@deepseek-ai/dsh-session 0.2.0-rc.1 → 0.2.1-alpha.1

package/README.i18n.yaml

@@ -42,17 +42,17 @@
   en: bbfb53c50100ab13
   zh: 303a8ee47f4f656a
 /deepseek-ai-dsh-session/understand-the-implementation/source-map:
-  en: 1268738282846f1d
-  zh: 75a9fe0d5088ea09
+  en: c596a8f74b4f1b79
+  zh: a29f23c4c1d1ff75
 /deepseek-ai-dsh-session/understand-the-implementation/append-validation:
   en: 5c09583bc8e1ffc6
   zh: 3b25552de2d1f9b6
 /deepseek-ai-dsh-session/understand-the-implementation/shared-recovery:
-  en: 76bb076736b2dd0f
-  zh: de8306afc1e5faa1
+  en: 160b35afd9d866e4
+  zh: cd1021e0ef567f87
 /deepseek-ai-dsh-session/understand-the-implementation/derived-history:
-  en: 0cc7a06f76bd7eca
-  zh: 1db25185b15cad23
+  en: 4a9861492a8c3869
+  zh: e9566de647206230
 /deepseek-ai-dsh-session/understand-the-implementation/the-request-header:
   en: 1349f47bea4dab00
   zh: 20cc03f2c87ec492
@@ -78,8 +78,8 @@
   en: 9c2efc3e9064e3c4
   zh: 9a7783991b322750
 /deepseek-ai-dsh-session/model-experience/tool-result-recovery-and-fork-results/what-the-model-sees:
-  en: b2ae41b23519cdc6
-  zh: 0e80c34e3267d098
+  en: d15c350efc66e832
+  zh: b769ba23dbb374e7
 /deepseek-ai-dsh-session/model-experience/tool-result-recovery-and-fork-results/token-effect:
   en: 1339facbd3d7cee0
   zh: 9d392a053ef90032

package/README.md

@@ -101,7 +101,6 @@ The package is built on event sourcing: a `Session` is an append-only log of typ
 | [`src/request-header.ts`](src/request-header.ts) | `request/header` folding and reconstruction |
 | [`dsh-util-values`](../../util/values/README.md) | Shared lossless JSON validation and detached snapshots |
 | [`src/repair.ts`](src/repair.ts) | Shared tool-result recovery for failed steps, interrupted logs, and fork seeds |
-| [`src/invariant.ts`](src/invariant.ts) | Invariant companion: seq, turn/step enclosure, tool call/result pairing |
 
 ### Append validation
 
@@ -109,11 +108,11 @@ Every append uses the shared iterative `snapshotJsonValue()` pass, which reads,
 
 ### Shared recovery
 
-`ToolCallRecovery` tracks unanswered requests from committed events without retaining event history. AgentLoop observes live steps; crash recovery and fork-seed construction replay their prefixes through `openTurnClosers`. Live failures and crash recovery use interrupted-result wording by default; fork construction passes the fork cause to select its distinct retry guidance. The caller appends recovery results before closing the step ([decision](../../../.agents/notes/implemented/bug-fix/2026-09-19-failed-step-tool-results.md)).
+`ToolCallRecovery` tracks unanswered requests from committed events without retaining event history. AgentLoop observes live steps; crash recovery and fork-seed construction replay their prefixes through `openTurnClosers`. Live failures and crash recovery use interrupted-result wording by default; fork construction passes the fork cause to select its distinct retry guidance. The caller appends recovery results before closing the step ([reference](../agent-loop/README.md)).
 
 ### Derived history
 
-`deriveMessages()` caches deep-frozen projections and returns a fresh array per call. The surface event types (`system/message`, `developer/message`, `user/message`, `assistant/message`, `tool/result`) supply their recorded message identities and content; empty-content system and developer nodes project to no message. Plugin-owned projections change derived content without mutating recorded messages. Replacements and projection decisions invalidate the cache. Embedded Assistant streams and `assistant/attempt` events remain replay and diagnostic data only.
+`deriveMessages()` caches deep-frozen projections and returns a fresh array per call. The surface event types (`system/message`, `developer/message`, `user/message`, `assistant/message`, `tool/result`) supply their recorded message identities and content; empty-content system and developer nodes project to no message. Plugin-owned projections change derived content without mutating recorded messages. Replacements and projection decisions invalidate the cache. Embedded Assistant streams and `assistant/attempt` events remain replay and diagnostic data only. Ordinary prompts and injected context project without automatic type- or source-specific wrappers. Producers own any framing in their recorded content.
 
 ### The request header
 
@@ -157,7 +156,7 @@ Appended surface entries preserve reusable prefixes. A `replace` operation inval
 
 #### What the model sees
 
-If recovery finds an assistant tool request with no durable `tool/call`, its synthetic `TOOL_NOT_STARTED` result says `The tool call was interrupted before the Harness recorded it as started. Retry it if it is still needed.` If a durable `tool/call` has no result, its `TOOL_OUTCOME_UNKNOWN` result says `The tool call was interrupted after it was recorded, but no result was durably recorded. Its outcome is unknown. Decide whether to retry from the tool semantics: retry only if the operation is read-only or idempotent; if it may have side effects, first verify external state or ask the user. Do not retry blindly.` Fork-generated results describe only the inherited records: the parent may have started or completed a call after the selected event. `TOOL_NOT_STARTED` means the prefix contains no start record; `TOOL_OUTCOME_UNKNOWN` means it contains a start but no result. Both tell the model to retry only read-only or idempotent operations without further checks; operations with side effects require external verification or user input. See the [fork decision](../../../.agents/notes/implemented/feature/2026-08-18-arbitrary-seq-session-fork.md).
+If recovery finds an assistant tool request with no durable `tool/call`, its synthetic `TOOL_NOT_STARTED` result says `The tool call was interrupted before the Harness recorded it as started. Retry it if it is still needed.` If a durable `tool/call` has no result, its `TOOL_OUTCOME_UNKNOWN` result says `The tool call was interrupted after it was recorded, but no result was durably recorded. Its outcome is unknown. Decide whether to retry from the tool semantics: retry only if the operation is read-only or idempotent; if it may have side effects, first verify external state or ask the user. Do not retry blindly.` Fork-generated results describe only the inherited records: the parent may have started or completed a call after the selected event. `TOOL_NOT_STARTED` means the prefix contains no start record; `TOOL_OUTCOME_UNKNOWN` means it contains a start but no result. Both tell the model to retry only read-only or idempotent operations without further checks; operations with side effects require external verification or user input. See the [fork reference](src/fork.ts).
 
 #### Token effect
 

package/README.zh.md

@@ -101,7 +101,6 @@ session.deriveMessages()         // the derived model history
 | [`src/request-header.ts`](src/request-header.ts) | `request/header` 折叠与重建 |
 | [`dsh-util-values`](../../util/values/README.zh.md) | 共享无损 JSON 校验与分离式快照 |
 | [`src/repair.ts`](src/repair.ts) | 失败步骤、中断日志与 fork 种子共享的工具结果恢复 |
-| [`src/invariant.ts`](src/invariant.ts) | 不变式配套：序号、轮次／步骤闭合、工具调用／结果配对 |
 
 ### 追加校验
 
@@ -109,11 +108,11 @@ session.deriveMessages()         // the derived model history
 
 ### 共享恢复逻辑
 
-`ToolCallRecovery` 从已提交事件中跟踪尚无结果的请求，不保留事件历史。AgentLoop 观察实时步骤；崩溃恢复与 fork 种子构造通过 `openTurnClosers` 回放各自的前缀。实时失败与崩溃恢复默认使用中断结果文案；fork 构造传入 fork 原因，以选择其专用的重试指引。调用方在关闭步骤之前追加恢复结果（[决策](../../../.agents/notes/implemented/bug-fix/2026-09-19-failed-step-tool-results.zh.md)）。
+`ToolCallRecovery` 从已提交事件中跟踪尚无结果的请求，不保留事件历史。AgentLoop 观察实时步骤；崩溃恢复与 fork 种子构造通过 `openTurnClosers` 回放各自的前缀。实时失败与崩溃恢复默认使用中断结果文案；fork 构造传入 fork 原因，以选择其专用的重试指引。调用方在关闭步骤之前追加恢复结果（[参考](../agent-loop/README.zh.md)）。
 
 ### 派生历史
 
-`deriveMessages()` 缓存深度冻结的派生消息，每次调用返回新数组。surface 事件类型（`system/message`、`developer/message`、`user/message`、`assistant/message`、`tool/result`）提供记录的消息身份和内容，空内容的 system 和 developer 节点不派生消息。插件拥有的投影修改派生内容，不修改记录的消息。替换和投影决策使缓存失效。嵌入式 Assistant stream 与 `assistant/attempt` 事件只保留回放和诊断数据。
+`deriveMessages()` 缓存深度冻结的派生消息，每次调用返回新数组。surface 事件类型（`system/message`、`developer/message`、`user/message`、`assistant/message`、`tool/result`）提供记录的消息身份和内容，空内容的 system 和 developer 节点不派生消息。插件拥有的投影修改派生内容，不修改记录的消息。替换和投影决策使缓存失效。嵌入式 Assistant stream 与 `assistant/attempt` 事件只保留回放和诊断数据。普通提示与注入上下文在派生时不会按类型或来源自动添加包装。生产方负责记录内容中的所有框定格式。
 
 ### 请求头
 
@@ -157,7 +156,7 @@ session.deriveMessages()         // the derived model history
 
 #### 模型看到什么
 
-如果恢复发现 assistant 工具请求没有持久 `tool/call`，其合成 `TOOL_NOT_STARTED` 结果内容为 `The tool call was interrupted before the Harness recorded it as started. Retry it if it is still needed.`。如果持久 `tool/call` 没有结果，其 `TOOL_OUTCOME_UNKNOWN` 结果内容为 `The tool call was interrupted after it was recorded, but no result was durably recorded. Its outcome is unknown. Decide whether to retry from the tool semantics: retry only if the operation is read-only or idempotent; if it may have side effects, first verify external state or ask the user. Do not retry blindly.`。 Fork 生成的结果只描述继承记录：父会话可能已经在所选事件之后启动或完成调用。`TOOL_NOT_STARTED` 表示前缀中没有启动记录；`TOOL_OUTCOME_UNKNOWN` 表示有启动记录但没有结果。两者都要求模型仅对只读或幂等操作直接重试；有副作用的操作需要先验证外部状态或询问用户。参见 [fork 决策](../../../.agents/notes/implemented/feature/2026-08-18-arbitrary-seq-session-fork.zh.md)。
+如果恢复发现 assistant 工具请求没有持久 `tool/call`，其合成 `TOOL_NOT_STARTED` 结果内容为 `The tool call was interrupted before the Harness recorded it as started. Retry it if it is still needed.`。如果持久 `tool/call` 没有结果，其 `TOOL_OUTCOME_UNKNOWN` 结果内容为 `The tool call was interrupted after it was recorded, but no result was durably recorded. Its outcome is unknown. Decide whether to retry from the tool semantics: retry only if the operation is read-only or idempotent; if it may have side effects, first verify external state or ask the user. Do not retry blindly.`。 Fork 生成的结果只描述继承记录：父会话可能已经在所选事件之后启动或完成调用。`TOOL_NOT_STARTED` 表示前缀中没有启动记录；`TOOL_OUTCOME_UNKNOWN` 表示有启动记录但没有结果。两者都要求模型仅对只读或幂等操作直接重试；有副作用的操作需要先验证外部状态或询问用户。参见 [fork 参考](src/fork.ts)。
 
 #### Token 影响
 

package/lib/index.js

@@ -1822,8 +1822,8 @@ var SessionStore = class extends Service {
 	* store owns the carrier, so callers (the checkpoint policy's per-request
 	* barrier, goal-round-driver's idle checkpoint, teardown drains, and consumers
 	* that flush themselves before reading storage) must come through here
-	* rather than dispatch a raw `ctx.parallel('session/flush', …)` — one owner,
-	* one spelling, and the scoped-dispatch invariant can pin it.
+	* rather than dispatch a raw `ctx.parallel('session/flush', …)` — one owner
+	* and one spelling.
 	* @param session - the session whose buffered events must reach durable storage.
 	* @returns whether at least one durability listener participated, after every
 	*   listener has settled successfully.

package/lib/types/index.d.ts

@@ -36,7 +36,6 @@ declare module '@deepseek-ai/cordis' {
          * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`): agent-scoped listeners
          * receive only sessions entered through that agent's context.
          * @param session - the session just entered and announced.
-         * @dshScopeScan unsupported
          * @mode emit
          */
         'session/created'(this: Scoped<Session>, session: Session): void;
@@ -46,7 +45,6 @@ declare module '@deepseek-ai/cordis' {
          * did not begin. Listener failures are logged and contained.
          * Scope-filtered dispatch (`@deepseek-ai/dsh-scope`) reuses the owner scope.
          * @param session - the session that is no longer live in the store.
-         * @dshScopeScan unsupported
          * @mode emit
          */
         'session/disposed'(this: Scoped<Session>, session: Session): void;
@@ -58,7 +56,6 @@ declare module '@deepseek-ai/cordis' {
          * receive only events from sessions entered through that agent's context.
          * @param session - the session whose log grew.
          * @param event - the appended event, exactly as recorded.
-         * @dshScopeScan unsupported
          * @mode emit
          */
         'session/event'(this: Scoped<Session>, session: Session, event: SessionEvent): void;
@@ -67,7 +64,6 @@ declare module '@deepseek-ai/cordis' {
          * caller awaits all of them, with no waterfall veto. Scope-filtered dispatch
          * (`@deepseek-ai/dsh-scope`) reuses the session's owner scope.
          * @param session - the session whose buffered events must reach durable storage.
-         * @dshScopeScan unsupported
          * @mode parallel
          */
         'session/flush'(this: Scoped<Session>, session: Session): Promise<void> | void;
@@ -429,8 +425,8 @@ export declare class SessionStore extends Service {
      * store owns the carrier, so callers (the checkpoint policy's per-request
      * barrier, goal-round-driver's idle checkpoint, teardown drains, and consumers
      * that flush themselves before reading storage) must come through here
-     * rather than dispatch a raw `ctx.parallel('session/flush', …)` — one owner,
-     * one spelling, and the scoped-dispatch invariant can pin it.
+     * rather than dispatch a raw `ctx.parallel('session/flush', …)` — one owner
+     * and one spelling.
      * @param session - the session whose buffered events must reach durable storage.
      * @returns whether at least one durability listener participated, after every
      *   listener has settled successfully.

package/lib/types/index.js

@@ -999,8 +999,8 @@ export class SessionStore extends Service {
      * store owns the carrier, so callers (the checkpoint policy's per-request
      * barrier, goal-round-driver's idle checkpoint, teardown drains, and consumers
      * that flush themselves before reading storage) must come through here
-     * rather than dispatch a raw `ctx.parallel('session/flush', …)` — one owner,
-     * one spelling, and the scoped-dispatch invariant can pin it.
+     * rather than dispatch a raw `ctx.parallel('session/flush', …)` — one owner
+     * and one spelling.
      * @param session - the session whose buffered events must reach durable storage.
      * @returns whether at least one durability listener participated, after every
      *   listener has settled successfully.

package/lib/types/surface.js

@@ -80,14 +80,8 @@ export function deriveEventMessage(event, projectedMessages) {
     // history; turn/step boundaries, failed attempts, and errors are trace/replay
     // data.
     switch (event.type) {
-        // Ordinary prompts and injected context project in user role: the event's
-        // model-facing content stays verbatim. Do NOT re-add per-type framing
-        // (e.g. `<context>`) here: framing is caller-owned — a producer bakes it
-        // into `content`, as agent-instructions does with `<system-reminder>` — or,
-        // if reintroduced, must be driven by the event `meta` map and a dedicated
-        // renderer, keeping this projection a verbatim pass-through. See the
-        // deferred design note in
-        // ../../../../.agents/notes/implemented/simplification/2026-07-20-unwrap-injected-content-envelopes.md
+        // Ordinary prompts and injected context retain producer-owned framing.
+        // See Derived history in packages/core/session/README.md.
         case 'user/message': {
             return event.data;
         }

package/lib/types/types.d.ts

@@ -417,8 +417,8 @@ export interface SessionEventMap {
      * keep ordinary restore and replay lifecycle boundaries.
      *
      * Only the `Session` constructor and `buildForkSeed` may create this marker.
-     * The invariant companion deliberately constrains nothing here, so a plugin
-     * appending one would silently classify every live bracket before it as seed history.
+     * Session append does not reject other writers, so a plugin appending one
+     * would silently classify every live bracket before it as seed history.
      *
      * An owner of a standalone open/close bracket (`compaction/start` …
      * `compaction/end`) reads it because seed history and live work are otherwise

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-session",
   "description": "Event-sourced session store for the DeepSeek Harness",
-  "version": "0.2.0-rc.1",
+  "version": "0.2.1-alpha.1",
   "publishConfig": {
     "access": "public"
   },
@@ -18,10 +18,6 @@
       "types": "./lib/types/index.d.ts",
       "default": "./lib/index.js"
     },
-    "./invariant": {
-      "types": "./lib/types/invariant.d.ts",
-      "default": "./lib/invariant.js"
-    },
     "./types": {
       "types": "./lib/types/types.d.ts",
       "default": "./lib/types/types.js"
@@ -39,25 +35,23 @@
   },
   "files": [
     "lib/index.js",
-    "lib/invariant.js",
     "lib/types/**/*.js",
     "lib/types/**/*.d.ts"
   ],
   "license": "MIT",
   "peerDependencies": {
-    "@deepseek-ai/dsh-scope": "0.2.0-rc.1",
-    "@deepseek-ai/cordis": "~4.0.4"
+    "@deepseek-ai/dsh-scope": "0.2.1-alpha.1",
+    "@deepseek-ai/cordis": "~4.0.5-alpha.1"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-invariants": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-scope": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-typert-registry": "0.2.0-rc.1",
-    "@deepseek-ai/cordis": "~4.0.4"
+    "@deepseek-ai/dsh-scope": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-typert-registry": "0.2.1-alpha.1",
+    "@deepseek-ai/cordis": "~4.0.5-alpha.1"
   },
   "dependencies": {
-    "@deepseek-ai/dsh-brand": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-util-values": "0.2.0-rc.1",
-    "@deepseek-ai/dsh-llm": "0.2.0-rc.1"
+    "@deepseek-ai/dsh-llm": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-brand": "0.2.1-alpha.1",
+    "@deepseek-ai/dsh-util-values": "0.2.1-alpha.1"
   }
 }

package/lib/invariant.js

@@ -1,174 +0,0 @@
-import { assertNever } from "@deepseek-ai/dsh-util-values";
-import "@deepseek-ai/dsh-brand";
-//#endregion
-//#region lib/types/invariant.js
-/**
-* Package-owned relational invariants for the session event log. Load this
-* companion beside `@deepseek-ai/dsh-invariants` to enable the checks.
-*
-* @module @deepseek-ai/dsh-session/invariant
-*/
-const PACKAGE_NAME = "@deepseek-ai/dsh-session";
-/** Cordis companion plugin name. */
-const name = "session-invariant";
-/** Service required before the companion can reserve package ownership. */
-const inject = ["invariants"];
-/** Assert that a step-scoped event names the currently open turn and step. */
-function requireOpenStep(trace, kind, turn, step, fail) {
-	if (trace.openTurn !== turn || trace.openStep !== step) fail(`${kind} names turn ${turn}/step ${step} but open is turn ${trace.openTurn}/step ${trace.openStep}`);
-}
-/** Validate one candidate event without mutating the committed trace. */
-function validateEvent(trace, event, fail) {
-	if (event.seq <= trace.lastSeq) fail(`seq must strictly increase: saw ${event.seq} after ${trace.lastSeq}`);
-	let openTurn = trace.openTurn;
-	let openStep = trace.openStep;
-	let nextTurn = trace.nextTurn;
-	let nextStep = trace.nextStep;
-	let pendingCalls = { kind: "none" };
-	switch (event.type) {
-		case "turn/start":
-			if (trace.openTurn !== null) fail(`turn/start ${event.data.turn} while turn ${trace.openTurn} is still open`);
-			if (event.data.turn !== trace.nextTurn) fail(`turn/start expected turn ${trace.nextTurn}, got ${event.data.turn}`);
-			openTurn = event.data.turn;
-			nextStep = 1;
-			break;
-		case "turn/end":
-			if (trace.openTurn !== event.data.turn) fail(`turn/end ${event.data.turn} does not match open turn ${trace.openTurn}`);
-			if (trace.openStep !== null) fail(`turn/end ${event.data.turn} while step ${trace.openStep} is still open`);
-			openTurn = null;
-			nextTurn += 1;
-			break;
-		case "step/start":
-			if (trace.openTurn !== event.data.turn) fail(`step/start in turn ${event.data.turn} but open turn is ${trace.openTurn}`);
-			if (trace.openStep !== null) fail(`step/start ${event.data.step} while step ${trace.openStep} is still open`);
-			if (event.data.step !== trace.nextStep) fail(`step/start expected step ${trace.nextStep} in turn ${event.data.turn}, got ${event.data.step}`);
-			openStep = event.data.step;
-			break;
-		case "developer/message":
-			requireOpenStep(trace, "developer/message", event.data.turn, event.data.step, fail);
-			break;
-		case "step/end":
-			requireOpenStep(trace, "step/end", event.data.turn, event.data.step, fail);
-			pendingCalls = { kind: "clear" };
-			openStep = null;
-			nextStep += 1;
-			break;
-		case "assistant/attempt":
-			requireOpenStep(trace, "assistant/attempt", event.data.turn, event.data.step, fail);
-			break;
-		case "assistant/message":
-			requireOpenStep(trace, "assistant/message", event.data.turn, event.data.step, fail);
-			break;
-		case "tool/call":
-			requireOpenStep(trace, "tool/call", event.data.turn, event.data.step, fail);
-			pendingCalls = {
-				kind: "add",
-				callId: event.data.callId
-			};
-			break;
-		case "tool/result": {
-			if (event.surfaceOp !== "append") {
-				if (trace.openTurn === null) fail("tool/result surface replacement appended outside any open turn");
-				break;
-			}
-			requireOpenStep(trace, "tool/result", event.data.turn, event.data.step, fail);
-			const callId = event.data.message.source.callId;
-			const syntheticNotStarted = event.data.message.isError === true && event.data.error?.code === "TOOL_NOT_STARTED";
-			if (!trace.pendingCalls.has(callId) && !syntheticNotStarted) fail(`tool/result for ${callId} with no prior tool/call in this step`);
-			pendingCalls = {
-				kind: "delete",
-				callId
-			};
-			break;
-		}
-		case "system/message":
-			requireOpenStep(trace, "system/message", event.data.turn, event.data.step, fail);
-			break;
-		case "user/message": break;
-		case "session/end-seed": break;
-		case "request/header":
-		case "request/context":
-			if (trace.openTurn === null) fail(`${event.type} appended outside any open turn (core execution events must be turn-enclosed)`);
-			break;
-		default: break;
-	}
-	return {
-		scalars: {
-			lastSeq: event.seq,
-			openTurn,
-			openStep,
-			nextTurn,
-			nextStep
-		},
-		pendingCalls
-	};
-}
-/** Apply one already-validated transition after its event commits. */
-function applyTransition(trace, transition) {
-	Object.assign(trace, transition.scalars);
-	switch (transition.pendingCalls.kind) {
-		case "none": break;
-		case "add":
-			trace.pendingCalls.add(transition.pendingCalls.callId);
-			break;
-		case "delete":
-			trace.pendingCalls.delete(transition.pendingCalls.callId);
-			break;
-		case "clear":
-			trace.pendingCalls.clear();
-			break;
-		/* v8 ignore next -- validateEvent produces this closed transition union */
-		default: assertNever(transition.pendingCalls, "session trace pending-call transition");
-	}
-}
-/** Install the session contribution into its child registration fiber. */
-const install = Object.assign((ctx, fail) => {
-	const traces = /* @__PURE__ */ new WeakMap();
-	const stagedTransitions = /* @__PURE__ */ new WeakMap();
-	const freshTrace = () => ({
-		lastSeq: -1,
-		openTurn: null,
-		openStep: null,
-		nextTurn: 1,
-		nextStep: 1,
-		pendingCalls: /* @__PURE__ */ new Set()
-	});
-	const seedSession = (session) => {
-		const trace = freshTrace();
-		traces.set(session, trace);
-		for (const event of session.snapshotEvents()) applyTransition(trace, validateEvent(trace, event, fail));
-		return trace;
-	};
-	/* v8 ignore next -- session/event always follows list() or session/created seeding */
-	const traceFor = (session) => traces.get(session) ?? seedSession(session);
-	for (const session of ctx.sessions.list()) seedSession(session);
-	ctx.on("session/created", (session) => {
-		seedSession(session);
-	}, { global: true });
-	ctx.on("session/event", (session, event) => {
-		const staged = stagedTransitions.get(event);
-		/* v8 ignore next 2 -- internal/dispatch stages the exact callback arguments */
-		if (staged === void 0 || staged.session !== session) return fail("session/event reached publication without matching pre-commit validation");
-		stagedTransitions.delete(event);
-		applyTransition(staged.trace, staged.transition);
-	}, { global: true });
-	ctx.on("internal/dispatch", (_mode, eventName, args) => {
-		if (eventName !== "session/event") return;
-		const [session, event] = args;
-		const trace = traceFor(session);
-		const transition = validateEvent(trace, event, fail);
-		stagedTransitions.set(event, {
-			session,
-			trace,
-			transition
-		});
-	}, { global: true });
-}, { inject: ["sessions"] });
-/**
-* Register the session invariant companion.
-* @param ctx - Cordis context carrying the invariant service.
-* @returns the installed registration's disposer after setup succeeds.
-*/
-const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
-//#endregion
-export { apply, inject, name };

package/lib/types/invariant.d.ts

@@ -1,18 +0,0 @@
-/**
- * Package-owned relational invariants for the session event log. Load this
- * companion beside `@deepseek-ai/dsh-invariants` to enable the checks.
- *
- * @module @deepseek-ai/dsh-session/invariant
- */
-import type { Context } from '@deepseek-ai/cordis';
-/** Cordis companion plugin name. */
-export declare const name = "session-invariant";
-/** Service required before the companion can reserve package ownership. */
-export declare const inject: string[];
-/**
- * Register the session invariant companion.
- * @param ctx - Cordis context carrying the invariant service.
- * @returns the installed registration's disposer after setup succeeds.
- */
-export declare const apply: (ctx: Context) => Promise<() => void>;
-//# sourceMappingURL=invariant.d.ts.map

package/lib/types/invariant.js

@@ -1,207 +0,0 @@
-/**
- * Package-owned relational invariants for the session event log. Load this
- * companion beside `@deepseek-ai/dsh-invariants` to enable the checks.
- *
- * @module @deepseek-ai/dsh-session/invariant
- */
-import { assertNever } from '@deepseek-ai/dsh-util-values';
-import { TOOL_NOT_STARTED } from "./repair.js";
-const PACKAGE_NAME = '@deepseek-ai/dsh-session';
-/** Cordis companion plugin name. */
-export const name = 'session-invariant';
-/** Service required before the companion can reserve package ownership. */
-export const inject = ['invariants'];
-/** Assert that a step-scoped event names the currently open turn and step. */
-function requireOpenStep(trace, kind, turn, step, fail) {
-    if (trace.openTurn !== turn || trace.openStep !== step) {
-        fail(`${kind} names turn ${turn}/step ${step} but open is turn ${trace.openTurn}/step ${trace.openStep}`);
-    }
-}
-/** Validate one candidate event without mutating the committed trace. */
-function validateEvent(trace, event, fail) {
-    if (event.seq <= trace.lastSeq) {
-        fail(`seq must strictly increase: saw ${event.seq} after ${trace.lastSeq}`);
-    }
-    let openTurn = trace.openTurn;
-    let openStep = trace.openStep;
-    let nextTurn = trace.nextTurn;
-    let nextStep = trace.nextStep;
-    let pendingCalls = { kind: 'none' };
-    // Context and plugin-owned log-only events may be appended between model
-    // executions. Core execution events retain their explicit turn relations.
-    switch (event.type) {
-        case 'turn/start': {
-            if (trace.openTurn !== null) {
-                fail(`turn/start ${event.data.turn} while turn ${trace.openTurn} is still open`);
-            }
-            if (event.data.turn !== trace.nextTurn) {
-                fail(`turn/start expected turn ${trace.nextTurn}, got ${event.data.turn}`);
-            }
-            openTurn = event.data.turn;
-            nextStep = 1;
-            break;
-        }
-        case 'turn/end': {
-            if (trace.openTurn !== event.data.turn) {
-                fail(`turn/end ${event.data.turn} does not match open turn ${trace.openTurn}`);
-            }
-            if (trace.openStep !== null) {
-                fail(`turn/end ${event.data.turn} while step ${trace.openStep} is still open`);
-            }
-            openTurn = null;
-            nextTurn += 1;
-            break;
-        }
-        case 'step/start': {
-            if (trace.openTurn !== event.data.turn) {
-                fail(`step/start in turn ${event.data.turn} but open turn is ${trace.openTurn}`);
-            }
-            if (trace.openStep !== null) {
-                fail(`step/start ${event.data.step} while step ${trace.openStep} is still open`);
-            }
-            if (event.data.step !== trace.nextStep) {
-                fail(`step/start expected step ${trace.nextStep} in turn ${event.data.turn}, got ${event.data.step}`);
-            }
-            openStep = event.data.step;
-            break;
-        }
-        case 'developer/message': {
-            requireOpenStep(trace, 'developer/message', event.data.turn, event.data.step, fail);
-            break;
-        }
-        case 'step/end': {
-            requireOpenStep(trace, 'step/end', event.data.turn, event.data.step, fail);
-            pendingCalls = { kind: 'clear' };
-            openStep = null;
-            nextStep += 1;
-            break;
-        }
-        case 'assistant/attempt': {
-            requireOpenStep(trace, 'assistant/attempt', event.data.turn, event.data.step, fail);
-            break;
-        }
-        case 'assistant/message': {
-            requireOpenStep(trace, 'assistant/message', event.data.turn, event.data.step, fail);
-            break;
-        }
-        case 'tool/call': {
-            requireOpenStep(trace, 'tool/call', event.data.turn, event.data.step, fail);
-            pendingCalls = { kind: 'add', callId: event.data.callId };
-            break;
-        }
-        case 'tool/result': {
-            // Session has already validated a content rewrite that cites its replaced event.
-            // It is durable turn work, not a second execution of the original call.
-            if (event.surfaceOp !== 'append') {
-                if (trace.openTurn === null) {
-                    fail('tool/result surface replacement appended outside any open turn');
-                }
-                break;
-            }
-            requireOpenStep(trace, 'tool/result', event.data.turn, event.data.step, fail);
-            const callId = event.data.message.source.callId;
-            const syntheticNotStarted = event.data.message.isError === true && event.data.error?.code === TOOL_NOT_STARTED;
-            if (!trace.pendingCalls.has(callId) && !syntheticNotStarted) {
-                fail(`tool/result for ${callId} with no prior tool/call in this step`);
-            }
-            pendingCalls = { kind: 'delete', callId };
-            break;
-        }
-        case 'system/message': {
-            requireOpenStep(trace, 'system/message', event.data.turn, event.data.step, fail);
-            break;
-        }
-        case 'user/message':
-            break;
-        case 'session/end-seed':
-            // Unconstrained: an unbalanced seed legally puts it inside an open turn.
-            break;
-        case 'request/header':
-        case 'request/context': {
-            if (trace.openTurn === null) {
-                fail(`${event.type} appended outside any open turn (core execution events must be turn-enclosed)`);
-            }
-            break;
-        }
-        default:
-            // Merge-extensible event relations belong to their owning plugin.
-            break;
-    }
-    return {
-        scalars: { lastSeq: event.seq, openTurn, openStep, nextTurn, nextStep },
-        pendingCalls,
-    };
-}
-/** Apply one already-validated transition after its event commits. */
-function applyTransition(trace, transition) {
-    Object.assign(trace, transition.scalars);
-    switch (transition.pendingCalls.kind) {
-        case 'none':
-            break;
-        case 'add':
-            trace.pendingCalls.add(transition.pendingCalls.callId);
-            break;
-        case 'delete':
-            trace.pendingCalls.delete(transition.pendingCalls.callId);
-            break;
-        case 'clear':
-            trace.pendingCalls.clear();
-            break;
-        /* v8 ignore next -- validateEvent produces this closed transition union */
-        default:
-            assertNever(transition.pendingCalls, 'session trace pending-call transition');
-    }
-}
-/** Install the session contribution into its child registration fiber. */
-const install = Object.assign((ctx, fail) => {
-    const traces = new WeakMap();
-    const stagedTransitions = new WeakMap();
-    const freshTrace = () => ({
-        lastSeq: -1,
-        openTurn: null,
-        openStep: null,
-        nextTurn: 1,
-        nextStep: 1,
-        pendingCalls: new Set(),
-    });
-    const seedSession = (session) => {
-        const trace = freshTrace();
-        traces.set(session, trace);
-        // oxlint-disable-next-line typescript/no-deprecated -- Existing Session history read; migration deferred.
-        for (const event of session.snapshotEvents()) {
-            applyTransition(trace, validateEvent(trace, event, fail));
-        }
-        return trace;
-    };
-    /* v8 ignore next -- session/event always follows list() or session/created seeding */
-    const traceFor = (session) => traces.get(session) ?? seedSession(session);
-    for (const session of ctx.sessions.list())
-        seedSession(session);
-    ctx.on('session/created', (session) => { seedSession(session); }, { global: true });
-    ctx.on('session/event', (session, event) => {
-        const staged = stagedTransitions.get(event);
-        /* v8 ignore next 2 -- internal/dispatch stages the exact callback arguments */
-        if (staged === undefined || staged.session !== session) {
-            return fail('session/event reached publication without matching pre-commit validation');
-        }
-        stagedTransitions.delete(event);
-        applyTransition(staged.trace, staged.transition);
-    }, { global: true });
-    ctx.on('internal/dispatch', (_mode, eventName, args) => {
-        if (eventName !== 'session/event')
-            return;
-        const [session, event] = args;
-        const trace = traceFor(session);
-        const transition = validateEvent(trace, event, fail);
-        // A later dispatch listener may veto. Validation is pure, so abandoning
-        // this weakly keyed transition does not advance or retain the session.
-        stagedTransitions.set(event, { session, trace, transition });
-    }, { global: true });
-}, { inject: ['sessions'] });
-/**
- * Register the session invariant companion.
- * @param ctx - Cordis context carrying the invariant service.
- * @returns the installed registration's disposer after setup succeeds.
- */
-export const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
-//# sourceMappingURL=invariant.js.map