docs(ops): claim PU6 semantic summary shadow on chat mutex

Co-authored-by: Cursor <cursoragent@cursor.com>

.doc/ops/CURRENT.md

@@ -13,6 +13,7 @@
 
 | owner | task | branch | worktree | mutex | status |
 |-------|------|--------|----------|-------|--------|
+| Cursor-Auto | 2026-09-16-pu6-semantic-summary | feature/pu6-semantic-summary | .worktrees/feature-pu6-semantic-summary | chat | done |
 | Cursor | 2026-09-16-full-backlog-override | docs/override-nogo-full-backlog | - | architecture-docs | in_progress |
 | Cursor | 2026-09-16-gitea-nightly-docker-datadir | fix/gitea-nightly-docker-datadir | - | ci | done |
 | Cursor | 2026-09-16-gitea-nightly-host-tools | fix/gitea-nightly-host-tools | - | ci | done |

.doc/ops/short-term/2026-09-16-pu6-semantic-summary.md

@@ -0,0 +1,55 @@
+---
+title: "PU6 语义摘要 shadow（SEMANTIC_SUMMARY_SHADOW）"
+status: done
+created: 2026-09-16
+updated: 2026-09-16
+owner: Cursor-Auto
+branch: feature/pu6-semantic-summary
+worktree: ".worktrees/feature-pu6-semantic-summary"
+mutex: chat
+---
+
+# PU6 语义摘要 shadow
+
+## 目标
+
+在授权可见消息集合上落地 `SEMANTIC_SUMMARY_SHADOW`（默认 off）：shadow 语义摘要、失败回 deterministic 并标注 freshness；不启用 REPLACE。
+
+## 范围
+
+- `internal/ctxmgr/summarizer.go` + semantic shadow
+- `internal/app/chatflow/` 授权过滤入口
+- `internal/server/chat_digest_api.go` 出站 freshness/shadow 字段
+- 单元/表征测试；测试报告
+
+## 非目标
+
+- 不启用 `SEMANTIC_SUMMARY_REPLACE`
+- 不合入 `dev`
+- 不改 plan 文件
+
+## 步骤
+
+1. [x] 从 `dev` 开分支 / worktree 并认领
+2. [x] flags + 无工具语义摘要器 + rolling summary shadow
+3. [x] chatflow 授权路径 + digest API
+4. [x] 测试与报告
+5. [x] 渐进提交并 push
+
+## 验收标准
+
+- [x] flag off 行为与基线一致
+- [x] shadow on：仅 authorized 消息；失败保留 deterministic + freshness
+- [x] injection 不能提权；REPLACE 路径未接线
+- [x] 测试报告归档
+
+## 相关链接
+
+- Contract: `../long-term/2026-09-16-pu6-semantic-summary-contract.md`
+- Test report: `../../test-reports/2026-09-16-pu6-semantic-summary-test-report.md`
+
+## 证据 / 备注
+
+- 分支：`feature/pu6-semantic-summary`（worktree）
+- 测试：`go test -short ./internal/ctxmgr/ ./internal/app/chatflow/ ./internal/server/` PASS
+