V5.0.21 — 完成事件额度归属与子进程编码

English

本轮处理 #518 与 #497 的新反馈。是否可安装以 GitHub Releases 为准。

范围

• 从本轮 Hermes 结果成对传递 model/provider，使已启用 subscription_usage 的符合条件 Codex 完成回合进入额度查询；不从全局配置、账号可用性或 GPT 名称猜测本轮归属。
• 固定 v0.23.0 的结果构造点捕获实际 fallback 路由，未知、冲突或混合归属保守隐藏额度；查询异常不阻断完成卡片，重复完成不重复查询。既有默认值和配置保持。已安装源码证明同时识别精确 v5.0.20 与当前 hooks；两套都须逐字还原固定原版，混合或陌生字节继续拒绝。
• 为受控 PM/backend Python 子进程明确 UTF-8 协议与解码，防止父进程非 UTF-8 locale 将子进程输出变成未分类的解码异常；安全诊断继续脱敏，失败保留拒绝与事务保护。

诊断结论与限制

Windows 报告者在原机仍看到 source_digest。正式 setup 两条路径会显式传入选中的 pm-0230 sources；直接调用无 sources 参数的内部 helper 会用旧默认合同，不能据此认定正式安装选错 family。原机正式拒绝原因尚未独立复现，未列为已解决。无 pip 的运行时使用预构建 .whl 及精确 HFC_INSTALL_SPEC，不通过修改受管运行时或删除保护记录绕过拒绝。

本轮 #512 的旧版现场证据仅属于精确 v5.0.20、同一机器人四 profile 桌面测试，不是本候选验收。新候选的 Windows 原机、真实 Gateway/model、客户端及多 Codex 账号归属需分别登记。

验证

定向回归覆盖 locale 解码、成对终局路由、fallback、混合路由、重复/迟到完成与额度查询失败。发布门禁要求独立 QA、普通 wheel/真实子进程、完整 PR/main/tag CI、归档与 checksums 和隔离公开安装；公开 Release 登记精确 CI 与包证据。原机 Windows 拒绝、真实 Codex Gateway/model 回合、客户端视觉和多个订阅账号选择仍未验证。

贡献

感谢 github-liu 提供 #518 的完成卡和额度诊断，DMarshall0114 提供 #497 的 Windows 安装、编码与复测证据。问题证据与代码作者分开记录；既有作者、tag、发行与贡献记录保留。

V5.0.21 — Completion attribution and subprocess encoding

中文

This release addresses new reports in #518 and #497. Installable availability follows GitHub Releases.

Scope

• Carry model/provider together from the authoritative Hermes turn result so eligible Codex completions can query enabled subscription_usage. Global configuration, account availability and an unqualified GPT name do not establish turn attribution.
• Capture the actual fallback route at the pinned v0.23.0 result construction point. Unknown, conflicting or mixed attribution keeps quota hidden. Quota-query errors cannot block the terminal card; duplicate completions do not query again. Existing defaults and configuration remain. Installed-source proof accepts the exact published v5.0.20 hooks and the current hooks, each reversible to the pinned clean source; mixed or foreign bytes remain refused.
• Make controlled PM/backend Python subprocess output encoding explicit for non-UTF-8 parent locales, retaining redacted diagnostics, source refusal and transaction protection.

Findings and limits

The reporter's Windows setup source_digest refusal has not been independently reproduced. Both formal setup paths pass the selected pm-0230 source map explicitly; calling an internal helper without sources exercises its older default contract and does not establish wrong family selection in setup. A pip-less runtime can use a prebuilt .whl with an exact HFC_INSTALL_SPEC; do not modify managed runtimes or delete protection evidence to bypass refusal.

The earlier #512 live evidence belongs only to exact v5.0.20, one bot/four profiles and desktop. It is not evidence for this candidate. Original-host Windows, actual Gateway/model, client and multiple Codex-account attribution require separate evidence.

Verification

Focused regression covers locale decoding, coherent terminal routes, fallback, mixed routes, duplicate/late completions and quota-query failure. Release gates require independent QA, ordinary-wheel/real-child checks, complete PR/main/tag CI, archive checksums and isolated public installation. The published Release records exact CI and package evidence. Original Windows-host refusal, live Codex Gateway/model execution, client visuals and multiple subscription-account selection remain unverified.

Credits

Thanks to github-liu for #518 completion/quota evidence, and DMarshall0114 for #497 Windows installation, encoding and retest evidence. Issue evidence is separate from code authorship; existing authors, tags, releases and credits are preserved.

发行验收记录 / Release verification

• 精确 merge / exact merge: a0e4297206cf0341236ae1f4ca0045d1b56bb6f4；tree c64112ee86c984aa2de170d0ef9c33f128d0065d，与独立 QA 候选相同。Annotated tag v5.0.21 已复验且未移动。
• PR 完整矩阵 59/59；main 完整矩阵 59/59；main CodeQL 通过。PR 早期 KittenTTS HTTP 504 基础设施失败保留记录，仅重跑失败场景后通过。
• 精确 tag 发行门禁 首次运行 61/61 通过，包含构建、所有支持 Python/平台及 8 个官方镜像场景。
• 普通非 editable wheel 独立 QA：161 个包资源逐字匹配，真实子进程完成 clean/current/v5.0.20 installed source proof、严格漂移拒绝与字节还原验证。QA wheel SHA-256: dca5ffd31c6cfbad3a11e68b4f3d2cb0cfbba43a56839170b0aa635e644533c3。
• 从公开 Git v5.0.21 隔离安装成功；VCS provenance 精确匹配 merge，161 个资源与 QA wheel 相同，CLI 正常导入/启动。未升级维护者正式 Hermes。
• 三个平台归档与 checksums 已下载并核对 GitHub asset digest、九文件清单、顶层目录和 mode。macOS 实际解压 Linux/macOS 归档至独占 0700/1777 目录，目标 inode/uid/gid/mode 与哨兵保持；Linux root/non-root 归档安全由 CI 覆盖。

这些自动化、包与安装证据不等于报告者原机或真实客户端验收。#497 原机 source_digest 拒绝尚未独立复现；真实 Codex Gateway/model 回合、桌面/Android/iOS 视觉与交互、多个 Codex 订阅账号选择均未验证。 本版本修复已复现的子进程编码异常与 #518 路由/额度归属，保留全部安全拒绝。

Automated CI, wheel provenance, public-tag installation and archive checks passed as linked above. They do not establish a real Codex Gateway/model turn, reporter-host acceptance, client visual/interaction acceptance, or multi-subscription account selection. The original Windows source_digest refusal remains unconfirmed; this release does not claim it resolved.