ReplaceFileW preserves ACLs by merging security information, which may reserialize auto-inheritance state and duplicate equivalent ACEs. Compare the final ordered, de-duplicated ACE policy instead of requiring byte-identical self-relative descriptor buffers.
Update the host-independent binding assertion to expect the namespaced absolute paths that the Win32 boundary actually receives, and align the package and bilingual RFC contracts with the semantic DACL guarantee.
Bring the TUI branch onto master after PR #378 landed so PR #363 is evaluated against the current type-equivalence documentation contract.
Resolve the bilingual development-record overlap by regenerating the English/Chinese consistency record from the merged documents. This preserves the branch's built-subprocess guidance alongside master's expanded JSDoc type-equivalence rules.
Remove the animated, dark, and light terminal captures and their bilingual RFC section. The implemented RFC retains the durable front-door decision and verification contract without carrying binary demo artifacts that need visual maintenance.
Tighten the package README ownership wording and refresh the bilingual consistency record so no repository link or prose claim refers to the removed files.
Copy an existing target's DACL onto the empty staging file before any content is written, then publish with ReplaceFileW so Windows replacement keeps the target security descriptor instead of inheriting the broader parent policy.
Keep new-file inheritance and POSIX mode behavior unchanged, retain the already-protected temp when a concurrently removed target requires rename fallback, and translate native errors into Node-style codes for the filesystem error boundary.
Add host-independent Win32 binding coverage, native Windows descriptor assertions, package documentation, and a bilingual implemented RFC that supersedes the earlier inheritance-only replacement claim.
Observe signal errors and bound the final forced-exit edge with disposeGraceMs so a refused or ineffective SIGKILL cannot leave disposal pending forever.
Apply the confirmation bound on POSIX and Windows, remove listeners and timers on every outcome, and update the ACP consumer contract plus the generated config catalog.
Cover emitted signal errors, synchronous kill exceptions, refused termination, and accepted termination that never reports exit.
Bring in the one-session surface manager landed through #376 after master advanced beyond the prior merge base.
Resolve the generated event-matrix overlap by regenerating from the merged TypeScript tree, preserving master's updated session declaration locations together with the TUI listener edges. Regenerate and verify the RFC index so both lifecycle updates remain represented.
Record the July 17 package split as an implemented bilingual feature RFC. The decision explains why TUI and stdio have separate terminal contracts, why concrete front-door selection belongs to composition, and how the TUI preserves existing session, tool-presentation, and lifecycle ownership.
Link the deterministic dark, light, and animated demos from the RFC so the assets have an in-repository owner. Cross-link the feature and testing decisions from the package README, then regenerate the RFC index and bilingual consistency record.
Master advanced with PR #375's documentation-only simplification RFCs while the TUI merge was validating. Incorporate that exact head as a merge commit so PR #363 retains current-base ancestry without rewriting its reviewed history; no TUI behavior or generated terminal artifact changes are involved.
Master unifies every live agent with its exact SessionId and moves declarative startup failures to agent-loop/config-start-failed. Keeping the branch’s AgentId label binding would let the TUI target the wrong lifecycle after reload and would miss asynchronous resume failures.
Resolve that contract migration by giving the selected terminal front door the same generated or resumed SessionId as agent-core, mounting the front door first, and entering fullscreen only after the matching root appears. Refresh the source-derived catalogs and keyless terminal goldens so Code Mode, workflow, Cordis-tool, and transient UI scenarios all exercise the merged identity model.
Tianyi Cui