@sema-agent/client-core 0.76.0 → 0.76.1

package/CHANGELOG.md

@@ -49,6 +49,32 @@
 > 挡住 ⇒ 本批把它机械化——④a0 对 `pending` 行**要求段头已是日期形**(`(未发布)` 直接红),阶段一
 > commit 漏转在发布前就红,不再靠人记。
 
+## 0.76.1(2026-09-20)
+
+> 主题:**能力位读器工厂 + 五只新读口 + 一处别名收口**(patch;零型面 BREAKING;公面值导出 1081 → **1120**)—— 读器工厂(CC-75)· MCP 活性观察读口(CC-36)· `capabilities.peerLane` / `capabilities.permissionRulesWrite` 四态读口(CC-102)· 记忆治理面两只四态读口 + 三只条目面回体读口(CC-97 a)· 主车道证明逐次新建(CC-99)。🔴 **已从本版撤出**:`capabilities.mcpProbe` 读口(CC-74)—— 上游三仓源码里尚无这一格与它的 501 码,上游那张票仍是设计稿;公面一旦发出就是承诺,无一字可验的键名不上公面,候上游真码落地后按字节重做。
+
+### Fixed
+
+- 🔴 **身份四键的一次性快照只修了投影口一侧(外部验收方对 0.76.0 的 F1 / F2)**:0.76.0 说「修在共享助手上 ⇒ 全部内部臂连带受益」—— 不成立。① `compaction_outcome` 的 adapt 侧臂两版逐字节相同,仍先判子流再取 `parentToolCallId`(读两次),而投影口已换成每键一读 ⇒ 值随读变的帧让「投影口 → 内部臂」与「直喂 adapt()」两条路**分叉**(直喂丢事件、经投影出 subagent chrome)—— 恰是 0.76.0 自己那格「两入口同答」要禁的形,还落在发车帖第一个点名的臂上;② `text_end` / `reasoning_end` 走的投影函数在同一个表达式里把每只身份键读两次,「每键恰读一次」在这两条臂上两版都不成立(方向 fail-closed:合法子代帧被判 malformed)。现在:快照助手 `snapshotSegmentIdentity` 单源(投影口的 `identitySnapshot` 委托它,adapt 侧 compaction 臂与 `prompt_assembled` 臂改读它;两侧各恰读一次、读抛整帧拒),`text_end` / `reasoning_end` 改走与其余七条内部臂同一只 `identityOrMalformed`;adapt 侧另两处「typeof 再取值」的双读(工具结果收卡的 `eventId` / `parentToolCallId`、`task_progress` 的 `parentToolCallId`)改单读 —— 🔴 **这两处也是修,不是纯重构**:对稳定帧行为不变,对值随读变的帧按设计改变(修前判形看第一份、取值看第二份 ⇒ 收卡丢父卡号、tick 落到主车道;修后一份到底),各给一格判据(compaction 门 A11 / A12)。🔴 **射程如实**:这两处是**存量**(2026-08-02 适配内核搬入那批入库,最早含它的发布版 0.67.0;在已发布的 0.75.1 / 0.76.0 制品上用同一夹具实跑读数一致),不是 0.76.0 引入;只对进程内**非幂等帧**(值随读变的 accessor)可见 —— 经 sdk 事件流进来的帧是其 SSE 读器 `JSON.parse` 的产物(普通数据属性,两次读同一个值),不会触发;不经序列化、把活对象直接喂进 `adapt()` 的路(宿主自建管线 / 重放腿 / 引擎与壳同进程直传)才受影响。F1(compaction 两入口分叉)则是 0.76.0 新引入。判据:compaction 门 A8–A10(两入口同答 ∧ 直喂 / 投影各恰读一次 ∧ 读抛不逸出)、文本段落门 Te0a / Te0b(两臂投影恰读一次且身份原样带出);修前实跑各红。🔴 **0.76.0 已发布且含 F1 / F2**:排了 0.76.0 的下游建议直接提 0.76.1。
+- **0.76.0 发车文案勘误(已发布段冻结,勘误只在这里)**:① 「两条行为面改口**只对直接调读器的端**可见」**被证伪** —— 审批 feed 自己就调 `readLivePendingRows`,只订阅 feed 的端对 `livePending:[{}]` / `pending:[{}]` / `pending:[7]` 三形在 0.76.0 也从「真快照 pending:1」变成 `unknown{unreadable_payload}`;修法方向不改,射程措辞改成「feed 订阅者同样可见」。② CC-77 ①「行为一字未动 … 逐键对拍等价」按字面不成立:12 形里 2 形跨版不等(均 `settled` true → false,fail-open 收紧;包内构造不出,只有宿主直调公面才够得着)。③ 发车帖「24 个 `_*ForTest`」按字面只匹配 22 只(另 2 只是 `_reset*` 无后缀);本版 §0a 改按真匹配数写。④ 「新门四只」实列五只。⑤ 流程:0.76.0 权威全门的第五轮来自与旧轮**无重叠**的一跑(前四轮里有一轮是重叠窗内旧轮负控套篡改共享文件报的假红,当时未写进帖)。
+
+### Changed
+
+- **六只能力位读器的四口收成一只工厂(CC-75)**:`sql` / `writeProtection` / `webSearch.backend` / `executionLane` / `approvalsStreamLive` / `deviceExecutor.management` 此前各自持有**逐字相同**的四份代码(caps 探测链上的 tee / per-baseUrl 读口 / 换代失效口 / 测试钩),现在共用包内叶 `createEngineCapReader`(不出公面);每只只剩**投影函数**(键路径 / 在场判据 / 值形校验)与诊断措辞表两件。**等价性三证**:六只读器的 `.d.ts` 与 0.76.0 发布制品**按字节一致**;六只各自的既有门一字未改、格数不变;行为逐条留在原位。🔴 刻意**不做**声明式键路径表 —— 投影函数本身就是那一份判据,压进通用描述表 = 给同一份判据立第二个判官。未观测读数改成**每次新铸**(此前六只各自新建、收编后若共享一只常量会被就地改坏,而失效口清不回它)。工厂门新增两格:**失效口的爆破半径恰是被点名那一格**(宿主同时连两台引擎时,失效掉 A 那台不许把 B 那台当代的读数清成「未观测」—— 那是凭空造出的缺席);**名单等值**(`src/` 里每一个调工厂的文件都必须在门的读器表里有一行,新读器逃不出这道门)。
+- **主车道证明改逐次新建(CC-99)**:`laneProof` 是公开输出面上的一位,此前约五十个主车道发点交出去的是**同一只**模块级常量 `{lane:'main'}` —— 跨适配器实例、跨流、跨 turn 全是它;修前实测两个互不相干的消费者各取一次未登记行的证明 `===` 为真,给第一只补上卡号之后第二只当场读出那张卡,开流序幕四条主车道事件也一起变。🔴 **判据如实**:按语法树穷举,本包内对车道证明**零就地写**,三个消费端的用法全是只读 ⇒ 本条修的是**别名风险**(拿证明做身份去重 / WeakMap 键 / 视图层身份记忆的消费者,在两条无关行共享一只对象时会把它们认成同一条,一个字不写也照错),**不是**一条已经在错归因的行。修法 = 每次新建(`mainLane()` 出厂口),落选的「冻结」只挡写不解别名、且只冻主车道半边会让同一写操作随行是否绑卡漂成间歇抛。同批:终态那两处(关卡 / 终态 tick)此前取一次证明给 stop 与 end 两条事件**共用** ⇒ 改成「归属判一次、证明铸多只」—— 刻意不做「每条事件各调一次」,生成器两次 yield 之间挂起,中间绑卡会把同一行分流到两个归属。
+- **`failloud` 豁免上限收到当日实测(42 → 36)**:那 6 格松量是历次抬数后 catch 又被删掉留下的,留着等于这道棘轮在 6 格之内不判任何新增静默吞。
+
+### Added
+
+- **引擎托管 MCP 服务器的活性观察读口(CC-36)**:`wiring_manifest.mcp[].liveness` 答的是**「这台服务器还够得着吗」**,与同一行上的申报位 `status`(拨号那一刻的判决,引擎有意冻结)、re-dial 回执的 `outcome`(一次动作的判词)**各说各的**;`status:"failed"` 与 `liveness.state:"reachable"` 同行并存是真行(答了握手、答的是协议错)。读法是**四种读数**:三个词(`reachable` / `unreachable` / `unknown`)+ **缺席 ⇒ `indeterminate`** —— 缺席在 wire 上四源同形(这条腿没走到那台 / 声明从未被拨过 / 老引擎或老服务端 / 上游投影判形没过),唯一诚实的含义是「没有可用的观察记录」,**不许**据它反推拨没拨过号,不许折成 `unknown` / 健康 / 关着。畸形与缺席**分开**:行上立 never-false 的 `livenessUnreadable`,腿级判词至多退到 `unknown`、**绝不**答 `reachable`;只由读不出的格决定的 `unknown` 另说一句(「记录在场而本端读不出」,主语不是「回来的东西答不了」—— 上游哪天加第四个词,老客户端落的正是这一档)。腿级判词按**最坏事实优先**合成,判词后面的观察时刻**与判词同源**(说「至少有一台够不着」时它是最新那次够不着的时刻,不是这条腿上任何一次观察的最大值)。新导出 `MCP_LIVENESS_STATES` / `readMcpLiveness` / `mcpLivenessRollupOf` / `mcpEngineLegHealthOf` / `mcpEngineLegHealthDetail`;行视图 `WiringManifestMcpEntryView` 加两个可选位(纯 additive;活体腿与面板回放仍是同一只读器)。⚠️ 服务端自 **7.91.2** 起把这一格过境,更老的服务端上恒缺席 = `indeterminate`(不是故障);`/mcp` 面板 `servers[]` 那一面上游投影白名单不带这一格,本包不铸那个位。
+- **两枚具名能力位键的四态读口(CC-102;server ≥7.91.1;sdk 9.8.1 无型 ⇒ 结构读)**:`capabilities.peerLane`(跨会话车道;**不是 HTTP 面**,v1 零新端点,消费方式是渲染 / 预期)与 `capabilities.permissionRulesWrite`(收紧方向的单步写口对这个调用方够不够得着)。四态 `unobserved` / `not_reported` / `absent` / `present`,三种「没有」不许互折。🔴 `permissionRulesWrite` 的读法按上游成文:**键缺席 = 这份二进制比单步写口老 ⇒ 藏入口;键在场 ⇒ 按本键自己的值判**(值与 `permissionRules` 是服务端同一个表达式),**与撤销面那一位读法不同、不许混** ⇒ `src/hitl/persistedRulesWire.ts` 新增便利口 `persistedRulesWriteAvailable(baseUrl)`,只由本键的四态派生,**不合取** `permissionRules`、不再读一遍 caps(反钉:`permissionRules:true` ∧ 写键缺席 ⇒ `false`;写键 `true` ∧ `permissionRules` 缺席 ⇒ `true`);显式 `undefined` 不回落装好的默认读锚(与两只兄弟 gate 同律)。`peerLane` 键缺席按上游成文语义是「老 worker,本部署没有跨会话车道」⇒ `peerLaneAvailable` 答 `no`(在场性即版本信号),只有本进程从没观测过才答 `unknown`。新导出 13 件 + 测试钩 2 件。
+- **记忆治理面两只能力位四态读口 + 三只条目面回体读口(CC-97 a;server ≥7.46.0 起铸两位)**:`capabilities.memoryCompliance`(出处问询 / 抹除两口)与 `capabilities.memoryOrigin`(外源审计 / 清标三口)各一只四态读口(工厂薄包装),🔴 **刻意不合并成一只**:上游把它们做成两个产品面并明说不合并(今天恒同值只是巧合),本包各持一张 per-baseUrl 表;两口 / 三口可用性判词各自归包,记忆治理面缺席时的 501 码 `MEMORY_ENGINE_REQUIRED_CODE` 只铸一次(上游源码里真有这一码)。三只回体读口一个动词都不调(动词半场候抬 sdk 地板):**条目导出行逐行窄读**(空数组 = 真 0 / 非空全坏 = `malformed` / 半坏 = `present` + `dropped`,读不懂的行与没有行永不共用一句话);🔴 **「空答不等于本店干净」现在是代码** —— 这条读口在服务端**缺省把带外源标的条目整条扣留**(消费方以查询参数声明认识 origin 键族后才放行),而装着的 sdk 那只动词不带该参数 ⇒ 经它拿到的回体里带标条目恒被扣留、回体形状与「没有带标条目」完全一样;所以「这个 scope 有没有外源条目」的判词口 `scopeExternalOriginVerdict(reading, asked)` 第二个形参**必填**,没声明 ⇒ 空答一律 `unknown(fenced)`,肯定的否定话最远只到调用方点名的那一个 scope 且带着 scope 串,联合里没有「整店」臂;服务端明说扣留了 n 条时那个计数本身就是「有带标条目」的肯定证据。**抹除证明读口**:「这一次一条都没抹掉」/「200 空体」/「回体读不懂」判成**三回事**;版本信封 `v > 1` 一律拒不重解释;`historyUnknown` 原样三态过境(上游今天只铸 `true` 或整键省掉)且**多出第四态** `unreadable`(键在场读不成,不折回缺席);「判决那一刻没有这条记录」**不**授权任何界面说「它从来不存在」(上游明说这份证明不区分从没存在过 / 自然删掉 / 别的请求删的);重发姿势三态(证据腿幂等 / 降级腿由人决定 / 读不出不当幂等)。**外源清标回执读口**:三把承重键 + 被清掉的标原样带出。🔴 **每一段数组只读一遍**(长度恰读一次、每下标恰读一次,不走调用方迭代器;自报行数大到读不下 ⇒ 如实报读不出,绝不静默截断)—— 异源对抗复审实撞:走的时候报一个长度、走完再报另一个的回体,修前能让一条带标的行被静默丢掉而丢行计数仍为零,一路判成「这个 scope 干净」。「键在场但值读不成」永不折回「键缺席」(历史位 / 扣留计数 / 「这是全量吗」三格各自处置,完备性轴 fail-closed)。新导出 21 件 + 测试钩 2 件。
+
+### Gates
+
+- 接入文档冻结账门补**「全量 = A + B = C」算式判据**(§0a 同一格手抄着三个数,此前门只盯行首两个;实翻:改了行首而算式仍是旧三数,门照样全绿)。
+- 新门四只:`run-engine-cap-reader-factory-test.mjs`(表驱动等价门,读器表长即真源)/ `run-mcp-liveness-test.mjs` / `run-peer-lane-rules-write-capability-test.mjs` / `run-lane-proof-identity-test.mjs`(含语法树 + 类型检查器的结构反钉)。
+
 ## 0.76.0(2026-09-20)
 
 > 主题:**六票一批** —— `prompt_assembled` 投影臂(CC-91)· 审批 feed 的「不知道」三态(CC-98,**型面 BREAKING**)· `ApprovalResolution` 单源判别联合(CC-77 ①)· 记忆 spec 读口与未列键判官(CC-96)· 终态词表补上游钉(CC-78 ①)· `tasks_expand` 退役(CC-92,**型面 BREAKING**)。外加一条**跨全部内部臂**的修复(身份四键一次性快照)。**minor**:两处型面 BREAKING + 两条只对「直接调读器的端」可见的行为面改口;公面值导出 1065 → **1081**(+16)。接入面 §76。

package/README.md

@@ -35,7 +35,7 @@ Renamed from **`@sema-agent/wire-cc-adapter`** (0.1.x, deprecated — see *Migra
 
 ## Scope
 
-**Version:** 0.76.0
+**Version:** 0.76.1
 
 - **Today** — the adapter seam, the whole `adapt()` pipeline (all 14 A-layer arms plus the
   B/D/E tool-card layers), the notification/caps/model families, the adapter kernel (stream driver
@@ -393,6 +393,11 @@ public-surface guard checks that last one).
 | `scripts/run-assistant-arm-identity-test.mjs` | The identity keys on an assistant row, and an explicit account of the two that are **deliberately not** there. What the renderer received was a bare role-and-content object, so a dozen consumer sites downstream were each estimating what the message envelope should have told them. The id is taken from the engine's own event id rather than minted locally, because it has to be **the same value** on the live leg and on a durable replay — a freshly minted one would make a replayed message look new to a host's dedup and to rewind — and when the wire carries none the key is simply absent rather than filled with a random stand-in wearing an identity it does not have; it is also kept distinct from the envelope's own local render key, which is a different identity. The model name comes from what the host pinned when it opened the stream (the request was the host's to build) and is never guessed, since a wrong model name is worse than none once a billing or capability face looks it up. Usage and stop reason are **not** minted on this arm, and the reason is frame order rather than effort: content arms arrive before the turn's closing frame, so at the moment the arm is emitted the engine has not yet said what the round cost — anything put there would be an estimate, which is the very thing this work exists to remove — and synthesising a follow-up assistant update when the real figure lands is also refused, because that shape does not exist upstream and would place a message in the transcript the engine never sent. Their real values leave through the turn's own neutral arm as two superset keys, the usage one reusing the **same single mint point** the footer rollup already folds so the two faces cannot diverge, and the stop reason passed through verbatim as an open set — the machine signal for *was this turn cut short*, previously blind on both the stream and the trace. The existing behaviours beside them are pinned too: no arm at all when usage is wholly absent, and the sub-flow cut-out that keeps a child's turn from driving the leader's face |
 | `scripts/run-text-segment-authority-test.mjs` | The **authoritative segment replacement** on `text_end` (L-310, server >=7.75.3). `text_end.content` now goes through the same redactor as `result` and the ledger while `text_delta` stays verbatim, so the two **may differ** — an answer that quoted a credential used to be committed to the local transcript in its unredacted form, because the arm only forwarded the boundary signal. Six timing shapes are pinned, two of which an adversarial review reproduced against the installed engine's real bytes and which the first design got wrong in both directions: a second boundary in the same turn (the per-block case on one provider lane) used to make the first segment's prose vanish, and a boundary that arrives *after* the tool card (the other lane emits it at finalize) used to be read as "this package never handled that segment" and reported nothing at all. Three additive keys, all never-false; the two shapes that look alike are told apart by the second one, because the host's action in them is the opposite. The end-to-end legs drive the real pipeline without hand-inserting a segment commit — doing so is exactly what hid the first defect. A second review round then found two combination timings on top of the first fix — a tool card followed by *more* deltas in the same segment, and a byte count that had been documented as a message count — and both are pinned here too. A third round caught a length that the prose called bytes while the code returned UTF-16 units — harmless in ASCII, and on CJK text enough to leave the credential on screen — plus a backfill ledger that had to be kept in step, so the terminal frame does not re-render the segment a second time — kept in step only where the whole stretch sits in one message, because those ledgers are per-message and a fourth round showed that writing across them charges one message's prose to another. A fifth round settled the whole class into one invariant the guard now checks against the previous release's behaviour: this package only rewrites bytes it is still holding in the current message — once a segment has crossed a package-side boundary it emits the three keys and changes nothing else **0.68.2 (CC-01):** the segment identity is now minted here, not by the host: every committed assistant text row carries a top-level `_sema_segment_id` (stamped once at the `adapt()` exit, so the durable whole-message leg and the streamed-segment leg are covered alike; thinking blocks, tool_use-tailed rows and chrome events are left byte-for-byte), `text_segment_end` carries the same value as `segmentId` before rotating, subagent boundaries never rotate, and a replayed stream yields the same identities. Three mutations (no rotation / no stamping / stamping tool_use rows) each turn the guard red **0.69.0 (CC-02):** the same authority replacement now covers the reasoning face (`reasoning_end`, server >=7.77.0): a thinking block still buffered is swapped whole and its live tail recomputed; one already committed at a boundary (the usual timing, since the first text delta commits it) is left untouched and the host is told the row to replace by its uuid, never re-emitted. Subagent boundaries are ignored and the text-segment identity does not rotate **0.69.1 (CC-09):** the run-stream replay guard still drops a frame whose event id was already seen, but it now reports the drop through the host's dropped-frame sink as `duplicate_seq` instead of vanishing silently (server 7.77.0 reuses the first reasoning delta's id for `reasoning_end`, so that authoritative segment is lost on the print lane until 7.78.1); the interactive adapter has no such guard and keeps receiving it **0.69.1 (CC-10/CC-11):** subagent segment-end frames are fenced on all three identity keys (a frame carrying only `sourceTaskId` no longer masquerades as the leader's), and a reasoning segment that spans tool cards now hands the host every committed row it covers (`committedUuids`) so nothing unredacted is left behind |
 | `scripts/run-gate-negative-controls-test.mjs` | Whether the registry-shaped guards among the 74 suites above actually turn red when the material they check really breaks — a census had found 16 of them clean enough to rehearse safely (closed sets, mirrors, baselines, floors, a type-shape ratchet) without touching any judgement code. Each is exercised by tampering a disk copy of the real material, spawning the guard's own unmodified script, asserting it exits non-zero and names the disease, then restoring the file byte-for-byte. Seven guards of the same shape and 51 behaviour/projection suites are catalogued rather than rehearsed this round — see `docs/GATE-NEGATIVE-CONTROLS.md` for the full table, the reasons, and a one-minute manual replay recipe for each blind one. The suite cross-checks its own case count against that document's row counts in both directions, so a case quietly dropped from the array without the document following is itself an undeclared blind guard. The backup that makes the restore possible is taken by **exclusive create**: checking for it and then copying are otherwise two steps, and two instances can pass the check together — the later one overwrites the only clean copy with material the earlier one has already tampered, and the rehearsal that promises to leave no trace leaves a permanently corrupted file instead. That interleaving is rehearsed too, in a throwaway directory of its own |
+| `scripts/run-engine-cap-reader-factory-test.mjs` | The one shared implementation behind every capability reader's four ports (cache, generation gate, probe tee, invalidation), exercised as a table: every reader in the table runs the *same* criteria (the table length is the source of truth, and a roster check fails the gate if any source file calls the factory without having a row) — the four states, a throwing projection treated exactly like an unreadable one (and never escaping the tee), the generation rules (a stale generation is dropped before the projection even runs; a projection that changes the generation mid-flight cannot overwrite the newer value, whether it returns or throws; the caller's `opts` is snapshotted once; and omitting the generation still writes, because that supply is additive and this refactor does not quietly tighten it), the top-level key's getter being read exactly once, a freshly minted "unobserved" reading on every miss (two misses are never the same object, so a consumer that mutates one cannot taint another base URL), one independent table per reader that never take each other down, invalidating one base URL leaving every other base URL's reading untouched, `forget`/tee being no-ops on an empty or non-string base URL, the read anchor being resolved dynamically, and the deliberate split in how presence is judged per reader. |
+| `scripts/run-mcp-liveness-test.mjs` | The engine's **liveness observation** about each MCP server it hosts (`wiring_manifest.mcp[].liveness`, engine-side from core 7.24.3 / server 7.91.2): one reader, one word list, one leg-level verdict. The cell answers *can this server still be reached* — it is not the connect-time verdict beside it, which the engine deliberately freezes (a server that died mid-run still reads `connected`), and it is not a re-dial's judgement either, so `status: "failed"` next to `liveness.state: "reachable"` is a **real row**: the server answered the handshake and answered with a protocol error — up, and misconfigured. The three words are read as a closed set (an exchange completed / it was lost in transport or the clock / what came back does not answer the question), and a word outside it is malformed rather than rendered, because a word nobody upstream has defined is not a sentence worth putting on screen. **Absence is the fourth reading and is not one of the words**: it means *no liveness record is available*, which on the wire covers a server this leg never reached, a declaration that could not be dialled, an older engine, and a record the projection ahead of us dropped — all indistinguishable, so it is never read as "we looked and could not tell" (a strictly stronger claim), never as healthy and never as off. The failure-class footnote rides the unreachable word only, and one that turns up anywhere else, or that is malformed, loses **just the footnote** while the word and its timestamp stay: the honest reading is then "cannot be reached, reason not given", not "this record is broken". Malformed never becomes healthy: a cell that is present but unreadable marks its row and pulls the leg-level verdict back to *cannot tell*, since letting it sit beside a reachable row would report a leg as reachable on the strength of a record that may well have said the opposite. The verdict takes the worst fact first rather than a majority or the newest reading, carries no server count — so there is no fabricated zero to be read as "no problems" — and its timestamp belongs to **that leg's** observation, not to now: the engine runs no probe and adds no traffic of its own, so this is a per-leg snapshot rather than a heartbeat. The replayed roster on the session panel and the live leg go through the same reader, and the panel's own deployment-side rows carry no liveness position today, so the verdict does not borrow a word from that face. The word list is bitten in both directions where an installed witness exists and the absence of one is itself asserted against the installed engine's version, so the day it ships the comparison starts on its own; the day the wire types declare the cell, the guard turns red and asks for the anchor to move there |
+| `scripts/run-peer-lane-rules-write-capability-test.mjs` | Two more engine self-descriptions read the same four-state way as their seven sibling capability readers (`capabilities.peerLane`, `capabilities.permissionRulesWrite`): an absent key is not reported (an older engine that predates the position, never folded into `false`), `true` is present, `false` is a positive absent (the cross-session lane not being mounted on this deployment, or this particular call not being able to reach the tightening-direction write entry), and anything else is unreadable and drops the cell. Each carries its own single-source verdict (`peerLaneAvailable` returns `yes`/`no`/`unknown`; `permissionRulesWriteAvailable` collapses to a plain boolean, present being the only `true`). The write-entry position pairs with a boolean convenience port in the persisted-rules module, and this guard pins that port to derive from nothing but this one reader's own reading — never a conjunction with the lane-reachable position, and never a second read of the deployment-level existence signal the revoke surface uses (the two are documented as reading differently on purpose): a deployment where the lane answers true but the write entry's key is simply absent (an older binary) must still come back `false`, a deployment where the write entry answers true while the lane key is entirely unseen must still come back `true` (proving no silent conjunction crept in), seeding only the general capabilities cache — never this reader's own feed — must still come back `false` (proving the convenience port cannot be satisfied by the wrong table), and passing an explicit `undefined` base URL must still come back `false` even while a different, already-installed engine target answers `true` for the same position (an adversarial pass found the naive forward of that parameter falls through to the reader's own convenience default, silently answering for whichever engine happens to be installed rather than the caller's absent target — the fix routes an explicit absence through the same empty-string path the reader treats as unobserved). |
+| `scripts/run-lane-proof-identity-test.mjs` | The **instance identity of a lane proof**: the main-lane proof is minted fresh on every emission. Previously a single module-level constant object was handed both to `laneOf(an unregistered task id)` and to some fifty main-lane emission points, so two unrelated consumers — across adapter instances, across streams, across turns — held the same object: writing a card id onto one of them was readable on the other, and the four opening main-lane events changed together. Nothing in this package writes to a lane proof and the known consumers only read it, so this is an **aliasing hazard on a published output surface** rather than an observed corruption — a consumer that uses the proof as an identity key, for dedup, or as a view-layer identity would conflate two unrelated rows without writing a single byte, which is precisely the half that freezing the object would not solve. The gate therefore anchors on instance identity: two independent adapter instances, two rows inside one instance, the same id read twice, and two arms in one beat are each distinct references; mutating one leaves the others byte-identical; and the subagent lane, which already minted fresh, is the control that proves the criterion discriminates. The main-lane **value** is unchanged — an unregistered id still answers `{lane:"main"}` with exactly one own key and still emits its events, so absence is not turned into a second kind of absence — with ordering pinned three ways (registered-then-read, read-then-registered with no retroactive edit of an already delivered proof, the same id twice) and the id failure classes pinned four ways (unregistered, empty string, absent, non-string, the last two emitting no panel event at all rather than an ownerless proof). Where one row emits **two** events — the terminal-tick and card-close legs, which each yield a lifecycle stop and a panel end — the attribution is decided once (a consumer binding a card between the two yields must not split one row across two lanes) while each event still gets its own proof, so a host consuming them one at a time cannot poison the second before it is even yielded. The run stream leg is covered as the same shape, and a syntax-tree check forbids reintroducing a module-level lane-proof object literal or a module-level `LaneProof`-annotated binding (judged on the type node, not on text, so a compile-time pin tuple that merely mentions the type is not miscaught), backed by a type-checker pass that also catches an un-annotated module-level cache such as `const x = mainLane()` while letting the callable factory itself through, while the module-private three-state sentinels of the untrusted read are frozen instead — only `Object.freeze` counts, never `Object.seal`, which still permits writes to existing keys — their exposure being confined to one module |
+| `scripts/run-memory-entries-wire-test.mjs` | The two memory-governance capability bits and the three memory-entry response readers. Each bit (`capabilities.memoryCompliance`, for the entry-provenance and erasure endpoints; `capabilities.memoryOrigin`, for the external-origin listing and clearance endpoints) is read the same four-state way as its sibling capability readers: an absent key is reported as not reported (never folded into `false` — an older engine simply does not answer, and the right next step is to try the endpoint and read its 501), `true` is the face being mounted, `false` is a positive "not on this deployment" (the wire does not distinguish a backend without control-plane ownership from an empty operator roster, so the wording never guesses which), any non-boolean value is unreadable and drops the cell instead of being folded into "absent", and a capabilities body that is not an object at all is unreadable rather than "not reported". The two bits deliberately stay **two** readers with two separate per-engine tables, because the engine deliberately keeps them two separate product faces even while they happen to carry the same value today: feeding one an unreadable body, or invalidating one, leaves the other's reading untouched, and a body where one is on and the other off is answered one bit at a time. The entry-export reader narrows each row on its own (an empty array really is zero rows, a non-empty array with nothing readable in it is reported as unreadable rather than as "no rows", and partly bad rows are kept with a dropped count), reads the external-origin marker as three states rather than a boolean (the two structural carriers mark a row; a row whose frontmatter cannot be read, or which carries the third, suspended-form carrier, is undecidable, because the judge for that carrier lives in the engine and this package refuses to mint a second copy of it), and treats an unreadable "is this the whole scope" flag as "not the whole scope". Its verdict port implements — in code, not in a comment — the rule that an empty answer is never a clean store: the caller must state whether the request declared origin-awareness, because this endpoint withholds marked entries by default and the two bodies are shaped identically, so without that statement an empty answer is only ever "unknown"; the affirmative answer is scoped to the one named scope and carries that scope with it, and the type has no store-wide arm at all. The erasure receipt reader keeps three things apart that are easy to collapse: "this call erased nothing" (a real receipt whose erased list is empty and whose not-found list explains why, per id), "a 200 with an empty body", and "a body that could not be read" — at the reading, the counting and the verdict layer alike; it refuses a version envelope it does not recognise instead of reinterpreting it, treats the three closed vocabularies as closed (an unknown word is unreadable, never folded into a known arm), keeps an unreadable binding as unknown instead of claiming "unbound", passes the "history cannot be judged" flag through as four states (set, explicitly unset, absent, and present-but-unreadable — an unreadable flag is kept distinct from an absent one, and the history verdict then answers "unknown" rather than the stronger claim), and answers the replay question as three states so that the degraded lane is never retried automatically. The clearance receipt reader carries the cleared marker through verbatim and says separately whether it was reported at all. Every array in every response is snapshotted once — the length is read exactly once and each index exactly once, rather than iterating the caller's own iterator — because an array that reports one length while being walked and another afterwards could otherwise have a marked row quietly dropped while the "was anything unreadable" check saw nothing, which ends in calling the scope clean; an array that reports an absurd length is reported as unreadable rather than silently truncated to its first rows. All three readers never throw. |
 
 Each suite carries a floor that only moves up — a refactor that stops executing a group of
 assertions is a failure, not a quieter pass. Guards anchor on the **installed artefact's content**

package/dist/adapt/arms.js

@@ -1,4 +1,4 @@
-import { isSubFlowSegmentEnd, SEGMENT_END_IDENTITY_KEYS } from '../adapter/types.js';
+import { isSubFlowSegmentEnd, SEGMENT_END_IDENTITY_KEYS, snapshotSegmentIdentity, snapshotIsSubFlow } from '../adapter/types.js';
 import { classifyPeerNotification, renderPeerFrameTranscriptText } from '../peerFrames.js';
 import { dropQueuedNotificationsForRun, isEngineWorkflowNotified, isWorkflowCompletionCardEnqueued, markEngineWorkflowNotified, noteOwnWorkflowRun, normalizeTaskNotification, noteWorkflowCompletionCardEnqueued, renderTaskNotificationXml, taskNotificationDedupKey } from '../notifications.js';
 import { mapBrainStatusToRetry } from '../retryStatus.js';
@@ -13,7 +13,7 @@ import { isTerminalStatus } from '../runTerminal.js';
 import { resolveEnginePanelTaskId } from '../engineAgentPanelStore.js';
 // 0.75.1 CC-95(b):子代类型的诚实来源台账(fleet 行帧折进 name 之前留的那一份;包内叶)。
 import { fleetRowAgentType } from '../fleet/fleetRowAgentType.js';
-import { chrome, MAIN, transcript, messageIdentityOf } from './ids.js';
+import { chrome, mainLane, transcript, messageIdentityOf } from './ids.js';
 import { CANCEL_MESSAGE, decisionOf, flattenWireOutput, REJECT_MESSAGE, sanitizeToolUseBlock, shortTaskLabel, TASK_TOOL_NAMES, WORKFLOW_TOOL_NAMES, } from './wireShapes.js';
 // ══ M2/M1 —— assistant(tool_use 半场 + durable 文本/思考半场)══════════════════════════════════
 const assistantArm = function* (m, { ctx, idOf, text, cards, inst }) {
@@ -53,7 +53,7 @@ const assistantArm = function* (m, { ctx, idOf, text, cards, inst }) {
         if (TASK_TOOL_NAMES.has(toolName)) {
             yield chrome({
                 kind: 'task_ledger_sync',
-                laneProof: MAIN,
+                laneProof: mainLane(),
                 source: 'tool_use',
                 toolName,
                 toolUseId,
@@ -190,7 +190,7 @@ const systemArm = function* (m, { ctx, idOf }) {
                 continue;
             yield chrome({
                 kind: 'attachment',
-                laneProof: MAIN,
+                laneProof: mainLane(),
                 id: idOf(m, `attached-file-${i++}`),
                 attachment: {
                     type: 'compact_file_reference',
@@ -207,7 +207,7 @@ const diagnosticsArm = function* (m, { idOf }) {
     const att = projectDiagnosticsFrame(m);
     if (att === null)
         return;
-    yield chrome({ kind: 'attachment', laneProof: MAIN, id: idOf(m), attachment: att });
+    yield chrome({ kind: 'attachment', laneProof: mainLane(), id: idOf(m), attachment: att });
 };
 const steeringInjectedArm = function* (m, { idOf }) {
     if (typeof m.parentToolCallId === 'string')
@@ -220,7 +220,7 @@ const steeringInjectedArm = function* (m, { idOf }) {
     for (const att of steeringInjectedToAttachments(source, preview)) {
         yield chrome({
             kind: 'attachment',
-            laneProof: MAIN,
+            laneProof: mainLane(),
             id: idOf(m, `steering-${i++}`),
             attachment: att,
         });
@@ -234,7 +234,7 @@ const workspaceChangedArm = function* (m, { idOf }) {
         return;
     yield chrome({
         kind: 'attachment',
-        laneProof: MAIN,
+        laneProof: mainLane(),
         id: idOf(m),
         attachment: { type: 'workspace_changed', cwd },
     });
@@ -267,7 +267,7 @@ const humanInputArm = function* (m) {
         };
     yield chrome({
         kind: 'human_input',
-        laneProof: MAIN,
+        laneProof: mainLane(),
         carrier,
         ...(str(m.inputId) !== undefined ? { inputId: str(m.inputId) } : {}),
         ...(typeof m.sessionSeq === 'number' && Number.isFinite(m.sessionSeq) ? { sessionSeq: m.sessionSeq } : {}),
@@ -301,7 +301,7 @@ const messageCommittedArm = function* (m) {
         return;
     yield chrome({
         kind: 'message_committed',
-        laneProof: MAIN,
+        laneProof: mainLane(),
         entryId,
         role,
         ...(typeof m.toolCallId === 'string' && m.toolCallId.length > 0 ? { toolCallId: m.toolCallId } : {}),
@@ -336,7 +336,7 @@ const engineNoticeArm = function* (m) {
         : {};
     yield chrome({
         kind: 'engine_notice',
-        laneProof: MAIN,
+        laneProof: mainLane(),
         code,
         message: typeof m.message === 'string' ? m.message : '',
         detail,
@@ -392,7 +392,7 @@ const wiringManifestArm = function* (m) {
         return;
     yield chrome({
         kind: 'wiring_manifest',
-        laneProof: MAIN,
+        laneProof: mainLane(),
         ...(hasGate ? { modelGate: modelGate } : {}),
         ...(hasAuto ? { autoMode: autoMode } : {}),
         ...(hasMcp ? { mcp: mcp } : {}),
@@ -428,7 +428,7 @@ const approvalFrameArm = (kind) => function* (m) {
     const frame = m.frame;
     if (typeof frame !== 'object' || frame === null)
         return;
-    yield chrome({ kind, laneProof: MAIN, frame, schemaVersion });
+    yield chrome({ kind, laneProof: mainLane(), frame, schemaVersion });
 };
 /**
  * `text_end` 内部臂 → **权威段替换** + chrome `text_segment_end`(#323 / core #447;L-310,
@@ -485,7 +485,7 @@ const toolDisclosureArm = function* (m) {
         return; // 二道判:非投影口喂进来的帧
     yield chrome({
         kind: 'tool_disclosure',
-        laneProof: MAIN,
+        laneProof: mainLane(),
         policy,
         ...(typeof m.thresholdPercent === 'number' ? { thresholdPercent: m.thresholdPercent } : {}),
         deferred,
@@ -508,7 +508,7 @@ const toolProgressArm = function* (m) {
     const output = typeof m.output === 'string' ? m.output : undefined;
     yield chrome({
         kind: 'tool_progress',
-        laneProof: MAIN,
+        laneProof: mainLane(),
         toolCallId,
         toolName,
         ...(typeof m.elapsedTimeSeconds === 'number' ? { elapsedSeconds: m.elapsedTimeSeconds } : {}),
@@ -530,7 +530,7 @@ const toolRosterDeltaArm = function* (m) {
         return;
     yield chrome({
         kind: 'tool_roster_delta',
-        laneProof: MAIN,
+        laneProof: mainLane(),
         delta: delta,
         ...(typeof m.eventId === 'string' && m.eventId.length > 0 ? { eventId: m.eventId } : {}),
     });
@@ -551,7 +551,7 @@ const contextUsageArm = function* (m) {
         return;
     yield chrome({
         kind: 'context_usage',
-        laneProof: MAIN,
+        laneProof: mainLane(),
         ...(usedTokens !== undefined ? { usedTokens } : {}),
         ...(windowTokens !== undefined ? { windowTokens } : {}),
         ...(compactAtTokens !== undefined ? { compactAtTokens } : {}),
@@ -569,16 +569,21 @@ const compactionOutcomeArm = function* (m) {
     const outcome = str(m.outcome);
     if (outcome === undefined)
         return;
-    let laneProof = MAIN;
-    if (isSubFlowSegmentEnd(m)) {
-        const parent = str(m.parentToolCallId);
+    // 🔴 身份四键一次性快照(0.76.1;外部验收方对 0.76.0 的 F1):修前先 isSubFlowSegmentEnd(m) 再 str(m.parentToolCallId),
+    //    parentToolCallId 读了两次 ⇒ 值随读变的帧让直喂入口丢事件、经投影却出 subagent chrome —— 两入口分叉。
+    const idSnap = snapshotSegmentIdentity(m);
+    if (idSnap === null)
+        return; // 读身份就抛 ⇒ 整帧拒(与投影口判 malformed 同一处置,不发 chrome)
+    let laneProof = mainLane();
+    if (snapshotIsSubFlow(idSnap)) {
+        const parent = str(idSnap.parentToolCallId);
         if (parent === undefined)
             return;
         laneProof = { lane: 'subagent', parentToolCallId: parent };
     }
     const trigger = str(m.trigger);
     const reason = str(m.reason);
-    const eventId = str(m.eventId);
+    const eventId = str(idSnap.eventId);
     yield chrome({
         kind: 'compaction_outcome',
         laneProof,
@@ -653,21 +658,12 @@ const promptAssembledArm = function* (m) {
     //       取 parent 又读一次」会让同一帧在两条路上归属不同 lane —— 子代的组成信息被洗成主会话的
     //       (第三轮复审 [medium] 实测可复现)。所以这里**不**用 `isSubFlowSegmentEnd(m)`(它会再读一遍),
     //       子流判定直接看快照里「三键有没有在场」,语义与它逐字同(键在场 = 子代帧,空串也算在场)。
-    const idSnap = {};
-    try {
-        for (const k of ['eventId', ...SEGMENT_END_IDENTITY_KEYS])
-            idSnap[k] = m[k];
-    }
-    catch {
-        // §C1 带理由的吞:读身份键本身抛(进程内帧的 accessor 抛)⇒ **整帧拒**,不发 chrome。
-        // 为什么这里吞是对的:身份决定的是「这条组成信息算谁的」——读不出归属时,任何一种猜(当主会话 / 当子代)
-        // 都会把一只子代的 prompt 组成挂到别人名下;而本臂是**可选渲染面**(required:false),不发的代价只是这一帧不上屏。
-        // 为什么不上报:适配层没有诊断出口(chrome 臂本身就是出口),再向上抛会打断整条 adapt 流、连带吞掉同批的真帧。
-        return;
-    }
+    const idSnap = snapshotSegmentIdentity(m);
+    if (idSnap === null)
+        return; // 读身份就抛 ⇒ 整帧拒(理由见 snapshotSegmentIdentity 头注与本臂上方的说明)
     if (SEGMENT_END_IDENTITY_KEYS.some((k) => idSnap[k] !== undefined && typeof idSnap[k] !== 'string'))
         return;
-    let laneProof = MAIN;
+    let laneProof = mainLane();
     if (SEGMENT_END_IDENTITY_KEYS.some((k) => idSnap[k] !== undefined)) {
         const parent = str(idSnap.parentToolCallId);
         if (parent === undefined)
@@ -703,7 +699,7 @@ const textSegmentEndArm = function* (m, { text }) {
     const r = text.replaceAnswerSegment(content, m);
     yield chrome({
         kind: 'text_segment_end',
-        laneProof: MAIN,
+        laneProof: mainLane(),
         content,
         // CC-01:帧上带的是**轮换前**的段身份 —— 与本段已过境的 committed 行同值(归属的第二把钥匙)。
         segmentId: text.segmentId(),
@@ -735,7 +731,7 @@ const thinkingSegmentEndArm = function* (m, { text }) {
     const r = text.replaceThinkingSegment(content, m);
     yield chrome({
         kind: 'thinking_segment_end',
-        laneProof: MAIN,
+        laneProof: mainLane(),
         content,
         ...(r.diverged ? { diverged: true } : {}),
         ...(r.committedPrefixDiverged ? { committedPrefixDiverged: true } : {}),
@@ -756,7 +752,7 @@ const promptSuggestionsArm = function* (m) {
     // 空批不发(cli 同门:`if (list.length > 0)`)—— 作废由 turn 开场那一发负责,
     // 这里再发一次 null 会把本轮真产出的建议在极端交错下擦掉。
     if (list.length > 0) {
-        yield chrome({ kind: 'prompt_suggestions', laneProof: MAIN, suggestions: list });
+        yield chrome({ kind: 'prompt_suggestions', laneProof: mainLane(), suggestions: list });
     }
 };
 // ══ M2 —— tool_end_result(关卡 + B/D/E 层卡本体 + 两个侧产物)══════════════════════════════════
@@ -802,14 +798,19 @@ const toolEndResultArm = function* (m, { ctx, idOf, cards, panel }) {
     if (p === undefined || callId === undefined)
         return;
     const structured = m.structured;
+    // 身份键各读一次(0.76.1:此前 typeof 再取值 = 读两次;值随读变的帧会让判形与取值各看一份)。
+    const closeEventIdRaw = m.eventId;
+    const closeParentRaw = m.parentToolCallId;
+    const closeEventId = typeof closeEventIdRaw === 'string' ? closeEventIdRaw : undefined;
+    const closeParent = typeof closeParentRaw === 'string' ? closeParentRaw : undefined;
     // 出栈 + S1 复位(**yield 之前**)已收进 close() —— 见 toolCards.ts 的拆分硬约束。
     yield* cards.close(p, {
         output: m.output,
         structured,
         truncated: m.truncated === true,
         isError: m.isError === true,
-        eventId: typeof m.eventId === 'string' ? m.eventId : undefined,
-        parentToolCallId: typeof m.parentToolCallId === 'string' ? m.parentToolCallId : undefined,
+        eventId: closeEventId,
+        parentToolCallId: closeParent,
     });
     const s = structured !== undefined && structured !== null && typeof structured === 'object'
         ? structured
@@ -837,7 +838,7 @@ const toolEndResultArm = function* (m, { ctx, idOf, cards, panel }) {
     if (s && (s.type === 'task' || s.type === 'task-list')) {
         yield chrome({
             kind: 'task_ledger_sync',
-            laneProof: MAIN,
+            laneProof: mainLane(),
             source: 'structured',
             structuredType: s.type,
             structured: s,
@@ -860,10 +861,12 @@ const taskProgressArm = function* (m, { ctx, cards, panel, inst }) {
     // 只带 rollup 数字 = CC `AgentProgress` 同形 ⇒ 忠实的 CC-187 面是 footer 面板行
     // (CC 自己对进程外 agent 的先例:面板行 + task-notification,从不合成 inline 消息轨)。
     // **不产任何 transcript 消息**:全是 chrome。
-    const taskId = typeof m.taskId === 'string' ? m.taskId : undefined;
+    const taskIdRaw = m.taskId;
+    const taskId = typeof taskIdRaw === 'string' ? taskIdRaw : undefined;
     if (taskId === undefined)
         return;
-    const explicitParent = typeof m.parentToolCallId === 'string' ? m.parentToolCallId : undefined;
+    const explicitParentRaw = m.parentToolCallId; // 读一次(0.76.1:typeof 再取值 = 读两次)
+    const explicitParent = typeof explicitParentRaw === 'string' ? explicitParentRaw : undefined;
     // ── W1 段2([1617]②,frame-lane-matrix #2/#8)workflow lane 门:workflow 子代的 tick 属
     // fleet lane 自描述行(footer 只渲 workflow 聚合行),**绝不**进前台 subagent lane
     // (不登 alias、不 bind、不 livePanelTasks、不发 panel tick —— 修前每个 workflow agent
@@ -1079,7 +1082,7 @@ function prefixOf(whole, part) {
     return null;
 }
 const resultArm = function* (m, { ctx, idOf, text, cards, panel, flags }) {
-    yield chrome({ kind: 'retry_status', laneProof: MAIN, status: null });
+    yield chrome({ kind: 'retry_status', laneProof: mainLane(), status: null });
     // MF-10 防御 sweep(sweep 点 2/4):结掉那些卡从没关过的行(流被截断)。
     // cli 同位:setRetryStatus(null) 之后、开卡兜底关闭之前。
     yield* panel.settle(null, false);
@@ -1170,7 +1173,7 @@ const resultArm = function* (m, { ctx, idOf, text, cards, panel, flags }) {
         //    改口。两个位是**长度**不是内容 —— 不复述任何一份正文。
         yield chrome({
             kind: 'result_text_diverged',
-            laneProof: MAIN,
+            laneProof: mainLane(),
             committedLength: committed.length,
             resultLength: terminalText.length,
         });
@@ -1195,7 +1198,7 @@ const taskNotificationArm = function* (m, { ctx, idOf, panel, inst }) {
     if (settleAllowed && terminal) {
         yield chrome({
             kind: 'bgshell_settle',
-            laneProof: MAIN,
+            laneProof: mainLane(),
             taskId,
             status: rawStatus,
             ...(typeof n.output_file === 'string' && n.output_file.length > 0
@@ -1218,7 +1221,7 @@ const taskNotificationArm = function* (m, { ctx, idOf, panel, inst }) {
     if (n.task_type !== 'external' && terminal) {
         yield chrome({
             kind: 'notification_terminal',
-            laneProof: MAIN,
+            laneProof: mainLane(),
             taskId,
             status: rawStatus,
             ...(typeof n.task_type === 'string' ? { taskType: n.task_type } : {}),
@@ -1322,7 +1325,7 @@ const workflowCompleteArm = function* (m) {
     noteWorkflowCompletionCardEnqueued(runId);
     yield chrome({
         kind: 'workflow_notification_enqueue',
-        laneProof: MAIN,
+        laneProof: mainLane(),
         runId,
         status: wfStatus,
         summary: wfSummary,
@@ -1375,10 +1378,10 @@ const retryStatusArm = function* (m, { ctx, flags }) {
     // 首版写成「无条件发 + clearRetryOverlay」,在常态顺序上双清(对抗复审命中)。
     if (status === null) {
         if (flags.takeRetryOverlay())
-            yield chrome({ kind: 'retry_status', laneProof: MAIN, status: null });
+            yield chrome({ kind: 'retry_status', laneProof: mainLane(), status: null });
         return;
     }
-    yield chrome({ kind: 'retry_status', laneProof: MAIN, status });
+    yield chrome({ kind: 'retry_status', laneProof: mainLane(), status });
     // ⟨帧序耦合 6/7⟩ 挂旗;下一个主 lane 内容帧到达时由 TurnFlags 的帧前置清掉(恢复即清)。
     flags.noteRetryOverlay();
 };

package/dist/adapt/ids.d.ts

@@ -1,8 +1,35 @@
 import type { AdapterContext, AdapterOutput, ChromeEvent, LaneProof } from '../seam.js';
 /** 帧 = wire 投影出来的中性 arm(cli seam/adapter downstream 的 SDKMessage 形),结构化读取。 */
 export type Frame = Record<string, unknown>;
-/** 主车道证明——本批实现的臂全在 leader lane(子代/workflow lane 的 tick 面留 #52b)。 */
-export declare const MAIN: LaneProof;
+/**
+ * 主车道证明的**出厂口** —— 每次调用交出一只**新的** `{lane:'main'}`(本批实现的臂全在 leader
+ * lane;子代/workflow lane 的 tick 面留 #52b)。
+ *
+ * 🔴 **为什么是函数不是常量**(0.76.1)。此前这里是一只模块级常量对象,`laneOf(未登记 id)` 与本包
+ *    约五十个 `laneProof:` 主车道发点交出去的是**同一只**对象 —— 跨适配器实例、跨流、跨 turn 全是
+ *    它。实测(修前,本门 L1/L5 段的同一条路径):两个互不相干的消费者各取一次未登记行的证明,
+ *    `===` 为真;给第一只补上卡号之后,第二只当场读出 `{lane:'subagent', parentToolCallId:'…'}`,
+ *    开流序幕那四条主车道事件也一起变 —— **一次写打穿整个进程**,而且静默。
+ *
+ * 🔴 **判据如实**:这是**别名风险**,不是「已经在串味的现场」。修前逐站点穷举(语法树扫写表达式)
+ *    的结论是:本包内对车道证明**零就地写**(两处看起来像写的是给局部变量**换绑**新对象,不改旧的);
+ *    三个消费端的证明用法全是只读(读 `lane` 位 / 解构丢弃)。⇒ 本批修的是「交出去的可变引用被
+ *    当成缺省值别名」这一形,不是在修一条已经在错归因的行。发布文案不许把它写成用户可见的回归。
+ *    这条形本身仍然要修:`laneProof` 是**公开输出面**上的一位,拿它做 WeakMap 键 / 身份去重 /
+ *    视图层身份记忆的消费者,在两条无关行共享一只对象时会把它们认成同一条 —— **一个字都不写也照错**。
+ *    这也正是冻结那条修法救不了的一半。
+ *
+ * 🔴 **为什么不是冻结**(两条都摆过,这条落选):
+ *    ① 冻结只挡「写」,不解「别名」——上一段那三种按身份认物的消费面照错;每次新建两件一起解决。
+ *    ② 子代臂 `{lane:'subagent', parentToolCallId}` 与 workflow 臂本来就**逐次新建**且可写,只冻主
+ *       车道这一半 ⇒ 同一处写操作会因为「这条行恰好绑没绑卡」而一边抛一边收,失败随行漂成间歇形;
+ *       要对称就得连十几处内联字面量一起冻,比每次新建更大的改动换更小的收益。
+ *    ③ 证明是在宿主手里被写的:冻结把一条本包的别名缺陷变成宿主侧的抛错,而宿主的抛会顺着
+ *       `for await` 打断整条 adapt 流。适配层不该给主链添这种反噬。
+ * ⚠️ 代价如实:每条主车道事件多一只小对象(≈ 一个键的字面量)。别为了省它把出厂口缓存成模块级
+ *    单例(`const M = mainLane()` 就是把这一形原样种回来)—— 结构反钉门盯着这一形。
+ */
+export declare const mainLane: () => LaneProof;
 /** 帧 → 稳定转录 id(`suffix` = 同一帧派生多条消息时的去撞位)。 */
 export type IdOf = (frame: Frame, suffix?: string) => string;
 /**

package/dist/adapt/ids.js

@@ -1,6 +1,33 @@
 import { deriveTranscriptId } from '../seam.js';
-/** 主车道证明——本批实现的臂全在 leader lane(子代/workflow lane 的 tick 面留 #52b)。 */
-export const MAIN = { lane: 'main' };
+/**
+ * 主车道证明的**出厂口** —— 每次调用交出一只**新的** `{lane:'main'}`(本批实现的臂全在 leader
+ * lane;子代/workflow lane 的 tick 面留 #52b)。
+ *
+ * 🔴 **为什么是函数不是常量**(0.76.1)。此前这里是一只模块级常量对象,`laneOf(未登记 id)` 与本包
+ *    约五十个 `laneProof:` 主车道发点交出去的是**同一只**对象 —— 跨适配器实例、跨流、跨 turn 全是
+ *    它。实测(修前,本门 L1/L5 段的同一条路径):两个互不相干的消费者各取一次未登记行的证明,
+ *    `===` 为真;给第一只补上卡号之后,第二只当场读出 `{lane:'subagent', parentToolCallId:'…'}`,
+ *    开流序幕那四条主车道事件也一起变 —— **一次写打穿整个进程**,而且静默。
+ *
+ * 🔴 **判据如实**:这是**别名风险**,不是「已经在串味的现场」。修前逐站点穷举(语法树扫写表达式)
+ *    的结论是:本包内对车道证明**零就地写**(两处看起来像写的是给局部变量**换绑**新对象,不改旧的);
+ *    三个消费端的证明用法全是只读(读 `lane` 位 / 解构丢弃)。⇒ 本批修的是「交出去的可变引用被
+ *    当成缺省值别名」这一形,不是在修一条已经在错归因的行。发布文案不许把它写成用户可见的回归。
+ *    这条形本身仍然要修:`laneProof` 是**公开输出面**上的一位,拿它做 WeakMap 键 / 身份去重 /
+ *    视图层身份记忆的消费者,在两条无关行共享一只对象时会把它们认成同一条 —— **一个字都不写也照错**。
+ *    这也正是冻结那条修法救不了的一半。
+ *
+ * 🔴 **为什么不是冻结**(两条都摆过,这条落选):
+ *    ① 冻结只挡「写」,不解「别名」——上一段那三种按身份认物的消费面照错;每次新建两件一起解决。
+ *    ② 子代臂 `{lane:'subagent', parentToolCallId}` 与 workflow 臂本来就**逐次新建**且可写,只冻主
+ *       车道这一半 ⇒ 同一处写操作会因为「这条行恰好绑没绑卡」而一边抛一边收,失败随行漂成间歇形;
+ *       要对称就得连十几处内联字面量一起冻,比每次新建更大的改动换更小的收益。
+ *    ③ 证明是在宿主手里被写的:冻结把一条本包的别名缺陷变成宿主侧的抛错,而宿主的抛会顺着
+ *       `for await` 打断整条 adapt 流。适配层不该给主链添这种反噬。
+ * ⚠️ 代价如实:每条主车道事件多一只小对象(≈ 一个键的字面量)。别为了省它把出厂口缓存成模块级
+ *    单例(`const M = mainLane()` 就是把这一形原样种回来)—— 结构反钉门盯着这一形。
+ */
+export const mainLane = () => ({ lane: 'main' });
 /**
  * L-215③(0.65.0)—— 一条 assistant 转录消息的**身份键**(`message.id` / `message.model`)。
  *

package/dist/adapt/panelTasks.d.ts

@@ -40,8 +40,9 @@ export interface PanelTaskLedger {
     unboundCandidates(): number;
     /** 行的车道证明:绑到卡的 = subagent lane(带父卡 id),未绑的 = 主 lane。 */
     laneOf(taskId: string): LaneProof;
-    /** 这条行已经绑过卡了吗(含糊回落的前置判位;别拿 `laneOf(...) === MAIN` 代替 —— 那是
-     *  按引用相等在推断,判据锚在会决定结果的量上才对)。 */
+    /** 这条行已经绑过卡了吗(含糊回落的前置判位;别拿「`laneOf(...)` 是不是那只主车道常量」代替 ——
+     *  那是按引用相等在推断,判据锚在会决定结果的量上才对。0.76.1 起主车道证明**逐次新建**,
+     *  那种写法连偶然成立都做不到了)。 */
     isBound(taskId: string): boolean;
     /**
      * B-074 —— 这条行绑在一张**本 turn 还开着**的卡上吗(`liveBound`,#6 的 live/inert 判位)。
@@ -75,7 +76,7 @@ export interface PanelTaskLedger {
      * B-074(0.65.0)**终态 tick 边** —— core 明写的那一拍(`task_progress.status` = `completed`/
      * `failed`)按 taskId 直接落行。
      *
-     * 为什么不复用 {@link settleFromNotification}:那一条是**通知帧**那半场,它按 `MAIN` 车道发
+     * 为什么不复用 {@link settleFromNotification}:那一条是**通知帧**那半场,它按**主车道**发
      * end(bg 子代行本来就是 unbound 的),而终态 tick 的行**可能绑着一张前台委派卡** ⇒ 车道证明
      * 必须走 {@link laneOf},否则一条 subagent lane 的行会拿 main lane 的证明去落终态(帧×lane
      * 矩阵那一族的病)。也不复用 {@link settle}:那一条按**卡 id** 收(关卡/防御 sweep 的语义),