[Sailfishc]

Problem and behavior

Model/API-key settings now apply to the running Core without restarting Desktop, Host, Core or Runtime. Existing conversations retain their original credential reference, new conversations use the saved selection, and invalid drafts remain editable. This integrates today’s completed work with the already-merged Homebrew changes in #91 for CLI 0.1.7-beta.2 and GUI 0.1.12-beta.2.

The GUI owns its backend for the application lifetime: closing a window preserves work; Cmd+Q confirms active work and safely stops only its own processes. Reopening restores history and drafts without replay. Also includes automatic semantic session names with a complete advertised public notification schema, stable reading position when expanding tools, clearer file summaries, trajectory copying, a bilingual download website, locked GUI builds and an explicitly scoped artifact-cleanup preview tool. Website deployment and public Homebrew tap activation remain separate.

Validation

• Native macOS GUI main flow: approvals, tools, PTY, side conversations, window hide/reopen, adapter crash/reconnect, cold quit/reopen, persisted drafts and scheduled execution passed.
• Native application lifetime suite: 11 scenarios passed, including peer-profile isolation, confirmation/cancel, hidden projects and Main/Desktop/runner failure cleanup.
• Native settings flow: save/rotation/invalid draft/cold reopen passed with fixed process identities and no implicit inference; Core tests 78/78; semantic-title integration 4/4.
• CLI and full-screen TUI native flows passed; Full workspace regression completed; three affected fixture suites were repaired and rerun (Goal 23/23, reasoning 4/4, tool-stream 16/16), giving 1,027 passing tests and 14 ignored across the combined run. Final all-target Clippy passed. GUI regression 95 passed, 3 skipped. Composer, queue, model-selection cold restart and full conversation-derivation native flows also passed. Sanitized public checkout typecheck/build, all generated schemas and bilingual docs passed. Website build/contracts/tests passed. Native Harness, Workgroup, all 20 strict public-schema Desktop API examples, permission modes, shared-service crash recovery, plugins, OTLP semantics and CLI/Skills consumers passed. A real-worker regression reproduces and prevents internal workers from consuming parent Goal/Workgroup budget for session naming. Native installer upgrade confirms retained PID, unchanged complete bundle and single completion of the active turn; ordinary request accounting excludes the separately recognized no-tools naming request.

The three skipped GUI checks and macOS notification permission delivery are not claimed as covered. Release packages will be rebuilt and validated from the clean merged SHA; no package, tag, feed change or release is part of this PR. Private design/prototype history, credentials, local configuration and raw acceptance evidence are excluded from this public branch.

• Native historical-session compatibility passed: three projects, two sessions, unchanged source and observed copy, zero model requests, and complete application-owned process cleanup. Service-recovery regression 50/50 passed, including rejection of crossed workspace/data directories and replacement generations.

Documentation

Updated the paired Core contract, Desktop contract, local-service contract, and configuration guide, with their Chinese counterparts. The website presents the product's existing download channels; deployment and public tap activation are separate.

Generalization evidence

The worker regression concerns all isolated ordinary Workgroup workers: representing an internal worker as a user root session made it eligible for an auxiliary title request against the parent's shared budget. The regression reproduced that source and naming-attempt defect before the fix, then passed with an explicit internal worker source; research-agent sources remain unchanged. Goal budget/unknown-usage checks remain strict. Session naming applies only to eligible ordinary user sessions, sends bounded text without tools, and leaves completed turn history/status/usage intact. Child, Side, Task, Goal and internal worker flows remain excluded. Restored historical project IDs are matched against their registered workspace and data directory, retaining owner and generation checks; this preserves existing data identity during application quit. These are contract and correctness checks; no task-level performance or overall agent-quality gain is claimed. No benchmark-specific routing, hidden assertions or model-budget expansion is introduced.