@quandev104/pi-style 0.1.5 → 0.1.6

package/extension-src/pi-style/pi/compatibility-probe.ts

@@ -25,142 +25,130 @@ import {
 	nextGeneration,
 } from "./compatibility-registry.js";
 
-const PI_VERSION_RANGE = ">=0.83.0 <0.84.0";
-const TRUSTED_PI_VERSION = "0.83.0";
-const reportStates = new WeakMap<
-	object,
-	{ records: CompatibilityRecord[]; toolOwner: ReturnType<typeof createToolDecorationOwner> | undefined }
->();
-// These fingerprints are coupled to the installed 0.83.0 package source. A matching
-// name/arity/hash is evidence of the shipped native method, not a cryptographic proof:
-// code loaded before this module could spoof the same function source. We therefore
-// fail closed on every unrecorded Pi build and never use module-load capture as trust.
-export const TRUSTED_NATIVE_FINGERPRINTS: Readonly<Record<string, string>> = Object.freeze({
-	"native-assistant-message:render": "2a39243f",
-	"native-assistant-message:updateContent": "4a2f15ff",
-	"native-compaction-message:updateDisplay": "f8c44e78",
-	"native-branch-message:updateDisplay": "415d57b7",
-	"native-skill-message:updateDisplay": "48099ea6",
-	"native-custom-message:rebuild": "76ae2e3a",
-	"tool-call-renderer:getCallRenderer": "951ea0e0",
-	"tool-result-renderer:getResultRenderer": "8a25cd71",
-	"native-bash-execution:render": "a5b5abca",
-});
+/**
+ * Certification is identity-first, never version-pinned: a surface is certified
+ * when the runtime method (or class constructor, for additive installs) matches a
+ * recorded name/arity/source-fingerprint identity. Pi version strings are
+ * informational only (diagnostics, doctor output) and never gate installation — a
+ * version drift that preserves the native identity keeps working, and a drift that
+ * changes the identity degrades that single surface to its native fallback while
+ * every other surface continues.
+ */
+export const SUPPORTED_VERSION_RANGE = ">=0.83.0 <0.85.0";
+export const SUPPORTED_PI_VERSIONS: readonly string[] = Object.freeze(["0.83.0", "0.84.0"]);
+
+/** A recorded native identity for one certified surface. */
+export interface KnownNativeIdentity {
+	readonly name: string;
+	readonly arity: number;
+	readonly fingerprint: string;
+	/** Pi versions known to carry this exact identity (informational only). */
+	readonly versions: readonly string[];
+}
 
-export const CERTIFICATION_TABLE = Object.freeze({
-	"0.83.0": Object.freeze({
-		"native-assistant-message:render": Object.freeze({
-			feature: "messages",
-			subtype: "native-assistant-message",
-			target: AssistantMessageComponent.prototype,
-			method: "render",
-			writable: true,
-			configurable: true,
+/**
+ * Registry of recorded native identities per surface. A surface matches when the
+ * runtime function has the same name, arity, and source fingerprint as one of its
+ * identities; the `versions` list only documents where that identity was observed.
+ * A matching name/arity/hash is evidence of the shipped native method, not a
+ * cryptographic proof: code loaded before this module could spoof the same
+ * function source. Unrecorded identities therefore fall back natively per surface.
+ */
+export const KNOWN_NATIVE_IDENTITIES: Readonly<Record<string, readonly KnownNativeIdentity[]>> = Object.freeze({
+	"native-assistant-message:render": Object.freeze([
+		Object.freeze({
 			name: "render",
 			arity: 1,
-			fingerprint: TRUSTED_NATIVE_FINGERPRINTS["native-assistant-message:render"],
-			adapterId: "message-prefix-osc133-v1",
-			status: "certified" as const,
+			fingerprint: "2a39243f",
+			versions: Object.freeze(["0.83.0", "0.84.0"]),
 		}),
-		"tool-call-renderer:getCallRenderer": Object.freeze({
-			feature: "tools",
-			subtype: "tool-call-renderer",
-			target: ToolExecutionComponent.prototype,
-			method: "getCallRenderer",
-			writable: true,
-			configurable: true,
-			name: "getCallRenderer",
-			arity: 0,
-			fingerprint: TRUSTED_NATIVE_FINGERPRINTS["tool-call-renderer:getCallRenderer"],
-			adapterId: "tool-renderer-component-v1",
-			status: "certified" as const,
-		}),
-		"tool-result-renderer:getResultRenderer": Object.freeze({
-			feature: "tools",
-			subtype: "tool-result-renderer",
-			target: ToolExecutionComponent.prototype,
-			method: "getResultRenderer",
-			writable: true,
-			configurable: true,
-			name: "getResultRenderer",
-			arity: 0,
-			fingerprint: TRUSTED_NATIVE_FINGERPRINTS["tool-result-renderer:getResultRenderer"],
-			adapterId: "tool-renderer-component-v1",
-			status: "certified" as const,
+	]),
+	"native-assistant-message:updateContent": Object.freeze([
+		Object.freeze({
+			name: "updateContent",
+			arity: 1,
+			fingerprint: "4a2f15ff",
+			versions: Object.freeze(["0.83.0"]),
 		}),
-		"native-assistant-message:updateContent": Object.freeze({
-			feature: "messages",
-			subtype: "native-assistant-message",
-			target: AssistantMessageComponent.prototype,
-			method: "updateContent",
-			writable: true,
-			configurable: true,
+		// 0.84.0 adds an `isStreaming` default parameter and per-part markdown
+		// transforms; default parameters do not count toward Function.length, so
+		// the arity stays 1 while the source fingerprint changes.
+		Object.freeze({
 			name: "updateContent",
 			arity: 1,
-			fingerprint: TRUSTED_NATIVE_FINGERPRINTS["native-assistant-message:updateContent"],
-			adapterId: "message-thinking-collapse-v1",
-			status: "certified" as const,
+			fingerprint: "d2114491",
+			versions: Object.freeze(["0.84.0"]),
 		}),
-		"native-compaction-message:updateDisplay": Object.freeze({
-			feature: "messages",
-			subtype: "native-compaction-message",
-			target: CompactionSummaryMessageComponent.prototype,
-			method: "updateDisplay",
-			writable: true,
-			configurable: true,
-			adapterId: "message-block-boxed-v1",
-			status: "certified" as const,
+	]),
+	"native-compaction-message:updateDisplay": Object.freeze([
+		Object.freeze({
+			name: "updateDisplay",
+			arity: 0,
+			fingerprint: "f8c44e78",
+			versions: Object.freeze(["0.83.0", "0.84.0"]),
 		}),
-		"native-branch-message:updateDisplay": Object.freeze({
-			feature: "messages",
-			subtype: "native-branch-message",
-			target: BranchSummaryMessageComponent.prototype,
-			method: "updateDisplay",
-			writable: true,
-			configurable: true,
-			adapterId: "message-block-boxed-v1",
-			status: "certified" as const,
+	]),
+	"native-branch-message:updateDisplay": Object.freeze([
+		Object.freeze({
+			name: "updateDisplay",
+			arity: 0,
+			fingerprint: "415d57b7",
+			versions: Object.freeze(["0.83.0", "0.84.0"]),
 		}),
-		"native-skill-message:updateDisplay": Object.freeze({
-			feature: "messages",
-			subtype: "native-skill-message",
-			target: SkillInvocationMessageComponent.prototype,
-			method: "updateDisplay",
-			writable: true,
-			configurable: true,
-			adapterId: "message-block-boxed-v1",
-			status: "certified" as const,
+	]),
+	"native-skill-message:updateDisplay": Object.freeze([
+		Object.freeze({
+			name: "updateDisplay",
+			arity: 0,
+			fingerprint: "48099ea6",
+			versions: Object.freeze(["0.83.0", "0.84.0"]),
 		}),
-		"native-custom-message:rebuild": Object.freeze({
-			feature: "messages",
-			subtype: "native-custom-message",
-			target: CustomMessageComponent.prototype,
-			method: "rebuild",
-			writable: true,
-			configurable: true,
-			adapterId: "message-block-boxed-v1",
-			status: "certified" as const,
+	]),
+	"native-custom-message:rebuild": Object.freeze([
+		Object.freeze({
+			name: "rebuild",
+			arity: 0,
+			fingerprint: "76ae2e3a",
+			versions: Object.freeze(["0.83.0", "0.84.0"]),
+		}),
+	]),
+	"tool-call-renderer:getCallRenderer": Object.freeze([
+		Object.freeze({
+			name: "getCallRenderer",
+			arity: 0,
+			fingerprint: "951ea0e0",
+			versions: Object.freeze(["0.83.0", "0.84.0"]),
 		}),
-		"native-bash-execution:render": Object.freeze({
-			feature: "tools",
-			subtype: "native-bash-execution",
-			target: BashExecutionComponent.prototype,
-			method: "render",
-			writable: true,
-			configurable: true,
+	]),
+	"tool-result-renderer:getResultRenderer": Object.freeze([
+		Object.freeze({
+			name: "getResultRenderer",
+			arity: 0,
+			fingerprint: "8a25cd71",
+			versions: Object.freeze(["0.83.0", "0.84.0"]),
+		}),
+	]),
+	"native-bash-execution:render": Object.freeze([
+		Object.freeze({
 			// The additive render patch is certified by the class constructor identity
 			// (name/arity/source fingerprint): the class defines no own `render`, so
 			// the installed own method is the only one and the inherited Container
 			// render is the native fallback.
 			name: "BashExecutionComponent",
 			arity: 2,
-			fingerprint: TRUSTED_NATIVE_FINGERPRINTS["native-bash-execution:render"],
-			adapterId: "bash-execution-box-v1",
-			status: "certified" as const,
+			fingerprint: "a5b5abca",
+			versions: Object.freeze(["0.83.0", "0.84.0"]),
 		}),
-	}),
+	]),
 });
 
+/** Primary (first-recorded) fingerprint per surface, for diagnostics and back-compat. */
+export const TRUSTED_NATIVE_FINGERPRINTS: Readonly<Record<string, string>> = Object.freeze(
+	Object.fromEntries(
+		Object.entries(KNOWN_NATIVE_IDENTITIES).map(([key, identities]) => [key, identities[0]!.fingerprint]),
+	),
+);
+
 export interface CompatibilityDescriptorSnapshot {
 	readonly kind: "data" | "accessor";
 	readonly value?: unknown;
@@ -185,7 +173,7 @@ export interface CompatibilityRecordSnapshot {
 
 export interface CompatibilityProbeReport {
 	attemptedVersion: string;
-	matchedCertifiedVersion: string | undefined;
+	supportedVersions: readonly string[];
 	certificationTable: typeof CERTIFICATION_TABLE;
 	piVersion: string;
 	versionRange: string;
@@ -196,9 +184,8 @@ export interface CompatibilityProbeReport {
 	certification: readonly {
 		readonly version: string;
 		readonly attemptedVersion: string;
-		readonly matchedCertifiedVersion: string | undefined;
-		readonly expected: unknown;
-		readonly actualPreinstall: CompatibilityDescriptorSnapshot | undefined;
+		readonly matchedIdentity: KnownNativeIdentity | undefined;
+		readonly knownIdentities: readonly KnownNativeIdentity[];
 		readonly feature: CompatibilityRecord["feature"];
 		readonly subtype: CompatibilityRecord["subtype"];
 		readonly target: object;
@@ -210,6 +197,7 @@ export interface CompatibilityProbeReport {
 		readonly adapterId: string | undefined;
 		readonly status: "certified" | "native-fallback";
 		readonly fallbackReason?: string;
+		readonly actualPreinstall: CompatibilityDescriptorSnapshot | undefined;
 	}[];
 	getRuntimeDiagnostics: () => ReadonlyMap<string, number>;
 	getFinalDiagnostics: () => Readonly<import("../features/tools/index.js").ToolDiagnosticArchive> | undefined;
@@ -243,118 +231,38 @@ export function fingerprint(value: unknown): string | undefined {
 	return hash.toString(16).padStart(8, "0");
 }
 
-function trustedNativeIdentity(spec: TargetSpec, piVersion: string | undefined): unknown {
-	if (piVersion !== TRUSTED_PI_VERSION) return undefined;
+function knownIdentityMatches(spec: TargetSpec, value: unknown): KnownNativeIdentity | undefined {
+	if (typeof value !== "function") return undefined;
+	const hash = fingerprint(value);
+	const key = `${spec.subtype}:${spec.method}`;
+	return (KNOWN_NATIVE_IDENTITIES[key] ?? []).find(
+		(identity) => value.name === identity.name && value.length === identity.arity && hash === identity.fingerprint,
+	);
+}
+
+function matchedNativeIdentity(spec: TargetSpec): KnownNativeIdentity | undefined {
 	if (spec.kind === "add-method") {
 		// Additive install: the prototype must not already own the method (it is
-		// inherited), the class constructor identity must match the recorded build,
+		// inherited), the class constructor identity must match a recorded build,
 		// and the inherited method becomes the native fallback for the delegate.
 		if (Object.getOwnPropertyDescriptor(spec.target, spec.method)) return undefined;
 		const ctor = Object.getOwnPropertyDescriptor(spec.target, "constructor")?.value;
-		const key = `${spec.subtype}:${spec.method}`;
-		if (
-			typeof ctor !== "function" ||
-			ctor.name !== (spec.identityName ?? spec.method) ||
-			ctor.length !== (spec.arity ?? 0) ||
-			fingerprint(ctor) !== TRUSTED_NATIVE_FINGERPRINTS[key]
-		)
-			return undefined;
-		const inherited = Object.getOwnPropertyDescriptor(Object.getPrototypeOf(spec.target), spec.method)?.value;
-		return typeof inherited === "function" ? inherited : undefined;
+		return knownIdentityMatches(spec, ctor);
 	}
 	const descriptor = Object.getOwnPropertyDescriptor(spec.target, spec.method);
-	const value = descriptor?.value;
-	const key = `${spec.subtype}:${spec.method}`;
-	const expectedArity = spec.arity ?? (spec.method === "render" || spec.method === "updateContent" ? 1 : 0);
-	if (
-		descriptor?.writable !== true ||
-		descriptor.configurable !== true ||
-		typeof value !== "function" ||
-		value.name !== (spec.identityName ?? spec.method) ||
-		value.length !== expectedArity ||
-		fingerprint(value) !== TRUSTED_NATIVE_FINGERPRINTS[key]
-	)
-		return undefined;
-	return value;
+	if (descriptor?.writable !== true || descriptor.configurable !== true) return undefined;
+	return knownIdentityMatches(spec, descriptor.value);
 }
 
-export const targetSpecs: readonly TargetSpec[] = [
-	{
-		feature: "messages",
-		subtype: "native-assistant-message",
-		target: AssistantMessageComponent.prototype,
-		method: "render",
-		adapterId: "message-prefix-osc133-v1",
-		status: "certified",
-	},
-	{
-		feature: "messages",
-		subtype: "native-assistant-message",
-		target: AssistantMessageComponent.prototype,
-		method: "updateContent",
-		adapterId: "message-thinking-collapse-v1",
-		status: "certified",
-	},
-	{
-		feature: "messages",
-		subtype: "native-compaction-message",
-		target: CompactionSummaryMessageComponent.prototype,
-		method: "updateDisplay",
-		adapterId: "message-block-boxed-v1",
-		status: "certified",
-	},
-	{
-		feature: "messages",
-		subtype: "native-branch-message",
-		target: BranchSummaryMessageComponent.prototype,
-		method: "updateDisplay",
-		adapterId: "message-block-boxed-v1",
-		status: "certified",
-	},
-	{
-		feature: "messages",
-		subtype: "native-skill-message",
-		target: SkillInvocationMessageComponent.prototype,
-		method: "updateDisplay",
-		adapterId: "message-block-boxed-v1",
-		status: "certified",
-	},
-	{
-		feature: "messages",
-		subtype: "native-custom-message",
-		target: CustomMessageComponent.prototype,
-		method: "rebuild",
-		adapterId: "message-block-boxed-v1",
-		status: "certified",
-	},
-	{
-		feature: "tools",
-		subtype: "tool-call-renderer",
-		target: ToolExecutionComponent.prototype,
-		method: "getCallRenderer",
-		adapterId: "tool-renderer-component-v1",
-		status: "certified",
-	},
-	{
-		feature: "tools",
-		subtype: "tool-result-renderer",
-		target: ToolExecutionComponent.prototype,
-		method: "getResultRenderer",
-		adapterId: "tool-renderer-component-v1",
-		status: "certified",
-	},
-	{
-		feature: "tools",
-		subtype: "native-bash-execution",
-		target: BashExecutionComponent.prototype,
-		method: "render",
-		kind: "add-method",
-		identityName: "BashExecutionComponent",
-		arity: 2,
-		adapterId: "bash-execution-box-v1",
-		status: "certified",
-	},
-];
+function trustedNativeIdentity(spec: TargetSpec): unknown {
+	const identity = matchedNativeIdentity(spec);
+	if (!identity) return undefined;
+	if (spec.kind === "add-method") {
+		const inherited = Object.getOwnPropertyDescriptor(Object.getPrototypeOf(spec.target), spec.method)?.value;
+		return typeof inherited === "function" ? inherited : undefined;
+	}
+	return Object.getOwnPropertyDescriptor(spec.target, spec.method)?.value;
+}
 
 export interface PiVersionResolution {
 	resolvePackageEntry?: (packageName: string) => string;
@@ -426,6 +334,7 @@ function descriptorSnapshot(descriptor: PropertyDescriptor | undefined): Compati
 function certificationRecord(
 	spec: TargetSpec,
 	attemptedVersion: string | undefined,
+	matchedIdentity: KnownNativeIdentity | undefined,
 	evidence = Object.getOwnPropertyDescriptor(spec.target, spec.method),
 ) {
 	const descriptor = evidence;
@@ -433,9 +342,8 @@ function certificationRecord(
 	return {
 		version: attemptedVersion ?? "unknown",
 		attemptedVersion: attemptedVersion ?? "unknown",
-		matchedCertifiedVersion: attemptedVersion === TRUSTED_PI_VERSION ? TRUSTED_PI_VERSION : undefined,
-		expected: undefined,
-		actualPreinstall: descriptorSnapshot(descriptor),
+		matchedIdentity,
+		knownIdentities: KNOWN_NATIVE_IDENTITIES[`${spec.subtype}:${spec.method}`] ?? [],
 		feature: spec.feature,
 		subtype: spec.subtype,
 		target: spec.target,
@@ -450,10 +358,6 @@ function certificationRecord(
 	};
 }
 
-function versionInRange(version: string | undefined): boolean {
-	return version === TRUSTED_PI_VERSION;
-}
-
 function shape(spec: TargetSpec): boolean {
 	const descriptor = Object.getOwnPropertyDescriptor(spec.target, spec.method);
 	// Additive installs need an unowned slot (the method is inherited); every
@@ -491,7 +395,7 @@ function createFallbackRecord(
 		method: spec.method,
 		originalIdentity: Reflect.get(spec.target, spec.method),
 		piVersion: piVersion ?? "unknown",
-		versionRange: PI_VERSION_RANGE,
+		versionRange: SUPPORTED_VERSION_RANGE,
 		shape: "unsupported",
 		diagnostic: reason,
 		generation,
@@ -500,10 +404,10 @@ function createFallbackRecord(
 	};
 }
 
-function probeDiagnostic(spec: TargetSpec, piVersion: string | undefined, identity: unknown): string {
-	if (!versionInRange(piVersion)) return "Pi version is unknown or outside the recorded 0.83.0 support build";
+function probeDiagnostic(spec: TargetSpec, identity: unknown): string {
 	if (!shape(spec)) return "target method shape is not an own writable/configurable function";
-	if (identity === undefined) return "recorded 0.83.0 native fingerprint, name, or arity did not match";
+	if (identity === undefined)
+		return "runtime native identity (name, arity, or source fingerprint) matched no recorded Pi surface";
 	return "exact native identity verified; certified guarded decoration enabled";
 }
 
@@ -528,8 +432,8 @@ function probeSpec(options: {
 	toolOwner: ReturnType<typeof createToolDecorationOwner> | undefined;
 }) {
 	const { spec, piVersion, generation, markers, config, toolOwner, messageSnapshot } = options;
-	const identity = trustedNativeIdentity(spec, piVersion);
-	const diagnostic = probeDiagnostic(spec, piVersion, identity);
+	const identity = trustedNativeIdentity(spec);
+	const diagnostic = probeDiagnostic(spec, identity);
 	const disabled = surfaceDisabled(spec, config);
 	if (disabled) {
 		const reason = "native fallback: surface disabled by normalized configuration";
@@ -541,8 +445,8 @@ function probeSpec(options: {
 		target: spec.target,
 		method: spec.method,
 		piVersion: piVersion ?? "unknown",
-		versionRange: PI_VERSION_RANGE,
-		shape: identity !== undefined && versionInRange(piVersion) && shape(spec),
+		versionRange: SUPPORTED_VERSION_RANGE,
+		shape: identity !== undefined && shape(spec),
 		generation,
 		expectedIdentity: identity,
 		hasExpectedIdentity: true,
@@ -578,6 +482,153 @@ function probeSpec(options: {
 	};
 }
 
+export const targetSpecs: readonly TargetSpec[] = [
+	{
+		feature: "messages",
+		subtype: "native-assistant-message",
+		target: AssistantMessageComponent.prototype,
+		method: "render",
+		adapterId: "message-prefix-osc133-v1",
+		status: "certified",
+	},
+	{
+		feature: "messages",
+		subtype: "native-assistant-message",
+		target: AssistantMessageComponent.prototype,
+		method: "updateContent",
+		adapterId: "message-thinking-collapse-v1",
+		status: "certified",
+	},
+	{
+		feature: "messages",
+		subtype: "native-compaction-message",
+		target: CompactionSummaryMessageComponent.prototype,
+		method: "updateDisplay",
+		adapterId: "message-block-boxed-v1",
+		status: "certified",
+	},
+	{
+		feature: "messages",
+		subtype: "native-branch-message",
+		target: BranchSummaryMessageComponent.prototype,
+		method: "updateDisplay",
+		adapterId: "message-block-boxed-v1",
+		status: "certified",
+	},
+	{
+		feature: "messages",
+		subtype: "native-skill-message",
+		target: SkillInvocationMessageComponent.prototype,
+		method: "updateDisplay",
+		adapterId: "message-block-boxed-v1",
+		status: "certified",
+	},
+	{
+		feature: "messages",
+		subtype: "native-custom-message",
+		target: CustomMessageComponent.prototype,
+		method: "rebuild",
+		adapterId: "message-block-boxed-v1",
+		status: "certified",
+	},
+	{
+		feature: "tools",
+		subtype: "tool-call-renderer",
+		target: ToolExecutionComponent.prototype,
+		method: "getCallRenderer",
+		adapterId: "tool-renderer-component-v1",
+		status: "certified",
+	},
+	{
+		feature: "tools",
+		subtype: "tool-result-renderer",
+		target: ToolExecutionComponent.prototype,
+		method: "getResultRenderer",
+		adapterId: "tool-renderer-component-v1",
+		status: "certified",
+	},
+	{
+		feature: "tools",
+		subtype: "native-bash-execution",
+		target: BashExecutionComponent.prototype,
+		method: "render",
+		kind: "add-method",
+		identityName: "BashExecutionComponent",
+		arity: 2,
+		adapterId: "bash-execution-box-v1",
+		status: "certified",
+	},
+];
+
+/**
+ * Version → surface → recorded certified identity (informational). Certification
+ * itself is decided per-surface by the runtime identity; this table only documents
+ * which identity each supported Pi version is known to carry.
+ */
+export const CERTIFICATION_TABLE: Readonly<
+	Record<
+		string,
+		Readonly<
+			Record<
+				string,
+				Readonly<{
+					feature: CompatibilityRecord["feature"];
+					subtype: CompatibilityRecord["subtype"];
+					target: object;
+					method: string;
+					writable: boolean;
+					configurable: boolean;
+					name: string;
+					arity: number;
+					fingerprint: string;
+					adapterId: string | undefined;
+					status: "certified";
+				}>
+			>
+		>
+	>
+> = Object.freeze(
+	Object.fromEntries(
+		SUPPORTED_PI_VERSIONS.map((version) => [
+			version,
+			Object.freeze(
+				Object.fromEntries(
+					targetSpecs.flatMap((spec) => {
+						const key = `${spec.subtype}:${spec.method}`;
+						const identity = (KNOWN_NATIVE_IDENTITIES[key] ?? []).find((candidate) =>
+							candidate.versions.includes(version),
+						);
+						if (!identity) return [];
+						return [
+							[
+								key,
+								Object.freeze({
+									feature: spec.feature,
+									subtype: spec.subtype,
+									target: spec.target,
+									method: spec.method,
+									writable: true,
+									configurable: true,
+									name: identity.name,
+									arity: identity.arity,
+									fingerprint: identity.fingerprint,
+									adapterId: spec.adapterId,
+									status: "certified" as const,
+								}),
+							],
+						];
+					}),
+				),
+			),
+		]),
+	),
+);
+
+const reportStates = new WeakMap<
+	object,
+	{ records: CompatibilityRecord[]; toolOwner: ReturnType<typeof createToolDecorationOwner> | undefined }
+>();
+
 export function probePiCompatibility(
 	piVersion: string | undefined,
 	options: Set<string> | CompatibilityProbeOptions = new Set(),
@@ -587,7 +638,7 @@ export function probePiCompatibility(
 	const toolSpecs = targetSpecs.filter((spec) => spec.feature === "tools");
 	let toolOwner: ReturnType<typeof createToolDecorationOwner> | undefined;
 	if (
-		toolSpecs.some((spec) => trustedNativeIdentity(spec, piVersion) !== undefined) &&
+		toolSpecs.some((spec) => trustedNativeIdentity(spec) !== undefined) &&
 		(options instanceof Set || options.config?.tools.enabled !== false)
 	) {
 		toolOwner = createToolDecorationOwner(options instanceof Set ? {} : options.toolSnapshot);
@@ -610,6 +661,9 @@ export function probePiCompatibility(
 	for (const spec of targetSpecs) {
 		const captured = evidenceByKey.get(`${spec.subtype}:${String(spec.method)}`);
 		const preinstallDescriptor = captured?.descriptor;
+		// Captured before install: the runtime identity is still the pristine native
+		// method (or class constructor for additive installs) at this point.
+		const matchedIdentity = matchedNativeIdentity(spec);
 		const result = probeSpec({
 			messageSnapshot: options instanceof Set ? undefined : options.messageSnapshot,
 			spec,
@@ -620,15 +674,10 @@ export function probePiCompatibility(
 			toolOwner,
 		});
 		records.push(result.record);
-		const certificate = certificationRecord(spec, piVersion, preinstallDescriptor);
+		const certificate = certificationRecord(spec, piVersion, matchedIdentity, preinstallDescriptor);
 		certification.push({
 			...certificate,
 			attemptedVersion: piVersion ?? "unknown",
-			matchedCertifiedVersion: piVersion === TRUSTED_PI_VERSION ? TRUSTED_PI_VERSION : undefined,
-			expected:
-				CERTIFICATION_TABLE[TRUSTED_PI_VERSION][
-					`${spec.subtype}:${spec.method}` as keyof (typeof CERTIFICATION_TABLE)["0.83.0"]
-				],
 			actualPreinstall: descriptorSnapshot(preinstallDescriptor),
 			status: result.fallback ? "native-fallback" : "certified",
 			...(result.fallback ? { fallbackReason: result.reason } : {}),
@@ -637,10 +686,10 @@ export function probePiCompatibility(
 	}
 	const report: CompatibilityProbeReport = {
 		attemptedVersion: piVersion ?? "unknown",
-		matchedCertifiedVersion: piVersion === TRUSTED_PI_VERSION ? TRUSTED_PI_VERSION : undefined,
+		supportedVersions: SUPPORTED_PI_VERSIONS,
 		certificationTable: CERTIFICATION_TABLE,
 		piVersion: piVersion ?? "unknown",
-		versionRange: PI_VERSION_RANGE,
+		versionRange: SUPPORTED_VERSION_RANGE,
 		generation: currentGeneration(),
 		recordSnapshots: Object.freeze(
 			records.map((record) =>
@@ -659,14 +708,7 @@ export function probePiCompatibility(
 		),
 		unsupported: Object.freeze(unsupported.map((item) => Object.freeze({ ...item }))),
 		delegationMarkers: Object.freeze([...markers]),
-		certification: Object.freeze(
-			certification.map((item) =>
-				Object.freeze({
-					...item,
-					actualPreinstall: item.actualPreinstall,
-				}),
-			),
-		),
+		certification: Object.freeze(certification.map((item) => Object.freeze({ ...item }))),
 		getRuntimeDiagnostics: () => toolOwner?.getDiagnostics() ?? new Map(),
 		getFinalDiagnostics: () => toolOwner?.getFinalArchive(),
 		getActiveToolRecordCount: () => toolOwner?.getActiveRecordCount() ?? 0,