@lqc123qwe/car-runtime 1.5.0 → 1.6.0

package/README.md

@@ -5,7 +5,8 @@ Composable Agent Runtime — S1 迭代产物：微内核骨架（F1 可逆注册
 ## 运行
 
 ```bash
-# 测试（零依赖，Node 22.19+ 内置能力）
+npm install   # 1.5 起 zod 为常规运行时依赖（D-22）——CLI/doctor 传递加载
+# 测试（Node 22.19+；sqlite 需 --experimental-sqlite flag）
 node --experimental-transform-types --test test/*.spec.ts
 ```
 
@@ -199,9 +200,22 @@ node --experimental-transform-types --test test/*.spec.ts
 - **1.4 工程收口（2026-09-27）**：W1 完整四块兑现——**car run 首次真实调模型**（多步工具循环 E2E 全链），模型配置通道（llm.* + env + flags）、system prompt 落链（§3.5.5 红线兑现）、TurnAborted 首次实抛、CarM8Error 保形（A080001 引导文案可达）、TLS loopback 豁免（D-12a 兑现）、MCP/PTC 进真实 turn、遥测 turn/step span 出站。全量 **282（279 PASS + 3 能力门控 skip / 0 fail）** + tsc strict 0 + secrets-scan 105 文件 0 命中。**1.4-BUG-1（fetch 缺 POST）/BUG-2（win32 退出崩溃）/BUG-3（IPv6 方括号）均为生产接线暴露的真缺陷**。
 - **1.4.0 正式发布（2026-09-27，S9 收官，全自动第二次实战）**：npm `@lqc123qwe/car-runtime@1.4.0` 在架——**dist-tags latest → 1.4.0、rc 保留指向 1.0.0-rc.1** + provenance。Release `1.4.0`（agent 经 GCM 凭据 API 创建）→ **j16 run 36328295548 全步 success**（构建/keyless 签名/自动上传五件套/npm publish）→ **post-publish 12 PASS / 1 DRY-RUN / 0 FAIL（G-09 实查）**；外部等价检查 **SHA256 MATCH（`55ce08fd…`）+ cosign keyless Verified OK**。
 - **遗留登记**：anthropic 适配器（冻结）；远程 MCP 传输（SSE/HTTP）；写类工具双 toolResult 投影观察项；car.config.ts+zod；jiti。规划：`car-docs/10-内核v1/1.4-迭代规划.md`；收口报告：`car-docs/10-内核v1/1.4-收口终验报告.md`。
+
+## 1.5 状态（provider 扩展 + 远程 MCP + 配置完整形态）
+
+| `src/runtime-core/llm.ts` | 1.5-S1（D-20）anthropic 适配器：Messages API 流式 SSE（data-only 解析；`{baseUrl}/v1/messages`；x-api-key + anthropic-version 2023-06-01；system 顶层化〔多条 \n\n 连接〕；toolResult 收敛单 user 多 tool_result 块〔is_error〕；tools → input_schema；**max_tokens 必填缺省 4096**；stop_reason 映射未映射 fail-visible；凭据 provider='anthropic'）+ **streamSsePost 引擎抽取**（§3.5.4 重试/超时/取消语义单点共用——openai-compat/anthropic 不漂移）+ assertTlsOrLoopback 抽取（D-12a 口径不变） | 1.4 冻结表 anthropic 出清 |
+| `src/runtime-core/chatStep.ts` | **1.5-BUG-1 修复：toolCall 投影丢弃**——deriveMessages 的 assistant 工具调用形态为 `{role:'assistant', toolCall}`（log.ts 口径），chatStep 仅透传 content → 工具调用历史在后续请求静默消失（真实 provider 对无 tool_calls 前驱的 tool 消息 400）；anthropic spawn E2E 生产调用点核查暴露，openai-compat 同受益 | 1.5-GO-5 双向核查产出 |
+| `src/mcp/httpClient.ts` | 1.5-S2（D-21）远程 MCP 传输：Streamable HTTP（2025-06-18 单轨）+ **懒 initialize 握手**（恰好一次；Mcp-Session-Id 捕获回传）+ JSON/SSE 双形态响应（SSE 命中即收口流显式 destroy）+ **出站 node:http(s) 不走 undici fetch**（1.4-BUG-2 已验证口径；本地 spawn E2E 曾复现 win32 退出 0xC0000409，换通道后消除）+ TLS 门复用 + resolveMcpHeaders（`${ENV_VAR}` 值内插值 + 字面明文凭据拒绝 CR-05） | 1.4 冻结表远程 MCP 出清 |
+| `src/load/config.ts` | 1.5-S3（D-22）配置完整形态：**car.config.ts 载体**（动态 import 与插件加载同纪律；发现序 ts > json〔并存 ts 胜出〕；warmCarConfig 预热保持 loadCarConfig 同步签名——未预热显式报错禁静默回退 json）+ **zod ^3 校验层**（首个常规运行时依赖，D-11a ① 修订；CAR-E-CONFIG fail-visible 保持；issue 渲染 `路径 原因`；car.config.json 键位兼容）+ mcp.servers url/headers 键位（command/url 互斥恰好其一；通道专属键 fail-visible） | 1.1-S3「届时迁移」预登记出清 |
+| `src/dx/doctor.ts` + `src/runtime-core/credentials.ts` + `src/cli.ts` | 1.5-S4 配套：doctorModelReadiness provider 感知（adapterId anthropic → ANTHROPIC_API_KEY；providerEnvVars 导出复用）+ `--adapter-id anthropic` 装配分支 + HELP/错误文案双载体与 anthropic 引导 | 1.5 DX 配套 |
+| `test/s33~s35` | s33 8 测（出站体/stop_reason 映射/流容错/chatStep 多块聚合/基线同款 TLS·凭据·重试·取消/doctor 感知/spawn E2E）+ s34 6 测（握手序/会话头/SSE 形态/closed 拒绝/headers 凭据规则/config 键位/spawn `--mcp` url 全链）+ s35 4 测（zod 键位兼容/发现序/预热协议+epoch 击穿/TS 形态校验） | 1.5-GO |
+
+- **1.5 工程收口（2026-09-28，`ec5a4c4`）**：三大登记项全部兑现（1.4 冻结表「登记后续」清零）。全量 **300（297 PASS + 3 能力门控 skip / 0 fail）** + tsc strict 0 + secrets-scan commit 后复跑 114 文件 0 命中 + contract-check 4/4（golden 不动）。**1.5-BUG-1 为生产调用点核查直接产出**（1.4 的 E2E 假服务不校验 tool_calls 历史故未暴露）。**1.5-插曲-1（HELP 模板串 `${ENV_VAR}` 未转义 → CLI 全 spawn 挂）**——模板字面量内插值转义教训。**1.5-CI-1：test/dx-smoke jobs 补 npm install**（零依赖 CI 前提随 D-22 失效——j02/j03/j04/j10/j11/j12；改 workflow 后 PyYAML 复验执行）。
+- **1.5.0 正式发布（2026-09-28，S6 收官）**：npm `@lqc123qwe/car-runtime@1.5.0` 在架——**dist-tags latest → 1.5.0、rc 保留 1.0.0-rc.1** + provenance（slsa.dev/provenance/v1）。Release `1.5.0`（agent GCM 凭据 API 创建）→ **j16 run 36394117668 全步 success**（构建/keyless 签名/自动上传五件套/npm publish）→ **post-publish 12 PASS / 1 DRY-RUN / 0 FAIL（G-09 实查）**；外部等价检查 **SHA256 MATCH（`2edae513…`）+ Rekor 透明日志交叉验证**（logIndex 2981593515，bundle↔API 双端一致；cosign 二进制本地缺席，以 Rekor API 对拍替代——登记口径）。**G-04 门禁口径随 D-22 更新**：零依赖断言 → npm audit（omit=dev high，0 findings）。
+- **遗留登记**：jiti 首载；host 工具面；写类工具双 toolResult 投影观察项；MCP legacy HTTP+SSE（2024-11-05）不追溯。规划：`car-docs/10-内核v1/1.5-迭代规划.md`；收口报告：`car-docs/10-内核v1/1.5-收口终验报告.md`。
 ## 状态
 
-- **版本主线**：S1-S4 48/48 ｜ M2 89/89（v0.2.0）｜ M3 127/127（v0.3.0）｜ M4 139/139（**1.0.0-rc.1 已发布**）｜ M5 156/156（DEC-4 预埋项转正）｜ M6 179/179（2026-09-15 收口）｜ M7 全量 195（192 PASS + 3 能力门控 skip，2026-09-19 收口）｜ **M5-S28 装载签名门 全量 204（201 PASS + 3 skip，2026-09-26）** ｜ **M8 运行时底座 全量 231（228 PASS + 3 skip，2026-09-26 收口，§3.2 八模块全部收口）** ｜ **1.1 签名收尾最小集 全量 249（246 PASS + 3 skip，2026-09-27 收口，1.1.0 已发布，enforce 翻转准备就绪）** ｜ **1.2 会话/遥测小项 全量 263（260 PASS + 3 skip，2026-09-27 收口，1.2.0 已发布）** ｜ **1.3 发布资产自动化 全量 270（267 PASS + 3 skip，2026-09-27 收口，1.3.0 已发布，全链零人工拖拽兑现）** ｜ **1.4 真实模型接入 全量 282（279 PASS + 3 skip，2026-09-27 收口，1.4.0 已发布）**
+- **版本主线**：S1-S4 48/48 ｜ M2 89/89（v0.2.0）｜ M3 127/127（v0.3.0）｜ M4 139/139（**1.0.0-rc.1 已发布**）｜ M5 156/156（DEC-4 预埋项转正）｜ M6 179/179（2026-09-15 收口）｜ M7 全量 195（192 PASS + 3 能力门控 skip，2026-09-19 收口）｜ **M5-S28 装载签名门 全量 204（201 PASS + 3 skip，2026-09-26）** ｜ **M8 运行时底座 全量 231（228 PASS + 3 skip，2026-09-26 收口，§3.2 八模块全部收口）** ｜ **1.1 签名收尾最小集 全量 249（246 PASS + 3 skip，2026-09-27 收口，1.1.0 已发布，enforce 翻转准备就绪）** ｜ **1.2 会话/遥测小项 全量 263（260 PASS + 3 skip，2026-09-27 收口，1.2.0 已发布）** ｜ **1.3 发布资产自动化 全量 270（267 PASS + 3 skip，2026-09-27 收口，1.3.0 已发布，全链零人工拖拽兑现）** ｜ **1.4 真实模型接入 全量 282（279 PASS + 3 skip，2026-09-27 收口，1.4.0 已发布）** ｜ **1.5 provider 扩展+远程 MCP+配置完整形态 全量 300（297 PASS + 3 skip，2026-09-28 收口，1.5.0 已发布）**
 - **1.0.0 正式发布（2026-09-26，S29/S30）**：npm `@lqc123qwe/car-runtime@1.0.0` 在架——**dist-tag latest → 1.0.0，rc 保留指向 1.0.0-rc.1**（§1.1 口径）；SLSA provenance（Actions OIDC，透明日志在案）；GitHub Release v1.0.0 六资产（tgz/bundle/SHA256SUMS/SBOM/审计/公钥）；**post-publish 全链 13 PASS / 0 DRY-RUN / 0 FAIL** + 外部验证者等价检查（Release 实下载件 SHA256 MATCH + cosign Verified OK）。**宽限期时钟：2026-09-26 起算，2026-12-25 到期 verifier 默认值 warn→enforce 翻转（计划内变更）**。终验报告：`car-docs/10-内核v1/M5-S30-1.0收口终验报告.md`。发布工程事件：j16 首跑 E403（npm 2FA 策略 vs granular token 无 bypass——清单预设回退路径兑现）→ bypass token re-run 绿；G-09 期望 tag 动态化（`4c84b17`）在真实发布兑现价值。
 - **1.0.0-rc.1 已发布（2026-09-09）**：npm `@lqc123qwe/car-runtime@1.0.0-rc.1`（rc + latest 双 tag，SLSA provenance 在案）+ GitHub Release 6 制品；发布预演 **13 PASS / 0 DRY-RUN / 0 FAIL**（c762b72）。S22 GO 清单已全绿收口。
 - **轨道 A 三项全部完成**：E-1 WSL2 逃逸矩阵 **20/20 PASS 零逃逸**（2026-09-07，G-07 转 PASS）｜ E-3 远端发布通道 **13/13 全门禁 PASS**（2026-09-09，G-08/09/10 转 PASS）｜ E-2 Windows koffi FFI **四判据双环境全 PASS**（S24/S25/S26，2026-09-09~10；本机非提权 + windows-latest 提权 runner 双绿，CI 门禁已接入）。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lqc123qwe/car-runtime",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "Composable Agent Runtime (CAR) - microkernel plugin system with sandboxed PTC, append-only hashed session log, and MCP host bridge",
   "license": "MIT",
   "type": "module",
@@ -26,6 +26,7 @@
     "@types/node": "^26.6.1"
   },
   "dependencies": {
+    "jiti": "^2.7.0",
     "zod": "^3.25.76"
   }
 }

package/scripts/release-pipeline.ts

@@ -69,9 +69,26 @@ const record = (stage: string, gate: string, ok: boolean, detail = '', dryRun =
     for (const p of secretPatterns) if (p.test(content)) hits++
   }
   record(stage, 'G-03 硬编码密钥扫描 = 0', hits === 0, `${hits} hits（扫描 ${scanned} 个 .ts，豁免：secrets.ts 规则库 + s7 标定基准，豁免清单见脚本注记）`)
-  // 依赖审计：零运行时依赖 → 无漏洞面（pnpm audit 在引入依赖后启用）
+  // 依赖审计：1.5-S3（D-22）zod 为首个常规运行时依赖 → 门禁口径从「零依赖断言」切换为
+  // npm audit（omit=dev，high 阻塞）——与 ci.yml j01 依赖审计同款；audit 不可达（离线）= DRY-RUN
   const pkg = JSON.parse(readFileSync(join(ROOT, 'package.json'), 'utf-8'))
-  record(stage, 'G-04 依赖审计', Object.keys(pkg.dependencies ?? {}).length === 0, '零运行时依赖（node:sqlite/node:crypto 内置），pnpm audit 在引入首依赖后启用')
+  const depCount = Object.keys(pkg.dependencies ?? {}).length
+  let auditOk = true
+  let auditDetail = '无运行时依赖（audit 免除）'
+  if (depCount > 0) {
+    if (process.env.REMOTE_CHECK === '1') {
+      try {
+        execSync('npm audit --omit=dev --audit-level=high', { cwd: ROOT, stdio: 'pipe' })
+        auditDetail = `运行时依赖 ${depCount} 项（D-22：zod ^3）；npm audit --omit=dev --audit-level=high 0 findings`
+      } catch {
+        auditOk = false
+        auditDetail = `运行时依赖 ${depCount} 项；npm audit --audit-level=high 有 findings（阻塞——G-04 D-22 口径）`
+      }
+    } else {
+      auditDetail = `运行时依赖 ${depCount} 项（D-22：zod ^3）；npm audit 在 REMOTE_CHECK=1 实跑（DRY-RUN）`
+    }
+  }
+  record(stage, 'G-04 依赖审计', auditOk, auditDetail)
 }
 
 // ── 阶段 2：构建与制品 ──

package/src/cli.ts

@@ -461,9 +461,9 @@ async function main(): Promise<number> {
       // E-6 宿主实连入口（M4-S18）：CAR-as-MCP-Server——宿主（Claude Code/Codex）经 stdio JSON-RPC 接入
       // 1.1-S4 装载接线：--plugin <file|dir>（可重复）/ CAR_PLUGINS env → 六阶段流水线（verify 门先于
       // import()）挂载进 Context + car_load_total/car_unsigned_confirmed 全链计数。
-      // 边界（1.1 规划 W2-4，防口径外推）：此处是「装载接线 + 采集全链」——插件被真实装配
-      // （factory 执行 + bindCore 冲刷注册项），但宿主会话执行插件工具的执行接线属 W1 登记后续
-      // （sessionTurn 仍为事件批归一化）。
+      // 1.6-S2（D-25）宿主工具面透传接线：插件工具 Map 注入 RuntimeFacade——tool_list 出声明面
+      // （declaredSideEffect 不出站：权限面只进权限门红线）、tool_call 经权限门（write 类 policy
+      // 拒绝/readonly 执行）+ 成对落链；跨源同名 CAR-E-DUP fail-closed（1.4-S1 纪律同款）。
       const hostIdx = rest.indexOf('--host')
       const { HOST_MAPPINGS } = await import('./host/mappings.ts')
       // 默认宿主取映射表首项（数据驱动，静态架构断言红线：宿主标识只在 mappings 数据文件）
@@ -487,11 +487,12 @@ async function main(): Promise<number> {
         counters.onCount(name, labels)
         if (otel.enabled) otel.getMeter().createCounter(name).add(1, labels as Record<string, string> | undefined)
       }
+      // 1.6-S2：hostTools 提升到块外——跨源同名查重与 toolMap 装配在装载块之后统一收口
+      const hostTools: Array<{ name: string; description?: string; parameters?: unknown; declaredSideEffect?: 'readonly' | 'write'; run: (args: Record<string, unknown>) => Promise<unknown> }> = []
       if (pluginsArg.sources.length) {
         const { loadPlugins, formatLoadReport } = await import('./load/report.ts')
         const { Context } = await import('./kernel/context.ts')
         const ctx = new Context()
-        const hostTools: any[] = []
         for (const src of pluginsArg.sources) {
           const result = await loadPlugins({ source: src, signature: { ...sig.options, onCount: (n, l) => onCount(n, l) } })
           if (result.report.stages.some(s => s.status === 'FAIL')) {
@@ -511,14 +512,18 @@ async function main(): Promise<number> {
             } })
           }
           const names = result.plugins.map(p => `${p.manifest.name}@${p.manifest.version}`).join(', ')
-          console.error(`[car mcp-serve] plugins loaded: ${names}（tools: ${hostTools.map(t => t.name).join(', ') || '无'}；装载已接线，会话内执行接线属 W1 登记后续）`)
+          console.error(`[car mcp-serve] plugins loaded: ${names}（tools: ${hostTools.map(t => t.name).join(', ') || '无'}；装载+工具面透传已接线——1.6-S2）`)
         }
       }
       const { HostGateway } = await import('./host/hostGateway.ts')
       const { createRuntimeFacade } = await import('./host/facade.ts')
       const { createStdioServer } = await import('./host/stdio.ts')
       const profiles = new Map(HOST_MAPPINGS.map(h => [h.hostId, h]))
-      const facade = createRuntimeFacade({ profiles })
+      // 1.6-S2：跨源同名显式报错（禁静默覆盖——last-wins Map 语义下同名即歧义，fail-closed 启动中止）
+      const dupTool = hostTools.find((t, i) => hostTools.findIndex(x => x.name === t.name) !== i)
+      if (dupTool) { console.error(`CAR-E-DUP: 工具 "${dupTool.name}" 跨源同名——禁静默覆盖（mcp-serve fail-closed 启动中止）`); return 1 }
+      const toolMap = new Map(hostTools.map(t => [t.name as string, t]))
+      const facade = createRuntimeFacade({ profiles, ...(toolMap.size ? { tools: toolMap } : {}) })
       const gw = new HostGateway({ facade, audit: e => onCount('car_registry_decision', { source: 'registry' }) })
       for (const h of HOST_MAPPINGS) gw.registerHost({ hostId: h.hostId, profile: h, transport: {} as never })
       const server = createStdioServer((tool, args) => gw.handle(hostId, tool, args))

package/src/host/facade.ts

@@ -7,14 +7,24 @@
  *    未命中事件走 hostRaw 降级（零静默）；turnEnd reason 由最后一条归一化 turnEnd 决定（缺省 completed）；
  *  - 模型循环由宿主驱动（「统一边界而非统一内部」）：CAR 承载日志/审计/工具面，step 循环不暴露；
  *  - 会话内存态 Map 承载（v0.2.0 SessionLog 语义），持久化经 sessionExport（取证包）与后续 S13 文件落盘增强。
+ *  - 1.6-S2（D-25）宿主工具面透传：opts.tools 注入插件工具 Map（mcp-serve 装配）——
+ *    toolList 出 name/description/parameters（declaredSideEffect 不出站：权限面只进权限门红线）；
+ *    toolCall 经权限门（T-22 缺省 write 收口；write 类 policy 拒绝——mcp-serve 无人审回路，
+ *    人审 confirm 属 turn 循环 preset.authorize 通道不外推到宿主面）+ 成对落链
+ *    （actor='user' 宿主=用户代理 / turnId='T0' 会话级能力面，sessionTurn 从 T1 起不冲突）；
+ *    未装配 tools 时显式报错（S13 占位「静默空面」退役——fail-visible）。
  */
 import { SessionLog, type EventKind } from '../session/log.ts'
 import { forkCrossHost, loadForkedLog } from '../session/fork.ts'
 import { deriveSessionId, normalizeHostEvent } from './mappings.ts'
 import type { HostProfile } from './mappings.ts'
 import type { RuntimeFacade } from './hostGateway.ts'
+import type { ToolReg } from '../load/loader.ts'
 
-interface SessionState { log: SessionLog; profile: HostProfile; hostSessionId: string; turnCount: number; lastReason: string }
+interface SessionState { log: SessionLog; profile: HostProfile; hostSessionId: string; turnCount: number; lastReason: string; hostToolSeq: number }
+
+/** 宿主工具面声明形态（toolList 出站——权限面字段不出站） */
+export interface HostToolDescriptor { name: string; description?: string; parameters?: unknown }
 
 /** 迁移事件里已用过的最大 turn 序号（T{n}）——import 侧续跑 turnId 不与迁移段冲突 */
 function maxTurnIndex(log: SessionLog): number {
@@ -26,7 +36,7 @@ function maxTurnIndex(log: SessionLog): number {
   return max
 }
 
-export function createRuntimeFacade(opts: { profiles: Map<string, HostProfile> }): RuntimeFacade {
+export function createRuntimeFacade(opts: { profiles: Map<string, HostProfile>; tools?: Map<string, ToolReg> }): RuntimeFacade {
   const sessions = new Map<string, SessionState>()
 
   const bySession = (sessionId: string): SessionState => {
@@ -47,12 +57,12 @@ export function createRuntimeFacade(opts: { profiles: Map<string, HostProfile> }
       if (importJsonl !== undefined) {
         const { log } = loadForkedLog(importJsonl, { hostId, hostSessionId })
         const turnCount = maxTurnIndex(log)
-        sessions.set(sessionId, { log, profile, hostSessionId, turnCount, lastReason: 'completed' })
+        sessions.set(sessionId, { log, profile, hostSessionId, turnCount, lastReason: 'completed', hostToolSeq: 0 })
         return { sessionId }
       }
       const log = new SessionLog(sessionId)
       log.append('runtime', 'hostRaw', 'T0', { hostEvent: 'session_registered', hostId, hostSessionId })
-      sessions.set(sessionId, { log, profile, hostSessionId, turnCount: 0, lastReason: 'completed' })
+      sessions.set(sessionId, { log, profile, hostSessionId, turnCount: 0, lastReason: 'completed', hostToolSeq: 0 })
       return { sessionId }
     },
 
@@ -115,11 +125,38 @@ export function createRuntimeFacade(opts: { profiles: Map<string, HostProfile> }
     },
 
     async toolList() {
-      return { tools: [] } // S13：宿主工具面透传（登记制接入宿主侧工具）
+      if (!opts.tools) return { tools: [] } // 未装配 = 空面（与占位形态兼容）；装配后出声明面
+      const out: HostToolDescriptor[] = []
+      for (const t of opts.tools.values()) {
+        out.push({ name: t.name, ...(t.description !== undefined ? { description: t.description } : {}), ...(t.parameters !== undefined ? { parameters: t.parameters } : {}) })
+      }
+      return { tools: out }
     },
 
-    async toolCall() {
-      return { ok: false, error: 'tool 面透传在 S13 实装（tool_list/tool_call）' }
+    // 1.6-S2（D-25）：权限门语义——未知工具显式报错；T-22 缺省 write；write 类 policy 拒绝
+    //（mcp-serve 无人审回路，deny-by-default）；readonly 执行；工具异常=成对错误结果（US-5 同款）。
+    // 全路径成对落链（toolCall/toolResult）——宿主面调用 100% 留痕哈希链。
+    async toolCall(args) {
+      const { sessionId, tool, arguments: toolArgs } = args as { sessionId?: string; tool?: string; arguments?: Record<string, unknown> }
+      const s = bySession(String(sessionId))
+      if (!opts.tools) throw new Error('CAR-E-HOST: tool 面未装配（mcp-serve 未登记插件工具——tool_list/tool_call 不可用）')
+      const id = `host-tc-${++s.hostToolSeq}`
+      s.log.append('user', 'toolCall', 'T0', { id, tool: String(tool), args: toolArgs ?? {} })
+      const def = opts.tools.get(String(tool))
+      if (!def) {
+        s.log.append('plugin', 'toolResult', 'T0', { id, error: `unknown tool "${tool}"` })
+        return { ok: false, error: `unknown tool "${tool}"（tool_list 查看已装配工具面）` }
+      }
+      const sideEffect = def.declaredSideEffect ?? 'write' // T-22 收口：未声明按最高约束
+      if (sideEffect === 'write') {
+        s.log.append('runtime', 'toolResult', 'T0', { id, error: 'authorization-denied', granted: false, mode: 'host-policy' })
+        return { ok: false, error: 'CAR-E-HOST-AUTHZ: write 类工具经宿主面 policy 拒绝（mcp-serve 无人审回路——D-25 deny-by-default）' }
+      }
+      let result: unknown
+      let toolError: string | undefined
+      try { result = await def.run(toolArgs ?? {}) } catch (e) { toolError = String(e) }
+      s.log.append('plugin', 'toolResult', 'T0', { id, result, ...(toolError ? { error: toolError } : {}) })
+      return toolError !== undefined ? { ok: false, error: toolError } : { ok: true, result }
     },
   }
 }

package/src/host/hostGateway.ts

@@ -29,7 +29,8 @@ export interface RuntimeFacade {
   sessionExport(args: { sessionId: string }): Promise<{ bundle: unknown }>
   /** M5-DEC4 转正：跨宿主 fork（宿主 A 侧调用，产出可迁移工件 + 宿主 B 侧确定性会话 id） */
   sessionFork(args: { sessionId: string; targetHostId: string; targetHostSessionId: string; upToSeq?: number }): Promise<{ sessionId: string; jsonl: string; migrated: number }>
-  toolList(args: Record<string, never>): Promise<{ tools: string[] }>
+  /** 1.6-S2（D-25）：声明面出站（name/description/parameters——declaredSideEffect 权限面不出站）；未装配 = 空面 */
+  toolList(args: Record<string, never>): Promise<{ tools: Array<{ name: string; description?: string; parameters?: unknown }> }>
   toolCall(args: { sessionId: string; tool: string; arguments?: Record<string, unknown> }): Promise<{ ok: boolean; result?: unknown; error?: string }>
 }
 

package/src/host/stdio.ts

@@ -21,6 +21,9 @@ export interface StdioServer {
 
 export function createStdioServer(dispatch: StdioDispatcher): StdioServer {
   let nextId = 0
+  // 1.6-S2：tools/call 按请求序串行派发（会话态依赖 + 响应序确定性——JSON-RPC 允许乱序，
+  // 但 stdio 宿主与测试按序解析；tools/list 等同步方法不受此链影响）
+  let callChain: Promise<void> = Promise.resolve()
   return {
     async serve(input, output) {
       let count = 0
@@ -59,15 +62,19 @@ export function createStdioServer(dispatch: StdioDispatcher): StdioServer {
         if (req.method === 'tools/call') {
           const name = req.params?.name ?? ''
           const args = req.params?.arguments ?? {}
-          void dispatch(name, args).then(r => {
-            if (r.ok) respond({ content: [{ type: 'text', text: JSON.stringify(r.result ?? {}) }], carOk: true })
-            else respond(undefined, { code: -32000, message: r.error ?? 'host call failed' })
-          }).catch(e => respond(undefined, { code: -32000, message: String(e) }))
+          callChain = callChain
+            .then(() => dispatch(name, args))
+            .then(r => {
+              if (r.ok) respond({ content: [{ type: 'text', text: JSON.stringify(r.result ?? {}) }], carOk: true })
+              else respond(undefined, { code: -32000, message: r.error ?? 'host call failed' })
+            })
+            .catch(e => respond(undefined, { code: -32000, message: String(e) }))
           return
         }
         respond(undefined, { code: -32601, message: `unknown method "${req.method}"（支持 initialize / tools/list / tools/call）` })
       })
       await done
+      await callChain // 串行链收口：进程退出前最后一批调用响应写完（win32 退出断言同源教训）
       return count
     },
   }

package/src/load/config.ts

@@ -1,10 +1,13 @@
 /**
- * 1.1-S3 签名配置文件通道 → 1.5-S3 完整形态（car.config.ts + zod，D-22）
+ * 1.1-S3 签名配置文件通道 → 1.5-S3 完整形态（car.config.ts + zod，D-22）→ 1.6-S3 jiti 载体（D-24）
  *
  * 口径：
- *  - 载体（D-22）：发现序 **car.config.ts > car.config.json**（同目录两者并存 = ts 胜出，
+ *  - 载体（D-22 + D-24 修订）：发现序 **car.config.ts > car.config.json**（同目录两者并存 = ts 胜出，
  *    json 忽略——禁静默合并）；显式 --config 按扩展名分派（.ts 走 TS 载体，其余 JSON 解析）；
- *    TS 载体 = 动态 import()（Node 原生类型剥离，插件加载同纪律——jiti 继续登记不引入）；
+ *    TS 载体 = **jiti 自包含转译**（1.6-S3——零传递依赖 bundled 形态，第二个常规运行时依赖；
+ *    D-22「jiti 继续登记不引入」到期出清）：Node 22.19+ 加载 car.config.ts 不再依赖
+ *    --experimental-transform-types，非可擦除语法（enum 等 transform-only 形态）可用——
+ *    erasable-only 预检登记项随之出清（被取代）；插件加载的原生类型剥离纪律不动。
  *    形态 = `export default {…}`（非对象/缺 default 显式报错）。
  *  - **预热协议**：loadCarConfig 保持同步签名（doctor/resolveSigGate 等既有调用面不动）；
  *    car.config.ts 须先经 warmCarConfig 异步预热入缓存（CLI 入口统一预热），未预热显式报错
@@ -20,7 +23,6 @@
  */
 import { existsSync, readFileSync } from 'node:fs'
 import { isAbsolute, join } from 'node:path'
-import { pathToFileURL } from 'node:url'
 import { z } from 'zod'
 import type { SignatureGateOptions } from './sigGate.ts'
 
@@ -184,9 +186,10 @@ const tsCache = new Map<string, ConfigLoadResult>()
 let tsEpoch = 0
 
 /**
- * 1.5-S3（D-22）：car.config.ts 载体预热（动态 import 与插件加载同纪律——Node 原生类型剥离，
- * Node 22 须 --experimental-transform-types / Node ≥23.6 原生支持；报错文案引导）。
- * CLI 入口统一预热；直接调用 loadCarConfig 的库方在存在 car.config.ts 时须先 await 本函数。
+ * 1.5-S3（D-22）→ 1.6-S3（D-24）：car.config.ts 载体预热。
+ * jiti 自包含转译（每 epoch 新实例 + moduleCache 关 = 击穿语义与 1.5 等价）——
+ * Node 22.19+ 无需 --experimental-transform-types；直接调用 loadCarConfig 的库方
+ * 在存在 car.config.ts 时须先 await 本函数（CLI 入口统一预热，协议不变）。
  */
 export async function warmCarConfig(opts: { explicitPath?: string; cwd?: string } = {}): Promise<void> {
   let path: string | undefined
@@ -203,9 +206,14 @@ export async function warmCarConfig(opts: { explicitPath?: string; cwd?: string
   tsCache.set(path, result)
 }
 
-async function loadTsConfigFile(path: string, epoch: number): Promise<ConfigLoadResult> {
+async function loadTsConfigFile(path: string, _epoch: number): Promise<ConfigLoadResult> {
   try {
-    const mod = (await import(`${pathToFileURL(path).href}?cfg-epoch=${epoch}`)) as { default?: unknown }
+    // D-24：jiti 转译（零传递依赖 bundled）；每 epoch 新实例 + moduleCache 关——击穿语义保持；
+    // interopDefault 显式关（jiti 缺省 true 会把无 default 模块的 exports 整体当 default 返回，
+    // 「缺 default export」fail-visible 校验即失效）
+    const { createJiti } = await import('jiti')
+    const jiti = createJiti(import.meta.url, { moduleCache: false, fsCache: false, interopDefault: false })
+    const mod = await jiti.import(path) as { default?: unknown }
     const raw = mod.default
     if (raw === undefined) {
       return { path, config: {}, error: `CAR-E-CONFIG: ${path} 缺 default export（car.config.ts 形态 = export default {…}）` }
@@ -217,10 +225,7 @@ async function loadTsConfigFile(path: string, epoch: number): Promise<ConfigLoad
     return v.error ? { path, config: {}, error: v.error } : { path, config: v.config }
   } catch (e) {
     const err = e as { code?: string; message?: string }
-    const hint = err.code === 'ERR_UNKNOWN_FILE_EXTENSION' || /Unknown file extension|loader/i.test(err.message ?? '')
-      ? `——当前 Node 未启用 .ts 载体（须 --experimental-transform-types 或 Node ≥23.6 原生类型剥离）`
-      : ''
-    return { path, config: {}, error: `CAR-E-CONFIG: car.config.ts 载入失败（${err.message}）${hint}` }
+    return { path, config: {}, error: `CAR-E-CONFIG: car.config.ts 载入失败（${err.message ?? String(e)}）——jiti 转译失败显式拒绝，不静默忽略` }
   }
 }
 

package/src/session/log.ts

@@ -4,6 +4,7 @@
  * 设计口径：
  *  - 哈希链（SHA-256）为 CAR 自研增强（dsh 无此物，源码级核实）——合规卖点落地
  *  - 「Model-visible means logged」：断言口径 = 请求时快照 === 日志前缀 [0, atSeq) 投影
+ *  - 1.6-S1（D-23）：投影对同 id toolResult 收敛 last-wins——事件面/审计面不动，模型可见流去冗余
  *  - append-only：本层仅暴露 append/verifyChain/deriveMessages/assertModelVisibleLogged
  */
 import { createHash } from 'node:crypto'
@@ -83,16 +84,33 @@ export class SessionLog {
     return null
   }
 
-  /** 投影：从日志前缀重建模型可见消息流（不依赖模型运行时状态） */
+  /**
+   * 投影：从日志前缀重建模型可见消息流（不依赖模型运行时状态）。
+   * 1.6-S1（D-23）同 id toolResult 收敛 last-wins：写类工具授权决策（runtime/toolResult）
+   * 与执行结果（plugin/toolResult）成对落链（M4 既有语义冻结——审计全量留痕不动），
+   * 模型可见流只保留最终结果（真实 provider 对重复 tool_call_id/tool_use_id 拒绝或未定义，
+   * 1.4 观察项经真实适配器落地升级为缺陷面）。id 缺席不收敛（hostRaw/无 id 载荷形态不变，
+   * golden ④ 投影语义兼容）；授权拒绝单条即唯一结果原样保留。适配器侧零改动（消费已收敛上游）。
+   */
   deriveMessages(upTo?: number): Array<{ role: string; [k: string]: unknown }> {
+    const scoped = upTo !== undefined ? this.events.slice(0, upTo) : this.events
+    const lastSeqById = new Map<string, number>()
+    for (const e of scoped) {
+      if (e.kind !== 'toolResult') continue
+      const id = (e.payload as { id?: unknown } | null)?.id
+      if (typeof id === 'string') lastSeqById.set(id, e.seq)
+    }
     const out: Array<{ role: string; [k: string]: unknown }> = []
-    for (const e of this.events) {
-      if (upTo !== undefined && e.seq >= upTo) break
+    for (const e of scoped) {
       if (e.kind === 'system') out.push({ role: 'system', content: e.payload })
       else if (e.kind === 'user') out.push({ role: 'user', content: e.payload })
       else if (e.kind === 'assistant') out.push({ role: 'assistant', content: e.payload })
       else if (e.kind === 'toolCall') out.push({ role: 'assistant', toolCall: e.payload })
-      else if (e.kind === 'toolResult') out.push({ role: 'toolResult', content: e.payload })
+      else if (e.kind === 'toolResult') {
+        const id = (e.payload as { id?: unknown } | null)?.id
+        if (typeof id === 'string' && lastSeqById.get(id) !== e.seq) continue // D-23：后续有同 id 最终结果，本条为授权中间记录
+        out.push({ role: 'toolResult', content: e.payload })
+      }
     }
     return out
   }

package/test/s36-host-tool-surface.spec.ts

@@ -0,0 +1,250 @@
+/**
+ * 1.6-S2 · 宿主工具面透传（S36）：RuntimeFacade toolList/toolCall 实装（D-25）
+ *
+ * 覆盖：
+ *  - toolList：声明面出站（name/description/parameters）+ **declaredSideEffect 不出站**（权限面
+ *    只进权限门红线）；未装配 = 空面（占位形态兼容）
+ *  - toolCall 权限门：readonly 执行 / write（显式声明与未声明 T-22 收口）一律 policy 拒绝
+ *    （CAR-E-HOST-AUTHZ——mcp-serve 无人审回路，deny-by-default）/ 未知工具显式报错 /
+ *    工具异常=成对错误结果（US-5 同款）
+ *  - 成对落链：actor='user'（宿主=用户代理）+ turnId='T0'（会话级能力面，sessionTurn 从 T1
+ *    起不冲突）+ id 序列 host-tc-N；verifyChain 全程完整；跨源同名 CAR-E-DUP 由 cli 装配层
+ *    fail-closed（spawn E2E 断言）
+ *  - spawn E2E：mcp-serve 真进程 stdio——tools/list 十面不变 + tool_list 真实出插件工具 +
+ *    tool_call readonly 执行 / write 拒绝 / verify 链完整（1.6-GO-5 生产调用点核查）
+ */
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { spawn } from 'node:child_process'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { createRuntimeFacade } from '../src/host/facade.ts'
+import { HostGateway } from '../src/host/hostGateway.ts'
+import { HOST_MAPPINGS, deriveSessionId } from '../src/host/mappings.ts'
+import type { ToolReg } from '../src/load/loader.ts'
+
+const CLI = join(dirname(fileURLToPath(import.meta.url)), '..', 'src', 'cli.ts')
+
+function makeTools(): Map<string, ToolReg> {
+  return new Map([
+    ['echo', {
+      name: 'echo', description: '回声工具', parameters: { type: 'object', properties: { text: { type: 'string' } } },
+      declaredSideEffect: 'readonly', run: async (args: Record<string, unknown>) => 'pong:' + String((args as { text?: string }).text ?? ''),
+    }],
+    ['write_file', { name: 'write_file', declaredSideEffect: 'write', run: async () => 'written' }],
+    ['stealth', { name: 'stealth', run: async () => 'undeclared' }], // 未声明 sideEffect——T-22 收口 write
+  ])
+}
+
+function gatewayWith(tools?: Map<string, ToolReg>) {
+  const facade = createRuntimeFacade({ profiles: new Map(HOST_MAPPINGS.map(h => [h.hostId, h])), ...(tools ? { tools } : {}) })
+  const gw = new HostGateway({ facade, audit: () => {} })
+  gw.registerHost({ hostId: 'claude-code', profile: HOST_MAPPINGS[0]!, transport: {} as never })
+  return { facade, gw }
+}
+
+test('S36: toolList 声明面出站——name/description/parameters 齐，declaredSideEffect 权限面不出站', async () => {
+  const { gw } = gatewayWith(makeTools())
+  await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-list' })
+  const r = await gw.handle('claude-code', 'tool_list', {})
+  assert.ok(r.ok)
+  const tools = (r.result as { tools: Array<Record<string, unknown>> }).tools
+  assert.equal(tools.length, 3)
+  const echo = tools.find(t => t.name === 'echo')!
+  assert.equal(echo.description, '回声工具')
+  assert.deepEqual(echo.parameters, { type: 'object', properties: { text: { type: 'string' } } })
+  assert.ok(tools.every(t => !('declaredSideEffect' in t)), '权限面不出站红线：sideEffect 信息不经宿主面外泄')
+  assert.ok(tools.every(t => !('run' in t)), '执行面不出站')
+})
+
+test('S36: toolList 未装配 = 空面（S12 占位形态兼容）', async () => {
+  const { gw } = gatewayWith()
+  await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-empty' })
+  const r = await gw.handle('claude-code', 'tool_list', {})
+  assert.ok(r.ok)
+  assert.deepEqual((r.result as { tools: unknown[] }).tools, [])
+})
+
+test('S36: toolCall readonly 执行——ok + 成对落链（actor=user/turnId=T0/id 序列）+ 链完整', async () => {
+  const { gw } = gatewayWith(makeTools())
+  const { sessionId } = await (await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-exec' })).result as { sessionId: string }
+  // gateway.handle 把 facade 返回值包进 {ok:true, result:<facade envelope>}——双层 ok 语义
+  const r1 = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'echo', arguments: { text: 'hi' } })
+  assert.ok(r1.ok)
+  assert.deepEqual(r1.result, { ok: true, result: 'pong:hi' })
+  const r2 = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'echo', arguments: { text: 'again' } })
+  assert.deepEqual(r2.result, { ok: true, result: 'pong:again' })
+  // 落链核查经 sessionExport（生产消费路径）：toolCall actor=user + turnId=T0 + id 序列 host-tc-N
+  const exp = await gw.handle('claude-code', 'session_export', { sessionId })
+  const bundle = (exp.result as { bundle: { files: Array<{ name: string; content: string }> } }).bundle
+  const eventsFile = bundle.files.find(f => f.name.endsWith('events.jsonl'))!
+  const events = eventsFile.content.trim().split('\n').map(l => JSON.parse(l)) as Array<{ actor: string; kind: string; turnId: string; payload: { id?: string; tool?: string } }>
+  const calls = events.filter(e => e.kind === 'toolCall')
+  assert.equal(calls.length, 2)
+  assert.ok(calls.every(e => e.actor === 'user' && e.turnId === 'T0'), 'D-25：宿主=用户代理，会话级能力面落 T0（sessionTurn 从 T1 起不冲突）')
+  assert.deepEqual(calls.map(e => e.payload.id), ['host-tc-1', 'host-tc-2'])
+  const verify = await gw.handle('claude-code', 'session_verify', { sessionId })
+  assert.deepEqual((verify.result as { ok: boolean }).ok, true, '工具调用成对落链后哈希链完整')
+})
+
+test('S36: toolCall write 类 policy 拒绝（显式声明 + 未声明 T-22 收口双路径）+ 拒绝落链', async () => {
+  const { gw } = gatewayWith(makeTools())
+  const { sessionId } = await (await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-deny' })).result as { sessionId: string }
+  const w = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'write_file' })
+  assert.ok(w.ok, 'handle 层 ok（facade 正常返回 envelope）')
+  assert.equal((w.result as { ok: boolean }).ok, false, 'facade 层 ok=false')
+  assert.match((w.result as { error?: string }).error!, /CAR-E-HOST-AUTHZ/)
+  const s = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'stealth' })
+  assert.equal((s.result as { ok: boolean }).ok, false, 'T-22：未声明 sideEffect 收口 write → 同样拒绝')
+  assert.match((s.result as { error?: string }).error!, /CAR-E-HOST-AUTHZ/)
+  // 拒绝也落链（runtime/toolResult authorization-denied）——审计全量留痕
+  const replay = await gw.handle('claude-code', 'session_replay', { sessionId })
+  const results = ((replay.result as { messages: Array<{ role: string; content?: unknown }> }).messages).filter(m => m.role === 'toolResult')
+  const denied = results.filter(m => (m.content as { error?: string }).error === 'authorization-denied')
+  assert.equal(denied.length, 2, '两次拒绝各落一条授权拒绝记录（单条即终态——D-23 不收敛）')
+  const verify = await gw.handle('claude-code', 'session_verify', { sessionId })
+  assert.deepEqual((verify.result as { ok: boolean }).ok, true)
+})
+
+test('S36: toolCall 未知工具显式报错 + 成对落链；工具异常=成对错误结果（US-5 同款）', async () => {
+  const tools = new Map<string, ToolReg>([['boom', { name: 'boom', declaredSideEffect: 'readonly', run: async () => { throw new Error('炸了') } }]])
+  const { gw } = gatewayWith(tools)
+  const { sessionId } = await (await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-err' })).result as { sessionId: string }
+  const unk = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'nope' })
+  assert.ok(unk.ok, 'handle 层正常返回')
+  assert.equal((unk.result as { ok: boolean }).ok, false, 'facade 层显式拒绝')
+  assert.match((unk.result as { error?: string }).error!, /unknown tool "nope"/)
+  const err = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'boom', arguments: {} })
+  assert.equal((err.result as { ok: boolean }).ok, false)
+  assert.match((err.result as { error?: string }).error!, /炸了/)
+  const replay = await gw.handle('claude-code', 'session_replay', { sessionId })
+  const results = ((replay.result as { messages: Array<{ role: string; content?: unknown }> }).messages).filter(m => m.role === 'toolResult')
+  assert.equal((results[0]!.content as { error?: string }).error, 'unknown tool "nope"')
+  assert.match((results[1]!.content as { error?: string }).error!, /炸了/, '工具异常=结果非中断（US-5/D5 语义同款）')
+})
+
+test('S36: 未装配 tool 面时 toolCall 显式报错（S13 静默占位退役——fail-visible）', async () => {
+  const { gw } = gatewayWith()
+  const { sessionId } = await (await gw.handle('claude-code', 'session_start', { hostSessionId: 's36-nobridge' })).result as { sessionId: string }
+  const r = await gw.handle('claude-code', 'tool_call', { sessionId, tool: 'echo' })
+  assert.equal(r.ok, false)
+  assert.match(r.error!, /tool 面未装配/)
+})
+
+// ==================== spawn E2E（生产调用点——1.6-GO-5） ====================
+
+function withTempDir(name: string, fn: (dir: string) => Promise<void> | void): Promise<void> {
+  const dir = mkdtempSync(join(tmpdir(), `car-s36-${name}-`))
+  try {
+    const r = fn(dir)
+    const cleanup = () => { try { rmSync(dir, { recursive: true, force: true }) } catch { /* 红线 8 */ } }
+    if (r instanceof Promise) return r.finally(cleanup)
+    cleanup()
+    return Promise.resolve()
+  } catch (e) {
+    try { rmSync(dir, { recursive: true, force: true }) } catch { /* 红线 8 */ }
+    throw e
+  }
+}
+
+function talk(requests: string[], plugin: string): Promise<{ outs: any[]; stderr: string }> {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, ['--experimental-transform-types', CLI, 'mcp-serve', '--plugin', plugin], { stdio: ['pipe', 'pipe', 'pipe'] })
+    let out = ''
+    let err = ''
+    child.stdout.on('data', d => { out += d })
+    child.stderr.on('data', d => { err += d })
+    child.on('error', reject)
+    child.on('exit', () => {
+      try { resolve({ outs: out.split('\n').filter(Boolean).map(l => JSON.parse(l)), stderr: err }) } catch (e) { reject(e) }
+    })
+    for (const r of requests) child.stdin.write(r + '\n')
+    child.stdin.end()
+  })
+}
+
+test('S36: spawn E2E——mcp-serve 真进程 tool_list 透传插件工具面 + tool_call 执行/拒绝 + verify 链完整', async () => {
+  await withTempDir('e2e', async dir => {
+    const plugin = join(dir, 'p.ts')
+    writeFileSync(plugin, [
+      'export const manifest = { name: "s36p", version: "1.0.0" }',
+      'export default function apply(api) {',
+      '  api.registerTool({ name: "echo", description: "回声", declaredSideEffect: "readonly", parameters: { type: "object", properties: { text: { type: "string" } } }, run: async (a) => "pong:" + a.text })',
+      '  api.registerTool({ name: "write_file", declaredSideEffect: "write", run: async () => "written" })',
+      '}',
+    ].join('\n'))
+    // 派生 id 进程内预计算（确定性派生——session_start 返回必须一致）
+    const sid = deriveSessionId('claude-code', 's36-e2e')
+    const { outs } = await talk([
+      JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }),
+      JSON.stringify({ jsonrpc: '2.0', id: 2, method: 'tools/call', params: { name: 'session_start', arguments: { hostSessionId: 's36-e2e' } } }),
+      JSON.stringify({ jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: 'tool_list', arguments: {} } }),
+      JSON.stringify({ jsonrpc: '2.0', id: 4, method: 'tools/call', params: { name: 'tool_call', arguments: { sessionId: sid, tool: 'echo', arguments: { text: 'hi' } } } }),
+      JSON.stringify({ jsonrpc: '2.0', id: 5, method: 'tools/call', params: { name: 'tool_call', arguments: { sessionId: sid, tool: 'write_file', arguments: {} } } }),
+      JSON.stringify({ jsonrpc: '2.0', id: 6, method: 'tools/call', params: { name: 'session_verify', arguments: { sessionId: sid } } }),
+      JSON.stringify({ jsonrpc: '2.0', id: 7, method: 'tools/call', params: { name: 'session_replay', arguments: { sessionId: sid } } }),
+    ], plugin)
+    assert.equal(outs[0].result.tools.length, 10, 'MCP tools/list 十面不变（宿主能力面与插件工具面分层）')
+    assert.equal(JSON.parse(outs[1].result.content[0].text).sessionId, sid, '确定性派生经真进程复核')
+    const listed = JSON.parse(outs[2].result.content[0].text) as { tools: Array<Record<string, unknown>> }
+    assert.deepEqual(listed.tools.map(t => t.name), ['echo', 'write_file'], 'tool_list 透传插件声明面')
+    assert.equal(listed.tools.find(t => t.name === 'echo')!.description, '回声')
+    assert.ok(listed.tools.every(t => !('declaredSideEffect' in t)), '权限面不出站经真进程协议面复核')
+    assert.deepEqual(JSON.parse(outs[3].result.content[0].text), { ok: true, result: 'pong:hi' }, 'readonly 工具经宿主面真实执行（facade envelope 经 stdio content 透出）')
+    const denied = JSON.parse(outs[4].result.content[0].text) as { ok: boolean; error?: string }
+    assert.equal(denied.ok, false, 'write 类工具 policy 拒绝（facade envelope——handle 层未抛错）')
+    assert.match(denied.error!, /CAR-E-HOST-AUTHZ/)
+    assert.equal(JSON.parse(outs[5].result.content[0].text).ok, true, '工具调用成对落链后哈希链完整')
+    const msgs = JSON.parse(outs[6].result.content[0].text).messages as Array<{ role: string; content?: unknown; toolCall?: unknown }>
+    assert.ok(msgs.some(m => m.role === 'assistant' && (m.toolCall as { tool?: string })?.tool === 'echo'), 'toolCall 落链经 replay 可见')
+    assert.deepEqual(msgs.filter(m => m.role === 'toolResult').map(m => m.content), [
+      { id: 'host-tc-1', result: 'pong:hi' },
+      { id: 'host-tc-2', error: 'authorization-denied', granted: false, mode: 'host-policy' },
+    ])
+  })
+})
+
+test('S36: spawn E2E——tool_call 带 sessionId 全链（readonly 执行 / write 拒绝 / verify 完整）', async () => {
+  await withTempDir('e2e2', async dir => {
+    const plugin = join(dir, 'p.ts')
+    writeFileSync(plugin, [
+      'export const manifest = { name: "s36p2", version: "1.0.0" }',
+      'export default function apply(api) {',
+      '  api.registerTool({ name: "echo", description: "回声", declaredSideEffect: "readonly", run: async (a) => "pong:" + a.text })',
+      '  api.registerTool({ name: "write_file", declaredSideEffect: "write", run: async () => "written" })',
+      '}',
+    ].join('\n'))
+    const start = JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: 'session_start', arguments: { hostSessionId: 's36-e2e2' } } })
+    const first = await talk([start], plugin)
+    const sid = JSON.parse(first.outs[0].result.content[0].text).sessionId as string
+    const { outs } = await talk([
+      JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: 'session_start', arguments: { hostSessionId: 's36-e2e2' } } }),
+      JSON.stringify({ jsonrpc: '2.0', id: 2, method: 'tools/call', params: { name: 'tool_call', arguments: { sessionId: sid, tool: 'echo', arguments: { text: 'hi' } } } }),
+      JSON.stringify({ jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: 'tool_call', arguments: { sessionId: sid, tool: 'write_file', arguments: {} } } }),
+    ], plugin)
+    assert.deepEqual(JSON.parse(outs[1].result.content[0].text), { ok: true, result: 'pong:hi' }, 'readonly 工具经宿主面真实执行（跨进程幂等派生会话）')
+    const denied2 = JSON.parse(outs[2].result.content[0].text) as { ok: boolean; error?: string }
+    assert.equal(denied2.ok, false, 'write 类工具 policy 拒绝经真进程协议面可达')
+    assert.match(denied2.error!, /CAR-E-HOST-AUTHZ/)
+  })
+})
+
+test('S36: spawn E2E——跨源同名工具 CAR-E-DUP fail-closed 启动中止（exit 1）', async () => {
+  await withTempDir('e2e3', async dir => {
+    const pA = join(dir, 'a.ts')
+    const pB = join(dir, 'b.ts')
+    for (const [p, name] of [[pA, 'a'], [pB, 'b']] as const) {
+      writeFileSync(p, `export const manifest = { name: "${name}", version: "1.0.0" }\nexport default function apply(api) { api.registerTool({ name: "dup_tool", declaredSideEffect: "readonly", run: async () => "${name}" }) }\n`)
+    }
+    const code = await new Promise<number>(resolve => {
+      const child = spawn(process.execPath, ['--experimental-transform-types', CLI, 'mcp-serve', '--plugin', pA, '--plugin', pB], { stdio: ['pipe', 'pipe', 'pipe'] })
+      let err = ''
+      child.stderr.on('data', d => { err += d })
+      child.on('exit', c => { resolve(c ?? -1) })
+      child.stdin.end()
+    })
+    assert.equal(code, 1, '禁静默覆盖：fail-closed 启动中止（1.4-S1 跨源同名纪律同款）')
+  })
+})

package/test/s37-projection-dedupe.spec.ts

@@ -0,0 +1,161 @@
+/**
+ * 1.6-S1 · 投影收敛（S37）：deriveMessages 同 id toolResult last-wins（D-23）
+ *
+ * 覆盖：
+ *  - runTurn confirm 全链：写类工具 granted 流——事件面两条 toolResult（runtime 授权 + plugin 执行，
+ *    M4 既有语义不动 = 审计全量留痕），投影单条且内容 = 执行结果；N1 快照一致性由构造保持
+ *  - denied 流：授权拒绝单条保留（唯一结果，原样投影）
+ *  - readonly 工具：单 plugin toolResult（无收敛对象——回归）
+ *  - id 缺席不收敛：无 id 载荷原样投影（golden ④ 投影语义兼容）；id 与无 id 混存互不影响
+ *  - 适配器出站体（1.6-GO-5 生产调用点核查）：收敛投影经 openai-compat / anthropic 双适配器
+ *    出站体无重复 tool 消息 / tool_result 块（真实 provider 重复 id 拒绝面出清）
+ */
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { SessionLog } from '../src/session/log.ts'
+import { runTurn, type ModelStep } from '../src/loop/stop.ts'
+import { createOpenAICompatAdapter, createAnthropicAdapter } from '../src/runtime-core/llm.ts'
+
+const dataLine = (obj: unknown) => `data: ${JSON.stringify(obj)}\n\n`
+const openaiSse = (finish: string) =>
+  dataLine({ choices: [{ delta: {}, finish_reason: finish }] }) + 'data: [DONE]\n\n'
+const sseResponse = (text: string) => {
+  const enc = new TextEncoder()
+  return new Response(new ReadableStream<Uint8Array>({ start(c) { c.enqueue(enc.encode(text)); c.close() } }),
+    { status: 200, headers: { 'content-type': 'text/event-stream' } })
+}
+const anthropicSse = (events: object[]) => events.map(dataLine).join('')
+const ANTHROPIC_STOP = [
+  { type: 'message_start', message: { role: 'assistant' } },
+  { type: 'message_delta', delta: { stop_reason: 'end_turn' } },
+  { type: 'message_stop' },
+]
+
+/** chatStep 消息映射同款复刻（deriveMessages → LlmRequest.messages 的唯一路径） */
+function toLlmMessages(log: SessionLog) {
+  return log.deriveMessages().map(m => ({
+    role: m.role as 'system' | 'user' | 'assistant' | 'toolResult',
+    content: (m as unknown as { toolCall?: unknown }).toolCall !== undefined
+      ? { toolCall: (m as unknown as { toolCall: unknown }).toolCall }
+      : m.content,
+  }))
+}
+
+test('S37: 写类工具 granted 流——事件面两条 toolResult（M4 语义不动），投影单条且为执行结果 + N1 一致', async () => {
+  const log = new SessionLog('s37-granted')
+  const steps: ModelStep[] = [
+    { stopReason: 'toolUse', toolCalls: [{ id: 'tc1', tool: 'save_note', args: { text: 'hi' } }] },
+    { stopReason: 'stop' },
+  ]
+  const r = await runTurn({
+    log, turnId: 'T1',
+    model: async () => steps.shift()!,
+    tools: new Map([['save_note', { declaredSideEffect: 'write', run: async () => '已保存' }]]),
+    preset: { mode: 'confirm', authorize: async () => true },
+  })
+  assert.equal(r.reason, 'completed')
+  // 事件面不动：授权决策（runtime）+ 执行结果（plugin）两条都落链（审计全量留痕）
+  const resultEvents = log.events.filter(e => e.kind === 'toolResult')
+  assert.equal(resultEvents.length, 2, 'M4 既有语义冻结：runtime 授权记录 + plugin 执行结果均落链')
+  assert.equal(resultEvents[0]!.actor, 'runtime')
+  assert.equal(resultEvents[1]!.actor, 'plugin')
+  // 投影收敛：同 id last-wins，模型可见流单条且为执行结果
+  const proj = log.deriveMessages().filter(m => m.role === 'toolResult')
+  assert.equal(proj.length, 1, 'D-23：授权中间记录不再进模型可见流')
+  assert.deepEqual(proj[0]!.content, { id: 'tc1', result: '已保存' })
+  // N1 快照一致性（runTurn 每步 snapshotModelRequest；收敛激活下重算同函数构造一致）
+  assert.deepEqual(log.assertModelVisibleLogged(), { ok: true })
+})
+
+test('S37: denied 流——授权拒绝单条保留（唯一结果原样投影）', async () => {
+  const log = new SessionLog('s37-denied')
+  const steps: ModelStep[] = [
+    { stopReason: 'toolUse', toolCalls: [{ id: 'tc2', tool: 'save_note', args: {} } ] },
+    { stopReason: 'stop' },
+  ]
+  await runTurn({
+    log, turnId: 'T1',
+    model: async () => steps.shift()!,
+    tools: new Map([['save_note', { declaredSideEffect: 'write', run: async () => '不应执行' }]]),
+    preset: { mode: 'confirm', authorize: async () => false },
+  })
+  assert.equal(log.events.filter(e => e.kind === 'toolResult').length, 1, '拒绝即终态：仅 runtime 授权拒绝事件')
+  const proj = log.deriveMessages().filter(m => m.role === 'toolResult')
+  assert.equal(proj.length, 1, '唯一结果原样保留（不误收敛）')
+  assert.equal((proj[0]!.content as { error?: string }).error, 'authorization-denied')
+})
+
+test('S37: readonly 工具单条 toolResult 无收敛对象（回归）', async () => {
+  const log = new SessionLog('s37-readonly')
+  const steps: ModelStep[] = [
+    { stopReason: 'toolUse', toolCalls: [{ id: 'tc3', tool: 'echo', args: {} }] },
+    { stopReason: 'stop' },
+  ]
+  await runTurn({
+    log, turnId: 'T1',
+    model: async () => steps.shift()!,
+    tools: new Map([['echo', { declaredSideEffect: 'readonly', run: async () => 'pong' }]]),
+    preset: { mode: 'readonly' },
+  })
+  assert.equal(log.events.filter(e => e.kind === 'toolResult').length, 1)
+  const proj = log.deriveMessages().filter(m => m.role === 'toolResult')
+  assert.equal(proj.length, 1)
+  assert.deepEqual(proj[0]!.content, { id: 'tc3', result: 'pong' })
+})
+
+test('S37: id 缺席不收敛——无 id 载荷原样投影（golden ④ 兼容），id 与无 id 混存互不影响', () => {
+  const log = new SessionLog('s37-idless')
+  log.append('runtime', 'toolResult', 'T1', { ok: 1 })
+  log.append('runtime', 'toolResult', 'T1', { ok: 2 })
+  log.append('plugin', 'toolResult', 'T1', { id: 'tc9', error: 'authorization-denied', granted: true })
+  log.append('plugin', 'toolResult', 'T1', { id: 'tc9', result: 'final' })
+  const proj = log.deriveMessages().filter(m => m.role === 'toolResult')
+  assert.equal(proj.length, 3, '无 id 两条原样保留 + 同 id 收敛为最后一条')
+  assert.deepEqual(proj[0]!.content, { ok: 1 })
+  assert.deepEqual(proj[1]!.content, { ok: 2 })
+  assert.deepEqual(proj[2]!.content, { id: 'tc9', result: 'final' })
+  // 前缀投影（upTo）语义：前缀内 last-wins 独立成立
+  const half = log.deriveMessages(3).filter(m => m.role === 'toolResult')
+  assert.equal(half.length, 3, '前缀 [0,3)：无 id 两条 + tc9 授权记录（前缀内 tc9 授权记录即终态）')
+  assert.deepEqual(half[2]!.content, { id: 'tc9', error: 'authorization-denied', granted: true })
+})
+
+test('S37: openai-compat 出站体——收敛后单 tool 消息（重复 tool_call_id 出清）', async () => {
+  const log = new SessionLog('s37-openai')
+  log.append('user', 'user', 'T1', '查天气')
+  log.append('model', 'toolCall', 'T1', { id: 'tc1', tool: 'weather', args: { city: '北京' } })
+  log.append('runtime', 'toolResult', 'T1', { id: 'tc1', error: 'authorization-denied', granted: true, mode: 'confirm' })
+  log.append('plugin', 'toolResult', 'T1', { id: 'tc1', result: '晴 25 度' })
+  const seen: RequestInit[] = []
+  const adapter = createOpenAICompatAdapter({
+    baseUrl: 'https://api.test',
+    fetchImpl: (async (_u: string | URL, init?: RequestInit) => { seen.push(init!); return sseResponse(openaiSse('stop')) }) as typeof fetch,
+  })
+  for await (const _ of adapter.chat({ model: 'm', messages: toLlmMessages(log), tools: [] })) void _
+  const body = JSON.parse(seen[0]!.body as string)
+  const toolMsgs = body.messages.filter((m: { role: string }) => m.role === 'tool')
+  assert.equal(toolMsgs.length, 1, '1.6-GO-5：出站体单 tool 消息（收敛前为两条）')
+  assert.equal(toolMsgs[0].tool_call_id, 'tc1')
+  assert.equal(toolMsgs[0].content, JSON.stringify('晴 25 度'), '内容 = 执行结果（非授权中间记录）')
+})
+
+test('S37: anthropic 出站体——收敛后单 tool_result 块（重复 tool_use_id 400 面出清）', async () => {
+  const log = new SessionLog('s37-anthropic')
+  log.append('user', 'user', 'T1', '查天气')
+  log.append('model', 'toolCall', 'T1', { id: 'toolu_1', tool: 'weather', args: { city: '北京' } })
+  log.append('runtime', 'toolResult', 'T1', { id: 'toolu_1', error: 'authorization-denied', granted: true, mode: 'confirm' })
+  log.append('plugin', 'toolResult', 'T1', { id: 'toolu_1', result: '晴 25 度' })
+  const seen: RequestInit[] = []
+  const adapter = createAnthropicAdapter({
+    baseUrl: 'https://api.test',
+    fetchImpl: (async (_u: string | URL, init?: RequestInit) => { seen.push(init!); return sseResponse(anthropicSse(ANTHROPIC_STOP)) }) as typeof fetch,
+  })
+  for await (const _ of adapter.chat({ model: 'm', messages: toLlmMessages(log), tools: [] })) void _
+  const body = JSON.parse(seen[0]!.body as string)
+  const blocks = body.messages.flatMap((m: { content: unknown }) =>
+    Array.isArray(m.content) ? m.content : []).filter((b: { type: string }) => b.type === 'tool_result')
+  assert.equal(blocks.length, 1, '1.6-GO-5：出站体单 tool_result 块（重复 tool_use_id 会被 provider 400）')
+  assert.equal(blocks[0].tool_use_id, 'toolu_1')
+  assert.equal(blocks[0].content, JSON.stringify('晴 25 度'))
+  assert.ok(!('is_error' in blocks[0]), '执行结果非错误形态')
+})

package/test/s38-config-jiti.spec.ts

@@ -0,0 +1,116 @@
+/**
+ * 1.6-S3 · jiti 载体（S38）：car.config.ts 经 jiti 自包含转译（D-24）
+ *
+ * 覆盖：
+ *  - 非可擦除语法（enum）真载——1.5 D-22 原生类型剥离不可表达的 transform-only 形态，
+ *    erasable-only 预检登记项随之出清（被取代）
+ *  - strip-only spawn 差分（1.6-GO-5 生产调用点）：`--experimental-strip-types`（无 transform）
+ *    下 enum 配置经 jiti 真载成功 + 原生 import 同文件失败（负控——证明语法确属非可擦除、
+ *    jiti 是载体）；同进程实测首载时延（登记口径，无硬门禁，CI 宽上界防抖）
+ *  - CLI 真路径：car run 于 enum 配置目录——配置经 jiti 装载生效（CAR-E-LLM-CONFIG 引导 =
+ *    配置解析通过、模型未配；若配置载体失败应为 CAR-E-CONFIG）
+ *  - s35 存量零改动全量回归 = 载体迁移验收线（interoptDefault 显式关：jiti 缺省 true 会把
+ *    无 default 模块的 exports 整体当 default，「缺 default export」校验即失效）
+ */
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+import { spawn } from 'node:child_process'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, dirname } from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+import { warmCarConfig, loadCarConfig } from '../src/load/config.ts'
+
+const CLI = join(dirname(fileURLToPath(import.meta.url)), '..', 'src', 'cli.ts')
+const SRC_CONFIG = join(dirname(fileURLToPath(import.meta.url)), '..', 'src', 'load', 'config.ts')
+
+function withTempDir(name: string, fn: (dir: string) => Promise<void> | void): Promise<void> {
+  const dir = mkdtempSync(join(tmpdir(), `car-s38-${name}-`))
+  try {
+    const r = fn(dir)
+    const cleanup = () => { try { rmSync(dir, { recursive: true, force: true }) } catch { /* 红线 8 */ } }
+    if (r instanceof Promise) return r.finally(cleanup)
+    cleanup()
+    return Promise.resolve()
+  } catch (e) {
+    try { rmSync(dir, { recursive: true, force: true }) } catch { /* 红线 8 */ }
+    throw e
+  }
+}
+
+test('S38: 非可擦除语法（enum）经 jiti 真载——D-22 原生类型剥离不可表达形态', async () => {
+  await withTempDir('enum', async dir => {
+    writeFileSync(join(dir, 'car.config.ts'), [
+      `export enum LlmMode { full = 'full-model' }`,
+      `export default { llm: { model: LlmMode.full } }`,
+    ].join('\n'))
+    await warmCarConfig({ cwd: dir })
+    const r = loadCarConfig({ cwd: dir })
+    assert.equal(r.error, undefined)
+    assert.equal(r.config.llm?.model, 'full-model', 'enum 值经 jiti 转译进配置')
+  })
+})
+
+test('S38: strip-only spawn 差分——原生 import enum 载体失败（负控）+ jiti 真载成功 + 首载时延实测', async () => {
+  await withTempDir('strip', async dir => {
+    const configPath = join(dir, 'car.config.ts')
+    writeFileSync(configPath, [
+      `export enum LlmMode { full = 'strip-model' }`,
+      `export default { llm: { model: LlmMode.full } }`,
+    ].join('\n'))
+    // 夹具自身仅可擦除语法（strip-only 可载）；非可擦除只出现在被测配置里
+    const fixture = join(dir, 'fixture.ts')
+    writeFileSync(fixture, [
+      `import { warmCarConfig, loadCarConfig } from ${JSON.stringify(pathToFileURL(SRC_CONFIG).href)}`,
+      `import { pathToFileURL as toURL } from 'node:url'`,
+      `const configPath = process.argv[2]!`,
+      `let nativeError = ''`,
+      `try { await import(toURL(configPath).href) } catch (e) { nativeError = String((e as Error).message) }`,
+      `if (!nativeError) { console.log('NATIVE_UNEXPECTEDLY_OK'); process.exit(1) }`,
+      `const t0 = performance.now()`,
+      `await warmCarConfig({ explicitPath: configPath })`,
+      `const elapsed = Math.round(performance.now() - t0)`,
+      `const r = loadCarConfig({ explicitPath: configPath })`,
+      `if (r.error) { console.log('JITI_FAIL ' + r.error); process.exit(1) }`,
+      `console.log('OK model=' + r.config.llm?.model + ' firstLoadMs=' + elapsed + ' nativeRejected=' + nativeError.slice(0, 60).replace(/\\n/g, ' '))`,
+    ].join('\n'))
+    // --experimental-strip-types：仅类型剥离无转译（22.19+ 可用；enum 属 transform-only 形态）
+    const { code, stdout } = await new Promise<{ code: number | null; stdout: string }>(resolve => {
+      const child = spawn(process.execPath, ['--experimental-strip-types', fixture, configPath], { stdio: ['ignore', 'pipe', 'pipe'] })
+      let out = ''
+      child.stdout.on('data', d => { out += d })
+      child.on('exit', c => resolve({ code: c, stdout: out }))
+    })
+    assert.equal(code, 0, 'strip-only 环境下 jiti 真载 enum 配置')
+    const m = /OK model=(\S+) firstLoadMs=(\d+) nativeRejected=(.+)/.exec(stdout.trim())!
+    assert.equal(m[1], 'strip-model')
+    assert.ok(m[2] !== undefined, '首载时延实测出值')
+    console.log(`    [登记] car.config.ts jiti 首载时延（spawn 冷启，本机实跑）：${m[2]} ms`)
+    assert.ok(Number(m[2]) < 15_000, '首载时延宽上界（CI 防抖；真实数值进收口报告）')
+    assert.ok(m[3]!.length > 0, '负控：原生 import 对非可擦除语法显式失败——jiti 是载体而非原生剥离')
+  })
+})
+
+test('S38: CLI 真路径——car run 于 enum 配置目录：配置经 jiti 装载生效（模型未配引导而非配置报错）', async () => {
+  await withTempDir('cli', async dir => {
+    writeFileSync(join(dir, 'car.config.ts'), [
+      `export enum LlmMode { full = 'full-model' }`,
+      `export default { llm: { model: LlmMode.full } }`,
+    ].join('\n'))
+    const plugin = join(dir, 'noop.ts')
+    writeFileSync(plugin, [
+      `export const manifest = { name: "s38p", version: "1.0.0" }`,
+      `export default function apply(api) { api.registerTool({ name: "noop", declaredSideEffect: "readonly", run: async () => "ok" }) }`,
+    ].join('\n'))
+    const { code, output } = await new Promise<{ code: number | null; output: string }>(resolve => {
+      const child = spawn(process.execPath, ['--experimental-transform-types', CLI, 'run', plugin], { cwd: dir, stdio: ['ignore', 'pipe', 'pipe'] })
+      let out = ''
+      child.stdout.on('data', d => { out += d })
+      child.stderr.on('data', d => { out += d })
+      child.on('exit', c => resolve({ code: c, output: out }))
+    })
+    assert.equal(code, 2, 'D-13：无凭据/端点 → exit 2 显式引导')
+    assert.match(output, /CAR-E-LLM-CONFIG/, '配置经 jiti 解析通过（enum 值进 llm.model）走到模型就绪检查')
+    assert.doesNotMatch(output, /CAR-E-CONFIG/, '配置载体本身零错误')
+  })
+})