fix(im): gate optional resource downloads at runtime

internal/cli/schema_catalog/tools/chat.json

@@ -50915,10 +50915,10 @@
       "canonical_path": "chat.shortcut_at_me",
       "cli_name": "+at-me",
       "cli_path": "chat +at-me",
-      "confirmation": "user_required",
+      "confirmation": "not_required",
       "description": "当你想快速看回最近谁在群里或单聊里 @了你、但不想手动把起止时间换算成毫秒、也不想记 list-mentions 的一堆参数时使用；内部按本地时区算出「最近 N 天」（默认 7 天，可用 --days 调整回溯天数）的时间窗，搜索这段时间内 @我 的消息，再在本地把每条消息投影成发送人、时间、内容、所在会话四个关键字段。默认只读且不会发送、撤回或标记任何消息；传 --download-resources 时会在工作目录写文件，因此命令按本地写入操作确认。\n\n参数约束：\n  - --output-dir 必须是工作目录内的相对路径，不允许绝对路径或 .. 逃逸",
       "display": "群聊 / 消息 / 机器人",
-      "effect": "write",
+      "effect": "read",
       "effect_source": "agent-hint",
       "examples": [
         "dws chat +at-me",
@@ -50945,7 +50945,7 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
               "value": "available"
@@ -50953,7 +50953,7 @@
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
           "value": "available"
         },
@@ -50997,17 +50997,17 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
-              "value": "user_required"
+              "value": "not_required"
             }
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
-          "value": "user_required"
+          "value": "not_required"
         },
         "description": {
           "candidates": [
@@ -51027,17 +51027,17 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
-              "value": "write"
+              "value": "read"
             }
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
-          "value": "write"
+          "value": "read"
         },
         "examples": {
           "candidates": [
@@ -51065,23 +51065,23 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
-              "value": "unknown"
+              "value": "idempotent"
             }
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
-          "value": "unknown"
+          "value": "idempotent"
         },
         "interface_mode": {
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
               "value": "composite"
@@ -51089,7 +51089,7 @@
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
           "value": "composite"
         },
@@ -51097,7 +51097,7 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
               "value": "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref."
@@ -51105,7 +51105,7 @@
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
           "value": "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref."
         },
@@ -51129,7 +51129,7 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
               "value": true
@@ -51144,7 +51144,7 @@
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
           "value": true
         },
@@ -51152,17 +51152,17 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
-              "value": "medium"
+              "value": "low"
             }
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
-          "value": "medium"
+          "value": "low"
         },
         "title": {
           "candidates": [
@@ -51200,7 +51200,7 @@
         }
       },
       "has_parameters": true,
-      "idempotency": "unknown",
+      "idempotency": "idempotent",
       "interface_mode": "composite",
       "interface_reason": "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref.",
       "is_alias": false,
@@ -51840,7 +51840,7 @@
       "primary_cli_path": "chat +at-me",
       "product_id": "chat",
       "reviewed": true,
-      "risk": "medium",
+      "risk": "low",
       "source": "reviewed_command_registry",
       "title": "查最近 @我 的消息（自动算时间窗，投影发送人/时间/内容/会话）",
       "use_when": [
@@ -58207,7 +58207,7 @@
       "canonical_path": "chat.shortcut_chat_messages",
       "cli_name": "+chat-messages",
       "cli_path": "chat +chat-messages",
-      "confirmation": "user_required",
+      "confirmation": "not_required",
       "constraints": {
         "mutually_exclusive": [
           [
@@ -58226,7 +58226,7 @@
       },
       "description": "当你想快速看某个会话里的消息（谁在什么时间说了什么），而不想拿到一大坨原始消息字段时使用；群聊传 --group（群会话 ID，openConversationId），单聊传 --user（对方 userId），两者互斥且必须二选一。省略 --time 时默认从当前时间向前读取最近消息；也可指定时间边界并用 --direction newer/older 控制方向。内部据此调用群聊或单聊的消息列表接口，再在本地投影出每条消息的发言人、文本和时间。默认只读且不会发送或修改任何消息；传 --download-resources 时会在工作目录写文件，因此命令按本地写入操作确认。\n\n参数约束：\n  - --group、--conversation-id、--id、--user、--open-dingtalk-id 必须且只能指定一个\n  - --output-dir 必须是工作目录内的相对路径，不允许绝对路径或 .. 逃逸",
       "display": "群聊 / 消息 / 机器人",
-      "effect": "write",
+      "effect": "read",
       "effect_source": "agent-hint",
       "examples": [
         "dws chat +chat-messages --group \u003copenConversationId\u003e --direction older",
@@ -58253,7 +58253,7 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable Shortcut, group/direct lower read tools, optional local-file writes, shared safe-output validation, resource de-duplication, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable Shortcut and group/direct lower read tools. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
               "value": "available"
@@ -58261,7 +58261,7 @@
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable Shortcut, group/direct lower read tools, optional local-file writes, shared safe-output validation, resource de-duplication, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable Shortcut and group/direct lower read tools. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
           "value": "available"
         },
@@ -58305,17 +58305,17 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable Shortcut, group/direct lower read tools, optional local-file writes, shared safe-output validation, resource de-duplication, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable Shortcut and group/direct lower read tools. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
-              "value": "user_required"
+              "value": "not_required"
             }
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable Shortcut, group/direct lower read tools, optional local-file writes, shared safe-output validation, resource de-duplication, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable Shortcut and group/direct lower read tools. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
-          "value": "user_required"
+          "value": "not_required"
         },
         "description": {
           "candidates": [
@@ -58335,17 +58335,17 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable Shortcut, group/direct lower read tools, optional local-file writes, shared safe-output validation, resource de-duplication, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable Shortcut and group/direct lower read tools. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
-              "value": "write"
+              "value": "read"
             }
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable Shortcut, group/direct lower read tools, optional local-file writes, shared safe-output validation, resource de-duplication, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable Shortcut and group/direct lower read tools. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
-          "value": "write"
+          "value": "read"
         },
         "examples": {
           "candidates": [
@@ -58373,23 +58373,23 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable Shortcut, group/direct lower read tools, optional local-file writes, shared safe-output validation, resource de-duplication, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable Shortcut and group/direct lower read tools. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
-              "value": "unknown"
+              "value": "idempotent"
             }
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable Shortcut, group/direct lower read tools, optional local-file writes, shared safe-output validation, resource de-duplication, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable Shortcut and group/direct lower read tools. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
-          "value": "unknown"
+          "value": "idempotent"
         },
         "interface_mode": {
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable Shortcut, group/direct lower read tools, optional local-file writes, shared safe-output validation, resource de-duplication, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable Shortcut and group/direct lower read tools. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
               "value": "composite"
@@ -58397,7 +58397,7 @@
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable Shortcut, group/direct lower read tools, optional local-file writes, shared safe-output validation, resource de-duplication, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable Shortcut and group/direct lower read tools. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
           "value": "composite"
         },
@@ -58405,7 +58405,7 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable Shortcut, group/direct lower read tools, optional local-file writes, shared safe-output validation, resource de-duplication, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable Shortcut and group/direct lower read tools. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
               "value": "Reviewed built-in Shortcut adapter: it routes group or direct-message history reads, projects a stable message shape, and optionally orchestrates safe resource downloads with a failure ledger."
@@ -58413,7 +58413,7 @@
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable Shortcut, group/direct lower read tools, optional local-file writes, shared safe-output validation, resource de-duplication, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable Shortcut and group/direct lower read tools. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
           "value": "Reviewed built-in Shortcut adapter: it routes group or direct-message history reads, projects a stable message shape, and optionally orchestrates safe resource downloads with a failure ledger."
         },
@@ -58437,7 +58437,7 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable Shortcut, group/direct lower read tools, optional local-file writes, shared safe-output validation, resource de-duplication, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable Shortcut and group/direct lower read tools. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
               "value": true
@@ -58452,7 +58452,7 @@
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable Shortcut, group/direct lower read tools, optional local-file writes, shared safe-output validation, resource de-duplication, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable Shortcut and group/direct lower read tools. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
           "value": true
         },
@@ -58460,17 +58460,17 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable Shortcut, group/direct lower read tools, optional local-file writes, shared safe-output validation, resource de-duplication, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable Shortcut and group/direct lower read tools. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
-              "value": "medium"
+              "value": "low"
             }
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable Shortcut, group/direct lower read tools, optional local-file writes, shared safe-output validation, resource de-duplication, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable Shortcut and group/direct lower read tools. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
-          "value": "medium"
+          "value": "low"
         },
         "title": {
           "candidates": [
@@ -58508,7 +58508,7 @@
         }
       },
       "has_parameters": true,
-      "idempotency": "unknown",
+      "idempotency": "idempotent",
       "interface_mode": "composite",
       "interface_reason": "Reviewed built-in Shortcut adapter: it routes group or direct-message history reads, projects a stable message shape, and optionally orchestrates safe resource downloads with a failure ledger.",
       "is_alias": false,
@@ -59427,7 +59427,7 @@
       "primary_cli_path": "chat +chat-messages",
       "product_id": "chat",
       "reviewed": true,
-      "risk": "medium",
+      "risk": "low",
       "source": "reviewed_command_registry",
       "title": "拉取某个会话（群聊或单聊）的消息列表并投影出发言人/文本/时间",
       "use_when": [
@@ -70454,10 +70454,10 @@
       "canonical_path": "chat.shortcut_messages_mget",
       "cli_name": "+messages-mget",
       "cli_path": "chat +messages-mget",
-      "confirmation": "user_required",
+      "confirmation": "not_required",
       "description": "当你已有一批消息 openMsgId、需要批量取回完整详情、reaction 和可执行资源引用时使用；一次最多 50 条。--download-resources 可把所有可识别 mediaId/fileId 安全下载到工作目录内，并逐资源返回成功/失败 ledger。默认只读；传 --download-resources 时会在工作目录写文件，因此命令按本地写入操作确认。\n\n参数约束：\n  - --msg-ids 去重后必须包含 1-50 条消息 ID\n  - --output-dir 必须是工作目录内的相对路径，不允许绝对路径或 .. 逃逸",
       "display": "群聊 / 消息 / 机器人",
-      "effect": "write",
+      "effect": "read",
       "effect_source": "agent-hint",
       "examples": [
         "dws chat +messages-mget --msg-ids msgId1,msgId2"
@@ -70483,7 +70483,7 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
               "value": "available"
@@ -70491,7 +70491,7 @@
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
           "value": "available"
         },
@@ -70535,17 +70535,17 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
-              "value": "user_required"
+              "value": "not_required"
             }
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
-          "value": "user_required"
+          "value": "not_required"
         },
         "description": {
           "candidates": [
@@ -70565,17 +70565,17 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
-              "value": "write"
+              "value": "read"
             }
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
-          "value": "write"
+          "value": "read"
         },
         "examples": {
           "candidates": [
@@ -70601,23 +70601,23 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
-              "value": "unknown"
+              "value": "idempotent"
             }
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
-          "value": "unknown"
+          "value": "idempotent"
         },
         "interface_mode": {
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
               "value": "composite"
@@ -70625,7 +70625,7 @@
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
           "value": "composite"
         },
@@ -70633,7 +70633,7 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
               "value": "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref."
@@ -70641,7 +70641,7 @@
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
           "value": "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref."
         },
@@ -70665,7 +70665,7 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
               "value": true
@@ -70680,7 +70680,7 @@
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
           "value": true
         },
@@ -70688,17 +70688,17 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
-              "value": "medium"
+              "value": "low"
             }
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the built-in Shortcut registry, mounted Cobra command, and optional local-file writes; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the built-in Shortcut registry and mounted Cobra command. The published default remains read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
-          "value": "medium"
+          "value": "low"
         },
         "title": {
           "candidates": [
@@ -70736,7 +70736,7 @@
         }
       },
       "has_parameters": true,
-      "idempotency": "unknown",
+      "idempotency": "idempotent",
       "interface_mode": "composite",
       "interface_reason": "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref.",
       "is_alias": false,
@@ -71199,7 +71199,7 @@
       "primary_cli_path": "chat +messages-mget",
       "product_id": "chat",
       "reviewed": true,
-      "risk": "medium",
+      "risk": "low",
       "source": "reviewed_command_registry",
       "title": "根据消息 ID 批量查询消息（最多 50 条）",
       "use_when": [
@@ -77518,7 +77518,7 @@
       "canonical_path": "chat.shortcut_search_msg",
       "cli_name": "+search-msg",
       "cli_path": "chat +search-msg",
-      "confirmation": "user_required",
+      "confirmation": "not_required",
       "constraints": {
         "mutually_exclusive": [
           [
@@ -77566,7 +77566,7 @@
       },
       "description": "当你要按关键词、发送者、@对象、会话、消息类型或机器人来源组合搜索 IM 消息时使用；默认查询近 7 天，也可指定精确起止时间。--page-all 会连续拉取游标页，默认再按消息 ID 分批富化详情；任何续页或富化失败都会保留已取得结果并返回逐项失败 ledger，绝不把截断结果标成完整。默认只读；传 --download-resources 时会在工作目录写文件，因此命令按本地写入操作确认。\n\n参数约束：\n  - 至少指定一个内容、身份、会话或消息类型过滤条件\n  - 需与 --end 一起传\n  - 需与 --start 一起传\n  - --groups、--chat-id 互斥，最多指定一个\n  - --senders、--sender 互斥，最多指定一个\n  - --at-me、--is-at-me 互斥，最多指定一个\n  - --conversation-type、--chat-type 互斥，最多指定一个\n  - --limit、--page-size 互斥，最多指定一个\n  - --cursor、--page-token 互斥，最多指定一个\n  - --output-dir 必须是工作目录内的相对路径，不允许绝对路径或 .. 逃逸",
       "display": "群聊 / 消息 / 机器人",
-      "effect": "write",
+      "effect": "read",
       "effect_source": "agent-hint",
       "examples": [
         "dws chat +search-msg --query \"周报\" --senders \u003copenDingTalkId\u003e --days 3 --page-all",
@@ -77593,7 +77593,7 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable advanced-search flags, page and enrichment failure ledgers, optional local-file writes, shared safe-output validation, and per-resource download ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable advanced-search flags plus page and enrichment ledgers. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
               "value": "available"
@@ -77601,7 +77601,7 @@
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable advanced-search flags, page and enrichment failure ledgers, optional local-file writes, shared safe-output validation, and per-resource download ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable advanced-search flags plus page and enrichment ledgers. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
           "value": "available"
         },
@@ -77645,17 +77645,17 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable advanced-search flags, page and enrichment failure ledgers, optional local-file writes, shared safe-output validation, and per-resource download ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable advanced-search flags plus page and enrichment ledgers. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
-              "value": "user_required"
+              "value": "not_required"
             }
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable advanced-search flags, page and enrichment failure ledgers, optional local-file writes, shared safe-output validation, and per-resource download ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable advanced-search flags plus page and enrichment ledgers. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
-          "value": "user_required"
+          "value": "not_required"
         },
         "description": {
           "candidates": [
@@ -77675,17 +77675,17 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable advanced-search flags, page and enrichment failure ledgers, optional local-file writes, shared safe-output validation, and per-resource download ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable advanced-search flags plus page and enrichment ledgers. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
-              "value": "write"
+              "value": "read"
             }
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable advanced-search flags, page and enrichment failure ledgers, optional local-file writes, shared safe-output validation, and per-resource download ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable advanced-search flags plus page and enrichment ledgers. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
-          "value": "write"
+          "value": "read"
         },
         "examples": {
           "candidates": [
@@ -77713,23 +77713,23 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable advanced-search flags, page and enrichment failure ledgers, optional local-file writes, shared safe-output validation, and per-resource download ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable advanced-search flags plus page and enrichment ledgers. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
-              "value": "unknown"
+              "value": "idempotent"
             }
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable advanced-search flags, page and enrichment failure ledgers, optional local-file writes, shared safe-output validation, and per-resource download ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable advanced-search flags plus page and enrichment ledgers. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
-          "value": "unknown"
+          "value": "idempotent"
         },
         "interface_mode": {
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable advanced-search flags, page and enrichment failure ledgers, optional local-file writes, shared safe-output validation, and per-resource download ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable advanced-search flags plus page and enrichment ledgers. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
               "value": "composite"
@@ -77737,7 +77737,7 @@
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable advanced-search flags, page and enrichment failure ledgers, optional local-file writes, shared safe-output validation, and per-resource download ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable advanced-search flags plus page and enrichment ledgers. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
           "value": "composite"
         },
@@ -77745,7 +77745,7 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable advanced-search flags, page and enrichment failure ledgers, optional local-file writes, shared safe-output validation, and per-resource download ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable advanced-search flags plus page and enrichment ledgers. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
               "value": "Reviewed search adapter: it combines filters, cursor pagination, batched mget enrichment, stable projection, completeness accounting, and optional safe resource downloads."
@@ -77753,7 +77753,7 @@
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable advanced-search flags, page and enrichment failure ledgers, optional local-file writes, shared safe-output validation, and per-resource download ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable advanced-search flags plus page and enrichment ledgers. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
           "value": "Reviewed search adapter: it combines filters, cursor pagination, batched mget enrichment, stable projection, completeness accounting, and optional safe resource downloads."
         },
@@ -77777,7 +77777,7 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable advanced-search flags, page and enrichment failure ledgers, optional local-file writes, shared safe-output validation, and per-resource download ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable advanced-search flags plus page and enrichment ledgers. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
               "value": true
@@ -77792,7 +77792,7 @@
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable advanced-search flags, page and enrichment failure ledgers, optional local-file writes, shared safe-output validation, and per-resource download ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable advanced-search flags plus page and enrichment ledgers. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
           "value": true
         },
@@ -77800,17 +77800,17 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable advanced-search flags, page and enrichment failure ledgers, optional local-file writes, shared safe-output validation, and per-resource download ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable advanced-search flags plus page and enrichment ledgers. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
-              "value": "medium"
+              "value": "low"
             }
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable advanced-search flags, page and enrichment failure ledgers, optional local-file writes, shared safe-output validation, and per-resource download ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable advanced-search flags plus page and enrichment ledgers. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
-          "value": "medium"
+          "value": "low"
         },
         "title": {
           "candidates": [
@@ -77848,7 +77848,7 @@
         }
       },
       "has_parameters": true,
-      "idempotency": "unknown",
+      "idempotency": "idempotent",
       "interface_mode": "composite",
       "interface_reason": "Reviewed search adapter: it combines filters, cursor pagination, batched mget enrichment, stable projection, completeness accounting, and optional safe resource downloads.",
       "is_alias": false,
@@ -80295,7 +80295,7 @@
       "primary_cli_path": "chat +search-msg",
       "product_id": "chat",
       "reviewed": true,
-      "risk": "medium",
+      "risk": "low",
       "source": "reviewed_command_registry",
       "title": "多维搜索消息，可全量翻页并批量富化详情",
       "use_when": [
@@ -80923,7 +80923,7 @@
       "canonical_path": "chat.shortcut_thread_replies",
       "cli_name": "+thread-replies",
       "cli_path": "chat +thread-replies",
-      "confirmation": "user_required",
+      "confirmation": "not_required",
       "constraints": {
         "mutually_exclusive": [
           [
@@ -80940,7 +80940,7 @@
       },
       "description": "当你已经拿到某个群里一条「话题消息」的 threadId/topicId、想快速看这条话题下的全部回复（谁在什么时间回复了什么），而不想拿到一大坨原始消息字段时使用；内部按 --group（群会话 ID）和 --thread-id（兼容 --topic-id）拉取该话题的回复列表，可选 --time 指定起始时间、--limit 指定每页条数，再在本地投影出每条回复的发言人、文本和回复时间。默认只读且不会发送或修改任何消息；传 --download-resources 时会在工作目录写文件，因此命令按本地写入操作确认。\n\n参数约束：\n  - --thread-id 与兼容参数 --topic-id 必须且只能指定一个\n  - --output-dir 必须是工作目录内的相对路径，不允许绝对路径或 .. 逃逸",
       "display": "群聊 / 消息 / 机器人",
-      "effect": "write",
+      "effect": "read",
       "effect_source": "agent-hint",
       "examples": [
         "dws chat +thread-replies --group \u003copenConversationId\u003e --thread-id \u003cthreadId\u003e",
@@ -80967,7 +80967,7 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable thread/topic alias contract, real list_topic_replies mapping, optional local-file writes, group fallback for resource context, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable thread/topic alias contract and real list_topic_replies mapping. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
               "value": "available"
@@ -80975,7 +80975,7 @@
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable thread/topic alias contract, real list_topic_replies mapping, optional local-file writes, group fallback for resource context, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable thread/topic alias contract and real list_topic_replies mapping. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
           "value": "available"
         },
@@ -81019,17 +81019,17 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable thread/topic alias contract, real list_topic_replies mapping, optional local-file writes, group fallback for resource context, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable thread/topic alias contract and real list_topic_replies mapping. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
-              "value": "user_required"
+              "value": "not_required"
             }
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable thread/topic alias contract, real list_topic_replies mapping, optional local-file writes, group fallback for resource context, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable thread/topic alias contract and real list_topic_replies mapping. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
-          "value": "user_required"
+          "value": "not_required"
         },
         "description": {
           "candidates": [
@@ -81049,17 +81049,17 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable thread/topic alias contract, real list_topic_replies mapping, optional local-file writes, group fallback for resource context, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable thread/topic alias contract and real list_topic_replies mapping. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
-              "value": "write"
+              "value": "read"
             }
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable thread/topic alias contract, real list_topic_replies mapping, optional local-file writes, group fallback for resource context, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable thread/topic alias contract and real list_topic_replies mapping. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
-          "value": "write"
+          "value": "read"
         },
         "examples": {
           "candidates": [
@@ -81087,23 +81087,23 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable thread/topic alias contract, real list_topic_replies mapping, optional local-file writes, group fallback for resource context, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable thread/topic alias contract and real list_topic_replies mapping. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
-              "value": "unknown"
+              "value": "idempotent"
             }
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable thread/topic alias contract, real list_topic_replies mapping, optional local-file writes, group fallback for resource context, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable thread/topic alias contract and real list_topic_replies mapping. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
-          "value": "unknown"
+          "value": "idempotent"
         },
         "interface_mode": {
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable thread/topic alias contract, real list_topic_replies mapping, optional local-file writes, group fallback for resource context, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable thread/topic alias contract and real list_topic_replies mapping. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
               "value": "composite"
@@ -81111,7 +81111,7 @@
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable thread/topic alias contract, real list_topic_replies mapping, optional local-file writes, group fallback for resource context, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable thread/topic alias contract and real list_topic_replies mapping. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
           "value": "composite"
         },
@@ -81119,7 +81119,7 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable thread/topic alias contract, real list_topic_replies mapping, optional local-file writes, group fallback for resource context, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable thread/topic alias contract and real list_topic_replies mapping. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
               "value": "Reviewed thread reader adapter: it accepts threadId/topicId, reads lower topic replies, projects stable message fields, and optionally downloads reply resources safely."
@@ -81127,7 +81127,7 @@
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable thread/topic alias contract, real list_topic_replies mapping, optional local-file writes, group fallback for resource context, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable thread/topic alias contract and real list_topic_replies mapping. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
           "value": "Reviewed thread reader adapter: it accepts threadId/topicId, reads lower topic replies, projects stable message fields, and optionally downloads reply resources safely."
         },
@@ -81151,7 +81151,7 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable thread/topic alias contract, real list_topic_replies mapping, optional local-file writes, group fallback for resource context, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable thread/topic alias contract and real list_topic_replies mapping. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
               "value": true
@@ -81166,7 +81166,7 @@
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable thread/topic alias contract, real list_topic_replies mapping, optional local-file writes, group fallback for resource context, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable thread/topic alias contract and real list_topic_replies mapping. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
           "value": true
         },
@@ -81174,17 +81174,17 @@
           "candidates": [
             {
               "precedence": "reviewed_explicit",
-              "review_reason": "Reviewed against the executable thread/topic alias contract, real list_topic_replies mapping, optional local-file writes, group fallback for resource context, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+              "review_reason": "Reviewed against the executable thread/topic alias contract and real list_topic_replies mapping. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
               "selected": true,
               "source": "internal/cli/schema_hints/metadata/chat.json",
-              "value": "medium"
+              "value": "low"
             }
           ],
           "precedence": "reviewed_explicit",
           "resolution": "highest_precedence",
-          "review_reason": "Reviewed against the executable thread/topic alias contract, real list_topic_replies mapping, optional local-file writes, group fallback for resource context, and per-resource failure ledger; the static runtime risk is conservatively write because --download-resources writes files.",
+          "review_reason": "Reviewed against the executable thread/topic alias contract and real list_topic_replies mapping. The published default is read-only; runtime risk escalates to write when --download-resources opts into local file writes.",
           "source": "internal/cli/schema_hints/metadata/chat.json",
-          "value": "medium"
+          "value": "low"
         },
         "title": {
           "candidates": [
@@ -81222,7 +81222,7 @@
         }
       },
       "has_parameters": true,
-      "idempotency": "unknown",
+      "idempotency": "idempotent",
       "interface_mode": "composite",
       "interface_reason": "Reviewed thread reader adapter: it accepts threadId/topicId, reads lower topic replies, projects stable message fields, and optionally downloads reply resources safely.",
       "is_alias": false,
@@ -82033,7 +82033,7 @@
       "primary_cli_path": "chat +thread-replies",
       "product_id": "chat",
       "reviewed": true,
-      "risk": "medium",
+      "risk": "low",
       "source": "reviewed_command_registry",
       "title": "拉取某条话题消息的全部回复并投影出发言人/文本/时间",
       "use_when": [