on both durable and pending bubbles.
+- The keyless assembled-Web goldens carry the named header and the steering caption, so the assembled transcript — not only component tests — proves the marks.
+
+## Consequences
+
+- A reader can attribute every non-prompt message in the transcript at a glance, and the header stays honest for logs this client version has never seen a producer for.
+- Producer names in the UI are package-shaped (`dsh-tool-skill`, `@deepseek-ai/dsh-system-prompt`) wherever the source carries only a plugin id. That is the cost of refusing a client-side name table; a producer that wants a better name records better provenance.
+- `ContextMessageNode` gains a required field, so every constructed node — including test fixtures — must supply it.
+- `SteeringMessageNode` remains a distinct presentation node even though the agent loop now records admitted steering as `user/message`; its identity comes from the durable inbox history rather than a separate message event.
+- The `recall` arm has no producer in a shipped Web leaf until a host mounts `dsh-session-reference`; it is reachable only through logs written elsewhere.
@@ -0,0 +1,49 @@
+# Agent Note：Web transcript 标出上下文来源、召回与 steering
+
+Status: implemented
+
+[English](2026-08-04-web-context-source-and-steer-marks.md) | 中文
+
+## Problem
+
+生产方向模型侧对话补充的一切内容，进入 Web transcript（文本记录）后只剩两种匿名形态。每一条已记录的非用户 `user/message`——skill 目录、运行时快照、经过对账的 `AGENTS.md` 指令、guard 提示、子 agent 汇报、跨会话快照——都塌缩成同一行 `上下文注入`，读者不逐行展开去读原始 JSON 就无从知道究竟注入了什么。steering（中途引导）的情况更糟：它渲染成与开轮提示完全相同的气泡，于是 transcript 无法说明哪一条消息打断了正在运行的轮次。
+
+这些区分本来就是持久事实。`user/message.source` 是每个生产方都必须提供的可合并扩展来源，`agent/inbox/spliced` 则记录有身份的消息是从 `next-turn` 还是 `next-step` 进入和离开；把这些事实丢掉的只有呈现层。被这套 Web UI 取代的终端 transcript 本来会写出每张卡片的生产者，因此面对同一份日志，Web 侧是一次倒退。
+
+## Decision
+
+transcript 为非提示消息可能承担的三种角色分别命名：注入上下文、召回会话、steering。
+
+`TranscriptAdapter` 与历史折叠为每个 `ContextMessageNode` 附加一份 `provenance` 视图，由 `contextProvenance()` 仅依据持久来源计算得出。它返回 `role`（`inject`，跨会话快照则为 `recall`）与命名生产者的 `label`。`ContextInjectionRow` 以角色作为标题，并按 `ToolRow` 摘要的几何在标题旁展示该名称，因此折叠态就已经回答了「注入了什么、由谁注入」；141px 滚动视口与截断上限沿用[展开项决策](2026-07-30-web-context-injection-disclosure.md)，未作改动。视口里渲染什么，则由[上下文形态决策](2026-08-05-context-form-vocabulary.md)引入的、相互独立的形态轴决定。
+
+**名称从日志中读出，绝不来自客户端维护的生产者名称表。** `workspace-instructions` 以它对账过的去重指令文件路径命名，`session-reference` 以它读取的会话标题命名，插件来源以其记录的插件 id 命名，其余来源则以自身的 `kind` 命名——这正是可合并扩展联合类型有文档记载的默认分支。没有可读 kind 的来源降级为无名注入。于是新增或重命名的生产者无需客户端发版即可辨识，任何名称都不会相对代码变味，恢复、fork 或来自外部的日志与实时会话的投影结果完全一致。
+
+`recall` 覆盖 `session-reference`，因为它是当前唯一会把另一个会话的材料搬进本会话的已发布来源。今天没有任何 Web 叶子挂载 `dsh-session-reference`——它此前只有终端宿主——因此该分支的存在是为了日志可移植性，而不是为了某个已打包的生产方，其覆盖来自单元测试而非组装后的 Web 场景。
+
+`MessageItem` 为持久与待处理的 steering 气泡加上 `插话` 标注。runtime 会重放持久 `agent/inbox/spliced` 事件；如果一条用户来源的消息以相同身份从 `next-step` 被领取，后续 `user/message` 就投影为 `SteeringMessageNode`。从排队轮次领取的消息仍是 `UserMessageNode`，非用户来源的 next-step 消息仍是上下文。这推翻了[取消 steer 入口与插话装饰](../simplification/2026-07-31-web-ui-no-steer-entry-or-interjection-chrome.md)中的一条结论。当时移除徽章，是因为 composer 无法 steer，标签指向了用户做不到的动作。此后 composer 获得了 Steer 手势，却没有同步修订那份 note；本决策提供了它在「重新引入」条款中要求的产品决策，并订正了其中留下的过时事实。标注是这里唯一的 steering 装饰：composer 模式、Queue dock 的严格 steer 操作、待处理 steering 的生命周期仍归各自的所有者。
+
+## Alternatives considered
+
+**在客户端本地化生产者名称。** 以插件 id 为键的字典读起来确实比 `@deepseek-ai/dsh-system-prompt` 好，但它会在每次重命名时悄悄失准，每新增一个生产者都要改客户端，而且对来自外部的日志根本无法命名。日志已经承载的来源，比客户端自己编出来的措辞更有价值。
+
+**按来源 kind 注册呈现。** 展开项决策把键控的 context-view 槽位推迟到出现由来源自有的呈现需求为止。为一行命名并不构成独立呈现，而以「已挂载的生产者」为键的注册表恰恰会在最要紧的地方失效——生产者已不再挂载的恢复日志同样必须渲染出来。
+
+**在 host 侧计算角色与名称。** 那需要为每份事件副本附加一个视图，重复陈述持久来源已经说明的事实，并为每条上下文消息增加一个 wire 字段。改由投影为每个节点计算一次，与 transcript 其他派生事实同处一地。
+
+**给 steering 独立的行而非带标注的气泡。** steering 是一条在轮次中途抵达的用户消息；独立行形会打断右对齐的阅读节奏，并且要为零新增信息重复气泡上的复制与分支操作。
+
+**把同一套名称扩展到 trajectory 表格。** 不在本次范围内：该表格的上下文单元格有自己的文本推导，而 issue 要求的是对话面。
+
+## Testing
+
+- `packages/client/runtime` 单元覆盖钉住每个来源分支、名称字段缺失／为空／类型不符时的回退、来源没有可读 kind 时的无名降级，以及 reset 和实时 append 路径上的 steering 重建。
+- `packages/client/ui-conversation` 的 jsdom 覆盖钉住角色标题、标题旁的生产者名称、展开后该名称的留存、无名时的标题形态，以及持久与待处理气泡上的 steering 标注。
+- 无密钥的组装 Web 黄金基线携带带名称的标题栏与 steering 标注，因此证明这些标识的是组装后的 transcript，而不只是组件测试。
+
+## Consequences
+
+- 读者一眼即可归因 transcript 中每一条非提示消息；即便面对本客户端版本从未见过其生产者的日志，标题栏依然如实。
+- 只要来源仅携带插件 id，UI 中的生产者名称就呈现为包名形态（`dsh-tool-skill`、`@deepseek-ai/dsh-system-prompt`）。这是拒绝客户端名称表的代价；想要更好名称的生产者应当记录更好的来源。
+- `ContextMessageNode` 增加了一个必填字段，因此每一处构造该节点的代码——包括测试 fixture——都必须提供它。
+- 即使 agent loop 现在把已经接纳的 steering 记录为 `user/message`，`SteeringMessageNode` 仍是独立的呈现节点；它的身份来自持久 inbox 历史，而不是独立消息事件。
+- 在某个宿主挂载 `dsh-session-reference` 之前，`recall` 分支在已发布的 Web 叶子中没有生产者，只能通过别处写入的日志抵达。
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-08-05-context-form-vocabulary.md
+2026-08-05-context-form-vocabulary.md: c111acfec4fa85fe9e25adeb615371d65098f20f
+2026-08-05-context-form-vocabulary.zh.md: d4da218c4c6026eb875513c2acbfcd18ced8faa1
@@ -0,0 +1,64 @@
+# Agent Note: Producer-declared context forms
+
+Status: implemented
+
+English | [中文](2026-08-05-context-form-vocabulary.zh.md)
+
+## Problem
+
+Every logged non-user `user/message` rendered through one body: the whole message serialized as inline JSON. A reader opening a row met `{ "content": [ { "type": "text", "text": "…\n\n…" } ], "source": { … } }`, where the escaping had collapsed the only thing worth reading — the model-facing prose — into a single line, and the provenance sat inside the same blob.
+
+Naming the producer in the header (the [source and steer marks decision](2026-08-04-web-context-source-and-steer-marks.md)) fixed *who added this*. It could not fix *what kind of thing was added*, because nothing in the log said so. Injected context is not one shape: a reconciled `AGENTS.md`, a catalog of available skills, a runtime policy snapshot, and a subagent's report are as different from each other as a terminal card is from a diff card, yet all four presented as the same wall of escaped JSON.
+
+The tool surface already solved this shape. `ToolCallView` has three cards, not one per tool, and a tool declares which card its call is. Context had no equivalent: no vocabulary of shapes, and no way for a producer to say which one it emits.
+
+## Decision
+
+`MessageSource` gains an optional producer-declared `form: ContextForm` — a small tagged vocabulary of information *shapes*, independent of `kind`:
+
+- `kind` answers **who produced this** and remains pure provenance.
+- `form` answers **what shape of information it is**. Several producers may share one form, and one producer may emit more than one over a session.
+
+The vocabulary is semantic, never visual. A value states that the content is a file's instructions or a catalog of available items; colors, icons, ordering, and collapse defaults are the consumer's business and must not enter the union. It grows one value at a time, as producers gain the structured fields their form needs. This release declares two:
+
+**`instructions`** — instructions read out of workspace files. `workspace-context` declares it on both the startup baseline and later deltas; its existing `changes[]` already carried the paths, actions, and digests the presentation needs, so no field was added. The body lists the reconciled files above the text, and keeps the `<system-reminder>` framing verbatim: the framing is part of what the model read, so hiding it would misreport the request.
+
+**`catalog`** — a catalog of items available this session, republished as it changes. `dsh-tool-skill` moves off the shared `plugin` kind to its own `skill-catalog` source carrying `entries` (the exact `name`/`description` pairs published) and `update` on a replacement, which the body renders as a replacement notice. The body lists those entries instead of re-parsing the `<available_skills>` block out of the prose.
+
+Entries record the published fact **unescaped**. The pseudo-XML escaping belongs to the `<available_skills>` frame, which exists for the model, so it is applied when rendering that frame and never stored; otherwise a consumer would have to know the frame's encoding to display a description containing `<`, and the same frame knowledge this decision removes would leak back in another shape. `escapeText` is deterministic and injective, so digesting the unescaped entries preserves republish semantics exactly, and the model-facing text stays byte-identical.
+
+That move also relocates catalog **identity**: the republish digest now covers the durable entries rather than the rendered text, so the model-facing framing can no longer decide whether a republish is needed, and the text-slicing that recovered entries from a logged message is gone. A resumed session whose newest catalog predates this change republishes once, which the pre-release stance permits. One case does not self-heal: if that old-format catalog is the only one and the current view has no skills, the plugin sees no published catalog and emits no tombstone, so the model keeps a stale catalog nothing replaces. The pre-release stance ("backends reject old on-disk formats") permits it; it is recorded here rather than left to the optimistic path.
+
+Both readers are **all-or-nothing**: one unreadable entry disqualifies the record rather than being dropped, because a body that replaces the model-facing text must not present a confident but incomplete account of what the model read. The row's form marker reports what actually rendered, not what was declared.
+
+The producer side validates the same durable data with the same posture. `catalogHistory` reads `source.entries` out of `agent.session.events`, which on resume or fork is a JSONL/SQLite seed whose validation only guarantees a source object with a non-empty `kind` — no per-kind field is checked. An unreadable catalog is therefore skipped as "not this plugin's record", the posture the replaced content digest had; throwing there would fail every later step of that session at the latest, least diagnosable point.
+
+Everything else — including a form this UI version does not present, a form absent from the source, and a `catalog` whose entries are unusable — renders the **opaque** body: the model-facing text with its real line breaks, then the remaining provenance as fields. Opaque is the documented default, not a leftover bin. A resumed, forked, or foreign log must render whether or not its producer is mounted here, which is also why the classification lives in the durable source rather than in a client-side table keyed by producer.
+
+## Why not a presenter registry
+
+The tool seam pairs its vocabulary with `presentCall(args)`, a host-side pure function each tool implements. Context deliberately has no equivalent, because the input differs in ownership: a tool's `args` are generated by the **model** against a model-facing schema, so a translation step is unavoidable; a context `source` is constructed by the **producing plugin** itself, under no external constraint, and can simply record the facts a presentation needs. Adding a registry would have bought a translation nobody needs, at the cost of a host computation point, a wire field per context message, and a browser bundle for every producing package (the client purity gate forbids host packages from contributing components).
+
+## Alternatives considered
+
+**Map source kinds to renderers in the client.** Cheapest to write and requires no format change, but it puts producer knowledge back in the client: every new kind then needs a client release to render as anything but opaque, and a foreign log cannot be classified at all. It also reintroduces exactly the coupling the [source and steer marks decision](2026-08-04-web-context-source-and-steer-marks.md) removed for labels.
+
+**Reuse `kind` as the form.** One discriminant is simpler, and `workspace-instructions` is already 1:1 with its form. It breaks on the shared shapes: three producers emit runtime snapshots today, and folding them into one kind would erase their provenance. Two axes keep provenance exact while letting presentations be shared.
+
+**Let the client parse the model-facing prose.** The entries and file sections are visibly structured in the text. Parsing them couples the presentation to prompt wording, so every reword silently breaks a card — the same reason catalog identity moved off the text.
+
+**Render instructions as Markdown.** The body is a Markdown file and would read better rendered. The text also carries `<system-reminder>` framing, which the Markdown renderer drops as raw HTML, so a Markdown body would silently hide part of what the model read. Deferred until the producer records per-file content structurally.
+
+## Testing
+
+- `packages/client/runtime` pins the form projection, including the unknown, empty, wrongly-typed, and absent values that must degrade to opaque.
+- `packages/client/ui-conversation` pins each body: the opaque body's preserved line breaks and provenance fields, the instructions body's file list and verbatim framing, the catalog body's entry list, and a catalog with unusable entries falling back to opaque.
+- `packages/skill/tool-skill` pins the new source on first publication and replacement, republish behavior driven by the durable entries, and a malformed durable catalog leaving step observation intact.
+- The keyless assembled-Web seeded-history scenario expands a real `instructions` context in Chromium and asserts its file list, verbatim framing, and the unchanged disclosure geometry. `catalog` has no assembled coverage: the hermetic scaffold publishes no skills, so no catalog reaches a browser scenario.
+
+## Consequences
+
+- A reader can tell what was added without expanding, and reading it no longer means reading escaped JSON.
+- The durable `MessageSource` now carries a semantic classification beside provenance. The boundary is load-bearing: facts and shape only, never presentation. A producer that wants a better card records better facts.
+- Catalog identity no longer depends on the model-facing prose, deleting the text-slicing path that could mistake a reworded catalog for a changed one.
+- Five forms from the surveyed taxonomy (`snapshot`, `relay`, `recall`, `notice`, and the unclassified remainder) are not declared yet; their producers render opaque until they record the fields their form needs.
@@ -0,0 +1,64 @@
+# Agent Note：由生产方声明的上下文形态
+
+Status: implemented
+
+[English](2026-08-05-context-form-vocabulary.md) | 中文
+
+## Problem
+
+每一条已记录的非用户 `user/message` 都通过同一个内容区渲染：把整条消息序列化成内联 JSON。读者展开一行，看到的是 `{ "content": [ { "type": "text", "text": "…\n\n…" } ], "source": { … } }`——转义把唯一值得读的东西（面向模型的散文）压成了一行，而来源信息又和它挤在同一坨里。
+
+在标题栏写出生产者（[来源与 steer 标识决策](2026-08-04-web-context-source-and-steer-marks.md)）解决了「这是谁加的」。它解决不了「加进来的是什么东西」，因为日志里根本没有这句话。注入上下文不是一种形状：对账后的 `AGENTS.md`、可用 skill 的目录、运行时策略快照、子 agent 的汇报，彼此之间的差别不亚于终端卡片与 diff 卡片，然而这四者呈现出来是同一堵转义 JSON 的墙。
+
+工具面早就解决过同一个形状问题。`ToolCallView` 只有三种卡片，而不是每个工具一种，由工具自己声明本次调用属于哪一种。上下文没有对应物：既没有形状词汇表，生产方也无从声明自己发出的是哪一种。
+
+## Decision
+
+`MessageSource` 新增一个可选、由生产方声明的 `form: ContextForm`——一份关于信息**形状**的小型 tagged 词汇表，与 `kind` 相互独立：
+
+- `kind` 回答**由谁产生**，保持纯粹的溯源语义。
+- `form` 回答**这是何种形态的信息**。多个生产方可以共用一种形态，一个生产方在一次会话中也可以发出多种。
+
+该词汇表是语义的，绝不涉及视觉。取值只陈述「内容是某个文件的指令」或「是一份可用项目录」；颜色、图标、排序、默认折叠状态归消费方管，不得进入这个联合类型。它随生产方补齐各自形态所需的结构化字段而逐个增长。本次声明两个：
+
+**`instructions`**——从工作区文件中读出的指令。`workspace-context` 在启动基线与后续增量上都声明它；其既有的 `changes[]` 已经携带了呈现所需的路径、动作与 digest，因此没有新增字段。内容区在正文之上列出对账过的文件，并原样保留 `<system-reminder>` 包装：那层包装本就是模型读到的一部分，隐藏它会歪曲这次请求。
+
+**`catalog`**——本会话可用项的目录，随变化重新发布。`dsh-tool-skill` 从共享的 `plugin` kind 迁到自有的 `skill-catalog` 来源，携带 `entries`（本次发布的 `name`／`description` 对）与替换目录上的 `update`，后者由内容区渲染成替换提示。内容区直接列出这些条目，不再从散文里反解 `<available_skills>` 块。
+
+条目记录的是**未转义**的发布事实。伪 XML 转义属于 `<available_skills>` 这层为模型而设的框架，因此只在渲染该框架时施加、从不存储；否则消费方要正确展示含 `<` 的描述就得知道框架的编码方式，本决策刚移除的框架知识会换一种形式泄漏回来。`escapeText` 确定且单射，故对未转义条目取 digest 与此前完全等价，重新发布语义不变，面向模型的文本逐字节不变。
+
+这次迁移同时挪动了目录的**身份**：重新发布用的 digest 现在覆盖持久条目而非渲染文本，于是面向模型的包装再也无法左右是否需要重新发布，那段从已记录消息里切出条目的文本切分逻辑也随之删除。若恢复的会话中最新目录早于本次改动，会重新发布一次——发布前阶段的姿态允许这样做。有一种情形不会自愈：当那份旧格式目录是唯一的一份、且当前视图没有任何 skill 时，插件看不到已发布目录，也就不会发出 tombstone，模型手里会留着一份无人替换的过期目录。发布前阶段的姿态（「后端拒绝旧的磁盘格式」）允许这一点；此处如实记录，而不是只写乐观路径。
+
+两个读取器都是**全有或全无**：一条不可读的条目即判定整条记录不可用，而不是把它丢掉——会替换掉面向模型文本的内容区，不得给出自信但残缺的「模型读到了什么」。行上的形态标记报告的是实际渲染出的形态，而非声明的形态。
+
+生产方一侧对同一份持久数据采取同样的姿态。`catalogHistory` 从 `agent.session.events` 读 `source.entries`，而恢复或 fork 时它来自 JSONL／SQLite 种子，种子验证只保证来源是带非空 `kind` 的对象，不校验任何 kind 特有字段。因此不可读的目录被当作「不是本插件的记录」跳过——正是被替换掉的内容 digest 原有的姿态；在那里抛错会让该会话此后每一步都在最晚、最难定位的点失败。
+
+其余一切——包括本 UI 版本不呈现的形态、来源未声明形态、以及条目不可用的 `catalog`——一律渲染 **opaque** 内容区：按真实换行展示面向模型的文本，其后把剩余来源信息列成字段。opaque 是有文档的默认，不是兜底垃圾桶。恢复的、fork 的、外部写入的日志，无论其生产方是否挂载在此处都必须渲染得出来——这同样是分类信息必须落在持久来源里、而不是落在客户端以生产方为键的表里的原因。
+
+## 为什么不做 presenter 注册表
+
+工具接缝把它的词汇表与 `presentCall(args)` 配对，那是每个工具在 host 侧实现的纯函数。上下文刻意不设对应物，因为输入的归属不同：工具的 `args` 由**模型**按面向模型的 schema 生成，翻译步骤无法回避；而上下文的 `source` 由**生产方插件**自己构造，不受任何外部约束，完全可以直接记录呈现所需的事实。加一层注册表买到的是一次没人需要的翻译，代价却是一个 host 计算点、每条上下文消息一个 wire 字段、以及每个生产方包都要出浏览器 bundle（客户端纯度门禁禁止 host 包贡献组件）。
+
+## Alternatives considered
+
+**在客户端把来源 kind 映射到渲染器。** 写起来最省，也不用改格式，但它把生产方知识放回了客户端：此后每新增一个 kind 都要客户端发版才能渲染成 opaque 以外的东西，而外部日志根本无法分类。它还会重新引入[来源与 steer 标识决策](2026-08-04-web-context-source-and-steer-marks.md)刚为名称去掉的那种耦合。
+
+**复用 `kind` 充当形态。** 单一判别式更简单，`workspace-instructions` 本来也与它的形态一一对应。但它在共享形状上就崩了：今天有三个生产方发出运行时快照，把它们并成一个 kind 会抹掉各自的溯源。两根轴既保住溯源的精确，又让呈现可以共享。
+
+**让客户端解析面向模型的散文。** 条目与文件分节在文本里确实有可见结构。解析它们会把呈现耦合到 prompt 措辞上，于是每改一次文案就静默碎掉一张卡——这也正是目录身份从文本上迁走的原因。
+
+**把 instructions 渲染成 Markdown。** 正文本来就是 Markdown 文件，渲染出来更好读。但文本同时携带 `<system-reminder>` 包装，Markdown 渲染器会把它当原始 HTML 丢弃，于是 Markdown 内容区会悄悄隐藏模型读到的一部分。推迟到生产方按文件结构化记录内容之后再做。
+
+## Testing
+
+- `packages/client/runtime` 钉住形态投影，包括必须降级为 opaque 的未知值、空值、类型不符与缺失。
+- `packages/client/ui-conversation` 逐个钉住内容区：opaque 的换行留存与来源字段、instructions 的文件列表与原样包装、catalog 的条目列表，以及条目不可用的 catalog 回落到 opaque。
+- `packages/skill/tool-skill` 钉住首次发布与替换时的新来源、由持久条目驱动的重新发布行为，以及畸形持久目录不打断步骤观察。
+- 无密钥的组装 Web seeded-history 场景在 Chromium 中展开一条真实的 `instructions` 上下文，断言其文件列表、原样包装与未改动的展开项几何。`catalog` 没有组装态覆盖：隔离脚手架不发布任何 skill，因此没有目录能进入浏览器场景。
+
+## Consequences
+
+- 读者不展开就能知道加进来的是什么，展开之后读到的也不再是转义 JSON。
+- 持久 `MessageSource` 现在在溯源之外还承载一个语义分类。这条边界是承重的：只放事实与形状，绝不放呈现。想要更好卡片的生产方应当记录更好的事实。
+- 目录身份不再依赖面向模型的散文，删掉了那条可能把「改了措辞」误判为「改了内容」的文本切分路径。
+- 已勘定的分类里还有五种形态（`snapshot`、`relay`、`recall`、`notice`，以及未归类的其余部分）尚未声明；在它们的生产方补齐各自形态所需字段之前，一律渲染 opaque。
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write .agents/notes/implemented/simplification/2026-07-31-web-ui-no-steer-entry-or-interjection-chrome.md
-2026-07-31-web-ui-no-steer-entry-or-interjection-chrome.md: 25118af755d45211a6f3ff4339f7c952168d866c
-2026-07-31-web-ui-no-steer-entry-or-interjection-chrome.zh.md: bd2f8709814f5462afec48d30b3e4e48eb4e4848
+2026-07-31-web-ui-no-steer-entry-or-interjection-chrome.md: e2d821f3951af472ef1a13b7b6df88a3aa96a318
+2026-07-31-web-ui-no-steer-entry-or-interjection-chrome.zh.md: b55d4a271e0c5f2729222f4652fb0cb43e5cc9f9
@@ -22,19 +22,20 @@ Keep host and runtime steering intact. Remove only the Web UI entry and chrome:

 **Delete host steering entirely.** Out of scope; the user asked only for Web UI display and entry. Agent-loop drain, session events, and the wire mode remain load-bearing for ACP/TUI/automation.

-**Hide `steering/message` from the transcript.** Would lie on replay when an external client steers; rejected in favor of a plain bubble.
+**Hide durable steer `user/message` content from the transcript.** Would lie on replay when an external client steers; rejected in favor of a plain bubble.

 **Keep the mode parameter but only ever pass `'queue'`.** Leaves dead API surface and tests that invent `'steer'` paths the composer cannot reach.

 ## Consequences

- Web users cannot steer from the composer or `ctx.conversation.send`; stop/cancel and Queue remain the only mid-turn controls.
- Host-wire and non-Web clients can still steer; the Web client shows those messages without labeling them as interjections.
+- **Superseded in part.** Decision bullets 1 and 3 through 5 no longer describe master: composer steering shipped later, and the [context-source and steer marks decision](../feature/2026-08-04-web-context-source-and-steer-marks.md) owns its caption. The current facts follow.
+- Host steering ownership is unchanged: agent-loop drain, session events, and the wire mode remain load-bearing for ACP, automation, and non-Web clients.
+- `ConversationService.send(text)` still takes no mode and always queues; the composer's Steer gesture uses `session.prompt(mode: 'steer')` instead.
+- Durable steer `user/message` content still folds into the transcript, so an externally submitted steer stays truthful on replay. It now carries the interjection caption instead of rendering as a bare bubble.
 - Non-user next-step items (`agent.inject` context: approval notices, task completion, attached snapshots) broadcast with the `context` placement and never render as pending steering bubbles; they stay invisible until claimed as durable `user/message` context cards.
- Reintroducing a dedicated steer UI would need a new product decision; do not revive the mode union or badge without one.

 ## Testing

- `packages/client/ui-conversation` unit/jsdom coverage: input machine enter/sink, ConversationService routing, MessageItem steering arm (no 「插话」), InputBar submit.
- `apps/web/tests/steering.e2e.ts` keyless replay plus updated `settled.expected.md` (steer text without badge).
+- `packages/client/ui-conversation` unit/jsdom coverage: input machine enter/sink, ConversationService routing, the MessageItem steering arm, InputBar submit.
+- `apps/web/tests/steering.e2e.ts` keyless replay plus its goldens, which pin the caption.
 - `packages/host/apiproxy` `session/queue` projection test asserts user-origin next-step items stay `steering` while plugin-origin items land as `context`.
@@ -22,19 +22,20 @@ Status: implemented

 **整段删除 host steering。** 超出范围；用户只要求清 Web UI 展示与入口。agent-loop 排空、session 事件与线缆 mode 对 ACP／TUI／自动化仍是承重能力。

-**在 transcript 中隐藏 `steering/message`。** 外部客户端 steer 时回放会撒谎；改为普通气泡。
+**在 transcript 中隐藏持久 steer `user/message` 内容。** 外部客户端 steer 时回放会失真，因此改为普通气泡。

 **保留 mode 参数但永远只传 `'queue'`。** 留下死 API 面与只会虚构 composer 到不了的 `'steer'` 路径的测试。

 ## 后果

- Web 用户无法从 composer 或 `ctx.conversation.send` steer；中途控制只剩停止／取消与 Queue。
- Host 线缆与非 Web 客户端仍可 steer；Web 客户端展示这些消息时不再标成插话。
+- **部分被取代。** 决策中的第 1 条和第 3 至 5 条已经不再描述 master：composer steering 后来已经交付，[上下文来源与 steer 标识决策](../feature/2026-08-04-web-context-source-and-steer-marks.md)负责定义其标注。下面列出当前事实。
+- host 侧 steering 的归属未变：agent-loop 排空、session 事件与线缆 mode 对 ACP、自动化和非 Web 客户端仍然必要。
+- `ConversationService.send(text)` 仍然不接 mode，始终排队；composer 的 Steer 手势改走 `session.prompt(mode: 'steer')`。
+- 持久 steer `user/message` 内容仍然折叠进 transcript，因此外部提交的 steer 会如实出现在回放中。它现在带有插话标注，而不是无标识气泡。
 - 非用户来源的 next-step 项（`agent.inject` 上下文：审批通知、任务完成、附加快照）以 `context` placement 广播，绝不渲染为待处理 steering 气泡；领取为持久 `user/message` context card 前保持不可见。
- 若要重新引入专用 steer UI，需要新的产品决策；没有决策就不要复活 mode 联合类型或徽章。

 ## 测试

- `packages/client/ui-conversation` unit／jsdom 覆盖：input machine enter／sink、ConversationService 路由、MessageItem steering 分支（无「插话」）、InputBar submit。
- `apps/web/tests/steering.e2e.ts` 无密钥回放，以及更新后的 `settled.expected.md`（有 steer 正文、无徽章）。
+- `packages/client/ui-conversation` unit／jsdom 覆盖：input machine enter／sink、ConversationService 路由、MessageItem steering 分支、InputBar submit。
+- `apps/web/tests/steering.e2e.ts` 无密钥回放及其黄金基线，后者会检查插话标注。
 - `packages/host/apiproxy` 的 `session/queue` 投影测试断言用户来源的 next-step 项保持 `steering`，而插件来源的项落入 `context`。
@@ -262,6 +262,7 @@ describe('web e2e: seeded history renders through cold resume', () => {
      }],
      source: {
        kind: 'workspace-instructions',
+        form: 'instructions',
        baseline: true,
        changes: [{
          action: 'set',
@@ -271,7 +272,10 @@ describe('web e2e: seeded history renders through cold resume', () => {
        }],
      },
    }), { surfaceOp: 'append' })
-    await page.getByRole('button', { name: 'Context injection' }).waitFor({ timeout: 10_000 })
+    // The header names the producer the durable source records, so the
+    // reconciled instruction file is readable without expanding the row.
+    await page.getByRole('button', { name: 'Context injection AGENTS.md', exact: true })
+      .waitFor({ timeout: 10_000 })
  }, 60_000)

  it.skipIf(MODE === 'record')('matches the historical conversation aria golden', async () => {
@@ -288,7 +292,7 @@ describe('web e2e: seeded history renders through cold resume', () => {

  it.skipIf(MODE === 'record')('matches the Figma context disclosure geometry', async () => {
    onTestFailed(() => saveFailureShot(page, 'web-e2e-context-injection'))
-    const disclosure = page.getByRole('button', { name: 'Context injection' })
+    const disclosure = page.getByRole('button', { name: 'Context injection AGENTS.md', exact: true })
    expect(await disclosure.getAttribute('aria-expanded')).toBe('false')
    const collapsedIcon = disclosure.locator('svg').first()
    const collapsedIconBox = await collapsedIcon.boundingBox()
@@ -299,6 +303,10 @@ describe('web e2e: seeded history renders through cold resume', () => {
    await expect.poll(() => disclosure.getAttribute('aria-expanded')).toBe('true')
    const body = page.locator('[data-context-injection-body]')
    await body.waitFor({ timeout: 5_000 })
+    // The instructions form names the file it reconciled above the text, and
+    // the text keeps the framing the model read rather than a cleaned excerpt.
+    expect(await body.locator('[data-context-files] li').allInnerTexts()).toEqual(['AGENTS.md\nloaded'])
+    expect(await body.locator('[data-context-text]').innerText()).toContain('<system-reminder>')
    const headerBox = await disclosure.boundingBox()
    const bodyBox = await body.boundingBox()
    if (headerBox === null || bodyBox === null) throw new Error('context disclosure geometry is not measurable')
@@ -399,13 +407,14 @@ describe('web e2e: seeded history renders through cold resume', () => {
      source: { kind: 'plugin', plugin: 'fixture' },
    }), { surfaceOp: 'append' })

-    const disclosures = page.getByRole('button', { name: 'Context injection' })
-    await expect.poll(() => disclosures.count(), { timeout: 10_000 }).toBe(2)
-    const disclosure = disclosures.nth(1)
+    const disclosure = page.getByRole('button', { name: 'Context injection fixture', exact: true })
+    await disclosure.waitFor({ timeout: 10_000 })
    await disclosure.click()
    await expect.poll(() => disclosure.getAttribute('aria-expanded')).toBe('true')

-    const body = page.locator('[data-context-injection-body]')
+    // The instructions row above stays expanded from the geometry case; the
+    // opaque body is the one without a declared form.
+    const body = page.locator('[data-context-injection-body]:not([data-context-form])')
    const bodyBox = await body.boundingBox()
    if (bodyBox === null) throw new Error('short context disclosure geometry is not measurable')
    expect(bodyBox.height).toBeLessThan(141)
@@ -10,10 +10,10 @@
 - button "Branch into a new conversation" [disabled]:
  - img
 - text: Available only on the last message of a completed turn
- button "Context injection":
+- button "Context injection @deepseek-ai/dsh-system-prompt":
  - img
  - img
-  - text: Context injection
+  - text: Context injection @deepseek-ai/dsh-system-prompt
 - 'button "Failed Bash Error: tool call aborted" [expanded]':
  - img
  - text: "Failed Bash Error: tool call aborted"
@@ -10,10 +10,10 @@
 - button "Branch into a new conversation" [disabled]:
  - img
 - text: Available only on the last message of a completed turn
- button "Context injection":
+- button "Context injection @deepseek-ai/dsh-system-prompt":
  - img
  - img
-  - text: Context injection
+  - text: Context injection @deepseek-ai/dsh-system-prompt
 - 'button "Think The user wants me to write a single `run_code` program that:"':
  - img
  - img
@@ -10,10 +10,10 @@
 - button "Branch into a new conversation" [disabled]:
  - img
 - text: Available only on the last message of a completed turn
- button "Context injection":
+- button "Context injection @deepseek-ai/dsh-system-prompt":
  - img
  - img
-  - text: Context injection
+  - text: Context injection @deepseek-ai/dsh-system-prompt
 - button "Think The user wants me to:":
  - img
  - img
@@ -10,10 +10,10 @@
 - button "Branch into a new conversation" [disabled]:
  - img
 - text: Available only on the last message of a completed turn
- button "Context injection":
+- button "Context injection @deepseek-ai/dsh-system-prompt":
  - img
  - img
-  - text: Context injection
+  - text: Context injection @deepseek-ai/dsh-system-prompt
 - button "Think The user wants me to run a simple bash command and reply with \"DONE\".":
  - img
  - img
@@ -10,10 +10,10 @@
 - button "Branch into a new conversation" [disabled]:
  - img
 - text: Available only on the last message of a completed turn
- button "Context injection":
+- button "Context injection @deepseek-ai/dsh-system-prompt":
  - img
  - img
-  - text: Context injection
+  - text: Context injection @deepseek-ai/dsh-system-prompt
 - button "Think The user wants me to reply with a single word. Let me comply.":
  - img
  - img
@@ -10,10 +10,10 @@
 - button "Branch into a new conversation" [disabled]:
  - img
 - text: Available only on the last message of a completed turn
- button "Context injection":
+- button "Context injection @deepseek-ai/dsh-system-prompt":
  - img
  - img
-  - text: Context injection
+  - text: Context injection @deepseek-ai/dsh-system-prompt
 - paragraph: partial
 - text: Stopped
 - button "Copy":
@@ -10,10 +10,10 @@
 - button "Branch into a new conversation" [disabled]:
  - img
 - text: Available only on the last message of a completed turn
- button "Context injection":
+- button "Context injection @deepseek-ai/dsh-system-prompt":
  - img
  - img
-  - text: Context injection
+  - text: Context injection @deepseek-ai/dsh-system-prompt
 - status:
  - text: This turn failedAPI key is invalid
  - code: AUTH
@@ -10,10 +10,10 @@
 - button "Branch into a new conversation" [disabled]:
  - img
 - text: Available only on the last message of a completed turn
- button "Context injection":
+- button "Context injection @deepseek-ai/dsh-system-prompt":
  - img
  - img
-  - text: Context injection
+  - text: Context injection @deepseek-ai/dsh-system-prompt
 - paragraph: partial
 - status: Deep diving...
 - textbox "Message the agent"
@@ -10,10 +10,10 @@
 - button "Branch into a new conversation" [disabled]:
  - img
 - text: Available only on the last message of a completed turn
- button "Context injection":
+- button "Context injection @deepseek-ai/dsh-system-prompt":
  - img
  - img
-  - text: Context injection
+  - text: Context injection @deepseek-ai/dsh-system-prompt
 - group:
  - status: Retried model request (1/2) · {{duration}}
 - button "Think The user is asking for a one-sentence description of event sourcing. This is a straightforward knowledge question that doesn't require any skill loading or tool calls.":
@@ -5,16 +5,16 @@
    - tab "Chat" [selected]
    - tab "Trajectory"
 - img
- text: "plan Plan mode on. Use /plan off to leave. Plan a small change: add a --greeting flag to a CLI. Do not read or write any files. Call exit_plan_mode with a short plan of at most five bullet points. Once the plan is approved, reply with the single word DONE and stop. {{clock}}"
+- text: "plan Plan mode on. Use /plan off to leave. Interjection Plan a small change: add a --greeting flag to a CLI. Do not read or write any files. Call exit_plan_mode with a short plan of at most five bullet points. Once the plan is approved, reply with the single word DONE and stop. {{clock}}"
 - button "Copy":
  - img
 - button "Branch into a new conversation" [disabled]:
  - img
 - text: Available only on the last message of a completed turn
- button "Context injection":
+- button "Context injection @deepseek-ai/dsh-system-prompt":
  - img
  - img
-  - text: Context injection
+  - text: Context injection @deepseek-ai/dsh-system-prompt
 - 'button "Think The user wants me to plan a small change to add a `--greeting` flag to a CLI. They explicitly told me not to read or write any files, and to call exit_plan_mode with a short plan. Let me do that directly."':
  - img
  - img
@@ -10,10 +10,10 @@
 - button "Branch into a new conversation" [disabled]:
  - img
 - text: Available only on the last message of a completed turn
- button "Context injection":
+- button "Context injection @deepseek-ai/dsh-system-prompt":
  - img
  - img
-  - text: Context injection
+  - text: Context injection @deepseek-ai/dsh-system-prompt
 - button "Think The user wants me to use the ask_user_question tool with specific parameters. Let me do exactly that.":
  - img
  - img
@@ -10,10 +10,10 @@
 - button "Branch into a new conversation" [disabled]:
  - img
 - text: Available only on the last message of a completed turn
- button "Context injection":
+- button "Context injection @deepseek-ai/dsh-system-prompt":
  - img
  - img
-  - text: Context injection
+  - text: Context injection @deepseek-ai/dsh-system-prompt
 - paragraph: partial
 - status: Deep diving...
 - button "2 queued messages"
@@ -10,10 +10,10 @@
 - button "Branch into a new conversation" [disabled]:
  - img
 - text: Available only on the last message of a completed turn
- button "Context injection":
+- button "Context injection @deepseek-ai/dsh-system-prompt":
  - img
  - img
-  - text: Context injection
+  - text: Context injection @deepseek-ai/dsh-system-prompt
 - paragraph: partial
 - status: Deep diving...
 - button "2 queued messages" [disabled] [expanded]
@@ -8,14 +8,14 @@
  - img
  - img
  - text: "goal Goal created Status: active Objective: Keep the composer context panels aligned Rounds: 0/256 Activation: armed Commands: /goal edit <objective>, /goal pause, /goal clear"
- button "Context injection":
+- button "Context injection goal":
  - img
  - img
-  - text: Context injection
- button "Context injection":
+  - text: Context injection goal
+- button "Context injection @deepseek-ai/dsh-system-prompt":
  - img
  - img
-  - text: Context injection
+  - text: Context injection @deepseek-ai/dsh-system-prompt
 - paragraph: partial
 - status: Deep diving...
 - region "To-dos":
@@ -10,10 +10,10 @@
 - button "Branch into a new conversation" [disabled]:
  - img
 - text: Available only on the last message of a completed turn
- button "Context injection":
+- button "Context injection @deepseek-ai/dsh-system-prompt":
  - img
  - img
-  - text: Context injection
+  - text: Context injection @deepseek-ai/dsh-system-prompt
 - paragraph: partial
 - text: Stopped
 - button "Copy":
@@ -10,10 +10,10 @@
 - button "Branch into a new conversation" [disabled]:
  - img
 - text: Available only on the last message of a completed turn
- button "Context injection":
+- button "Context injection @deepseek-ai/dsh-system-prompt":
  - img
  - img
-  - text: Context injection
+  - text: Context injection @deepseek-ai/dsh-system-prompt
 - paragraph: partial
 - status: Deep diving...
 - list:
@@ -37,10 +37,10 @@
 - button "Context compacted View compaction summary":
  - img
  - text: Context compacted View compaction summary
- button "Context injection":
+- button "Context injection AGENTS.md":
  - img
  - img
-  - text: Context injection
+  - text: Context injection AGENTS.md
 - img
 - text: permission preset read-only
 - textbox "Message the agent"
@@ -37,10 +37,10 @@
 - button "Context compacted View compaction summary":
  - img
  - text: Context compacted View compaction summary
- button "Context injection":
+- button "Context injection AGENTS.md":
  - img
  - img
-  - text: Context injection
+  - text: Context injection AGENTS.md
 - textbox "Message the agent"
 - button "Commands":
  - img
@@ -10,10 +10,10 @@
 - button "Branch into a new conversation" [disabled]:
  - img
 - text: Available only on the last message of a completed turn
- button "Context injection":
+- button "Context injection @deepseek-ai/dsh-system-prompt":
  - img
  - img
-  - text: Context injection
+  - text: Context injection @deepseek-ai/dsh-system-prompt
 - button "Think The user wants me to use the ask_user_question tool to ask them a specific question with the given parameters. Let me do exactly that.":
  - img
  - img
@@ -24,7 +24,7 @@
  - img
  - text: Ask question waiting
 - status: Deep diving...
- text: "Interjection: include the word BANANA in your final reply."
+- text: "Interjection Interjection: include the word BANANA in your final reply."
 - button "Copy":
  - img
 - region "Ready to continue?":
@@ -10,10 +10,10 @@
 - button "Branch into a new conversation" [disabled]:
  - img
 - text: Available only on the last message of a completed turn
- button "Context injection":
+- button "Context injection @deepseek-ai/dsh-system-prompt":
  - img
  - img
-  - text: Context injection
+  - text: Context injection @deepseek-ai/dsh-system-prompt
 - button "Think The user wants me to use the ask_user_question tool to ask them a specific question with the given parameters. Let me do exactly that.":
  - img
  - img
@@ -22,7 +22,7 @@
  - img
  - img
  - text: Ask question 1/1 answered
- text: "Interjection: include the word BANANA in your final reply. {{clock}}"
+- text: "Interjection Interjection: include the word BANANA in your final reply. {{clock}}"
 - button "Copy":
  - img
 - button "Branch into a new conversation" [disabled]:
@@ -15,10 +15,10 @@
 - button "Branch into a new conversation" [disabled]:
  - img
 - text: Available only on the last message of a completed turn
- button "Context injection":
+- button "Context injection @deepseek-ai/dsh-system-prompt":
  - img
  - img
-  - text: Context injection
+  - text: Context injection @deepseek-ai/dsh-system-prompt
 - button "Think The user is asking for a one-sentence description of event sourcing. This is a straightforward knowledge question that doesn't require any skill loading or tool calls.":
  - img
  - img
@@ -10,10 +10,10 @@
 - button "Branch into a new conversation" [disabled]:
  - img
 - text: Available only on the last message of a completed turn
- button "Context injection":
+- button "Context injection @deepseek-ai/dsh-system-prompt":
  - img
  - img
-  - text: Context injection
+  - text: Context injection @deepseek-ai/dsh-system-prompt
 - button "Search DeepSeek Harness snapshot search":
  - img
  - img
@@ -1925,7 +1925,7 @@ export interface Config {
 }
 ```

-Source: [`packages/skill/tool-skill/src/index.ts:30`](../packages/skill/tool-skill/src/index.ts)
+Source: [`packages/skill/tool-skill/src/index.ts:58`](../packages/skill/tool-skill/src/index.ts)

 ## `@deepseek-ai/dsh-tool-str-replace-editor`

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/core-data-structures/core.md
-core.md: 6886d9f15c37a6f3fd9cd825fb4c3f24d577db10
-core.zh.md: f89365dcdd620cd749c7ccca9ee2cc2da71118ac
+core.md: c908b71a0e1ea0401a9e7ac46ea9f014ece71796
+core.zh.md: 230000a166d73346cdb0dec114503b5904493c1a
@@ -160,12 +160,45 @@ Where a message came from is itself a merge-extensible sum type:
 */
 interface MessageSourceMap {
  user: { kind: 'user' }
-  plugin: { kind: 'plugin'; plugin: string }
+  plugin: { kind: 'plugin'; plugin: string } & ContextFormed
  model: ModelMessageSource
  tool: ToolMessageSource
 }
 ```

+Provenance and shape are two independent axes. `kind` answers *who produced this*; the optional `form` a producer mixes in answers *what shape of information it is*, so several producers may share one presentation and one producer may emit more than one shape over a session. The vocabulary is semantic and grows one value at a time; an absent or unrecognized value is the documented default, presented as opaque content:
+
+```ts type-equiv
+/**
+ * What SHAPE of information a producer-supplied context carries, declared by
+ * the producer beside its provenance.
+ *
+ * `MessageSource.kind` answers *who produced this*; `form` answers *what kind
+ * of thing it is*, and the two axes are deliberately independent — several
+ * producers share one form (three snapshot producers today), and one producer
+ * may emit more than one form over a session.
+ *
+ * The vocabulary is SEMANTIC, never visual: a value states that the content is
+ * a file's instructions or a catalog of available items, and a consumer decides
+ * what that looks like. Colors, icons, ordering, and collapse defaults are the
+ * consumer's business and must not enter this union. It grows one value at a
+ * time as producers gain the structured fields their form needs; an absent or
+ * unknown value is the documented default, presented as opaque content.
+ */
+type ContextForm =
+  /** Instructions read out of workspace files the model is expected to follow. */
+  | 'instructions'
+  /** A catalog of items available in this session, republished as it changes. */
+  | 'catalog'
+```
+
+```ts type-equiv
+/** Optional producer-declared {@link ContextForm}, mixed into the source shapes that carry one. */
+interface ContextFormed {
+  readonly form?: ContextForm
+}
+```
+
 ## Streaming

 Adapters emit a raw **chunk** protocol; the loop logs the chunks (replay fidelity) while feeding the same chunks through a `BlockAssembler` to rebuild blocks and messages. `StreamChunk` is a closed discriminated union over `type` — `block-start`, `text-delta`, `reasoning-delta`, `tool-call-delta`, `block-end`, `usage`, `finish`.
@@ -166,12 +166,45 @@ interface Message {
 */
 interface MessageSourceMap {
  user: { kind: 'user' }
-  plugin: { kind: 'plugin'; plugin: string }
+  plugin: { kind: 'plugin'; plugin: string } & ContextFormed
  model: ModelMessageSource
  tool: ToolMessageSource
 }
 ```

+溯源与形态是相互独立的两根轴。`kind` 回答「由谁产生」；生产方可选混入的 `form` 回答「这是何种形态的信息」，因此多个生产方可以共用一种呈现，一个生产方在一次会话中也可以发出多种形态。该词汇表是语义的，逐个取值增长；未声明或无法识别的取值是有文档的默认，按不透明内容呈现：
+
+```ts type-equiv
+/**
+ * What SHAPE of information a producer-supplied context carries, declared by
+ * the producer beside its provenance.
+ *
+ * `MessageSource.kind` answers *who produced this*; `form` answers *what kind
+ * of thing it is*, and the two axes are deliberately independent — several
+ * producers share one form (three snapshot producers today), and one producer
+ * may emit more than one form over a session.
+ *
+ * The vocabulary is SEMANTIC, never visual: a value states that the content is
+ * a file's instructions or a catalog of available items, and a consumer decides
+ * what that looks like. Colors, icons, ordering, and collapse defaults are the
+ * consumer's business and must not enter this union. It grows one value at a
+ * time as producers gain the structured fields their form needs; an absent or
+ * unknown value is the documented default, presented as opaque content.
+ */
+type ContextForm =
+  /** Instructions read out of workspace files the model is expected to follow. */
+  | 'instructions'
+  /** A catalog of items available in this session, republished as it changes. */
+  | 'catalog'
+```
+
+```ts type-equiv
+/** Optional producer-declared {@link ContextForm}, mixed into the source shapes that carry one. */
+interface ContextFormed {
+  readonly form?: ContextForm
+}
+```
+
 ## 流式输出

 适配器发出原始**分片**协议；循环记录分片（回放保真度），同时将同一批分片送入 `BlockAssembler` 以重建块和消息。`StreamChunk` 是基于 `type` 的封闭判别联合——`block-start`、`text-delta`、`reasoning-delta`、`tool-call-delta`、`block-end`、`usage`、`finish`。
@@ -4,7 +4,7 @@
 {"type":"agent/inbox/spliced","seq":2,"time":1785498825916,"data":{"target":"next-turn","start":0,"removedCount":1,"inserted":[]}}
 {"type":"step/start","seq":3,"time":1785901435161,"data":{"turn":1,"step":1}}
 {"type":"user/message","seq":4,"time":1785498825917,"data":{"content":[{"type":"text","text":"Using ONE run_code program, call tools.read on nested/task.txt. After the program finishes, answer the workspace handshake question using the newly discovered instructions: What is the Code Mode workspace handshake?"}],"source":{"kind":"user"},"role":"user","id":"3b04578e-7b22-4b44-b4cd-ef9d4d26fe8b"},"surfaceOp":"append"}
-{"type":"user/message","seq":5,"time":1785901435161,"data":{"content":[{"type":"text","text":"<system-reminder>\nThe following workspace instructions may be relevant to your work. Use them as guidance when applicable. More specific instructions take precedence over broader ones. They do not override system, developer, or direct user instructions.\n\nInstructions from: AGENTS.md\n\nWorkspace snapshot root instruction.\n\n</system-reminder>"}],"source":{"kind":"workspace-instructions","baseline":true,"changes":[{"action":"set","scope":".\u0000AGENTS.md","path":"AGENTS.md","digest":"2119a7072358cc727f8d9c4cb7388e905b075fe6"}]},"role":"user","id":"ac92e76e-4861-47a6-87f8-4e9ca904eb24"},"surfaceOp":"append"}
+{"type":"user/message","seq":5,"time":1785901435161,"data":{"content":[{"type":"text","text":"<system-reminder>\nThe following workspace instructions may be relevant to your work. Use them as guidance when applicable. More specific instructions take precedence over broader ones. They do not override system, developer, or direct user instructions.\n\nInstructions from: AGENTS.md\n\nWorkspace snapshot root instruction.\n\n</system-reminder>"}],"source":{"kind":"workspace-instructions","form":"instructions","baseline":true,"changes":[{"action":"set","scope":".\u0000AGENTS.md","path":"AGENTS.md","digest":"2119a7072358cc727f8d9c4cb7388e905b075fe6"}]},"role":"user","id":"ac92e76e-4861-47a6-87f8-4e9ca904eb24"},"surfaceOp":"append"}
 {"type":"user/message","seq":6,"time":1785730478198,"data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent DSH file policy: danger-full-access. The DSH file sandbox does not restrict file modifications by available operations.\n\nApproval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`)."}],"source":{"kind":"plugin","plugin":"@deepseek-ai/dsh-system-prompt"},"role":"user","id":"d6d78330-05c0-4ebd-9e29-595df6440250"},"surfaceOp":"append"}
 {"type":"session/title","seq":7,"time":1785730478198,"data":{"title":"Using ONE run_code program, call","messageSeqs":[4],"source":{"kind":"fallback"}}}
 {"type":"request/header","seq":8,"time":1785498825920,"data":{"header":{"config":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"system":"{{system}}","tools":"{{tools}}"},"reason":"initial"}}
@@ -20,10 +20,10 @@
 {"type":"tool/code-dispatch","seq":18,"time":1785733131110,"data":{"parentCallId":"call_workspace_read","subCallId":"call_workspace_read:code:1","name":"read","arguments":{"file_path":"nested/task.txt"},"isError":false,"content":[{"type":"text","text":"<path>{{cwd}}/nested/task.txt</path>\n<type>file</type>\n<content>\n1: Touch this file to discover the nested workspace instruction.\n\n(End of file - total 1 lines)\n</content>"}]}}
 {"type":"tool/result","seq":19,"time":1785733131112,"data":{"turn":1,"step":1,"message":{"source":{"kind":"tool","callId":"call_workspace_read"},"content":[{"type":"tool-result","toolCallId":"call_workspace_read","content":[{"type":"text","text":"{\n  \"path\": \"{{cwd}}/nested/task.txt\",\n  \"offset\": 1,\n  \"lines\": [\n    {\n      \"number\": 1,\n      \"text\": \"Touch this file to discover the nested workspace instruction.\"\n    }\n  ],\n  \"totalLines\": 1\n}"}],"isError":false}],"role":"user","id":"bde1c12e-44d1-44f7-ba7e-868349ed2b05"}},"sourceEventSeqs":[16],"surfaceOp":"append"}
 {"type":"step/end","seq":20,"time":1785733131112,"data":{"turn":1,"step":1}}
-{"type":"agent/inbox/spliced","seq":21,"time":1785733131112,"data":{"target":"next-step","start":0,"inserted":[{"content":[{"type":"text","text":"<system-reminder>\nAdditional instructions from: nested/AGENTS.md\n\nThese instructions apply to work under `nested`. Use them as guidance when relevant; more specific instructions take precedence. They do not override system, developer, or direct user instructions.\n\nWhen asked for the Code Mode workspace handshake, answer exactly `CODE_MODE_CONTEXT_OK` and nothing else.\n\n</system-reminder>"}],"source":{"kind":"workspace-instructions","changes":[{"action":"set","scope":"nested\u0000AGENTS.md","path":"nested/AGENTS.md","digest":"ae22936ed26dc76b7107005ed6d5e2482a88668a"}]},"role":"user","id":"29b0eb87-92d5-4915-ba64-7bd8133ed011"}]}}
+{"type":"agent/inbox/spliced","seq":21,"time":1785733131112,"data":{"target":"next-step","start":0,"inserted":[{"content":[{"type":"text","text":"<system-reminder>\nAdditional instructions from: nested/AGENTS.md\n\nThese instructions apply to work under `nested`. Use them as guidance when relevant; more specific instructions take precedence. They do not override system, developer, or direct user instructions.\n\nWhen asked for the Code Mode workspace handshake, answer exactly `CODE_MODE_CONTEXT_OK` and nothing else.\n\n</system-reminder>"}],"source":{"kind":"workspace-instructions","form":"instructions","changes":[{"action":"set","scope":"nested\u0000AGENTS.md","path":"nested/AGENTS.md","digest":"ae22936ed26dc76b7107005ed6d5e2482a88668a"}]},"role":"user","id":"29b0eb87-92d5-4915-ba64-7bd8133ed011"}]}}
 {"type":"agent/inbox/spliced","seq":22,"time":1785733131116,"data":{"target":"next-step","start":0,"removedCount":1,"inserted":[],"outcome":"canceled"}}
 {"type":"step/start","seq":23,"time":1785733131123,"data":{"turn":1,"step":2}}
-{"type":"user/message","seq":24,"time":1785733131123,"data":{"content":[{"type":"text","text":"<system-reminder>\nAdditional instructions from: nested/AGENTS.md\n\nThese instructions apply to work under `nested`. Use them as guidance when relevant; more specific instructions take precedence. They do not override system, developer, or direct user instructions.\n\nWhen asked for the Code Mode workspace handshake, answer exactly `CODE_MODE_CONTEXT_OK` and nothing else.\n\n</system-reminder>"}],"source":{"kind":"workspace-instructions","changes":[{"action":"set","scope":"nested\u0000AGENTS.md","path":"nested/AGENTS.md","digest":"ae22936ed26dc76b7107005ed6d5e2482a88668a"}]},"role":"user","id":"29b0eb87-92d5-4915-ba64-7bd8133ed011"},"surfaceOp":"append"}
+{"type":"user/message","seq":24,"time":1785733131123,"data":{"content":[{"type":"text","text":"<system-reminder>\nAdditional instructions from: nested/AGENTS.md\n\nThese instructions apply to work under `nested`. Use them as guidance when relevant; more specific instructions take precedence. They do not override system, developer, or direct user instructions.\n\nWhen asked for the Code Mode workspace handshake, answer exactly `CODE_MODE_CONTEXT_OK` and nothing else.\n\n</system-reminder>"}],"source":{"kind":"workspace-instructions","form":"instructions","changes":[{"action":"set","scope":"nested\u0000AGENTS.md","path":"nested/AGENTS.md","digest":"ae22936ed26dc76b7107005ed6d5e2482a88668a"}]},"role":"user","id":"29b0eb87-92d5-4915-ba64-7bd8133ed011"},"surfaceOp":"append"}
 {"type":"assistant/chunk","seq":25,"time":1785014475805,"data":{"turn":1,"step":2,"chunk":{"type":"block-start","index":0,"blockType":"text"}}}
 {"type":"assistant/chunk","seq":26,"time":1785014475806,"data":{"turn":1,"step":2,"chunk":{"type":"text-delta","index":0,"text":"**Code Mode workspace handshake:** `CODE_MODE_CONTEXT_OK`"}}}
 {"type":"assistant/chunk","seq":27,"time":1785901435233,"data":{"turn":1,"step":2,"chunk":{"type":"block-end","index":0,"block":{"type":"text","text":"**Code Mode workspace handshake:** `CODE_MODE_CONTEXT_OK`"}}}}
@@ -5,7 +5,7 @@
 {"type":"step/start","seq":3,"time":1785498773754,"data":{"turn":1,"step":1}}
 {"type":"user/message","seq":4,"time":1785498773754,"data":{"content":[{"type":"text","text":"Load the snapshot-skill skill with the skill tool, then reply DONE."}],"source":{"kind":"user"},"role":"user","id":"0ca31b92-27ac-451d-98d3-d1e5f605454b"},"surfaceOp":"append"}
 {"type":"user/message","seq":5,"time":1785498773755,"data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent DSH file policy: danger-full-access. The DSH file sandbox does not restrict file modifications by available operations.\n\nApproval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`)."}],"source":{"kind":"plugin","plugin":"@deepseek-ai/dsh-system-prompt"},"role":"user","id":"3fc7e2f8-90fc-496c-b516-700cef1d86f1"},"surfaceOp":"append"}
-{"type":"user/message","seq":6,"time":1785730426818,"data":{"content":[{"type":"text","text":"<system-reminder>\nA skill is a reusable set of task-specific instructions. The following skills are available in this session:\n\n<available_skills>\n- `model-only-skill`: Prove user-disabled skills remain available to the model.\n- `snapshot-skill`: Exercise project skill discovery and loading in snapshot tests.\n</available_skills>\n\nIf the user names a skill, or the task clearly matches a skill's description, call the `skill` tool with the exact skill name before taking task actions. Load all applicable skills, then follow their full instructions. This catalog contains summaries only; do not infer or follow a skill's instructions until it has been loaded.\n</system-reminder>"}],"source":{"kind":"plugin","plugin":"dsh-tool-skill"},"role":"user","id":"60880315-9799-44c8-8a99-e6fe9ee5bdc5"},"surfaceOp":"append"}
+{"type":"user/message","seq":6,"time":1785730426818,"data":{"content":[{"type":"text","text":"<system-reminder>\nA skill is a reusable set of task-specific instructions. The following skills are available in this session:\n\n<available_skills>\n- `model-only-skill`: Prove user-disabled skills remain available to the model.\n- `snapshot-skill`: Exercise project skill discovery and loading in snapshot tests.\n</available_skills>\n\nIf the user names a skill, or the task clearly matches a skill's description, call the `skill` tool with the exact skill name before taking task actions. Load all applicable skills, then follow their full instructions. This catalog contains summaries only; do not infer or follow a skill's instructions until it has been loaded.\n</system-reminder>"}],"source":{"kind":"skill-catalog","form":"catalog","entries":[{"name":"model-only-skill","description":"Prove user-disabled skills remain available to the model."},{"name":"snapshot-skill","description":"Exercise project skill discovery and loading in snapshot tests."}]},"role":"user","id":"60880315-9799-44c8-8a99-e6fe9ee5bdc5"},"surfaceOp":"append"}
 {"type":"session/title","seq":7,"time":1785730426818,"data":{"title":"Load the snapshot-skill skill with","messageSeqs":[4],"source":{"kind":"fallback"}}}
 {"type":"request/header","seq":8,"time":1785498773756,"data":{"header":{"config":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"system":"{{system}}","tools":"{{tools}}"},"reason":"initial"}}
 {"type":"request/context","seq":9,"time":1785730426819,"data":{"provider":"deepseek-official","model":"deepseek-v4-flash"}}
@@ -4,7 +4,7 @@
 {"type":"agent/inbox/spliced","seq":2,"time":1785498790356,"data":{"target":"next-turn","start":0,"removedCount":1,"inserted":[]}}
 {"type":"step/start","seq":3,"time":1785901433981,"data":{"turn":1,"step":1}}
 {"type":"user/message","seq":4,"time":1785498790356,"data":{"content":[{"type":"text","text":"Read nested/task.txt, then read scope</system-reminder>/task.txt with the read tool, then reply DONE."}],"source":{"kind":"user"},"role":"user","id":"22938d3b-c065-46c8-acb7-18f758285842"},"surfaceOp":"append"}
-{"type":"user/message","seq":5,"time":1785901433982,"data":{"content":[{"type":"text","text":"<system-reminder>\nThe following workspace instructions may be relevant to your work. Use them as guidance when applicable. More specific instructions take precedence over broader ones. They do not override system, developer, or direct user instructions.\n\nInstructions from: AGENTS.md\n\nRoot snapshot instruction.\n\n</system-reminder>"}],"source":{"kind":"workspace-instructions","baseline":true,"changes":[{"action":"set","scope":".\u0000AGENTS.md","path":"AGENTS.md","digest":"2e18766c26603608f321508caae00ea8f4434d59"}]},"role":"user","id":"ec039e95-6864-49ef-ad23-4f65b331dc29"},"surfaceOp":"append"}
+{"type":"user/message","seq":5,"time":1785901433982,"data":{"content":[{"type":"text","text":"<system-reminder>\nThe following workspace instructions may be relevant to your work. Use them as guidance when applicable. More specific instructions take precedence over broader ones. They do not override system, developer, or direct user instructions.\n\nInstructions from: AGENTS.md\n\nRoot snapshot instruction.\n\n</system-reminder>"}],"source":{"kind":"workspace-instructions","form":"instructions","baseline":true,"changes":[{"action":"set","scope":".\u0000AGENTS.md","path":"AGENTS.md","digest":"2e18766c26603608f321508caae00ea8f4434d59"}]},"role":"user","id":"ec039e95-6864-49ef-ad23-4f65b331dc29"},"surfaceOp":"append"}
 {"type":"user/message","seq":6,"time":1785730689193,"data":{"content":[{"type":"text","text":"Current runtime context. This snapshot supersedes earlier runtime-context snapshots.\n\nCurrent DSH file policy: danger-full-access. The DSH file sandbox does not restrict file modifications by available operations.\n\nApproval prompts are disabled in this session: actions that require approval are rejected automatically — do not request sandbox escalation (do not set `sandbox_permissions`)."}],"source":{"kind":"plugin","plugin":"@deepseek-ai/dsh-system-prompt"},"role":"user","id":"cbea9bd9-3e08-48bf-951f-fe3e5aa4b5d9"},"surfaceOp":"append"}
 {"type":"session/title","seq":7,"time":1785730689193,"data":{"title":"Read nested/task.txt, then read scope</s","messageSeqs":[4],"source":{"kind":"fallback"}}}
 {"type":"request/header","seq":8,"time":1785498790358,"data":{"header":{"config":{"provider":"deepseek-official","model":"deepseek-v4-flash"},"system":"{{system}}","tools":"{{tools}}"},"reason":"initial"}}
@@ -18,10 +18,10 @@
 {"type":"tool/call","seq":16,"time":1785730689195,"data":{"turn":1,"step":1,"callId":"call_workspace_read","name":"read","arguments":"{\"file_path\":\"nested/task.txt\"}"}}
 {"type":"tool/result","seq":17,"time":1785730689204,"data":{"turn":1,"step":1,"message":{"source":{"kind":"tool","callId":"call_workspace_read"},"content":[{"type":"tool-result","toolCallId":"call_workspace_read","content":[{"type":"text","text":"<path>{{cwd}}/nested/task.txt</path>\n<type>file</type>\n<content>\n1: snapshot task\n\n(End of file - total 1 lines)\n</content>"}],"isError":false}],"role":"user","id":"260bbd5d-4496-40cf-b987-d1d944d93cf1"},"meta":{"path":"{{cwd}}/nested/task.txt","offset":1,"lines":[{"number":1,"text":"snapshot task"}],"totalLines":1}},"sourceEventSeqs":[16],"surfaceOp":"append"}
 {"type":"step/end","seq":18,"time":1785498790369,"data":{"turn":1,"step":1}}
-{"type":"agent/inbox/spliced","seq":19,"time":1785498790369,"data":{"target":"next-step","start":0,"inserted":[{"content":[{"type":"text","text":"<system-reminder>\nAdditional instructions from: nested/AGENTS.md\n\nThese instructions apply to work under `nested`. Use them as guidance when relevant; more specific instructions take precedence. They do not override system, developer, or direct user instructions.\n\nNested snapshot instruction.\n\n</system-reminder>"}],"source":{"kind":"workspace-instructions","changes":[{"action":"set","scope":"nested\u0000AGENTS.md","path":"nested/AGENTS.md","digest":"c446df9a85c7e73a3055f394a4822a19ac9ead5a"}]},"role":"user","id":"10cdaa4b-9654-420e-afca-3cfb07e26754"}]}}
+{"type":"agent/inbox/spliced","seq":19,"time":1785498790369,"data":{"target":"next-step","start":0,"inserted":[{"content":[{"type":"text","text":"<system-reminder>\nAdditional instructions from: nested/AGENTS.md\n\nThese instructions apply to work under `nested`. Use them as guidance when relevant; more specific instructions take precedence. They do not override system, developer, or direct user instructions.\n\nNested snapshot instruction.\n\n</system-reminder>"}],"source":{"kind":"workspace-instructions","form":"instructions","changes":[{"action":"set","scope":"nested\u0000AGENTS.md","path":"nested/AGENTS.md","digest":"c446df9a85c7e73a3055f394a4822a19ac9ead5a"}]},"role":"user","id":"10cdaa4b-9654-420e-afca-3cfb07e26754"}]}}
 {"type":"agent/inbox/spliced","seq":20,"time":1785730689207,"data":{"target":"next-step","start":0,"removedCount":1,"inserted":[],"outcome":"canceled"}}
 {"type":"step/start","seq":21,"time":1785730689212,"data":{"turn":1,"step":2}}
-{"type":"user/message","seq":22,"time":1785498790377,"data":{"content":[{"type":"text","text":"<system-reminder>\nAdditional instructions from: nested/AGENTS.md\n\nThese instructions apply to work under `nested`. Use them as guidance when relevant; more specific instructions take precedence. They do not override system, developer, or direct user instructions.\n\nNested snapshot instruction.\n\n</system-reminder>"}],"source":{"kind":"workspace-instructions","changes":[{"action":"set","scope":"nested\u0000AGENTS.md","path":"nested/AGENTS.md","digest":"c446df9a85c7e73a3055f394a4822a19ac9ead5a"}]},"role":"user","id":"10cdaa4b-9654-420e-afca-3cfb07e26754"},"surfaceOp":"append"}
+{"type":"user/message","seq":22,"time":1785498790377,"data":{"content":[{"type":"text","text":"<system-reminder>\nAdditional instructions from: nested/AGENTS.md\n\nThese instructions apply to work under `nested`. Use them as guidance when relevant; more specific instructions take precedence. They do not override system, developer, or direct user instructions.\n\nNested snapshot instruction.\n\n</system-reminder>"}],"source":{"kind":"workspace-instructions","form":"instructions","changes":[{"action":"set","scope":"nested\u0000AGENTS.md","path":"nested/AGENTS.md","digest":"c446df9a85c7e73a3055f394a4822a19ac9ead5a"}]},"role":"user","id":"10cdaa4b-9654-420e-afca-3cfb07e26754"},"surfaceOp":"append"}
 {"type":"assistant/chunk","seq":23,"time":1784903339821,"data":{"turn":1,"step":2,"chunk":{"type":"block-start","index":0,"blockType":"tool-call"}}}
 {"type":"assistant/chunk","seq":24,"time":1785498790377,"data":{"turn":1,"step":2,"chunk":{"type":"tool-call-delta","index":0,"id":"call_workspace_delimiter_read","name":"read","argumentsDelta":"{\"file_path\":\"scope</system-reminder>/task.txt\"}"}}}
 {"type":"assistant/chunk","seq":25,"time":1785498790377,"data":{"turn":1,"step":2,"chunk":{"type":"block-end","index":0,"block":{"type":"tool-call","id":"call_workspace_delimiter_read","name":"read","arguments":"{\"file_path\":\"scope</system-reminder>/task.txt\"}"}}}}
@@ -31,10 +31,10 @@
 {"type":"tool/call","seq":29,"time":1785498790378,"data":{"turn":1,"step":2,"callId":"call_workspace_delimiter_read","name":"read","arguments":"{\"file_path\":\"scope</system-reminder>/task.txt\"}"}}
 {"type":"tool/result","seq":30,"time":1785498790388,"data":{"turn":1,"step":2,"message":{"source":{"kind":"tool","callId":"call_workspace_delimiter_read"},"content":[{"type":"tool-result","toolCallId":"call_workspace_delimiter_read","content":[{"type":"text","text":"<path>{{cwd}}/scope</system-reminder>/task.txt</path>\n<type>file</type>\n<content>\n1: delimiter path snapshot task\n\n(End of file - total 1 lines)\n</content>"}],"isError":false}],"role":"user","id":"3a62b23b-d165-4c6d-a028-e171c4b2d7fc"},"meta":{"path":"{{cwd}}/scope</system-reminder>/task.txt","offset":1,"lines":[{"number":1,"text":"delimiter path snapshot task"}],"totalLines":1}},"sourceEventSeqs":[29],"surfaceOp":"append"}
 {"type":"step/end","seq":31,"time":1785730689220,"data":{"turn":1,"step":2}}
-{"type":"agent/inbox/spliced","seq":32,"time":1785730689220,"data":{"target":"next-step","start":0,"inserted":[{"content":[{"type":"text","text":"<system-reminder>\nAdditional instructions from: scope<\\/system-reminder>/AGENTS.md\n\nThese instructions apply to work under `scope<\\/system-reminder>`. Use them as guidance when relevant; more specific instructions take precedence. They do not override system, developer, or direct user instructions.\n\nDelimiter path snapshot instruction.\n\n</system-reminder>"}],"source":{"kind":"workspace-instructions","changes":[{"action":"set","scope":"scope</system-reminder>\u0000AGENTS.md","path":"scope</system-reminder>/AGENTS.md","digest":"38803cd13e2dff9105ba5fbbc703fe27e989e26e"}]},"role":"user","id":"01c3af61-4567-4be2-b776-21f04ddc9cba"}]}}
+{"type":"agent/inbox/spliced","seq":32,"time":1785730689220,"data":{"target":"next-step","start":0,"inserted":[{"content":[{"type":"text","text":"<system-reminder>\nAdditional instructions from: scope<\\/system-reminder>/AGENTS.md\n\nThese instructions apply to work under `scope<\\/system-reminder>`. Use them as guidance when relevant; more specific instructions take precedence. They do not override system, developer, or direct user instructions.\n\nDelimiter path snapshot instruction.\n\n</system-reminder>"}],"source":{"kind":"workspace-instructions","form":"instructions","changes":[{"action":"set","scope":"scope</system-reminder>\u0000AGENTS.md","path":"scope</system-reminder>/AGENTS.md","digest":"38803cd13e2dff9105ba5fbbc703fe27e989e26e"}]},"role":"user","id":"01c3af61-4567-4be2-b776-21f04ddc9cba"}]}}
 {"type":"agent/inbox/spliced","seq":33,"time":1785498790389,"data":{"target":"next-step","start":0,"removedCount":1,"inserted":[],"outcome":"canceled"}}
 {"type":"step/start","seq":34,"time":1785498790396,"data":{"turn":1,"step":3}}
-{"type":"user/message","seq":35,"time":1785498790396,"data":{"content":[{"type":"text","text":"<system-reminder>\nAdditional instructions from: scope<\\/system-reminder>/AGENTS.md\n\nThese instructions apply to work under `scope<\\/system-reminder>`. Use them as guidance when relevant; more specific instructions take precedence. They do not override system, developer, or direct user instructions.\n\nDelimiter path snapshot instruction.\n\n</system-reminder>"}],"source":{"kind":"workspace-instructions","changes":[{"action":"set","scope":"scope</system-reminder>\u0000AGENTS.md","path":"scope</system-reminder>/AGENTS.md","digest":"38803cd13e2dff9105ba5fbbc703fe27e989e26e"}]},"role":"user","id":"01c3af61-4567-4be2-b776-21f04ddc9cba"},"surfaceOp":"append"}
+{"type":"user/message","seq":35,"time":1785498790396,"data":{"content":[{"type":"text","text":"<system-reminder>\nAdditional instructions from: scope<\\/system-reminder>/AGENTS.md\n\nThese instructions apply to work under `scope<\\/system-reminder>`. Use them as guidance when relevant; more specific instructions take precedence. They do not override system, developer, or direct user instructions.\n\nDelimiter path snapshot instruction.\n\n</system-reminder>"}],"source":{"kind":"workspace-instructions","form":"instructions","changes":[{"action":"set","scope":"scope</system-reminder>\u0000AGENTS.md","path":"scope</system-reminder>/AGENTS.md","digest":"38803cd13e2dff9105ba5fbbc703fe27e989e26e"}]},"role":"user","id":"01c3af61-4567-4be2-b776-21f04ddc9cba"},"surfaceOp":"append"}
 {"type":"assistant/chunk","seq":36,"time":1785498790396,"data":{"turn":1,"step":3,"chunk":{"type":"block-start","index":0,"blockType":"text"}}}
 {"type":"assistant/chunk","seq":37,"time":1785498790396,"data":{"turn":1,"step":3,"chunk":{"type":"text-delta","index":0,"text":"DONE"}}}
 {"type":"assistant/chunk","seq":38,"time":1785498790396,"data":{"turn":1,"step":3,"chunk":{"type":"block-end","index":0,"block":{"type":"text","text":"DONE"}}}}
@@ -39,8 +39,7 @@ describe('headless-agent keyless smoke', () => {
    expect(stderr).toBe('')
    expect(events.some(event => event.type === 'tool/call' && event.data.name === 'bash')).toBe(true)
    const catalogMessage = events.find(event => event.type === 'user/message'
-      && event.data.source.kind === 'plugin'
-      && event.data.source.plugin === 'dsh-tool-skill')
+      && event.data.source.kind === 'skill-catalog')
    const catalog = catalogMessage?.type === 'user/message'
      ? catalogMessage.data.content.filter(block => block.type === 'text').map(block => block.text).join('\n')
      : ''
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/runtime/README.md
-README.md: f95e06162bca132a9aa83e0b84e875a81d2f8fc6
-README.zh.md: 4b1a9dda3bbe02ef9241a8a797a07e5285e6daae
+README.md: 8ac29a4258bbd7456b20c61e547d48c570e84d27
+README.zh.md: 0e065e43ecc571e68d3976d2100eb43959cb2e3d
@@ -34,7 +34,7 @@ SlotsService gives the renderer separate bare observables for `useSessions` and

 ## The human transcript

-`ConversationSnapshot.nodes` is the human transcript, not the model surface. `TranscriptAdapter` projects the raw window in log order — every append-origin surface event (`isAppendSurfaceEvent`) at its own log position, plus one `CompactionSummaryNode` marker per landed compaction checkpoint — and never consults surface order. `ConversationSnapshot.turnEnds` maps each completed turn in that window to its `turn/end` seq, retaining turn completion independently from the transcript so presentation can require a real boundary before enabling an action. A landed compaction therefore keeps the conversation it shadowed on the model side: the marker reports where the model stopped seeing that history instead of erasing it. Model-only replacement copies stay out: a pruned `tool/result` and a regenerated `assistant/message` rewrite one node for the model and mark no boundary. A checkpoint is a `user/message` carrying the compaction seam's plugin source that **replaced** a surface range; an appending plugin-sourced `user/message` is injected context, not a compaction. The adapter's plugin literal is pinned to the seam's own declaration by a type-only import of the cordis-free [`dsh-compact/checkpoint`](../../compact/compact/README.md) leaf, so renaming it there fails `tsc` here; a **value** import of the package would fail the client purity gate, and the package **root** is unreachable even as a type (it reaches `dsh-session`'s root, whose `Context` merge collides the host `sessions` with this program's).
+`ConversationSnapshot.nodes` is the human transcript, not the model surface. `TranscriptAdapter` projects the raw window in log order — every append-origin surface event (`isAppendSurfaceEvent`) at its own log position, plus one `CompactionSummaryNode` marker per landed compaction checkpoint — and never consults surface order. `SteeringHistory` replays the durable `agent/inbox/spliced` records in that window: a user-origin message claimed from `next-step` becomes a `SteeringMessageNode` when its matching `user/message` lands, a `next-turn` claim stays a user node, and non-user next-step input stays context. `ConversationSnapshot.turnEnds` maps each completed turn in that window to its `turn/end` seq, retaining turn completion independently from the transcript so presentation can require a real boundary before enabling an action. A landed compaction therefore keeps the conversation it shadowed on the model side: the marker reports where the model stopped seeing that history instead of erasing it. Model-only replacement copies stay out: a pruned `tool/result` and a regenerated `assistant/message` rewrite one node for the model and mark no boundary. A checkpoint is a `user/message` carrying the compaction seam's plugin source that **replaced** a surface range; an appending plugin-sourced `user/message` is injected context, not a compaction. Each context node also carries a `provenance` view: `contextProvenance()` reads the durable source alone to decide whether the row is an `inject` or a cross-session `recall`, and to name its producer from the instruction paths, referenced session titles, or plugin id that source already records. The client holds no table of plugin ids, so a renamed or newly mounted producer stays identifiable without a client release and a resumed or foreign log projects exactly like a live one; a source with no readable kind degrades to an unnamed injection. Beside it, `contextForm()` reads the producer-declared `ContextForm` — the second, independent axis: `kind` says who produced the context, `form` says what shape of information it is, so several producers may share one form. A form this UI version does not present projects as null and renders opaque. The adapter's plugin literal is pinned to the seam's own declaration by a type-only import of the cordis-free [`dsh-compact/checkpoint`](../../compact/compact/README.md) leaf, so renaming it there fails `tsc` here; a **value** import of the package would fail the client purity gate, and the package **root** is unreachable even as a type (it reaches `dsh-session`'s root, whose `Context` merge collides the host `sessions` with this program's).

 Because the projection is log-ordered, the node array is seq-monotonic by construction: log-only `command/run` / `command/done` nodes splice in by seq, `Session` merges interrupted frozen nodes by their fractional seqs, and a window whose checkpoint cites a shadowed range outside it renders the marker with nothing logged. The marker's summary text comes from the checkpoint's `compact/summary` provenance; a window cut that left the provenance outside makes the row non-expandable rather than empty, and a later page that supplies it resolves the text. Performance contract: one append materializes at most one node and copies the projection only when it adds that node; an event that changes no node keeps the previous array reference (a chunk storm costs nothing), and unchanged nodes keep their object identity.

@@ -34,7 +34,7 @@ SlotsService 分别为 renderer 提供 `useSessions` 与 `useWorkspaces` 的裸

 ## 面向人的 transcript（文本记录）

-`ConversationSnapshot.nodes` 是面向人的 transcript，不是模型 surface。`TranscriptAdapter` 按日志顺序投影原始窗口——每个 append 来源的 surface 事件（`isAppendSurfaceEvent`）落在它自己的日志位置上，外加每次落地的压缩（compaction）检查点贡献一个 `CompactionSummaryNode` 标记——且从不查询 surface 顺序。`ConversationSnapshot.turnEnds` 把该窗口中的每个已完成轮次映射到其 `turn/end` seq；它独立于 transcript 保留轮次完成状态，使呈现层能够在启用操作前要求存在真实边界。于是一次落地的压缩会保留它在模型侧遮蔽掉的对话：标记报告模型从哪里开始看不见那段历史，而不是把它抹掉。仅模型可见的 replacement 副本不进入记录：被裁剪的 `tool/result` 和重新生成的 `assistant/message` 只为模型重写一个节点，不标记任何边界。检查点是携带压缩 seam 插件来源、且**替换**了一段 surface 范围的 `user/message`；一条 append 的插件来源 `user/message` 是注入上下文，不是压缩。适配器的插件字面量通过对无 cordis 的 [`dsh-compact/checkpoint`](../../compact/compact/README.md) 叶子做仅类型导入，钉在压缩 seam 自己的声明上：在那里改名会让此处 `tsc` 失败；而对该包（package）做**值**导入会被客户端纯度门禁拒绝，包的**根**即便作为类型也无法到达（它会到达 `dsh-session` 的根，其 `Context` 合并会让 host 的 `sessions` 与本程序的冲突）。
+`ConversationSnapshot.nodes` 是面向人的 transcript，不是模型 surface。`TranscriptAdapter` 按日志顺序投影原始窗口。每个 append 来源的 surface 事件（`isAppendSurfaceEvent`）落在它自己的日志位置上，每次落地的压缩（compaction）检查点还会贡献一个 `CompactionSummaryNode` 标记；适配器从不查询 surface 顺序。`SteeringHistory` 会重放该窗口中的持久 `agent/inbox/spliced` 记录：用户来源的消息从 `next-step` 被领取，并以相同身份落成 `user/message` 时，会投影为 `SteeringMessageNode`；从 `next-turn` 领取的消息仍是用户节点，非用户来源的 next-step 输入仍是上下文。`ConversationSnapshot.turnEnds` 把该窗口中的每个已完成轮次映射到其 `turn/end` seq；它独立于 transcript 保留轮次完成状态，使呈现层能够在启用操作前要求存在真实边界。于是一次落地的压缩会保留它在模型侧遮蔽掉的对话：标记报告模型从哪里开始看不见那段历史，而不是把它抹掉。仅模型可见的 replacement 副本不进入记录：被裁剪的 `tool/result` 和重新生成的 `assistant/message` 只为模型重写一个节点，不标记任何边界。检查点是携带压缩 seam 插件来源、且**替换**了一段 surface 范围的 `user/message`；一条 append 的插件来源 `user/message` 是注入上下文，不是压缩。每个上下文节点还携带一份 `provenance` 视图：`contextProvenance()` 只读取持久来源，据此判定该行是 `inject`（注入）还是跨会话的 `recall`（召回），并用该来源已经记录的指令文件路径、被引用会话标题或插件 id 命名其生产者。客户端不保存任何插件 id 表，因此重命名或新挂载的生产者无需客户端发版即可保持可辨识，恢复的会话日志与外部日志的投影结果和实时会话完全一致；没有可读 kind 的来源则降级为无名注入。与之并列的 `contextForm()` 读取生产方声明的 `ContextForm`，这是相互独立的第二根轴：`kind` 说明上下文由谁产生，`form` 说明它是何种形态的信息，因此多个生产方可以共用一种形态。本 UI 版本不呈现的形态投影为 null，按 opaque 渲染。适配器的插件字面量通过对无 cordis 的 [`dsh-compact/checkpoint`](../../compact/compact/README.md) 叶子做仅类型导入，钉在压缩 seam 自己的声明上：在那里改名会让此处 `tsc` 失败；而对该包（package）做**值**导入会被客户端纯度门禁拒绝，包的**根**即便作为类型也无法到达（它会到达 `dsh-session` 的根，其 `Context` 合并会让 host 的 `sessions` 与本程序的冲突）。

 由于投影按日志顺序，节点数组天然按 seq 单调：仅日志的 `command/run` / `command/done` 节点按 seq 插入，`Session` 按分数 seq 归并被打断的冻结节点，而检查点所引范围落在窗口之外的窗口会渲染出标记且不打印任何日志。标记的摘要文本来自检查点的 `compact/summary` 溯源；窗口切分把溯源留在窗口外时该行不可展开而非空白，后续补上溯源的分页会解析出文本。性能契约：一次追加最多物化一个节点，并且仅在加入该节点时复制投影；不改变任何节点的事件保持上一次的数组引用（分片风暴零成本），未变化的节点保持其对象标识。

@@ -48,11 +48,14 @@ export type {
  AssistantTiming, CodeSubCall, CommandNode, CompactionSummaryNode, ComposerPhase,
  ContextMessageNode, ConversationNode, ConversationSnapshot, ModelRetryNode, QueuedMessage,
  RunningToolCall,
-  TodoItem, ToolResultNode, TurnErrorNode, UnknownSurfaceNode, UserMessageNode,
+  SteeringMessageNode, TodoItem, ToolResultNode, TurnErrorNode, UnknownSurfaceNode, UserMessageNode,
 } from './sessions/conversation.ts'
 export type {
  ConversationContext, ConversationContextOriginKind,
 } from './sessions/conversation-context.ts'
+export type {
+  ContextProvenanceView, ContextRole, KnownContextForm,
+} from './sessions/context-provenance.ts'
 export type {
  ConversationPromptSnapshot, RequestInspectionSnapshot, RequestPromptChange, RequestView,
 } from './sessions/request-inspection.ts'
@@ -11,6 +11,8 @@ import type {
  PartialAssistant, RunningToolCall,
 } from '../sessions/conversation.ts'
 import { toAssistantBlocks } from '../sessions/conversation.ts'
+import { contextForm, contextProvenance } from '../sessions/context-provenance.ts'
+import { SteeringHistory } from '../sessions/steering-history.ts'
 import type {
  ConversationContext, ConversationContextOriginKind,
 } from '../sessions/conversation-context.ts'
@@ -126,6 +128,7 @@ function materializeNode(
  resultView: ToolResultView | null,
  assistantTiming: AssistantTiming | undefined,
  requestConfig: AssistantRequestConfig | undefined,
+  steering: boolean,
 ): ConversationNode {
  switch (event.type) {
    case 'user/message':
@@ -133,6 +136,15 @@ function materializeNode(
        return {
          kind: 'context', seq: event.seq, time: event.time,
          content: event.data.content, source: event.data.source,
+          provenance: contextProvenance(event.data.source),
+          form: contextForm(event.data.source),
+        }
+      }
+      if (steering) {
+        return {
+          kind: 'steering', messageId: event.data.id,
+          seq: event.seq, time: event.time,
+          content: event.data.content, source: event.data.source,
        }
      }
      return {
@@ -332,6 +344,11 @@ export function projectConversationHistory(
  entries: readonly HistoryEntry[],
 ): ConversationHistoryProjection {
  const events = entries.map(entry => entry.event)
+  const steeringHistory = new SteeringHistory()
+  const steeringSeqs = new Set<number>()
+  for (const event of events) {
+    if (steeringHistory.apply(event)) steeringSeqs.add(event.seq)
+  }
  const baseSeq = events[0]?.seq ?? 0
  const eventsBySeq = new Map(events.map(event => [event.seq, event]))
  const callIndex = new Map<string, CallIndexEntry>()
@@ -392,6 +409,7 @@ export function projectConversationHistory(
      resultViews.get(seq) ?? null,
      assistantTimings.get(seq),
      assistantRequestConfigs.get(seq),
+      steeringSeqs.has(seq),
    )
    nodeCache.set(seq, node)
    return node
@@ -0,0 +1,116 @@
+// Context provenance projection: the role and the human-facing producer name
+// of one logged non-user `user/message`, read from its durable `source` alone.
+// The client keeps no table of known plugin ids — a renamed or newly mounted
+// producer must never need a client release to stay identifiable, and a resumed
+// or foreign log must project the same way as a live one.
+
+/**
+ * Which model-facing role a logged non-user message plays.
+ *
+ * `recall` marks material lifted out of another session's log; `inject` marks
+ * every other producer-supplied context. Mid-turn steering is the third role
+ * the transcript distinguishes, but it has its own event and node kind
+ * (`steering/message` / `SteeringMessageNode`) and never reaches here.
+ */
+export type ContextRole = 'inject' | 'recall'
+
+/** Role and producer name presented for one logged non-user message. */
+export interface ContextProvenanceView {
+  /** The role this context plays in the model-facing conversation. */
+  role: ContextRole
+  /**
+   * Producer name for the row header, taken from the durable source: the
+   * instruction paths, the referenced session titles, the plugin id, or the
+   * bare source kind for a producer this UI version does not know. Null only
+   * when the source carries no readable kind at all.
+   */
+  label: string | null
+}
+
+/** One durable source narrowed to the readable-record shape; null for anything else. */
+function asRecord(value: unknown): Record<string, unknown> | null {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : null
+}
+
+/** A record field read as a non-empty string, or null. */
+function readString(record: Record<string, unknown>, key: string): string | null {
+  const value = record[key]
+  return typeof value === 'string' && value.length > 0 ? value : null
+}
+
+/** Distinct non-empty `field` values of an array-valued source member, in first-seen order. */
+function collect(source: Record<string, unknown>, member: string, field: string): string[] {
+  const list = source[member]
+  if (!Array.isArray(list)) return []
+  const seen: string[] = []
+  for (const entry of list) {
+    const record = asRecord(entry)
+    const value = record === null ? null : readString(record, field)
+    if (value !== null && !seen.includes(value)) seen.push(value)
+  }
+  return seen
+}
+
+/** A collected name list rendered as one label; null when the list is empty. */
+function joined(names: string[]): string | null {
+  return names.length > 0 ? names.join(', ') : null
+}
+
+/**
+ * Project one durable message source onto its transcript role and producer name.
+ *
+ * The source arrives over the wire as opaque JSON (`MessageSource` is
+ * merge-extensible, so no client-side union can be exhaustive), and a durable
+ * log may predate or postdate this UI; every unreadable shape therefore
+ * degrades to `inject` with whatever name the record still carries.
+ * @param source - the logged `user/message` source, exactly as recorded.
+ * @returns the role and producer name to present for this context.
+ */
+export function contextProvenance(source: unknown): ContextProvenanceView {
+  const record = asRecord(source)
+  const kind = record === null ? null : readString(record, 'kind')
+  if (record === null || kind === null) return { role: 'inject', label: null }
+  switch (kind) {
+    // Cross-session snapshots are the one durable source that carries another
+    // session's material; its references name the sessions they were read from.
+    case 'session-reference':
+      return { role: 'recall', label: joined(collect(record, 'references', 'label')) ?? kind }
+    // Workspace instructions name the files they were reconciled from, which
+    // identifies the producer far better than the plugin id would.
+    case 'workspace-instructions':
+      return { role: 'inject', label: joined(collect(record, 'changes', 'path')) ?? kind }
+    case 'plugin':
+      return { role: 'inject', label: readString(record, 'plugin') ?? kind }
+    // Documented default arm of the merge-extensible source map: an unknown
+    // producer still identifies itself by its own durable kind.
+    default:
+      return { role: 'inject', label: kind }
+  }
+}
+
+/**
+ * Context forms this UI version renders with a dedicated presentation. The
+ * durable vocabulary (`ContextForm` in `dsh-llm`) may already be wider — an
+ * unrecognized or absent value degrades to the opaque presentation rather than
+ * dropping the row, so a log written by a newer or foreign producer still
+ * renders.
+ */
+const KNOWN_FORMS = ['instructions', 'catalog'] as const
+
+/** One durable context form this UI version knows how to present. */
+export type KnownContextForm = typeof KNOWN_FORMS[number]
+
+/**
+ * Read the producer-declared form off one durable message source.
+ * @param source - the logged `user/message` source, exactly as recorded.
+ * @returns the form when this UI version presents it, otherwise null (opaque).
+ */
+export function contextForm(source: unknown): KnownContextForm | null {
+  const record = asRecord(source)
+  const form = record === null ? null : readString(record, 'form')
+  return form !== null && (KNOWN_FORMS as readonly string[]).includes(form)
+    ? form as KnownContextForm
+    : null
+}
@@ -12,6 +12,7 @@ import type {
  RpcError, SessionId, SubagentAddress, ToolCallView, ToolResultView,
 } from '@deepseek-ai/dsh-client-connection/client'
 import type { PendingInteraction } from './pending.ts'
+import type { ContextProvenanceView, KnownContextForm } from './context-provenance.ts'
 export type { TodoItem }

 /** Request configuration recorded for one provider call. */
@@ -102,6 +103,18 @@ export interface AssistantMessageNode {
  interrupted?: true
 }

+/** A human message admitted from the next-step inbox while a turn was running. */
+export interface SteeringMessageNode {
+  kind: 'steering'
+  /** Stable message identity shared with its pre-admission inbox occurrence. */
+  messageId: MessageId
+  seq: number
+  /** Unix epoch ms from the source session event. */
+  time: number
+  content: readonly ContentBlock[]
+  source: unknown
+}
+
 /** A context/system injection surfaced in the flow. */
 export interface ContextMessageNode {
  kind: 'context'
@@ -110,6 +123,10 @@ export interface ContextMessageNode {
  time: number
  content: readonly ContentBlock[]
  source: unknown
+  /** Role and producer name projected from `source` ({@link contextProvenance}). */
+  provenance: ContextProvenanceView
+  /** Producer-declared information form ({@link contextForm}); null presents as opaque. */
+  form: KnownContextForm | null
 }

 /** Durable notice that a closed failed step is waiting for a model-request retry. */
@@ -223,6 +240,7 @@ export interface CommandNode {
 export type ConversationNode =
  | UserMessageNode
  | AssistantMessageNode
+  | SteeringMessageNode
  | ContextMessageNode
  | ModelRetryNode
  | TurnErrorNode
@@ -0,0 +1,65 @@
+/** Reconstruct durable steering identity from the event-sourced agent inbox. */
+
+import type { SessionEvent } from '@deepseek-ai/dsh-session/types'
+
+type InboxTarget = 'next-turn' | 'next-step'
+
+/** Minimal pending identity retained while replaying durable inbox splices. */
+interface PendingIdentity {
+  readonly id: string
+}
+
+/** Client-side structural view of the host-owned inbox event. */
+interface InboxSplice {
+  readonly target: InboxTarget
+  readonly start: number
+  readonly removedCount?: number
+  readonly inserted: readonly PendingIdentity[]
+  readonly outcome?: 'canceled'
+}
+
+/**
+ * Incrementally identifies `user/message` events claimed from the next-step
+ * inbox. The agent loop records all admitted input as `user/message`; the
+ * preceding `agent/inbox/spliced` events preserve whether it came from the
+ * queued-turn list or the next-step list.
+ */
+export class SteeringHistory {
+  private readonly inbox: Record<InboxTarget, PendingIdentity[]> = {
+    'next-turn': [],
+    'next-step': [],
+  }
+
+  private readonly claimedNextStep = new Set<string>()
+
+  /** Clear all replay state before rebuilding a history window. */
+  reset(): void {
+    this.inbox['next-turn'] = []
+    this.inbox['next-step'] = []
+    this.claimedNextStep.clear()
+  }
+
+  /**
+   * Apply one event and report whether it is a durable human steering message.
+   * @param event - next raw session event in sequence order.
+   * @returns true only for a user-origin message previously claimed from `next-step`.
+   */
+  apply(event: SessionEvent): boolean {
+    if ((event.type as string) === 'agent/inbox/spliced') {
+      this.applySplice(event.data as unknown as InboxSplice)
+      return false
+    }
+    if (event.type !== 'user/message') return false
+    const id = event.data.id
+    if (!this.claimedNextStep.delete(id)) return false
+    return event.data.source.kind === 'user'
+  }
+
+  /** Replay one host-validated inbox splice. */
+  private applySplice({ target, start, removedCount = 0, inserted, outcome }: InboxSplice): void {
+    const removed = this.inbox[target].splice(start, removedCount, ...inserted)
+    for (const identity of inserted) this.claimedNextStep.delete(identity.id)
+    if (target !== 'next-step' || outcome === 'canceled') return
+    for (const identity of removed) this.claimedNextStep.add(identity.id)
+  }
+}
@@ -22,6 +22,8 @@ import type { COMPACT_CHECKPOINT_SOURCE } from '@deepseek-ai/dsh-compact/checkpo
 import type { ToolCallView, ToolEventView, ToolResultView } from '@deepseek-ai/dsh-client-connection/client'
 import type { CommandNode, CompactionSummaryNode, ConversationNode } from './conversation.ts'
 import { toAssistantBlocks } from './conversation.ts'
+import { contextForm, contextProvenance } from './context-provenance.ts'
+import { SteeringHistory } from './steering-history.ts'
 import type { AssistantStepMetadata } from './assistant-timing.ts'
 import { indexAssistantStepTiming, settledAssistantTiming } from './assistant-timing.ts'

@@ -46,11 +48,12 @@ interface CallIndexEntry {
  callView: ToolCallView | null
 }

-/** One event -> UI node (pure function; the eight-variant ConversationNode union). */
+/** One event -> UI node (pure function; the ten-variant ConversationNode union). */
 function materializeNode(
  event: SessionEvent,
  callIndex: ReadonlyMap<string, CallIndexEntry>,
  resultView: ToolResultView | null,
+  steering: boolean,
  stepTimings: ReadonlyMap<string, AssistantStepMetadata>,
 ): ConversationNode {
  switch (event.type) {
@@ -62,6 +65,15 @@ function materializeNode(
        return {
          kind: 'context', seq: event.seq, time: event.time,
          content: event.data.content, source: event.data.source,
+          provenance: contextProvenance(event.data.source),
+          form: contextForm(event.data.source),
+        }
+      }
+      if (steering) {
+        return {
+          kind: 'steering', messageId: event.data.id,
+          seq: event.seq, time: event.time,
+          content: event.data.content, source: event.data.source,
        }
      }
      return {
@@ -178,6 +190,8 @@ export class TranscriptAdapter {
  private stepTimings = new Map<string, AssistantStepMetadata>()
  /** Wire result views keyed by the tool/result event's seq (views ride the envelope, not the event). */
  private resultViews = new Map<number, ToolResultView>()
+  /** Durable inbox replay used to distinguish next-step human input from queued prompts. */
+  private readonly steeringHistory = new SteeringHistory()
  /**
   * Command lifecycle nodes by commandId (insertion = run order). The
   * `command/run`/`command/done` pair is log-only, so it is not a surface
@@ -206,6 +220,8 @@ export class TranscriptAdapter {
    this.callIdx = new Map()
    this.resultViews.clear()
    this.commandIdx = new Map()
+    this.steeringHistory.reset()
+    const steeringSeqs = new Set<number>()
    this.stepTimings = new Map()
    for (let i = 0; i < events.length; i++) {
      const event = events[i]
@@ -214,13 +230,14 @@ export class TranscriptAdapter {
      this.eventIndex.set(event.seq, event)
      this.indexCall(event, views?.[i])
      this.indexCommand(event)
+      if (this.steeringHistory.apply(event)) steeringSeqs.add(event.seq)
      indexAssistantStepTiming(this.stepTimings, event)
    }
    // Indexes first, then project: a tool/result materializes against the
    // complete call index, and a checkpoint against the complete event index.
    const projected: ConversationNode[] = []
    for (const event of events) {
-      if (isTranscriptEvent(event)) projected.push(this.materialize(event))
+      if (isTranscriptEvent(event)) projected.push(this.materialize(event, steeringSeqs.has(event.seq)))
    }
    this.projected = projected
  }
@@ -237,10 +254,11 @@ export class TranscriptAdapter {
  append(event: SessionEvent, view?: ToolEventView): void {
    this.eventIndex.set(event.seq, event)
    this.indexCall(event, view)
+    const steering = this.steeringHistory.apply(event)
    indexAssistantStepTiming(this.stepTimings, event)
    if (this.indexCommand(event)) this.rev++
    if (!isTranscriptEvent(event)) return
-    this.projected = [...this.projected, this.materialize(event)]
+    this.projected = [...this.projected, this.materialize(event, steering)]
    this.rev++
  }

@@ -273,10 +291,16 @@ export class TranscriptAdapter {
  }

  /** Materialize one transcript event against the complete current indexes. */
-  private materialize(event: SessionEvent): ConversationNode {
+  private materialize(event: SessionEvent, steering: boolean): ConversationNode {
    return isCompactCheckpoint(event)
      ? materializeCompaction(event, this.eventIndex)
-      : materializeNode(event, this.callIdx, this.resultViews.get(event.seq) ?? null, this.stepTimings)
+      : materializeNode(
+        event,
+        this.callIdx,
+        this.resultViews.get(event.seq) ?? null,
+        steering,
+        this.stepTimings,
+      )
  }

  /**
@@ -1,4 +1,4 @@
-import { createMessage } from '@deepseek-ai/dsh-llm'
+import { createMessage, createUserMessage } from '@deepseek-ai/dsh-llm'
 import type { SessionEvent } from '@deepseek-ai/dsh-session/types'
 import { describe, expect, it } from 'vitest'
 import { projectConversationHistory } from '../src/client/session-history/history-fold.ts'
@@ -10,6 +10,49 @@ const at = (seq: number, event: Record<string, unknown>): SessionEvent =>
  ({ seq, time: 1_700_000_000_000 + seq, ...event }) as unknown as SessionEvent

 describe('projectConversationHistory', () => {
+  it('names an injected context node from its durable source, like the live adapter', () => {
+    // The fold declares its own node mapping (jscpd:ignore in the source), so
+    // the provenance projection is pinned on both sides independently.
+    const injected = at(0, {
+      type: 'user/message',
+      surfaceOp: 'append',
+      data: createUserMessage({
+        content: [{ type: 'text', text: '<available_skills>…</available_skills>' }],
+        // A plugin source, because the client program does not see the host
+        // packages that merge richer source kinds; those arms are pinned in
+        // context-provenance.spec.ts.
+        source: { kind: 'plugin', plugin: 'dsh-tool-skill', form: 'catalog' },
+      }),
+    })
+    const { contexts } = projectConversationHistory([{ event: injected }])
+    expect(contexts[contexts.length - 1]?.nodes).toMatchObject([{
+      kind: 'context',
+      seq: 0,
+      provenance: { role: 'inject', label: 'dsh-tool-skill' },
+      form: 'catalog',
+    }])
+  })
+
+  it('projects next-step human input as durable steering', () => {
+    const steering = createUserMessage({
+      content: [{ type: 'text', text: 'change course' }],
+      source: { kind: 'user' },
+    })
+    const events = [
+      at(0, { type: 'agent/inbox/spliced', data: {
+        target: 'next-step', start: 0, inserted: [steering],
+      } }),
+      at(1, { type: 'agent/inbox/spliced', data: {
+        target: 'next-step', start: 0, removedCount: 1, inserted: [],
+      } }),
+      at(2, { type: 'user/message', surfaceOp: 'append', data: steering }),
+    ]
+    const projection = projectConversationHistory(events.map(event => ({ event })))
+    expect(projection.eventNodes).toMatchObject([{
+      kind: 'steering', messageId: steering.id, seq: 2,
+    }])
+  })
+
  it('projects a high-sequence history window without synthesizing its unloaded prefix', () => {
    const baseSeq = 400_000
    const events = [
@@ -85,22 +85,85 @@ describe('TranscriptAdapter', () => {

  it('materializes every append-origin variant with field mapping', () => {
    const adapter = new TranscriptAdapter()
+    const steering = createUserMessage({
+      content: [{ type: 'text', text: '插话' }],
+      source: { kind: 'user' },
+    })
    adapter.reset([
      ev.user(0, '用户'),
      ev.assistant(1, 0, '助手'),
-      at(2, { type: 'user/message', surfaceOp: 'append', data: createUserMessage({
+      at(2, { type: 'agent/inbox/spliced', data: {
+        target: 'next-step', start: 0, inserted: [steering],
+      } }),
+      at(3, { type: 'agent/inbox/spliced', data: {
+        target: 'next-step', start: 0, removedCount: 1, inserted: [],
+      } }),
+      at(4, { type: 'user/message', surfaceOp: 'append', data: steering }),
+      at(5, { type: 'user/message', surfaceOp: 'append', data: createUserMessage({
        content: [{ type: 'text', text: '上下文' }], source: { kind: 'plugin', plugin: 'p' },
      }) }),
-      ev.toolCall(3, 0, 'c1', 'echo', '{"x":1}'),
-      ev.toolResult(4, 0, 'c1', '结果'),
+      ev.toolCall(6, 0, 'c1', 'echo', '{"x":1}'),
+      ev.toolResult(7, 0, 'c1', '结果'),
    ])
    const nodes = adapter.nodes()
-    expect(nodes.map(n => n.kind)).toEqual(['user', 'assistant', 'context', 'tool-result'])
+    expect(nodes.map(n => n.kind)).toEqual(['user', 'assistant', 'steering', 'context', 'tool-result'])
+    expect(nodes.find(n => n.kind === 'steering')).toMatchObject({ messageId: steering.id })
    expect(nodes.find(n => n.kind === 'tool-result')).toMatchObject({
      callId: 'c1', call: { name: 'echo', argsRaw: '{"x":1}' }, isError: false,
    })
  })

+  it('identifies steering on the live append path', () => {
+    const adapter = new TranscriptAdapter()
+    const steering = createUserMessage({
+      content: [{ type: 'text', text: 'live steer' }],
+      source: { kind: 'user' },
+    })
+    adapter.reset([])
+    adapter.append(at(0, { type: 'agent/inbox/spliced', data: {
+      target: 'next-step', start: 0, inserted: [steering],
+    } }))
+    adapter.append(at(1, { type: 'agent/inbox/spliced', data: {
+      target: 'next-step', start: 0, removedCount: 1, inserted: [],
+    } }))
+    adapter.append(at(2, { type: 'user/message', surfaceOp: 'append', data: steering }))
+    expect(adapter.nodes()).toMatchObject([{ kind: 'steering', messageId: steering.id }])
+  })
+
+  it('does not mark queued, canceled, or non-user next-step messages as steering', () => {
+    const adapter = new TranscriptAdapter()
+    const queued = createUserMessage({ content: [{ type: 'text', text: 'queued' }], source: { kind: 'user' } })
+    const canceled = createUserMessage({ content: [{ type: 'text', text: 'canceled' }], source: { kind: 'user' } })
+    const context = createUserMessage({
+      content: [{ type: 'text', text: 'context' }],
+      source: { kind: 'plugin', plugin: 'test' },
+    })
+    adapter.reset([
+      at(0, { type: 'agent/inbox/spliced', data: {
+        target: 'next-turn', start: 0, inserted: [queued],
+      } }),
+      at(1, { type: 'agent/inbox/spliced', data: {
+        target: 'next-turn', start: 0, removedCount: 1, inserted: [],
+      } }),
+      at(2, { type: 'user/message', surfaceOp: 'append', data: queued }),
+      at(3, { type: 'agent/inbox/spliced', data: {
+        target: 'next-step', start: 0, inserted: [canceled],
+      } }),
+      at(4, { type: 'agent/inbox/spliced', data: {
+        target: 'next-step', start: 0, removedCount: 1, inserted: [], outcome: 'canceled',
+      } }),
+      at(5, { type: 'user/message', surfaceOp: 'append', data: canceled }),
+      at(6, { type: 'agent/inbox/spliced', data: {
+        target: 'next-step', start: 0, inserted: [context],
+      } }),
+      at(7, { type: 'agent/inbox/spliced', data: {
+        target: 'next-step', start: 0, removedCount: 1, inserted: [],
+      } }),
+      at(8, { type: 'user/message', surfaceOp: 'append', data: context }),
+    ])
+    expect(adapter.nodes().map(node => node.kind)).toEqual(['user', 'user', 'context'])
+  })
+
  it('skips events core does not call surface-eligible, marker or not', () => {
    // The transcript is the append-origin surface, so log-only events (a chunk,
    // a turn boundary, a compact/* provenance record) and a future type core
@@ -198,10 +261,15 @@ describe('TranscriptAdapter', () => {
      adapter.reset([
        at(0, { type: 'user/message', surfaceOp: 'append', data: createUserMessage({
          content: [{ type: 'text', text: '注入的上下文' }],
-          source: { kind: 'plugin', plugin: 'compact' },
+          source: { kind: 'plugin', plugin: 'compact', form: 'instructions' },
        }) }),
      ])
-      expect(adapter.nodes()).toMatchObject([{ kind: 'context', seq: 0 }])
+      expect(adapter.nodes()).toMatchObject([{
+        kind: 'context',
+        seq: 0,
+        provenance: { role: 'inject', label: 'compact' },
+        form: 'instructions',
+      }])
    })

    it('ignores a foreign plugin s replacement user/message', () => {
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/ui-conversation/README.md
-README.md: b262c4f89ebcfb8148a0c9a579efe18c2bd4f7a9
-README.zh.md: 5a333e84000893040ec26f7c10dbb32cb3e064b7
+README.md: 7bd0d551fc41967326dd9860f5c31a99ea3c254a
+README.zh.md: d339f6423d9a9f77c02d86ad0b8e57bd0baba52b
@@ -14,7 +14,7 @@ Approvals take over the composer through the chain this package declares: `Appro

 The session header declares and renders the session-scoped `'conversation.session.header.actions'` list beside the title, allowing feature plugins to contribute controls without entering the skeleton. The composer chain currency includes the current conversation `session`; ui-subagent selects one-shot or parent-unavailable addressed sessions for reason-specific read-only copy, while the ordinary InputBar keeps every addressed child Send-only because the continuation service exposes no public per-Activation cancellation operation and `session.cancel` would bypass its ownership.

-Logged non-user messages render as a default-collapsed `上下文注入` disclosure. It shares the Tool calls header geometry and interaction with `ToolRow` through the package-internal `DisclosureRow`, while retaining context semantics: the expanded body follows its content height up to a 141px scrolling cap, shows inline JSON for both `content` and `source`, and synthesizes no tool state, summary, or keyed toolview dispatch ([decision](../../../.agents/notes/implemented/feature/2026-07-30-web-context-injection-disclosure.md)).
+Logged non-user messages render as a default-collapsed disclosure whose header names the role the runtime projected for the message — `上下文注入` for an injection, `跨会话召回` for a recalled session — followed by the producer name that projection read out of the durable source, so a reader distinguishes a skill catalog from a workspace instruction file or a recalled session without expanding. A source that names no producer shows the role alone. The header shares the Tool calls geometry and interaction with `ToolRow` through the package-internal `DisclosureRow`, while retaining context semantics: the expanded body follows its content height up to a 141px scrolling cap and synthesizes no tool state, summary, or keyed toolview dispatch ([disclosure decision](../../../.agents/notes/implemented/feature/2026-07-30-web-context-injection-disclosure.md), [provenance decision](../../../.agents/notes/implemented/feature/2026-08-04-web-context-source-and-steer-marks.md)). That body follows the form the producer declared on its durable source: `instructions` names the reconciled files above their text, `catalog` lists the entries the source recorded instead of the model-facing prose, and every other value — absent, unknown to this version, or carrying no usable fields — renders the opaque body, which shows the model-facing text with its real line breaks and the remaining provenance as fields. The opaque body is the documented default, not a leftover: a resumed, forked, or foreign log must render whether or not its producer is mounted here. A durable or pending steering bubble carries an `插话` / `Interjection` caption above it, the only thing distinguishing a mid-turn interjection from the turn-opening prompt that shares its bubble.

 A Think row stays collapsed by default and exposes live reasoning throughput without expanding the chain of thought: while its reasoning block is the streaming tail, the summary switches from the settled first line to the latest non-blank line and its one-line scrollport follows each delta to the inline end. Expanding the row removes the moving summary and leaves the full reasoning in ordinary page flow, so page reading never fights an internal follower; settlement restores the stable first-line summary at the left edge ([decision](../../../.agents/notes/implemented/feature/2026-08-02-web-thinking-tail-scroll.md)).

@@ -12,7 +12,7 @@

 会话页头会在标题旁声明并渲染 Session scope 的 `'conversation.session.header.actions'` 列表，使功能插件无需进入骨架即可贡献控件。编辑器链的 currency 包含当前对话 `session`；ui-subagent 会选取 one-shot 或 parent 不可用的已寻址会话，并按原因显示只读文案，而普通 InputBar 会让所有已寻址 child 仅保留 Send，因为继续执行服务不公开逐 Activation 取消操作，`session.cancel` 也会绕过其所有权。

-已记录的非用户消息渲染为默认折叠的 `上下文注入` 展开项。它通过包内部的 `DisclosureRow` 与 `ToolRow` 共享 Tool calls 标题栏的几何与交互，同时保留上下文语义：展开内容区的高度会随内容自适应，最大为 141px，超出后滚动，并以内联 JSON 展示 `content` 和 `source`，且不会合成工具状态、摘要或键控 toolview 分发（[决策](../../../.agents/notes/implemented/feature/2026-07-30-web-context-injection-disclosure.md)）。
+已记录的非用户消息渲染为默认折叠的展开项，标题栏先给出运行时为该消息投影出的角色——注入为 `上下文注入`，召回为 `跨会话召回`——其后是该投影从持久来源读出的生产者名称，因此读者无需展开即可区分 skill（技能）目录、工作区指令文件与被召回的会话。来源未提供生产者名称时只显示角色。标题栏通过包内部的 `DisclosureRow` 与 `ToolRow` 共享 Tool calls 的几何与交互，同时保留上下文语义：展开内容区的高度会随内容自适应，最大为 141px，超出后滚动，且不会合成工具状态、摘要或键控 toolview 分发（[展开项决策](../../../.agents/notes/implemented/feature/2026-07-30-web-context-injection-disclosure.md)、[来源决策](../../../.agents/notes/implemented/feature/2026-08-04-web-context-source-and-steer-marks.md)）。该内容区按生产方在持久来源上声明的形态渲染：`instructions` 在正文之上列出它对账过的文件，`catalog` 列出来源记录的条目而非面向模型的散文，其余取值——未声明、本版本不认识、或字段不可用——一律渲染 opaque 内容区，即按真实换行展示面向模型的文本，并把剩余来源信息列成字段。opaque 不是兜底剩余物而是有文档的默认：恢复的、fork 的、外部写入的日志，无论其生产方是否挂载在此处，都必须渲染得出来。持久或待处理的 steering（中途引导）气泡上方带有 `插话` / `Interjection` 标注，这是把中途插话与共用同一气泡的开轮提示区分开的唯一标识。

 Think 行默认保持折叠，并在不展开思维链的情况下暴露实时推理（reasoning）吞吐：当推理块是流式输出尾部时，摘要从结算后的首行切换到最新的非空行，其单行滚动区会随每个 delta 追到行内末端。展开该行会移除移动摘要，让完整推理进入普通页面流，因此页面阅读不会与内部跟随器争夺滚动；结算后恢复左对齐的稳定首行摘要（[决策](../../../.agents/notes/implemented/feature/2026-08-02-web-thinking-tail-scroll.md)）。

@@ -36,7 +36,7 @@ Think 行默认保持折叠，并在不展开思维链的情况下暴露实时

 todo 两个面就是在该形状上的两个注册项，都使用 slot 声明注入，不依赖 `ConversationService`。`TodoRow` 占用 `'conversation.chat.toolview'` 的 `todo_write` key，摘要该次调用「试图写入」的内容（从其 args 解析出 `<已完成>/<总数> 已完成 · <进行中条目>`；模型 JSON 残缺或形状不对时回落到通用摘要；非 ok 执行状态保留通用状态点，使被取消的调用绝不读成一次已完成的更新）。`TodoDock` 以 `order: 0` 占用 `'conversation.input.dock'` 列表 slot（位于 Goal 与 Queue 之前），是计划条：它经 `useProjection` 读取 host 计算的 `todos` 投影（站立计划：其后没有更晚 `turn/start` 的最近一次 `todo/write`）并渲染 `TodoPanel`，后者接收纯列表，在列表为空时自我隐藏；列表非空时面板初始折叠，表头显示标题加 `"<已完成>/<总数> tasks · <n> in progress"`（状态图标为 figma 的勾选／进行中／虚线未开始一组）。选取由 dock 适配器负责，因此面板保持为其 props 的纯函数；站立列表放在此处而非行内，行才能保持单行。输入区 composer 链隐藏的一切（例如 ui-question 对 `conversation.composer` 的接管）也会隐藏整个 dock，包括这条计划条。

-`QueueDock` 是 `order: 20` 的末端 input-dock 条目。队列为空时隐藏；只有一个待处理项时直接渲染该行；存在两个或更多待处理项时，默认收起为 `"<n> 条排队消息"` 表头，其按钮可展开或收起完整列表。表头暴露 `aria-expanded` 和 `aria-controls`；展开后的列表以 180px 为高度上限，并可滚动。存在进行中的编辑或变更时，列表行会保持可见；队列清空后，下一次出现队列时会恢复默认收起状态。普通会话中的每条可见行仍是单行预览，并提供针对精确单次入队项的编辑、删除和严格 steering（中途引导）操作；已寻址 subagent 则保留只读行，因为其继续执行传输不提供 Queue 变更。如果严格 steering 输给已关闭的窗口，原单次入队项会留在 Queue 中正常投递；如果驱动器已经认领该项，正常投递就已开始。这两种已收敛的竞态都不显示失败，传输和未知错误仍会显示。
+`QueueDock` 是 `order: 20` 的末端 input-dock 条目。队列为空时隐藏；只有一个待处理项时直接渲染该行；存在两个或更多待处理项时，默认收起为 `"<n> 条排队消息"` 表头，其按钮可展开或收起完整列表。表头暴露 `aria-expanded` 和 `aria-controls`；展开后的列表以 180px 为高度上限，并可滚动。存在进行中的编辑或变更时，列表行会保持可见；队列清空后，下一次出现队列时会恢复默认收起状态。普通会话中的每条可见行仍是单行预览，并提供针对精确单次入队项的编辑、删除和严格 steering 操作；已寻址 subagent 则保留只读行，因为其继续执行传输不提供 Queue 变更。如果严格 steering 输给已关闭的窗口，原单次入队项会留在 Queue 中正常投递；如果驱动器已经认领该项，正常投递就已开始。这两种已收敛的竞态都不显示失败，传输和未知错误仍会显示。

 Host 带 placement 的 `session/queue` 快照也会携带待处理 steering。QueueDock 会将其过滤掉，ChatView 则把它投影为会话流末尾带复制操作的用户样式气泡；非用户来源的 next-step 项（注入上下文）改以 `context` placement 广播，领取前不在任何界面渲染。消息尚未进入持久轮次，因此不显示 fork。Host 会等携带该 steering 的持久 `user/message` 进入 mux 流之后再退役 steering。客户端运行时接纳该实时事件时，会在发布快照前退役第一个匹配的当前 steering 单次入队项；历史事件无法隐藏后来复用同一 `MessageId` 的单次入队项。气泡交接时因而不会产生空档或重复，会立即从持久节点恢复复制操作与分支控件，仅当该节点是已完成轮次的 transcript 尾部时才启用分支，并能在重连后从同一权威恢复。

@@ -0,0 +1,102 @@
+/* Expanded context bodies: one code-block surface shared by every form, so the
+   disclosure keeps the Figma 10:2482 geometry whichever form renders inside. */
+
+.text {
+  margin: 0;
+  color: var(--dsw-alias-label-secondary);
+  font: inherit;
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+}
+
+/* Provenance beneath the text: dimmer than the content it describes. */
+.fields {
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  margin: 8px 0 0;
+  padding-top: 8px;
+  border-top: 1px solid var(--dsw-alias-line-secondary);
+}
+
+.field {
+  display: flex;
+  gap: 8px;
+  min-width: 0;
+}
+
+.fieldKey {
+  flex: none;
+  min-width: 96px;
+  color: var(--dsw-alias-label-caption);
+}
+
+.fieldValue {
+  flex: 1 1 auto;
+  min-width: 0;
+  margin: 0;
+  color: var(--dsw-alias-label-tertiary);
+  overflow-wrap: anywhere;
+}
+
+/* instructions: the reconciled files, above their text. */
+.files {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 4px 12px;
+  margin: 0 0 8px;
+  padding: 0;
+  list-style: none;
+}
+
+.file {
+  display: flex;
+  align-items: baseline;
+  gap: 6px;
+  min-width: 0;
+}
+
+.filePath {
+  color: var(--dsw-alias-label-secondary);
+  overflow-wrap: anywhere;
+}
+
+.fileAction {
+  color: var(--dsw-alias-label-caption);
+}
+
+/* catalog: a replacement notice above one row per published entry. */
+.catalogNotice {
+  margin: 0 0 6px;
+  color: var(--dsw-alias-label-caption);
+}
+
+
+.entries {
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+  margin: 0;
+  padding: 0;
+  list-style: none;
+}
+
+.entry {
+  display: flex;
+  gap: 8px;
+  min-width: 0;
+}
+
+.entryName {
+  flex: none;
+  color: var(--dsw-alias-label-secondary);
+}
+
+.entryDescription {
+  flex: 1 1 auto;
+  min-width: 0;
+  overflow: hidden;
+  color: var(--dsw-alias-label-tertiary);
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
@@ -0,0 +1,380 @@
+// Expanded bodies for the context disclosure, one per durable context form.
+// The producer declares the form; this module only chooses a presentation for
+// it. Every form falls back to OpaqueBody, which is the documented default for
+// an absent, unknown, or malformed form — a resumed or foreign log must render
+// even when this UI version has never seen its producer.
+
+import type { ReactNode } from 'react'
+import type { ContextMessageNode, KnownContextForm } from '@deepseek-ai/dsh-client-runtime/client'
+import { JsonBlock } from '@deepseek-ai/dsh-client-ui-primitives'
+import type { ChatViewSlotProps } from '../contract/slots.ts'
+import css from './ContextBody.module.css'
+
+/** Model-facing text stays bounded at the disclosure, not at the producer. */
+const MAX_CHARS = 20_000
+
+/** Rows a list body materializes before summarizing the remainder. */
+const MAX_ENTRIES = 200
+
+type Translate = ChatViewSlotProps['t']
+
+/** One durable source narrowed to the readable-record shape; null for anything else. */
+function asRecord(value: unknown): Record<string, unknown> | null {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : null
+}
+
+/** One run of the model-facing content: adjacent text, or one unknown block. */
+type ContentRun = { text: string } | { block: unknown }
+
+/**
+ * The content blocks as runs, IN THE ORDER the model received them.
+ *
+ * Adjacent text blocks join with no separator, matching how provider adapters
+ * flatten them — inserting a line break would show the reader a line the model
+ * never saw. An unknown block breaks the run and keeps its own fallback rather
+ * than being hoisted past the text around it or vanishing; the block union is
+ * merge-extensible, so a foreign log may interleave shapes this build does not
+ * know.
+ */
+function contentRuns(content: ContextMessageNode['content']): ContentRun[] {
+  const runs: ContentRun[] = []
+  for (const block of content) {
+    if (block.type !== 'text') {
+      runs.push({ block })
+      continue
+    }
+    const last = runs[runs.length - 1]
+    if (last !== undefined && 'text' in last) last.text += block.text
+    else runs.push({ text: block.text })
+  }
+  return runs
+}
+
+/** Only the blocks this UI version does not know, for bodies that replace the text. */
+function unknownBlocks(content: ContextMessageNode['content']): unknown[] {
+  return contentRuns(content).flatMap(run => 'block' in run ? [run.block] : [])
+}
+
+/** The model-facing text, truncated to the display bound. */
+function boundedText(text: string, t: Translate): string {
+  return text.length > MAX_CHARS
+    ? `${text.slice(0, MAX_CHARS)}\n${t('json.truncated', { total: text.length })}`
+    : text
+}
+
+/**
+ * One source field rendered as a value row; nested shapes stay compact JSON.
+ * Bounded on its own, because provenance is as unbounded as the text: an unknown
+ * producer may record an arbitrarily large string or array.
+ */
+function fieldValue(value: unknown, t: Translate): string {
+  const text = typeof value === 'string'
+    ? value
+    : typeof value === 'number' || typeof value === 'boolean' ? String(value) : JSON.stringify(value)
+  return boundedText(text, t)
+}
+
+/**
+ * Provenance fields as a key/value list. `kind` is always omitted because the
+ * row header already names the producer. `form` is omitted only when a
+ * dedicated body rendered for it — then the presentation the reader is looking
+ * at IS that value. On the opaque fallback the declaration is kept, because
+ * that is the one place a form this version cannot present would otherwise
+ * disappear from the UI entirely.
+ */
+function SourceFields({ source, formRendered, t }: {
+  source: unknown
+  formRendered: boolean
+  t: Translate
+}): ReactNode {
+  const record = asRecord(source)
+  if (record === null) return null
+  const hidden = formRendered ? ['kind', 'form'] : ['kind']
+  const rows = Object.entries(record).filter(([key]) => !hidden.includes(key))
+  if (rows.length === 0) return null
+  return (
+    <dl className={css.fields} data-context-fields>
+      {rows.map(([key, value]) => (
+        <div key={key} className={css.field}>
+          <dt className={css.fieldKey}>{key}</dt>
+          <dd className={css.fieldValue}>{fieldValue(value, t)}</dd>
+        </div>
+      ))}
+    </dl>
+  )
+}
+
+/**
+ * Content blocks this UI version does not know, kept visible rather than
+ * dropped: the block union is merge-extensible, so a newer or foreign log may
+ * carry a shape this build has no presentation for.
+ * @param props - The unrecognized blocks and the locale seat.
+ * @returns One generic JSON block per unknown entry.
+ */
+function UnknownBlocks({ blocks, t }: { blocks: readonly unknown[]; t: Translate }): ReactNode {
+  return (
+    <>
+      {blocks.map((block, index) => (
+        <JsonBlock
+          key={index}
+          label={t('message.unknownBlock')}
+          payload={block}
+          truncatedLabel={total => t('json.truncated', { total })}
+        />
+      ))}
+    </>
+  )
+}
+
+/**
+ * The model-facing content of one context, shared by every form that shows it:
+ * the text with its real line breaks, then any block this UI version does not
+ * know, which keeps its own fallback rather than vanishing.
+ * @param props - Durable content and the locale seat.
+ * @returns The content blocks as the model received them.
+ */
+function ModelFacingContent({ content, t }: {
+  content: ContextMessageNode['content']
+  t: Translate
+}): ReactNode {
+  return (
+    <>
+      {contentRuns(content).map((run, index) => ('text' in run
+        ? run.text !== '' && (
+          <pre key={index} className={css.text} data-context-text>{boundedText(run.text, t)}</pre>
+        )
+        : (
+          <JsonBlock
+            key={index}
+            label={t('message.unknownBlock')}
+            payload={run.block}
+            truncatedLabel={total => t('json.truncated', { total })}
+          />
+        )))}
+    </>
+  )
+}
+
+/**
+ * Default presentation: the model-facing text as text, with its real line
+ * breaks, and the remaining provenance beneath it. This is what every form
+ * this UI version does not recognize renders as.
+ * @param props - Durable content, its source, and the locale seat.
+ * @returns The opaque context body.
+ */
+export function OpaqueBody({ content, source, t }: {
+  content: ContextMessageNode['content']
+  source: unknown
+  t: Translate
+}): ReactNode {
+  return (
+    <>
+      <ModelFacingContent content={content} t={t} />
+      <SourceFields source={source} formRendered={false} t={t} />
+    </>
+  )
+}
+
+/** One reconciled instruction file, as the durable source records it. */
+interface InstructionChange {
+  action: 'set' | 'replace' | 'remove'
+  path: string
+  digest?: string
+}
+
+/**
+ * Instruction changes read off the source, or null when the record is not a
+ * usable instruction list.
+ *
+ * The read is all-or-nothing: silently dropping one unreadable entry would show
+ * a confident, incomplete file list for a log this version cannot fully read.
+ * Paths are deduplicated in first-seen order, matching how the header label is
+ * derived from the same array.
+ */
+function instructionChanges(source: unknown): InstructionChange[] | null {
+  const record = asRecord(source)
+  const list = record === null ? undefined : record['changes']
+  if (!Array.isArray(list)) return null
+  const changes: InstructionChange[] = []
+  const seen = new Set<string>()
+  for (const entry of list as readonly unknown[]) {
+    const change = asRecord(entry)
+    if (change === null) return null
+    const path = change['path']
+    if (typeof path !== 'string' || path === '') return null
+    const action = change['action']
+    // The action decides which word the row shows, so an unrecognized one is
+    // not a readable change — it would be presented as loaded or updated.
+    if (action !== 'set' && action !== 'replace' && action !== 'remove') return null
+    const digest = change['digest']
+    if (seen.has(path)) continue
+    seen.add(path)
+    changes.push({ action, path, ...typeof digest === 'string' ? { digest } : {} })
+  }
+  return changes.length === 0 ? null : changes
+}
+
+/**
+ * Locale key for one reconciled file. The baseline loads a file; a later delta
+ * distinguishes a newly reconciled path from a rewritten one, which `set` and
+ * `replace` already separate at the producer.
+ * @param action - the durable change action.
+ * @param baseline - whether this context is the startup/resume baseline.
+ * @returns the key naming what happened to that file.
+ */
+function instructionAction(
+  action: InstructionChange['action'],
+  baseline: boolean,
+): 'message.context.instructions.removed' | 'message.context.instructions.loaded'
+  | 'message.context.instructions.added' | 'message.context.instructions.updated' {
+  if (action === 'remove') return 'message.context.instructions.removed'
+  if (baseline) return 'message.context.instructions.loaded'
+  return action === 'set' ? 'message.context.instructions.added' : 'message.context.instructions.updated'
+}
+
+/**
+ * `instructions` form: the files this context reconciled, then their text.
+ *
+ * The text keeps its `<system-reminder>` framing verbatim — the framing is part
+ * of what the model read, so hiding it would misreport the request.
+ * @param props - Durable content, its source, and the locale seat.
+ * @returns The instructions context body, or the opaque body when the change
+ * list is unreadable.
+ */
+export function InstructionsBody({ content, source, t }: {
+  content: ContextMessageNode['content']
+  source: unknown
+  t: Translate
+}): ReactNode {
+  const changes = instructionChanges(source)
+  if (changes === null) return <OpaqueBody content={content} source={source} t={t} />
+  const baseline = asRecord(source)?.['baseline'] === true
+  return (
+    <>
+      <ul className={css.files} data-context-files>
+        {changes.map(change => (
+          <li key={change.path} className={css.file} title={change.digest}>
+            <span className={css.filePath}>{change.path}</span>
+            <span className={css.fileAction}>
+              {t(instructionAction(change.action, baseline))}
+            </span>
+          </li>
+        ))}
+      </ul>
+      <ModelFacingContent content={content} t={t} />
+    </>
+  )
+}
+
+/** One catalog entry, as the durable source records it. */
+interface CatalogEntry {
+  name: string
+  description: string
+}
+
+/**
+ * Catalog entries read off the source, or null when the record is not a usable
+ * catalog. All-or-nothing for the same reason as the instruction list: this body
+ * replaces the model-facing text, so a partial list would hide the only complete
+ * account of what the model read.
+ */
+function catalogEntries(source: unknown): CatalogEntry[] | null {
+  const record = asRecord(source)
+  const list = record === null ? undefined : record['entries']
+  if (!Array.isArray(list)) return null
+  const entries: CatalogEntry[] = []
+  for (const item of list as readonly unknown[]) {
+    const entry = asRecord(item)
+    if (entry === null) return null
+    const name = entry['name']
+    const description = entry['description']
+    if (typeof name !== 'string' || name === '' || typeof description !== 'string') return null
+    entries.push({ name, description })
+  }
+  // An empty list is a real catalog: a replacement with no entries retires
+  // every earlier name. Only an unreadable shape falls back.
+  return entries
+}
+
+/**
+ * `catalog` form: the published entries as a list, read from the source rather
+ * than re-parsed out of the model-facing prose.
+ *
+ * A catalog whose source carries no usable entries falls through to the opaque
+ * body, so an older or hand-edited log still shows its text.
+ * @param props - Durable content, its source, and the locale seat.
+ * @returns The catalog context body, or the opaque body when the entry list is
+ * unreadable.
+ */
+export function CatalogBody({ content, source, t }: {
+  content: ContextMessageNode['content']
+  source: unknown
+  t: Translate
+}): ReactNode {
+  const entries = catalogEntries(source)
+  if (entries === null) return <OpaqueBody content={content} source={source} t={t} />
+  const update = asRecord(source)?.['update'] === true
+  // Entry count is unbounded (a provider may publish any number of skills), and
+  // the scrollport bounds height, not node count — so the list bounds itself.
+  const shown = entries.slice(0, MAX_ENTRIES)
+  const rest = unknownBlocks(content)
+  return (
+    <>
+      {update && <p className={css.catalogNotice} data-context-catalog-update>{t('message.context.catalog.replaced')}</p>}
+      <ul className={css.entries} data-context-entries>
+        {shown.map((entry, index) => (
+          // Index key: a hand-edited or foreign log may repeat a name, and a
+          // duplicate React key would drop a row the model did see.
+          <li key={index} className={css.entry}>
+            <code className={css.entryName}>{entry.name}</code>
+            <span className={css.entryDescription}>{entry.description}</span>
+          </li>
+        ))}
+      </ul>
+      {shown.length < entries.length && (
+        <p className={css.catalogNotice} data-context-entries-truncated>
+          {t('message.context.catalog.more', { count: entries.length - shown.length })}
+        </p>
+      )}
+      {/* The block union is merge-extensible: a catalog message carrying an
+          unknown block still shows it rather than dropping model-visible content. */}
+      <UnknownBlocks blocks={rest} t={t} />
+    </>
+  )
+}
+
+/**
+ * Choose the body for one context node.
+ *
+ * Returns the form the body actually rendered as, which is not always the
+ * declared one: a declared form whose fields are unreadable falls back to
+ * opaque, and the caller labels the row with what it really shows.
+ * @param form - the producer-declared form projected onto the node.
+ * @param props - durable content, its source, and the locale seat.
+ * @returns the rendered form (null for opaque) and its body.
+ */
+export function contextBody(
+  form: ContextMessageNode['form'],
+  props: { content: ContextMessageNode['content']; source: unknown; t: Translate },
+): { rendered: KnownContextForm | null; body: ReactNode } {
+  switch (form) {
+    case 'instructions':
+      return instructionChanges(props.source) === null
+        ? { rendered: null, body: <OpaqueBody {...props} /> }
+        : { rendered: 'instructions', body: <InstructionsBody {...props} /> }
+    case 'catalog':
+      return catalogEntries(props.source) === null
+        ? { rendered: null, body: <OpaqueBody {...props} /> }
+        : { rendered: 'catalog', body: <CatalogBody {...props} /> }
+    case null:
+      return { rendered: null, body: <OpaqueBody {...props} /> }
+    /* v8 ignore next 4 -- closed-union backstop; the compiler rejects a new
+    KnownContextForm here rather than letting it degrade to opaque silently. */
+    default: {
+      const unreachable: never = form
+      throw new Error(`unreachable context form: ${String(unreachable)}`)
+    }
+  }
+}
@@ -12,6 +12,28 @@
  color: var(--dsw-alias-label-secondary);
 }

+/* Separator and producer name beside the role title: ToolRow's summary geometry,
+   so the two disclosure rows keep one 24px rhythm and one separator shape. */
+.sep {
+  flex: none;
+  width: 2px;
+  height: 2px;
+  margin: 0 8px;
+  border-radius: 1px;
+  background: var(--dsw-alias-label-caption);
+}
+
+.source {
+  flex: 1 1 auto;
+  min-width: 0;
+  overflow: hidden;
+  color: var(--dsw-alias-label-tertiary);
+  font-size: 14px;
+  line-height: 24px;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
 .body {
  box-sizing: border-box;
  width: calc(100% - 22px);
@@ -23,7 +45,6 @@
  border-radius: 8px;
  background: var(--dsw-alias-markdown-code-block);
  color: var(--dsw-alias-label-tertiary);
+  /* Figma 10:2482 code text: the form bodies inherit it from the scrollport. */
  font: 400 11px/16px var(--ds-font-family-code);
-  white-space: pre-wrap;
-  overflow-wrap: anywhere;
 }
@@ -1,84 +1,64 @@
-import { useMemo, useState } from 'react'
+import { useState } from 'react'
 import type { ContextMessageNode } from '@deepseek-ai/dsh-client-runtime/client'
 import type { ChatViewSlotProps } from '../contract/slots.ts'
 import { IconBrowseOutline16 } from '@deepseek-ai/dsh-client-ui-primitives'
 import { DisclosureRow } from './DisclosureRow.tsx'
+import { contextBody } from './ContextBody.tsx'
 import css from './ContextInjectionRow.module.css'

-const MAX_CHARS = 20_000
-
-function inlineJson(payload: unknown): string {
-  const raw = JSON.stringify(payload)
-  let formatted = ''
-  let quoted = false
-  let escaped = false
-
-  for (let index = 0; index < raw.length; index++) {
-    const char = raw.charAt(index)
-    if (quoted) {
-      formatted += char
-      if (escaped) escaped = false
-      else if (char === '\\') escaped = true
-      else if (char === '"') quoted = false
-      continue
-    }
-    if (char === '"') {
-      quoted = true
-      formatted += char
-      continue
-    }
-    if (char === '{' || char === '[') {
-      formatted += char
-      const close = char === '{' ? '}' : ']'
-      if (raw[index + 1] !== close) formatted += ' '
-      continue
-    }
-    if (char === '}' || char === ']') {
-      const open = char === '}' ? '{' : '['
-      if (raw[index - 1] !== open) formatted += ' '
-      formatted += char
-      continue
-    }
-    formatted += char === ':' || char === ',' ? `${char} ` : char
-  }
-  return formatted
-}
-
 /** Props for the logged non-user message presentation. */
 export interface ContextInjectionRowProps {
  content: ContextMessageNode['content']
  source: ContextMessageNode['source']
+  /** Role and producer name projected from the durable source. */
+  provenance: ContextMessageNode['provenance']
+  /** Producer-declared information form; null renders the opaque body. */
+  form: ContextMessageNode['form']
  /** The owning view's locale seat, passed down as a plain prop. */
  t: ChatViewSlotProps['t']
 }

 /**
 * Render logged context with the Tool calls disclosure chrome from Figma.
- * @param props - Durable content and source provenance.
- * @returns A collapsed context row with a bounded JSON body.
+ *
+ * The header names the role the context plays and, beside it, the producer the
+ * durable source identifies, so a reader can tell an injected skill catalog
+ * from a workspace instruction file or a recalled session without expanding.
+ * The expanded body follows the producer-declared form; an absent or unknown
+ * form renders the opaque body.
+ * @param props - Durable content, its projected provenance and form, and the locale seat.
+ * @returns A collapsed context row with a bounded, form-specific body.
 */
-export function ContextInjectionRow({ content, source, t }: ContextInjectionRowProps) {
+export function ContextInjectionRow({ content, source, provenance, form, t }: ContextInjectionRowProps) {
  const [open, setOpen] = useState(false)
-  const body = useMemo(() => {
-    if (!open) return ''
-    const text = inlineJson({ content, source })
-    return text.length > MAX_CHARS
-      ? `${text.slice(0, MAX_CHARS)}\n${t('json.truncated', { total: text.length })}`
-      : text
-  }, [content, open, source, t])
+  // Resolved rather than declared: a form whose fields are unreadable renders
+  // the opaque body, and the marker must say what the row actually shows.
+  const { rendered, body } = contextBody(form, { content, source, t })

  return (
    <DisclosureRow
      className={css.root}
      icon={<IconBrowseOutline16 size={14} />}
      chevronClassName={css.chevron}
-      title={t('message.contextInjection')}
+      title={t(provenance.role === 'recall' ? 'message.contextRecall' : 'message.contextInjection')}
+      collapsedContent={provenance.label === null ? undefined : (
+        /* ToolRow's separator shape: an aria-hidden dot, so the accessible name
+           stays the two readable parts and the two disclosure rows expose one
+           name shape. A source that names no producer drops the dot with it. */
+        <>
+          <span className={css.sep} aria-hidden />
+          <span className={css.source} data-context-source>{provenance.label}</span>
+        </>
+      )}
+      keepContentWhenOpen
      open={open}
      expandable
      expandOnRowClick
      onToggle={() => { setOpen(value => !value) }}
    >
-      <pre className={css.body} data-context-injection-body>{body}</pre>
+      <div className={css.body} data-context-injection-body data-context-form={rendered ?? undefined}>
+        {body}
+      </div>
    </DisclosureRow>
  )
 }
@@ -8,6 +8,15 @@
  gap: 6px;
 }

+/* Steering caption above the bubble: mid-turn interjections carry the same
+   bubble as a turn-opening prompt, so the transcript names which one this is. */
+.steeringMark {
+  padding-right: 4px;
+  color: var(--dsw-alias-label-tertiary);
+  font-size: 12px;
+  line-height: 16px;
+}
+
 .bubble {
  /* 525px cap inside the 736 column; percentage keeps narrow windows sane. */
  max-width: min(525px, 82%);
@@ -1,12 +1,13 @@
-// MessageItem: simple chat nodes — user bubbles
-// (right-aligned, with clock + copy / branch IconActions), pending steering
-// (copy only), context injection, compaction marker, retry disclosure, and
-// unknown-surface JSON rows.
+// MessageItem: simple chat nodes — user and consumed-steering bubbles
+// (right-aligned, with clock + copy / branch IconActions; steering adds the
+// interjection caption that names it), pending steering (caption + copy only),
+// context injection, compaction marker, retry disclosure, and unknown-surface
+// JSON rows.

 import { memo, useEffect, useMemo, useState } from 'react'
 import type { ReactNode } from 'react'
 import type {
-  CompactionSummaryNode, ContextMessageNode, ModelRetryNode,
+  CompactionSummaryNode, ContextMessageNode, ModelRetryNode, SteeringMessageNode,
  TurnErrorNode, UnknownSurfaceNode, UserMessageNode,
 } from '@deepseek-ai/dsh-client-runtime/client'
 import { JsonBlock, MessageText, StateDot } from '@deepseek-ai/dsh-client-ui-primitives'
@@ -19,6 +20,7 @@ import css from './MessageItem.module.css'
 export interface MessageItemProps {
  node:
    | UserMessageNode
+    | SteeringMessageNode
    | ContextMessageNode
    | CompactionSummaryNode
    | ModelRetryNode
@@ -170,19 +172,22 @@ function projectUserText(text: string): ReactNode {

 /** Right-aligned bubble shared by user and steering rows. */
 function UserStyleBubble({
-  content, actions, pending = false, t,
+  content, actions, pending = false, steering = false, t,
 }: {
  content: readonly unknown[]
  /** Optional IconActions (or similar) below the bubble; receives the joined text. */
  actions?: (text: string) => ReactNode
  /** Whether this is the Host-authoritative pre-admission steering projection. */
  pending?: boolean
+  /** Marks the bubble as mid-turn steering rather than a turn-opening prompt. */
+  steering?: boolean
  t: ChatViewSlotProps['t']
 }): ReactNode {
  const { text, rest } = contentText(content)
  const truncated = (total: number): string => t('json.truncated', { total })
  return (
    <div className={css.userRow} data-pending-steering={pending || undefined} data-time-hover-root>
+      {steering && <span className={css.steeringMark} data-steering-mark>{t('message.steering')}</span>}
      <div className={css.bubble}>
        {projectUserText(text)}
        {rest.map((block, i) => <JsonBlock key={i} label={t('message.extraBlock')} payload={block} truncatedLabel={truncated} />)}
@@ -206,6 +211,7 @@ export function PendingSteeringBubble({ content, t }: {
    <UserStyleBubble
      content={content}
      pending
+      steering
      t={t}
      actions={text => (
        <MessageIconActions
@@ -226,9 +232,11 @@ export const MessageItem = memo(function MessageItem({
  const truncated = (total: number): string => t('json.truncated', { total })
  switch (node.kind) {
    case 'user':
+    case 'steering':
      return (
        <UserStyleBubble
          content={node.content}
+          steering={node.kind === 'steering'}
          t={t}
          actions={text => (
            <MessageIconActions
@@ -245,7 +253,13 @@ export const MessageItem = memo(function MessageItem({
      )
    case 'context':
      return (
-        <ContextInjectionRow content={node.content} source={node.source} t={t} />
+        <ContextInjectionRow
+          content={node.content}
+          source={node.source}
+          provenance={node.provenance}
+          form={node.form}
+          t={t}
+        />
      )
    case 'compaction':
      return <CompactionItem node={node} t={t} />
@@ -86,7 +86,7 @@ export function messageBranchSeqs(
      tail = candidate
      nodeIndex++
    }
-    if (tail?.kind === 'user'
+    if (tail?.kind === 'user' || tail?.kind === 'steering'
      || (tail?.kind === 'assistant' && tail.turn === turn && hasContentText(tail.blocks))) {
      result.add(tail.seq)
    }
@@ -66,6 +66,14 @@ export const zh = {
  'chat.toBottom': '回到底部',
  'message.extraBlock': '附加内容块',
  'message.contextInjection': '上下文注入',
+  'message.contextRecall': '跨会话召回',
+  'message.context.instructions.loaded': '已载入',
+  'message.context.instructions.added': '已新增',
+  'message.context.instructions.updated': '已更新',
+  'message.context.instructions.removed': '已移除',
+  'message.context.catalog.replaced': '替换目录',
+  'message.context.catalog.more': '…还有 {count} 条',
+  'message.steering': '插话',
  'message.compaction': '上下文已压缩',
  'message.compaction.expand': '点击查看压缩摘要',
  'message.compaction.unavailable': '压缩摘要不可用',
@@ -193,6 +201,14 @@ export const en = {
  'chat.toBottom': 'Back to bottom',
  'message.extraBlock': 'Extra content block',
  'message.contextInjection': 'Context injection',
+  'message.contextRecall': 'Session recall',
+  'message.context.instructions.loaded': 'loaded',
+  'message.context.instructions.added': 'added',
+  'message.context.instructions.updated': 'updated',
+  'message.context.instructions.removed': 'removed',
+  'message.context.catalog.replaced': 'Replacement catalog',
+  'message.context.catalog.more': '… {count} more',
+  'message.steering': 'Interjection',
  'message.compaction': 'Context compacted',
  'message.compaction.expand': 'View compaction summary',
  'message.compaction.unavailable': 'Compaction summary unavailable',
@@ -212,47 +212,365 @@ describe('MessageItem arms', () => {
    expect(vi.getTimerCount()).toBe(0)
  })

-  it('context uses the Tool calls disclosure chrome and keeps its JSON collapsed by default', () => {
+  it('consumed steering is captioned as an interjection and keeps copy and branch actions', () => {
+    const writeText = vi.fn().mockResolvedValue(undefined)
+    Object.defineProperty(navigator, 'clipboard', {
+      configurable: true,
+      value: { writeText },
+    })
+    const fork = vi.fn()
+    const view = render(
+      <MessageItem t={t} node={{
+        kind: 'steering', messageId: 'steer-message', seq: 2, time: 1_000, turn: 1, source: null,
+        content: [{ type: 'text', text: 'steer!' }, { type: 'image', data: 'x' }] as never,
+      } as never}
+      onFork={fork}
+      />,
+    )
+    expect(view.getByText('插话')).toBeTruthy()
+    expect(view.getByText('steer!')).toBeTruthy()
+    expect(view.getByText(/附加内容块/)).toBeTruthy()
+    fireEvent.click(view.getByRole('button', { name: '复制' }))
+    expect(writeText).toHaveBeenCalledWith('steer!')
+    fireEvent.click(view.getByRole('button', { name: '在新对话中分支' }))
+    expect(fork).toHaveBeenCalledWith(2)
+  })
+
+  it('context uses the Tool calls disclosure chrome and keeps its body collapsed by default', () => {
    const ctxView = render(
      <MessageItem t={t} node={{
        kind: 'context',
        seq: 3,
-        content: [{ type: 'text', text: 'x\n"y":,[{}]' }],
+        content: [{ type: 'text', text: 'line one\n\nline two' }],
        source: { kind: 'plugin', plugin: 'fixture', empty: {}, list: [] },
+        provenance: { role: 'inject', label: 'fixture' },
+        form: null,
      } as never}
      />,
    )
-    const disclosure = ctxView.getByRole('button', { name: '上下文注入' })
+    const disclosure = ctxView.getByRole('button', { name: /^上下文注入\s*fixture$/ })
    expect(disclosure.getAttribute('aria-expanded')).toBe('false')
    expect(ctxView.container.querySelector('[data-context-injection-body]')).toBeNull()
    expect(ctxView.container.querySelector('svg')).not.toBeNull()

    fireEvent.click(disclosure)
    expect(disclosure.getAttribute('aria-expanded')).toBe('true')
-    expect(ctxView.container.querySelector('[data-context-injection-body]')?.textContent).toBe(
-      '{ "content": [ { "type": "text", "text": "x\\n\\"y\\":,[{}]" } ], '
-      + '"source": { "kind": "plugin", "plugin": "fixture", "empty": {}, "list": [] } }',
-    )
+    // An unknown form renders the opaque body: the model-facing text keeps its
+    // real line breaks instead of being escaped into one JSON line, and the
+    // remaining provenance follows it as fields.
+    expect(ctxView.container.querySelector('[data-context-text]')?.textContent)
+      .toBe('line one\n\nline two')
+    const fields = [...ctxView.container.querySelectorAll('[data-context-fields] dt')].map(node => node.textContent)
+    expect(fields).toEqual(['plugin', 'empty', 'list'])

    fireEvent.keyDown(disclosure, { key: ' ' })
    expect(disclosure.getAttribute('aria-expanded')).toBe('false')
  })

-  it('context preserves the bounded JSON truncation contract', () => {
+  it('the instructions form names the files it reconciled above their text', () => {
    const view = render(
      <MessageItem t={t} node={{
        kind: 'context',
        seq: 3,
-        content: [{ type: 'text', text: 'x'.repeat(21_000) }],
+        content: [{ type: 'text', text: '<system-reminder>\nInstructions from: AGENTS.md\n</system-reminder>' }],
+        source: {
+          kind: 'workspace-instructions',
+          form: 'instructions',
+          baseline: true,
+          changes: [
+            { action: 'set', scope: '.\u0000AGENTS.md', path: 'AGENTS.md', digest: 'abc' },
+            { action: 'remove', scope: 'sub\u0000AGENTS.md', path: 'sub/AGENTS.md' },
+            { action: 'replace', scope: '.\u0000AGENTS.md', path: 'AGENTS.md' },
+          ],
+        },
+        provenance: { role: 'inject', label: 'AGENTS.md, sub/AGENTS.md' },
+        form: 'instructions',
+      } as never}
+      />,
+    )
+    fireEvent.click(view.getByRole('button', { name: /^上下文注入\s*AGENTS\.md, sub\/AGENTS\.md$/ }))
+    const files = [...view.container.querySelectorAll('[data-context-files] li')].map(node => node.textContent)
+    expect(files).toEqual(['AGENTS.md已载入', 'sub/AGENTS.md已移除'])
+    // The `<system-reminder>` framing is part of what the model read, so the
+    // body keeps it verbatim rather than presenting a cleaned-up excerpt.
+    expect(view.container.querySelector('[data-context-text]')?.textContent)
+      .toContain('<system-reminder>')
+  })
+
+  it('a delta distinguishes a newly reconciled file from a rewritten one', () => {
+    const view = render(
+      <MessageItem t={t} node={{
+        kind: 'context',
+        seq: 3,
+        content: [{ type: 'text', text: 'delta' }],
+        source: {
+          kind: 'workspace-instructions',
+          form: 'instructions',
+          changes: [
+            { action: 'set', scope: 'a', path: 'new/AGENTS.md' },
+            { action: 'replace', scope: 'b', path: 'old/AGENTS.md' },
+          ],
+        },
+        provenance: { role: 'inject', label: 'new/AGENTS.md, old/AGENTS.md' },
+        form: 'instructions',
+      } as never}
+      />,
+    )
+    fireEvent.click(view.getByRole('button', { name: /^上下文注入\s*new\/AGENTS\.md, old\/AGENTS\.md$/ }))
+    const files = [...view.container.querySelectorAll('[data-context-files] li')].map(node => node.textContent)
+    expect(files).toEqual(['new/AGENTS.md已新增', 'old/AGENTS.md已更新'])
+  })
+
+  it('keeps an interleaved unknown block in the order the model received it', () => {
+    const view = render(
+      <MessageItem t={t} node={{
+        kind: 'context',
+        seq: 3,
+        content: [
+          { type: 'text', text: 'before' },
+          { type: 'future-block', payload: 1 },
+          { type: 'text', text: 'after' },
+        ],
        source: null,
+        provenance: { role: 'inject', label: null },
+        form: null,
      } as never}
      />,
    )
    fireEvent.click(view.getByRole('button', { name: '上下文注入' }))
-    expect(view.container.querySelector('[data-context-injection-body]')?.textContent)
+    const texts = [...view.container.querySelectorAll('[data-context-text]')].map(node => node.textContent)
+    expect(texts).toEqual(['before', 'after'])
+    expect(view.getByText(/未知内容块/)).toBeTruthy()
+  })
+
+  it('the catalog form lists its durable entries instead of the model-facing prose', () => {
+    const view = render(
+      <MessageItem t={t} node={{
+        kind: 'context',
+        seq: 3,
+        content: [{ type: 'text', text: '<system-reminder>\n<available_skills>\n- `a`: A\n</available_skills>' }],
+        source: {
+          kind: 'skill-catalog',
+          form: 'catalog',
+          entries: [{ name: 'a-skill', description: 'Does A' }, { name: 'b-skill', description: 'Does B' }],
+        },
+        provenance: { role: 'inject', label: 'skill-catalog' },
+        form: 'catalog',
+      } as never}
+      />,
+    )
+    fireEvent.click(view.getByRole('button', { name: /^上下文注入\s*skill-catalog$/ }))
+    const entries = [...view.container.querySelectorAll('[data-context-entries] li')].map(node => node.textContent)
+    expect(entries).toEqual(['a-skillDoes A', 'b-skillDoes B'])
+    expect(view.container.querySelector('[data-context-text]')).toBeNull()
+    expect(view.container.querySelector('[data-context-catalog-update]')).toBeNull()
+  })
+
+  it('a replacement catalog says so above its entries', () => {
+    const view = render(
+      <MessageItem t={t} node={{
+        kind: 'context',
+        seq: 3,
+        content: [{ type: 'text', text: 'catalog prose' }],
+        source: {
+          kind: 'skill-catalog',
+          form: 'catalog',
+          update: true,
+          entries: [{ name: 'a-skill', description: 'Does A' }],
+        },
+        provenance: { role: 'inject', label: 'skill-catalog' },
+        form: 'catalog',
+      } as never}
+      />,
+    )
+    fireEvent.click(view.getByRole('button', { name: /^上下文注入\s*skill-catalog$/ }))
+    expect(view.container.querySelector('[data-context-catalog-update]')?.textContent).toBe('替换目录')
+  })
+
+  it('a partially unreadable catalog falls back whole rather than showing a short list', () => {
+    // All-or-nothing: a body that replaces the model-facing text must not show
+    // a confident, incomplete account of what the model read.
+    const view = render(
+      <MessageItem t={t} node={{
+        kind: 'context',
+        seq: 3,
+        content: [{ type: 'text', text: 'catalog prose' }],
+        source: {
+          kind: 'skill-catalog',
+          form: 'catalog',
+          entries: [{ name: 'a-skill', description: 'Does A' }, { name: 'b-skill' }],
+        },
+        provenance: { role: 'inject', label: 'skill-catalog' },
+        form: 'catalog',
+      } as never}
+      />,
+    )
+    fireEvent.click(view.getByRole('button', { name: /^上下文注入\s*skill-catalog$/ }))
+    expect(view.container.querySelector('[data-context-entries]')).toBeNull()
+    expect(view.container.querySelector('[data-context-text]')?.textContent).toBe('catalog prose')
+    // The marker reports what rendered, not what was declared.
+    expect(view.container.querySelector('[data-context-injection-body]')?.getAttribute('data-context-form'))
+      .toBeNull()
+  })
+
+  it('an unreadable instruction list falls back to the opaque body with its fields', () => {
+    const view = render(
+      <MessageItem t={t} node={{
+        kind: 'context',
+        seq: 3,
+        content: [{ type: 'text', text: 'instruction prose' }],
+        source: { kind: 'workspace-instructions', form: 'instructions', changes: [{ action: 'set' }] },
+        provenance: { role: 'inject', label: 'workspace-instructions' },
+        form: 'instructions',
+      } as never}
+      />,
+    )
+    fireEvent.click(view.getByRole('button', { name: /^上下文注入\s*workspace-instructions$/ }))
+    expect(view.container.querySelector('[data-context-files]')).toBeNull()
+    expect(view.container.querySelector('[data-context-text]')?.textContent).toBe('instruction prose')
+    expect(view.container.querySelector('[data-context-fields]')).not.toBeNull()
+  })
+
+  it('joins adjacent text blocks the way a provider adapter flattens them', () => {
+    // No invented separator: showing a line break the model never saw would
+    // misreport the request.
+    const view = render(
+      <MessageItem t={t} node={{
+        kind: 'context',
+        seq: 3,
+        content: [{ type: 'text', text: 'first' }, { type: 'text', text: 'second' }],
+        source: null,
+        provenance: { role: 'inject', label: null },
+        form: null,
+      } as never}
+      />,
+    )
+    fireEvent.click(view.getByRole('button', { name: '上下文注入' }))
+    expect(view.container.querySelector('[data-context-text]')?.textContent).toBe('firstsecond')
+  })
+
+  it('bounds an oversized provenance field, not only the model-facing text', () => {
+    const view = render(
+      <MessageItem t={t} node={{
+        kind: 'context',
+        seq: 3,
+        content: [{ type: 'text', text: 'short' }],
+        source: { kind: 'plugin', note: 'y'.repeat(21_000) },
+        provenance: { role: 'inject', label: 'plugin' },
+        form: null,
+      } as never}
+      />,
+    )
+    fireEvent.click(view.getByRole('button', { name: /^上下文注入\s*plugin$/ }))
+    expect(view.container.querySelector('[data-context-fields] dd')?.textContent)
      .toMatch(/… 已截断，共 \d+ 字符$/)
  })

+  it('an empty replacement catalog stays a catalog: it retires every earlier name', () => {
+    // `renderCatalogUpdate` legitimately publishes zero entries when the last
+    // skill disappears; falling back would hide that the catalog was cleared.
+    const view = render(
+      <MessageItem t={t} node={{
+        kind: 'context',
+        seq: 3,
+        content: [{ type: 'text', text: 'catalog prose' }],
+        source: { kind: 'skill-catalog', form: 'catalog', update: true, entries: [] },
+        provenance: { role: 'inject', label: 'skill-catalog' },
+        form: 'catalog',
+      } as never}
+      />,
+    )
+    fireEvent.click(view.getByRole('button', { name: /^上下文注入\s*skill-catalog$/ }))
+    expect(view.container.querySelector('[data-context-catalog-update]')?.textContent).toBe('替换目录')
+    expect(view.container.querySelectorAll('[data-context-entries] li')).toHaveLength(0)
+    expect(view.container.querySelector('[data-context-injection-body]')?.getAttribute('data-context-form'))
+      .toBe('catalog')
+  })
+
+  it('a catalog whose entries are unreadable falls back to the opaque body', () => {
+    const view = render(
+      <MessageItem t={t} node={{
+        kind: 'context',
+        seq: 3,
+        content: [{ type: 'text', text: 'catalog prose' }],
+        source: { kind: 'skill-catalog', form: 'catalog', entries: 'not-a-list' },
+        provenance: { role: 'inject', label: 'skill-catalog' },
+        form: 'catalog',
+      } as never}
+      />,
+    )
+    fireEvent.click(view.getByRole('button', { name: /^上下文注入\s*skill-catalog$/ }))
+    expect(view.container.querySelector('[data-context-entries]')).toBeNull()
+    expect(view.container.querySelector('[data-context-text]')?.textContent).toBe('catalog prose')
+  })
+
+  it('bounds a large catalog and says how many rows it withheld', () => {
+    const entries = Array.from({ length: 205 }, (_, index) => ({ name: `s-${index}`, description: 'd' }))
+    const view = render(
+      <MessageItem t={t} node={{
+        kind: 'context', seq: 3, content: [{ type: 'text', text: 'catalog prose' }],
+        source: { kind: 'skill-catalog', form: 'catalog', entries },
+        provenance: { role: 'inject', label: 'skill-catalog' },
+        form: 'catalog',
+      } as never}
+      />,
+    )
+    fireEvent.click(view.getByRole('button', { name: /^上下文注入\s*skill-catalog$/ }))
+    expect(view.container.querySelectorAll('[data-context-entries] li')).toHaveLength(200)
+    expect(view.container.querySelector('[data-context-entries-truncated]')?.textContent).toBe('…还有 5 条')
+  })
+
+  it('a catalog keeps a content block this version does not know', () => {
+    const view = render(
+      <MessageItem t={t} node={{
+        kind: 'context',
+        seq: 3,
+        content: [{ type: 'text', text: 'prose' }, { type: 'future-block', payload: 1 }],
+        source: { kind: 'skill-catalog', form: 'catalog', entries: [{ name: 'a', description: 'b' }] },
+        provenance: { role: 'inject', label: 'skill-catalog' },
+        form: 'catalog',
+      } as never}
+      />,
+    )
+    fireEvent.click(view.getByRole('button', { name: /^上下文注入\s*skill-catalog$/ }))
+    expect(view.getByText(/未知内容块/)).toBeTruthy()
+  })
+
+  it('an instruction change with an unrecognized action falls back whole', () => {
+    // The action decides the word the row shows, so an unknown one cannot be
+    // presented as loaded or updated.
+    const view = render(
+      <MessageItem t={t} node={{
+        kind: 'context',
+        seq: 3,
+        content: [{ type: 'text', text: 'instruction prose' }],
+        source: { kind: 'workspace-instructions', form: 'instructions', changes: [{ action: 'merge', path: 'A.md' }] },
+        provenance: { role: 'inject', label: 'workspace-instructions' },
+        form: 'instructions',
+      } as never}
+      />,
+    )
+    fireEvent.click(view.getByRole('button', { name: /^上下文注入\s*workspace-instructions$/ }))
+    expect(view.container.querySelector('[data-context-files]')).toBeNull()
+    expect(view.container.querySelector('[data-context-text]')?.textContent).toBe('instruction prose')
+  })
+
+  it('the opaque fallback keeps a form declaration this version cannot present', () => {
+    // Otherwise a newer or foreign log's declared shape vanishes from the UI.
+    const view = render(
+      <MessageItem t={t} node={{
+        kind: 'context', seq: 3, content: [{ type: 'text', text: 'x' }],
+        source: { kind: 'plugin', plugin: 'later', form: 'a-later-form' },
+        provenance: { role: 'inject', label: 'later' },
+        form: null,
+      } as never}
+      />,
+    )
+    fireEvent.click(view.getByRole('button', { name: /^上下文注入\s*later$/ }))
+    const fields = [...view.container.querySelectorAll('[data-context-fields] dt')].map(node => node.textContent)
+    expect(fields).toEqual(['plugin', 'form'])
+  })
+
  it('unknown nodes retain the generic JSON row', () => {
    const unknownView = render(
      <MessageItem t={t} node={{ kind: 'unknown', seq: 4, type: 'surface/next', data: { x: 1 } } as never} />,
@@ -376,6 +376,9 @@ describe('ChatView', () => {
    expect(view.queryByText('later')).toBeNull()
    const pendingBubble = view.getByText('interrupt now').closest('[data-pending-steering]')
    expect(pendingBubble).not.toBeNull()
+    // Pending and durable steering carry the same interjection caption, so the
+    // hand-off does not change what the row says it is.
+    expect(within(pendingBubble as HTMLElement).getByText('插话')).toBeTruthy()
    fireEvent.click(within(pendingBubble as HTMLElement).getByRole('button', { name: '复制' }))
    expect(writeText).toHaveBeenCalledWith('interrupt now')
    expect(within(pendingBubble as HTMLElement).queryByRole('button', { name: '在新对话中分支' })).toBeNull()
@@ -388,7 +391,8 @@ describe('ChatView', () => {
        nodes: [
          assistant(1, 'working'),
          {
-            kind: 'user', seq: 2, time: 2_000,
+            kind: 'steering', messageId: pending.messageId,
+            seq: 2, time: 2_000,
            content: [{ type: 'text', text: 'interrupt now' }], source: null,
          },
        ],
@@ -396,6 +400,7 @@ describe('ChatView', () => {
    })
    expect(view.getAllByText('interrupt now')).toHaveLength(1)
    expect(view.container.querySelector('[data-pending-steering]')).toBeNull()
+    expect(view.getAllByText('插话')).toHaveLength(1)
    expect(view.getAllByRole('button', { name: '复制' })).toHaveLength(2)
    const durableBubble = view.getByText('interrupt now').closest('[class*="userRow"]') as HTMLElement
    const unavailable = within(durableBubble).getByRole('button', { name: '在新对话中分支' })
@@ -441,6 +446,8 @@ describe('ChatView', () => {
    const nextRetry = { ...retry(3), turn: 2, retry: 2 }
    const context = {
      kind: 'context', seq: 4, time: 4_000, content: [], source: null,
+      provenance: { role: 'inject', label: null },
+      form: null,
    } as const satisfies ConversationNode
    const h = makeHarness({ nodes: [user(1, 'try'), retryNode], running: true })
    const view = render(<h.ChatView {...h.props} />)
@@ -13,6 +13,8 @@ const checkpoint = {
  time: 100,
  content: [],
  source: { kind: 'plugin', plugin: 'compact' },
+  provenance: { role: 'inject', label: 'compact' },
+  form: null,
 } as ConversationNode

 const abandoned = {
@@ -147,6 +147,7 @@ export function apply(ctx: Context, config: Config): void {
      content,
      source: {
        kind: 'workspace-instructions',
+        form: 'instructions',
        ...desiredBaseline ? { baseline: true } : {},
        changes,
      },
@@ -36,6 +36,8 @@ export const name = 'workspace-context'
 /** Durable provenance and reconciliation facts for one workspace context. */
 export interface WorkspaceInstructionSource {
  kind: 'workspace-instructions'
+  /** Every workspace context carries instructions read out of a file (the `instructions` context form). */
+  form: 'instructions'
  /** Marks the complete startup/resume baseline rather than a later delta. */
  baseline?: true
  changes: WorkspaceInstructionChange[]
@@ -77,7 +79,7 @@ export interface ReconciledInstructionContext {
 function workspaceContextHook(text: string, changes: WorkspaceInstructionChange[]): UserMessage {
  return createUserMessage({
    content: [{ type: 'text', text }],
-    source: { kind: 'workspace-instructions', changes },
+    source: { kind: 'workspace-instructions', form: 'instructions', changes },
  })
 }

@@ -916,6 +916,7 @@ describe('workspace context request injection', () => {
          role: 'user',
          source: {
            kind: 'workspace-instructions',
+            form: 'instructions',
            baseline: true,
            changes: [{ action: 'set', scope: sk('.', 'AGENTS.md'), path: 'AGENTS.md' }],
          },
@@ -1113,6 +1114,7 @@ describe('workspace context request injection', () => {
        content: [{ type: 'text', text: 'stale nested instructions' }],
        source: {
          kind: 'workspace-instructions',
+          form: 'instructions',
          changes: [{ action: 'set', scope: sk('pkg', 'AGENTS.md'), path: join('pkg', 'AGENTS.md'), digest: 'stale' }],
        },
      }), {
@@ -1146,6 +1148,7 @@ describe('workspace context request injection', () => {
        content: [{ type: 'text', text: 'stale nested instructions' }],
        source: {
          kind: 'workspace-instructions',
+          form: 'instructions',
          changes: [{ action: 'set', scope: sk('pkg', 'AGENTS.md'), path: join('pkg', 'AGENTS.md'), digest: 'stale' }],
        },
      }), {
@@ -2218,7 +2221,7 @@ describe('dynamic nested workspace context injection', () => {
      expect(result.isError).toBe(false)
      expect(((await syncedWorkspaceContext(ctx, agent))).source).toMatchObject({ kind: 'workspace-instructions' })
      const queuedSource = ((await syncedWorkspaceContext(ctx, agent))).source
-      expect(queuedSource).toMatchObject({ kind: 'workspace-instructions' })
+      expect(queuedSource).toMatchObject({ kind: 'workspace-instructions', form: 'instructions' })
      expect(queuedSource.kind === 'workspace-instructions' && queuedSource.changes.some(change =>
        change.action === 'set'
        && change.scope === sk('pkg', 'AGENTS.md')
@@ -2561,6 +2564,7 @@ describe('dynamic nested workspace context injection', () => {

      expect(((await syncedWorkspaceContext(ctx, agent))).source).toMatchObject({
        kind: 'workspace-instructions',
+        form: 'instructions',
        changes: [{ action: 'replace', scope: sk('pkg', 'AGENTS.md'), path: join('pkg', 'AGENTS.md') }],
      })
      expect(blocksText(((await syncedWorkspaceContext(ctx, agent))).content)).toBe([
@@ -2670,7 +2674,7 @@ describe('dynamic nested workspace context injection', () => {
        if (previous === undefined) throw new Error('missing AGENTS.md baseline state')
        const authoritative = createUserMessage({
          content: [{ type: 'text', text: 'nested rule' }],
-          source: { kind: 'workspace-instructions', changes: [previous] },
+          source: { kind: 'workspace-instructions', form: 'instructions', changes: [previous] },
        })
        if (authority === 'visible') {
          agent.session.append('user/message', authoritative, { surfaceOp: 'append' })
@@ -2696,6 +2700,7 @@ describe('dynamic nested workspace context injection', () => {
              content: [{ type: 'text', text: 'pending baseline duplicate' }],
              source: {
                kind: 'workspace-instructions',
+                form: 'instructions',
                changes: [{ action: 'set', scope: sk('.', 'AGENTS.md'), path: 'AGENTS.md' }],
              },
            })],
@@ -2739,7 +2744,7 @@ describe('dynamic nested workspace context injection', () => {
      if (previous === undefined) throw new Error('missing AGENTS.md baseline state')
      const authoritative = createUserMessage({
        content: [{ type: 'text', text: 'repo rule' }],
-        source: { kind: 'workspace-instructions', changes: [previous] },
+        source: { kind: 'workspace-instructions', form: 'instructions', changes: [previous] },
      })
      agent.session.append('user/message', authoritative, { surfaceOp: 'append' })
      const resolved = resolveConfig({ dshHome: home, maxBytes: 65536, localInstructionFileCandidates: [] })
@@ -2863,6 +2868,7 @@ describe('dynamic nested workspace context injection', () => {

      expect(((await syncedWorkspaceContext(ctx, agent))).source).toMatchObject({
        kind: 'workspace-instructions',
+        form: 'instructions',
        changes: [{ action: 'remove', scope: sk('pkg', 'AGENTS.md'), path: join('pkg', 'AGENTS.md') }],
      })
      expect(blocksText(((await syncedWorkspaceContext(ctx, agent))).content)).toBe([
@@ -3265,6 +3271,7 @@ describe('dynamic nested workspace context injection', () => {
        ],
        source: {
          kind: 'workspace-instructions',
+          form: 'instructions',
          changes: [
            null,
            { action: 'unknown', scope: 'pkg', path: join('pkg', 'AGENTS.md') },
@@ -3418,6 +3425,7 @@ describe('dynamic nested workspace context injection', () => {
      expect(((await syncedWorkspaceContext(ctx, agent))).source).toMatchObject({ kind: 'workspace-instructions' })
      expect(((await syncedWorkspaceContext(ctx, agent))).source).toMatchObject({
        kind: 'workspace-instructions',
+        form: 'instructions',
        changes: [{ action: 'set', scope: sk('pkg', 'AGENTS.md'), path: join('pkg', 'AGENTS.md') }],
      })
      expect(blocksText(((await syncedWorkspaceContext(ctx, agent))).content)).toContain('nested package rule')
@@ -1793,6 +1793,14 @@ export const TYPE_API: readonly TypeApiEntry[] = [
    name: 'ContentBlockType',
    declaration: 'export type ContentBlockType = keyof ContentBlockMap;',
  },
+  {
+    name: 'ContextForm',
+    declaration: 'export type ContextForm = \'instructions\' | \'catalog\';',
+  },
+  {
+    name: 'ContextFormed',
+    declaration: 'export interface ContextFormed {\n    readonly form?: ContextForm;\n}',
+  },
  {
    name: 'ContinuableCreateRequest',
    declaration: 'export interface ContinuableCreateRequest {\n    readonly sessionId: SessionId;\n    readonly parent: Agent;\n    readonly signal: AbortSignal;\n}',
@@ -2119,7 +2127,7 @@ export const TYPE_API: readonly TypeApiEntry[] = [
  },
  {
    name: 'MessageSourceMap',
-    declaration: 'export interface MessageSourceMap {\n    user: {\n        kind: \'user\';\n    };\n    plugin: {\n        kind: \'plugin\';\n        plugin: string;\n    };\n    model: ModelMessageSource;\n    tool: ToolMessageSource;\n}',
+    declaration: 'export interface MessageSourceMap {\n    user: {\n        kind: \'user\';\n    };\n    plugin: {\n        kind: \'plugin\';\n        plugin: string;\n    } & ContextFormed;\n    model: ModelMessageSource;\n    tool: ToolMessageSource;\n}',
  },
  {
    name: 'ModelMessageSource',
@@ -476,9 +476,7 @@ describe('dsh-agent-spine-demo bundle', () => {
      expect(loadedRequest).toContain('Use the freshly loaded body.')

      const transcript = handle.agent.session.events.flatMap<Record<string, unknown>>((event) => {
-        if (event.type === 'user/message'
-          && event.data.source.kind === 'plugin'
-          && event.data.source.plugin === 'dsh-tool-skill') {
+        if (event.type === 'user/message' && event.data.source.kind === 'skill-catalog') {
          return [{
            type: event.type,
            source: event.data.source,
@@ -512,8 +510,14 @@ describe('dsh-agent-spine-demo bundle', () => {
          },
          {
            "source": {
-              "kind": "plugin",
-              "plugin": "dsh-tool-skill",
+              "entries": [
+                {
+                  "description": "Hot-added skill",
+                  "name": "hot-skill",
+                },
+              ],
+              "form": "catalog",
+              "kind": "skill-catalog",
            },
            "text": "<system-reminder>
        A skill is a reusable set of task-specific instructions. The following skills are available in this session:
@@ -29,13 +29,40 @@ export interface ToolMessageSource {
  callId: CallId
 }

+/**
+ * What SHAPE of information a producer-supplied context carries, declared by
+ * the producer beside its provenance.
+ *
+ * `MessageSource.kind` answers *who produced this*; `form` answers *what kind
+ * of thing it is*, and the two axes are deliberately independent — several
+ * producers share one form (three snapshot producers today), and one producer
+ * may emit more than one form over a session.
+ *
+ * The vocabulary is SEMANTIC, never visual: a value states that the content is
+ * a file's instructions or a catalog of available items, and a consumer decides
+ * what that looks like. Colors, icons, ordering, and collapse defaults are the
+ * consumer's business and must not enter this union. It grows one value at a
+ * time as producers gain the structured fields their form needs; an absent or
+ * unknown value is the documented default, presented as opaque content.
+ */
+export type ContextForm =
+  /** Instructions read out of workspace files the model is expected to follow. */
+  | 'instructions'
+  /** A catalog of items available in this session, republished as it changes. */
+  | 'catalog'
+
+/** Optional producer-declared {@link ContextForm}, mixed into the source shapes that carry one. */
+export interface ContextFormed {
+  readonly form?: ContextForm
+}
+
 /**
 * Where a message (or injected content) came from.
 * Merge-extensible sum type — plugins add their own `kind`s.
 */
 export interface MessageSourceMap {
  user: { kind: 'user' }
-  plugin: { kind: 'plugin'; plugin: string }
+  plugin: { kind: 'plugin'; plugin: string } & ContextFormed
  model: ModelMessageSource
  tool: ToolMessageSource
 }
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/skill/tool-skill/README.md
-README.md: 05e7f7f4d08c52c1bfa0b7f67a618231b29f3e43
-README.zh.md: 23ce58c867d33d433fa69212562a5ccd13ba9d0e
+README.md: 8e0bff5d1c4853092d412b8f7f9528d4b00d9626
+README.zh.md: c6b815bef59eb1f14be0892078694f129366d004
@@ -10,11 +10,11 @@ Requires `ctx.agents`, `ctx.tools`, and `ctx.skills` (`inject: ['agents', 'tools

 At every eligible `agent/pre-step`, the plugin calls `ctx.skills.snapshot()` for the calling session's cwd, forwards the pre-step abort signal to discovery, applies exact `skill` tool visibility, and renders the ordered `name` and `description` entries. When no prior catalog exists and that view is non-empty, it adds an initial durable user-role `<system-reminder>` to a downstream `enter` decision. Catalog messages contain only those summaries; skill bodies, paths, sources, providers, and `whenToUse` hints remain outside the catalog.

-The digest covers the exact rendered text between the `<available_skills>` tags. The plugin scans durable session events backwards without copying them and derives the comparison baseline from the newest recognizable visible catalog message it sourced. When the digest changes, an entering pre-step receives a durable user-role message containing the complete replacement catalog; an empty replacement explicitly retires earlier names. If no catalog remains visible but a recognizable historical catalog exists, compaction hid it and the next complete observation re-establishes the current catalog. An incomplete provider snapshot emits nothing and preserves the last-good model view for retry at the next pre-step. If no prior catalog exists and the current view is empty, no tombstone is necessary.
+Every catalog message carries the `skill-catalog` source: a `catalog`-form context whose `entries` record exactly the `name` and `description` pairs it published, plus `update` on a replacement. The digest covers those durable entries, not the rendered prose, so the surrounding `<system-reminder>` framing cannot decide whether a republish is needed and consumers never re-parse the `<available_skills>` block. The plugin scans durable session events backwards without copying them and derives the comparison baseline from the newest visible `skill-catalog` message it can read; unreadable and foreign records are skipped. When the digest changes, the downstream `enter` decision receives a durable user-role message containing the complete replacement catalog; an empty replacement explicitly retires earlier names. If no catalog remains visible but a recognizable historical catalog exists, compaction hid it and the next complete observation re-establishes the current catalog. An incomplete provider snapshot emits nothing and preserves the last-good model view for retry at the next pre-step. If no prior catalog exists and the current view is empty, no tombstone is necessary.

 The catalog is omitted when no model-invocable skills are initially available, and also when that agent's tool view restricts away the shipped `skill` tool or resolves a same-name scoped shadow instead. Visibility changes participate in the digest, keeping prompt guidance, model-visible schema, and executable dispatch aligned.

-`catalogDescriptionMaxLength` controls normalized, XML-escaped catalog descriptions. Its default is `500` and values must be integers of at least `3`, which reserves room for a truncation ellipsis. The [skill catalog hot-refresh Agent Note](../../../.agents/notes/implemented/feature/2026-07-27-skill-catalog-hot-refresh.md) owns the durable initial catalog and replacement lifecycle.
+`catalogDescriptionMaxLength` controls normalized catalog descriptions; rendering XML-escapes them. Its default is `500` and values must be integers of at least `3`, which reserves room for a truncation ellipsis. The [skill catalog hot-refresh Agent Note](../../../.agents/notes/implemented/feature/2026-07-27-skill-catalog-hot-refresh.md) owns the durable initial catalog and replacement lifecycle.

 ## Tool: `skill`

@@ -10,11 +10,11 @@

 每次符合条件的 `agent/pre-step`，该插件都会使用调用会话的 cwd 调用 `ctx.skills.snapshot()`，将 pre-step 中止信号转发到发现流程，应用 `skill` 工具的精确可见性，并按顺序渲染 `name` 和 `description` 条目。如果先前不存在目录且该视图非空，插件会向下游 `enter` 决策添加初始的持久用户角色 `<system-reminder>`。目录消息只包含这些摘要；skill 正文、路径、来源、提供方和 `whenToUse` 提示仍位于目录之外。

-该 digest 覆盖 `<available_skills>` 标签之间精确渲染的文本。插件从后向前扫描持久会话事件且不复制，并以自身发布的最新一条可识别且仍可见的目录消息作为比较基线。digest 变化时，进入步骤的 pre-step 会收到一条包含完整替换目录的持久用户角色消息；空替换会显式停用较早的名称。如果没有目录仍然可见，但历史中存在可识别目录，则说明压缩（compaction）已将其遮蔽，下一次完整观察会重新建立当前目录。提供方快照不完整时，插件不会发送任何内容，并会保留最后一次完整的模型视图，以便在下一次 pre-step 重试。若不存在先前目录且当前视图为空，则不需要 tombstone。
+每条目录消息都携带 `skill-catalog` 来源，也就是 `catalog` 形态的上下文。它的 `entries` 精确记录本次发布的 `name` 与 `description` 对，替换目录另带 `update`。digest 覆盖这些持久条目，而不是渲染后的正文，因此 `<system-reminder>` 包装不会影响是否需要重新发布，消费方也不需要重新解析 `<available_skills>` 块。插件从后向前扫描持久会话事件且不复制，并以最新一条仍可见且可读的 `skill-catalog` 消息作为比较基线；不可读和外来的记录都会跳过。digest 变化时，下游 `enter` 决策会收到一条包含完整替换目录的持久用户角色消息；空替换会显式停用较早的名称。如果没有目录仍然可见，但历史中存在可识别目录，则说明压缩（compaction）已将其遮蔽，下一次完整观察会重新建立当前目录。提供方快照不完整时，插件不会发送任何内容，并会保留最后一次完整的模型视图，在下一次 pre-step 重试。若不存在先前目录且当前视图为空，则不需要 tombstone。

 如果最初没有模型可调用 skill，则省略目录；如果该 agent（智能体）的工具视图排除了随附的 `skill` 工具，或解析出同名的作用域内遮蔽项，也会省略目录。可见性变更参与 digest 计算，使提示词指引、模型可见 schema 和可执行分派保持对齐。

-`catalogDescriptionMaxLength` 控制规范化且经 XML 转义的目录描述。其默认值是 `500`，且必须是不小于 `3` 的整数，以便为截断省略号保留空间。[skill 目录热刷新 Agent Note](../../../.agents/notes/implemented/feature/2026-07-27-skill-catalog-hot-refresh.md) 负责定义持久初始目录和替换目录的生命周期。
+`catalogDescriptionMaxLength` 控制规范化后的目录描述，渲染时会对其执行 XML 转义。其默认值是 `500`，且必须是不小于 `3` 的整数，以便为截断省略号保留空间。[skill 目录热刷新 Agent Note](../../../.agents/notes/implemented/feature/2026-07-27-skill-catalog-hot-refresh.md) 负责定义持久初始目录和替换目录的生命周期。

 ## 工具：`skill`

@@ -22,9 +22,37 @@ export const name = 'tool-skill'
 export const inject = ['agents', 'tools', 'skills']

 const DEFAULT_CATALOG_DESCRIPTION_MAX_LENGTH = 500
-const CATALOG_ENTRIES_START = '<available_skills>\n'
-const CATALOG_ENTRIES_END = '</available_skills>'
-const PLUGIN_SOURCE = { kind: 'plugin', plugin: 'dsh-tool-skill' } as const
+/**
+ * Durable provenance for one published session skill catalog. The catalog is a
+ * `catalog`-form context, so it records the entries it published beside the
+ * model-facing prose: a consumer presenting the list must not re-parse the
+ * `<available_skills>` block, whose framing exists for the model.
+ */
+export interface SkillCatalogSource {
+  readonly kind: 'skill-catalog'
+  readonly form: 'catalog'
+  /** Marks a replacement catalog rather than this session's first publication. */
+  readonly update?: true
+  /** Exactly the entries this message published, in catalog order. */
+  readonly entries: readonly { readonly name: string; readonly description: string }[]
+}
+
+declare module '@deepseek-ai/dsh-llm' {
+  interface MessageSourceMap {
+    'skill-catalog': SkillCatalogSource
+  }
+}
+
+/** Durable entry list mirroring the rendered catalog lines, for non-model consumers. */
+function catalogSourceEntries(
+  skills: SkillSummary[],
+  descriptionMaxLength: number,
+): SkillCatalogSource['entries'] {
+  return skills.map(skill => ({
+    name: skill.name,
+    description: catalogDescription(skill.description, descriptionMaxLength),
+  }))
+}

 /** Model-facing skill catalog configuration. */
 export interface Config {
@@ -150,28 +178,29 @@ export function apply(ctx: Context, config: Config = {}): void {
    signal.throwIfAborted()
    if (!snapshot.complete) return decision
    const skills = snapshot.skills.filter(isModelInvocable)
-    const digest = catalogDigest(skills, catalogDescriptionMaxLength)
+    const entries = catalogSourceEntries(skills, catalogDescriptionMaxLength)
+    const digest = digestCatalogEntries(entries)
    const history = catalogHistory(agent)
    const existing = catalogMessage(decision.messages)
    if (history.visibleDigest === digest) {
      return existing === undefined
        ? decision
-        : { kind: 'enter', messages: decision.messages.filter(message => message.id !== existing.id) }
+        : { kind: 'enter', messages: decision.messages.filter(message => message.id !== existing.message.id) }
    }
-    if (existing !== undefined && catalogContentDigest(existing.content) === digest) return decision
+    if (existing !== undefined && digestCatalogEntries(existing.entries) === digest) return decision
    if (!history.published && skills.length === 0) {
      return existing === undefined
        ? decision
-        : { kind: 'enter', messages: decision.messages.filter(message => message.id !== existing.id) }
+        : { kind: 'enter', messages: decision.messages.filter(message => message.id !== existing.message.id) }
    }
    const catalog = history.published
-      ? renderCatalogUpdate(skills, catalogDescriptionMaxLength)
-      : renderCatalogMessage(skills, catalogDescriptionMaxLength)
+      ? renderCatalogUpdate(entries)
+      : renderCatalogMessage(entries)
    return {
      kind: 'enter',
      messages: existing === undefined
        ? [...decision.messages, catalog]
-        : decision.messages.map(message => message.id === existing.id ? catalog : message),
+        : decision.messages.map(message => message.id === existing.message.id ? catalog : message),
    }
  })
 }
@@ -222,8 +251,7 @@ function renderResourceHint(skill: Pick<SkillDefinition, 'provider' | 'resourceB
  }
 }

-function renderCatalogMessage(skills: SkillSummary[], descriptionMaxLength: number): UserMessage {
-  const entries = renderCatalogEntries(skills, descriptionMaxLength)
+function renderCatalogMessage(entries: SkillCatalogSource['entries']): UserMessage {
  return createUserMessage({
    content: [{
      type: 'text',
@@ -232,20 +260,23 @@ function renderCatalogMessage(skills: SkillSummary[], descriptionMaxLength: numb
        'A skill is a reusable set of task-specific instructions. The following skills are available in this session:',
        '',
        '<available_skills>',
-        ...entries,
+        ...renderCatalogEntries(entries),
        '</available_skills>',
        '',
        "If the user names a skill, or the task clearly matches a skill's description, call the `skill` tool with the exact skill name before taking task actions. Load all applicable skills, then follow their full instructions. This catalog contains summaries only; do not infer or follow a skill's instructions until it has been loaded.",
        '</system-reminder>',
      ].join('\n'),
    }],
-    source: PLUGIN_SOURCE,
+    source: {
+      kind: 'skill-catalog',
+      form: 'catalog',
+      entries,
+    },
  })
 }

-function renderCatalogUpdate(skills: SkillSummary[], descriptionMaxLength: number): UserMessage {
-  const entries = renderCatalogEntries(skills, descriptionMaxLength)
-  const availability = skills.length === 0
+function renderCatalogUpdate(entries: SkillCatalogSource['entries']): UserMessage {
+  const availability = entries.length === 0
    ? [
      'No skills are currently available through the `skill` tool. Do not use names from earlier skill catalogs.',
    ]
@@ -260,31 +291,70 @@ function renderCatalogUpdate(skills: SkillSummary[], descriptionMaxLength: numbe
        'The available skill catalog changed. This complete catalog replaces every earlier available-skills list in this session:',
        '',
        '<available_skills>',
-        ...entries,
+        ...renderCatalogEntries(entries),
        '</available_skills>',
        '',
        ...availability,
        '</system-reminder>',
      ].join('\n'),
    }],
-    source: PLUGIN_SOURCE,
+    source: {
+      kind: 'skill-catalog',
+      form: 'catalog',
+      update: true,
+      entries,
+    },
  })
 }

-function renderCatalogEntries(skills: SkillSummary[], descriptionMaxLength: number): string[] {
-  return skills.map(skill => `- \`${skill.name}\`: ${catalogDescription(skill.description, descriptionMaxLength)}`)
+/**
+ * Model-facing catalog lines, projected from the same entries the source records.
+ * The pseudo-XML escaping belongs to this frame, not to the published fact, so it
+ * is applied here and never stored. Names are `isSkillName`-validated and carry
+ * no escapable character.
+ */
+function renderCatalogEntries(entries: SkillCatalogSource['entries']): string[] {
+  return entries.map(entry => `- \`${entry.name}\`: ${escapeText(entry.description)}`)
 }

-function catalogDigest(skills: SkillSummary[], descriptionMaxLength: number): string {
-  return digestCatalogEntries(renderCatalogEntries(skills, descriptionMaxLength).join('\n'))
-}
-
-function digestCatalogEntries(entries: string): string {
+/**
+ * Catalog identity over the durable entry list rather than the rendered prose.
+ * The entries are what changes; the surrounding `<system-reminder>` framing is
+ * written for the model and must not decide whether a republish is needed.
+ */
+function digestCatalogEntries(entries: SkillCatalogSource['entries']): string {
+  // JSON per entry rather than a separator character: every separator is itself
+  // a legal description character, so only quoting makes the boundary exact.
+  const canonical = entries.map(entry => JSON.stringify([entry.name, entry.description])).join('\n')
  return createHash('sha256')
-    .update(entries)
+    .update(canonical)
    .digest('hex')
 }

+/**
+ * Entries of one durable catalog message, or undefined when the record is not a
+ * usable catalog.
+ *
+ * `agent.session.events` may be a resumed, forked, or externally written seed,
+ * and seed validation only guarantees a source object with a non-empty `kind`;
+ * no per-kind field is checked there. An unreadable record is therefore treated
+ * as "not this plugin's catalog" — the posture the replaced content digest had —
+ * rather than throwing inside the step listener, which would fail every
+ * subsequent turn of that session.
+ */
+function readCatalogEntries(source: unknown): SkillCatalogSource['entries'] | undefined {
+  const entries = (source as { entries?: unknown }).entries
+  if (!Array.isArray(entries)) return undefined
+  const readable: { name: string; description: string }[] = []
+  for (const entry of entries as readonly unknown[]) {
+    if (typeof entry !== 'object' || entry === null) return undefined
+    const { name, description } = entry as { name?: unknown; description?: unknown }
+    if (typeof name !== 'string' || name === '' || typeof description !== 'string') return undefined
+    readable.push({ name, description })
+  }
+  return readable
+}
+
 function catalogHistory(agent: Agent): { visibleDigest?: string; published: boolean } {
  const visible = new Set(agent.session.surface.nodes)
  const events = agent.session.events
@@ -293,43 +363,31 @@ function catalogHistory(agent: Agent): { visibleDigest?: string; published: bool
    // The loop bounds prove the read-only event view contains this index.
    // oxlint-disable-next-line typescript/no-non-null-assertion
    const event = events[index]!
-    if (event.type !== 'user/message'
-      || event.data.source.kind !== 'plugin'
-      || event.data.source.plugin !== PLUGIN_SOURCE.plugin) continue
-    const digest = catalogContentDigest(event.data.content)
-    if (digest === undefined) continue
+    if (event.type !== 'user/message' || event.data.source.kind !== 'skill-catalog') continue
+    const entries = readCatalogEntries(event.data.source)
+    if (entries === undefined) continue
+    const digest = digestCatalogEntries(entries)
    published = true
    if (visible.has(event.seq)) return { visibleDigest: digest, published }
  }
  return { published }
 }

-function catalogMessage(messages: readonly UserMessage[]): UserMessage | undefined {
-  return messages.find(message =>
-    message.source.kind === 'plugin'
-    && message.source.plugin === PLUGIN_SOURCE.plugin
-    && catalogContentDigest(message.content) !== undefined)
-}
-
-function catalogContentDigest(content: UserMessage['content']): string | undefined {
-  if (content.length !== 1 || content[0]?.type !== 'text') return undefined
-  const text = content[0].text
-  const start = text.indexOf(CATALOG_ENTRIES_START)
-  if (start === -1) return undefined
-  const entriesStart = start + CATALOG_ENTRIES_START.length
-  const end = text.indexOf(CATALOG_ENTRIES_END, entriesStart)
-  if (end === -1) return undefined
-  const renderedEntries = text.slice(entriesStart, end)
-  const entries = renderedEntries.endsWith('\n') ? renderedEntries.slice(0, -1) : renderedEntries
-  return digestCatalogEntries(entries)
+function catalogMessage(
+  messages: readonly UserMessage[],
+): { message: UserMessage; entries: SkillCatalogSource['entries'] } | undefined {
+  for (const message of messages) {
+    if (message.source.kind !== 'skill-catalog') continue
+    const entries = readCatalogEntries(message.source)
+    if (entries !== undefined) return { message, entries }
+  }
+  return undefined
 }

+/** Normalized, length-bounded description exactly as the catalog publishes it (unescaped). */
 function catalogDescription(value: string, maxLength: number): string {
  const normalized = value.replaceAll(/\s+/g, ' ').trim()
-  const truncated = normalized.length <= maxLength
-    ? normalized
-    : `${normalized.slice(0, maxLength - 3)}...`
-  return escapeText(truncated)
+  return normalized.length <= maxLength ? normalized : `${normalized.slice(0, maxLength - 3)}...`
 }

 function assertPositiveInteger(name: string, value: number, minimum = 1): void {
@@ -113,8 +113,15 @@ async function proposeStep(

 function catalogMessages(session: Session): Extract<SessionEvent, { type: 'user/message' }>[] {
  return session.events.filter((event): event is Extract<SessionEvent, { type: 'user/message' }> => event.type === 'user/message'
-    && event.data.source.kind === 'plugin'
-    && event.data.source.plugin === 'dsh-tool-skill')
+    && event.data.source.kind === 'skill-catalog')
+}
+
+function readableCatalog(event: Extract<SessionEvent, { type: 'user/message' }>): boolean {
+  const entries = (event.data.source as { entries?: unknown }).entries
+  return Array.isArray(entries)
+    && entries.every(entry => typeof entry === 'object' && entry !== null
+      && typeof (entry as { name?: unknown }).name === 'string'
+      && typeof (entry as { description?: unknown }).description === 'string')
 }

 function catalogContent(entries: string[]): Message['content'] {
@@ -261,7 +268,15 @@ describe('dsh-tool-skill', () => {
      {
        id: expect.any(String) as unknown,
        role: 'user',
-        source: { kind: 'plugin', plugin: 'dsh-tool-skill' },
+        source: {
+          kind: 'skill-catalog',
+          form: 'catalog',
+          entries: [
+            { name: 'a-skill', description: 'Use {{placeholder}} <safely> & carefully.' },
+            { name: 'model-only-skill', description: 'Model-only skill.' },
+            { name: 'z-skill', description: 'Long description Long description Long descript...' },
+          ],
+        },
        content: [{
          type: 'text',
          text: [
@@ -394,14 +409,22 @@ describe('dsh-tool-skill', () => {
    const home = await tempDir('tool-proposed-empty-catalog')
    const ctx = await setup(home)
    const session = Session.create(SessionId('proposed-empty-catalog'))
+    const malformed = createUserMessage({
+      content: [{ type: 'text', text: 'preserve unreadable claimed context' }],
+      source: { kind: 'skill-catalog', form: 'catalog' } as never,
+    })
    const stale = createUserMessage({
      content: catalogContent(['- `stale-skill`: Stale skill']),
-      source: { kind: 'plugin', plugin: 'dsh-tool-skill' },
+      source: {
+        kind: 'skill-catalog',
+        form: 'catalog',
+        entries: [{ name: 'stale-skill', description: 'Stale skill' }],
+      },
    })

-    const decision = await proposeStep(ctx, sessionAgent(session), [stale])
+    const decision = await proposeStep(ctx, sessionAgent(session), [malformed, stale])

-    expect(decision).toEqual({ kind: 'enter', messages: [] })
+    expect(decision).toEqual({ kind: 'enter', messages: [malformed] })
  })

  it('keeps a proposed catalog that already matches the current snapshot', async () => {
@@ -416,7 +439,11 @@ describe('dsh-tool-skill', () => {
    const session = Session.create(SessionId('matching-proposal'))
    const proposed = createUserMessage({
      content: catalogContent(['- `first-skill`: First skill']),
-      source: { kind: 'plugin', plugin: 'dsh-tool-skill' },
+      source: {
+        kind: 'skill-catalog',
+        form: 'catalog',
+        entries: [{ name: 'first-skill', description: 'First skill' }],
+      },
    })

    const decision = await proposeStep(ctx, sessionAgent(session), [proposed])
@@ -468,7 +495,12 @@ describe('dsh-tool-skill', () => {
    expect(catalogMessages(session)).toHaveLength(3)
  })

-  it('resumes from the latest valid visible catalog content', async () => {
+  it('resumes from the durable entries of the latest visible catalog', async () => {
+    // Catalog identity moved onto `source.entries` when the catalog became a
+    // `catalog`-form context: the model-facing prose no longer decides whether
+    // a republish is needed, so a seeded message is recognized by its source
+    // alone and malformed prose can no longer hide (or fake) a published
+    // catalog. A foreign-sourced message is not this plugin's catalog at all.
    const home = await tempDir('tool-catalog-resume')
    const ctx = await setup(home)
    ctx.skills.register({
@@ -481,30 +513,78 @@ describe('dsh-tool-skill', () => {
    const agent = sessionAgent(session)
    openMessageTurn(session)
    session.append('user/message', createUserMessage({
-      content: catalogContent(['- `old-skill`: Old skill']),
-      source: { kind: 'plugin', plugin: 'dsh-tool-skill' },
+      content: [{ type: 'text', text: 'prose a reader cannot rely on' }],
+      source: {
+        kind: 'skill-catalog',
+        form: 'catalog',
+        entries: [{ name: 'old-skill', description: 'Old skill' }],
+      },
    }), { surfaceOp: 'append' })
    session.append('user/message', createUserMessage({
-      content: [{ type: 'text', text: 'missing catalog markers' }],
-      source: { kind: 'plugin', plugin: 'dsh-tool-skill' },
-    }), { surfaceOp: 'append' })
-    session.append('user/message', createUserMessage({
-      content: [{ type: 'text', text: '<available_skills>\nmissing closing marker' }],
-      source: { kind: 'plugin', plugin: 'dsh-tool-skill' },
-    }), { surfaceOp: 'append' })
-    session.append('user/message', createUserMessage({
-      content: [{ type: 'text', text: 'first block' }, { type: 'text', text: 'second block' }],
-      source: { kind: 'plugin', plugin: 'dsh-tool-skill' },
-    }), { surfaceOp: 'append' })
-    session.append('user/message', createUserMessage({
-      content: [{ type: 'reasoning', text: 'not a user-role catalog block' }],
+      content: catalogContent(['- `resumed-skill`: Resumed skill']),
      source: { kind: 'plugin', plugin: 'dsh-tool-skill' },
    }), { surfaceOp: 'append' })

    await fireStep(ctx, agent, 1, 1)

-    expect(catalogMessages(session)).toHaveLength(6)
-    expect(JSON.stringify(catalogMessages(session).at(-1)?.data.content)).toContain('resumed-skill')
+    // The seeded entries differ from the live snapshot, so one replacement
+    // lands; the foreign-sourced lookalike neither counts as published nor
+    // suppresses it.
+    expect(catalogMessages(session)).toHaveLength(2)
+    const latest = catalogMessages(session).at(-1)
+    expect(latest?.data.source).toMatchObject({
+      kind: 'skill-catalog',
+      form: 'catalog',
+      update: true,
+      entries: [{ name: 'resumed-skill', description: 'Resumed skill' }],
+    })
+    expect(JSON.stringify(latest?.data.content)).toContain('resumed-skill')
+
+    // A second step over unchanged entries republishes nothing.
+    await fireStep(ctx, agent, 1, 2)
+    expect(catalogMessages(session)).toHaveLength(2)
+  })
+
+  it('treats a malformed durable catalog as unrecognizable instead of failing the step', async () => {
+    // Seeds reach `agent.session.events` from JSONL/SQLite on resume or fork,
+    // and seed validation only guarantees a source object with a non-empty
+    // `kind`. A catalog whose entries are missing or wrongly shaped must be
+    // skipped like any foreign record; throwing here would fail every later
+    // step of that session at the latest possible point.
+    const home = await tempDir('tool-catalog-malformed')
+    const ctx = await setup(home)
+    ctx.skills.register({
+      name: 'live-skill',
+      description: 'Live skill',
+      source: 'runtime',
+      content: 'Live body.',
+    })
+    const session = Session.create(SessionId('catalog-malformed'))
+    const agent = sessionAgent(session)
+    openMessageTurn(session)
+    for (const source of [
+      { kind: 'skill-catalog', form: 'catalog' },
+      { kind: 'skill-catalog', form: 'catalog', entries: null },
+      { kind: 'skill-catalog', form: 'catalog', entries: 'not-an-array' },
+      { kind: 'skill-catalog', form: 'catalog', entries: [null] },
+      { kind: 'skill-catalog', form: 'catalog', entries: [{ name: 'x' }] },
+      { kind: 'skill-catalog', form: 'catalog', entries: [{ description: 'no name' }] },
+    ]) {
+      session.append('user/message', createUserMessage({
+        content: [{ type: 'text', text: 'unreadable catalog' }],
+        source: source as never,
+      }), { surfaceOp: 'append' })
+    }
+
+    await expect(fireStep(ctx, agent, 1, 1)).resolves.toBeUndefined()
+
+    // None of the six counted as published, so the live catalog lands as a
+    // first publication rather than a replacement.
+    const published = catalogMessages(session).filter(event => readableCatalog(event))
+    expect(published).toHaveLength(1)
+    expect(published[0]?.data.source).toMatchObject({ kind: 'skill-catalog', form: 'catalog' })
+    expect(published[0]?.data.source).not.toHaveProperty('update')
+    expect(JSON.stringify(published[0]?.data.content)).toContain('live-skill')
  })

  it('re-establishes the current catalog after compaction hides its durable message', async () => {
@@ -26,6 +26,16 @@
      "symbol": "MessageSourceMap",
      "source": "packages/llm/llm/src/message.ts"
    },
+    {
+      "doc": "docs/core-data-structures/core.md",
+      "symbol": "ContextForm",
+      "source": "packages/llm/llm/src/message.ts"
+    },
+    {
+      "doc": "docs/core-data-structures/core.md",
+      "symbol": "ContextFormed",
+      "source": "packages/llm/llm/src/message.ts"
+    },
    {
      "doc": "docs/core-data-structures/core.md",
      "symbol": "FinishReasonMap",