# DSH Session Insights 0.5.0 acceptance

- Source: `607ecae2edaa0b145126a1c4cd8b3352c4a6bc5a`.
- Host contract: DSH `0.1.7-rc.2` only; V4; analysis identity `v4-rc2.2`.
- Artifact: `dsh-session-insights-0.5.0.tgz`, 136,679 bytes.
- SHA-256: `1b969c46de0c526e79b3283322ebaa340676d8eaee0792b4ba6cd906c150e8d2`.
- Package contains 25 files and embeds the source commit as `gitHead`. All other packaged bytes match that commit. Repeated packs are identical.

## Verified

- 70 Node and 70 Python tests. The final [CI run](https://github.com/GreenLv/dsh-session-insights/actions/runs/36216157577) passed all 13 jobs across macOS, Windows and Linux, Python 3.11–3.13, Node 22.19.0 and the configured Node 24.8.0 lane.
- Exact official rc.2 strict catalog: 19 nonempty fixture files, 289 events, 16 review-family positive controls and the original five invalid-contract controls.
- Independent replay of the five original review counterexamples through the Node and Python production analyzers, repeated against the installed tarball.
- Installed tarball: three synthetic sessions, one nonempty semantic batch per language, English and Chinese final HTML/JSON. Model outputs were constructed for the test; this does not prove a model roundtrip.
- Installed tarball: actual rc.2 Cordis registration/reload, Session/query/codec readback, message identity after reopen, query cancellation and interrupted-tail handling. Inputs and the persistence seam were synthetic.
- Source fixture bytes remained unchanged. Review and pack checks introduced no new source-log writes or upload path.

## Review repairs

- Accept valid omitted `isError`, extra source metadata and nested inherited markers without restoring legacy compatibility paths.
- Preserve outer PTC program failures after inner success. Each failed call outcome counts once; inner and outer failures are separately visible, without claiming unique causal incidents.
- Match PTC approval records through the original subCallId. Rejected verification calls are permission blocks, not failed verification; absent identity or permission-like text does not invent attribution.
- Preserve LF fixture bytes on Windows checkout. The strict fixture comparison was not weakened.

## Evidence boundaries

Windows 11 / Node 24.18.0 / actual rc.2 Web host: the canonical tarball was installed with the official offline plugin CLI into an isolated profile; all 25 installed files matched. Seven tools and the command registered. Official strict V4 synthetic inputs populated separate target and unrelated persisted sessions. A separate Agent executed the deterministic slash command: a project path containing Chinese characters and spaces selected exactly one session and produced nonempty HTML/JSON. Cancellation before the execution promise settled produced an AbortError; no new run directory appeared during the next 500 ms, and a new command succeeded. This does not locate cancellation within a specific worker phase or prove that existing files were untouched. Three Agent handles, two observation leases and the two identified host processes were cleaned up. No Windows model call or daily-profile adoption is claimed.

The maintainer manually checked both offline report languages from this exact package: display and expected metrics, filtering/reset, JSON/Markdown exports and browser-console behavior passed. This is human attestation, not automated browser observation or screenshot evidence. Automated navigation had been explicitly blocked; no alternative-browser workaround was used. Clipboard/adoption controls and a broad visual/device matrix were outside this bounded smoke check.

macOS acceptance used the exact tarball in the actual rc.2 Web host: seven tools registered, a deterministic report contained one fresh test session, and a separate analysis Agent completed a nonempty real-model semantic workflow over two test user turns. The final report has semantic_analysis.status=complete, one batch and one session; its manifest identifies v4-rc2.2. One producer-owned notice was recorded and remained after disposing the Agent and reopening 62 events through sessionQuery. This was a same-process reopen, not a full process restart. Active-Agent automatic tool-addition/removal events remain unverified natively. These limits do not turn installation or configuration dumps into workflow evidence.

## Public release

Published 2026-09-26: [GitHub Release v0.5.0](https://github.com/GreenLv/dsh-session-insights/releases/tag/v0.5.0) and [npm 0.5.0](https://www.npmjs.com/package/dsh-session-insights/v/0.5.0). npm latest resolves to 0.5.0. Anonymous readback verified the annotated tag target, embedded commit, registry integrity, Release text and all four downloaded assets. The registry and GitHub tarballs match the SHA-256 above. The [release receipt](v0.5.0-release-receipt.json) records those identities.

The packaged README and tag-bound candidate record preserve pre-publication status. This post-release document supplements that frozen artifact; it does not change its bytes or tag. Daily installation/adoption and marketplace ingestion remain separate actions.