feat: persist rectification analysis traces

skills/birth-time-rectification/SKILL.md

@@ -17,6 +17,7 @@ Before choosing an action, read the contracts in `references/`. Treat `assets/re
 - The server owns event reconciliation, candidate-minute scanning, event contributions, snapshots, diagnostics, stability gates, jobs, replay, persistence, and final decision validation.
 - The agent may select one active server opportunity, call at most one allowed read-only diagnostic, offer an already-gated candidate range, or stop for low confidence.
 - The agent never creates events, dates, scores, candidate minutes, or profile updates.
+- The persisted “分析过程” is a server-owned execution receipt, not hidden chain-of-thought. It may list only stages, tools, and techniques that actually ran, plus a provider-explicit reasoning summary after server-side safety filtering.
 - `canConfirmExactMinute` is always `false`. Never write `profiles.active_birth_time` automatically.
 
 ## Seventeen conversation boundaries
@@ -61,3 +62,15 @@ A user who answers with a different complete event may have that event saved wit
 ## Public language
 
 Use a brief acknowledgement tied to the user's actual event, an optional gated candidate update, an optional limitation, and at most one question. Do not repeat an unchanged range, over-interpret the event, or turn sparse/conflicting evidence into certainty.
+
+
+## Analysis process receipt
+
+The collapsible “分析过程” shown with an assistant message is a durable projection of server execution artifacts. It must remain attached to the correct Turn after refresh; the browser must not infer history from timestamps or manufacture missing phases.
+
+- Show only phases that actually ran and only tools or techniques confirmed by persisted server artifacts.
+- Never present an unavailable, skipped, reference-only, or merely supported technique as executed.
+- A provider reasoning summary may be shown only when the provider explicitly returned displayable reasoning content and the server accepted it through the public safety filter. Never synthesize a replacement summary or expose hidden chain-of-thought.
+- Do not expose scores, weights, contribution matrices, internal IDs or field names, candidate minutes, tool arguments/results, prompts, sensitive answer text, or model/provider internals.
+- D60 is neither displayed nor allowed to drive a conclusion.
+- Historical records without a receipt remain readable. `v4_legacy` and `v5_shadow` retain their existing visible-reply behavior and gain trace display only when compatible persisted artifacts actually exist.

skills/birth-time-rectification/references/failure-policy.md

@@ -19,3 +19,12 @@ A month-dated event is not a failure. Refine it only when date-sensitivity diagn
 Preserve the existing Job and persistence guarantees: claim/lease, idempotency, completed-job replay, and atomic completion. A renderer or extraction failure must not cause partial artifact writes, duplicate completion, profile mutation, or a different replay result.
 
 Never log raw sensitive answers to ordinary telemetry. Persist user text only in the approved Turn/evidence stores required by the product contract.
+
+
+## Analysis receipt failures
+
+- Missing phase history, tool traces, technique evidence, or provider reasoning is represented by omission, never by reconstruction or invented text.
+- A provider reasoning payload that fails source checks or the server safety filter is discarded. Do not fall back to hidden reasoning, a second-model summary, or raw provider metadata.
+- If a Job fails before durable artifacts exist, show only a safe public failure state; do not expose internal error codes or partial model output.
+- Legacy records without analysis receipts must continue to load. `v4_legacy` and `v5_shadow` visible replies must not change merely to populate the receipt.
+- Receipt persistence and Turn association must be replay-safe and owner-scoped. Refresh, completed-job replay, or retry must not duplicate, reorder, or attach a receipt to another Turn.

skills/birth-time-rectification/references/output-contract.md

@@ -42,3 +42,19 @@ The no-repeat rule takes precedence: it must be `null` for an unchanged range, i
 ## Deterministic fallback
 
 Fallback follows the same public rules as model output: acknowledge the actual event naturally, ask one anchored question, avoid repetition and over-interpretation, and never claim exact-minute certainty.
+
+
+## Persisted analysis process
+
+“分析过程” is rendered beside the assistant message as a collapsible, refresh-safe server execution receipt. It is not part of the model-authored public message fields above and is never generated by the Renderer.
+
+The public projection may contain only:
+
+- server phases that actually started or completed;
+- allowlisted labels for candidate calculation, stability diagnostics, and a Reasoner read-only diagnostic that actually ran;
+- allowlisted techniques proven present in persisted execution artifacts;
+- an optional provider-explicit reasoning summary accepted by the server safety filter.
+
+Do not infer missing phases from the final Job phase, and do not label a capability as executed merely because the deployment supports it. If no safe provider summary exists, omit it; never create a substitute or expose hidden chain-of-thought.
+
+The receipt must exclude scores, weights, contribution matrices, internal IDs and field names, candidate minutes, tool arguments or raw results, prompts, model/provider internals, and sensitive user wording. D60 is never displayed. Historical messages without a receipt remain valid, and `v4_legacy`/`v5_shadow` keep their established visible reply semantics.

skills/birth-time-rectification/references/technique-policy.md

@@ -20,3 +20,15 @@ Only server-reported available layers may be described as used. Missing, blocked
 - D60 is reference-only and must never drive candidate selection or the public conclusion.
 - Never expose private scores, weights, contribution values, internal technique traces, or tool/model names in the user-facing message.
 - No technique result can override `canConfirmExactMinute === false` or authorize an automatic profile birth-time write.
+
+
+## Public execution receipt
+
+The analysis receipt reports observed execution, not the complete capability catalog. A technique or diagnostic may be named only when persisted server artifacts prove it ran in that Turn.
+
+- Candidate-minute scanning and stability diagnostics are shown only on turns that executed them.
+- A Reasoner diagnostic is shown as an Agent read only when its persisted tool trace records the call; precomputed diagnostics are not Agent tool calls.
+- Technique labels are derived through a server allowlist from actual contribution/technique metadata. Never expose rule IDs, raw layers, scores, weights, contribution values, matrices, arguments, or candidate minutes.
+- Unsupported, unavailable, skipped, blocked, reference-only, and research-only layers are omitted rather than shown as missing work.
+- D60 is omitted from the receipt and must not drive candidate selection, stability claims, or public conclusions.
+- Provider-explicit reasoning content is not technique evidence. It may appear only as a separately labeled, server-filtered summary and never as hidden chain-of-thought.