@tacet-ink/journal-core 0.1.4 → 0.1.6

package/scripts/verify-core-crypto.ts

@@ -14,10 +14,15 @@ import {
   generateNoteKey,
   generateRecToken,
   storeLocalWrap,
+  clearLocalWrap,
+  buildBindPayload,
+  openNoteKey,
   unwrapNoteKey,
   unwrapNoteKeyWithRecToken,
   wrapNoteKey,
   wrapNoteKeyWithRecToken,
+  wrapNoteKeyShare,
+  unwrapNoteKeyShare,
   recTokenHash,
   wrapNoteKeyDual,
   unwrapNoteKeyDual,
@@ -26,6 +31,11 @@ import {
   decryptAttach,
   encryptLocal,
   decryptLocal,
+  hexToBytes,
+  encryptWithKey,
+  decryptWithKey,
+  b64 as modB64,
+  unb64 as unb64Mod,
 } from '../src/client/note-crypto.ts';
 import {
   verifyArgonKat,
@@ -43,6 +53,24 @@ import {
 } from '../src/client/argon2.ts';
 import { makeKeyStore } from '../src/client/keys.ts';
 import type { NoteCryptoConfig } from '../src/client/note-crypto.ts';
+import {
+  wrapNoteKeyPinLock,
+  unwrapNoteKeyPinLock,
+  type PinLockConfig,
+} from '../src/client/pinlock.ts';
+import {
+  makeInboundCipher,
+  isCipherFor,
+  validWrappedKey,
+  validHash64,
+  validSalt,
+  pickKeyPackage,
+  AUTH_RATE,
+  type CipherFormats,
+} from '../src/server/auth.ts';
+import { checkRate, isRateAllowed, SQL_RATE_BUMP, type RateWindow } from '../src/server/ratelimit.ts';
+import { generateSessionToken, timingSafeEq } from '../src/server/hash.ts';
+import { CORS_HEADERS, corsResponse } from '../src/server/cors.ts';
 
 const enc = new TextEncoder();
 
@@ -113,7 +141,8 @@ await A('AAD 防搬移：跨身份 guest 解密失敗回 null',
 // 舊版明文相容層：無前綴 = 原樣返回
 await A('舊明文原樣返回', (await decryptNote(TACET, held, '純舊明文', 'x', { current: () => identityA })) === '純舊明文');
 
-// ── 3. 包裹三件套（pass / rec / 本機） ───────────────────────────────────────
+// ── 3. 包裹三件套（pass / rec / 本機；2026-09-24 效能審查節——buildBindPayload 兩段
+//      PBKDF2 600k 已由卡C t_7361b68c 收 Promise.all 並行，node 實測 133-152ms→68-84ms） ──
 
 console.log('\n[3] 金鑰包裹（passphrase / 復原 / 本機）');
 const pass = 'correct-horse-battery-staple-42';
@@ -206,13 +235,9 @@ await A('dual unwrapNoteKeyDual 拒收 jr1w 字串', (await unwrapNoteKeyDual(TA
 await A('既有 jr1w 包裹不受 dual 並存影響', (await unwrapNoteKey(TACET2, wrapped, pass, salt)) !== null);
 
 // payload 竄改 → 一律 null（自描述完整性：pinSalt/hksalt/iv/ct 任一區）
-function unb64(text: string): Uint8Array {
-  const bin = atob(text);
-  const bytes = new Uint8Array(bin.length);
-  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
-  return bytes;
-}
-const payload2 = unb64(dual.wrapped.slice('jr2w.'.length));
+// 卡C 收口：本地複製退場、直呼模組 unb64（單一真相；t_7361b68c [14] 導入面；
+// round 2 NIT-5：轉手 wrapper 本身退場——呼叫端直用模組 unb64）。
+const payload2 = unb64Mod(dual.wrapped.slice('jr2w.'.length));
 const tamperedAt = async (idx: number): Promise<boolean> => {
   const copy = payload2.slice();
   copy[idx] ^= 0x01;
@@ -260,7 +285,7 @@ await A('jr3w unwrap 拒收 jr1w 字串', (await unwrapNoteKey3(TACET3, wrapped,
 await A('jr1w unwrapNoteKey 拒收 jr3w 字串', (await unwrapNoteKey(TACET2, w3.wrapped, pass, w3.salt)) === null);
 await A('既有 jr1w 包裹照解（遷移契約：舊前綴不解散）', (await unwrapNoteKey(TACET2, wrapped, pass, salt)) !== null);
 // jr3w payload 竄改 → GCM 驗證失敗 → null
-const payload3 = unb64(w3.wrapped.slice('jr3w.'.length));
+const payload3 = unb64Mod(w3.wrapped.slice('jr3w.'.length));
 const tampered3 = async (idx: number): Promise<boolean> => {
   const copy = payload3.slice();
   copy[idx] ^= 0x01;
@@ -438,7 +463,47 @@ await A('附件錯鑰匙 → null',
 
 // ── 11. 本機 IDB 密文（jr1d. cipherLocal opt-in）＋ guest 選配拒絕面 ──────────
 
-console.log('\n[11] 本機 IDB 密文（jr1d. cipherLocal opt-in）＋ guest 選配');
+console.log('\n[11] 本機 IDB 密文（jr1d. cipherLocal opt-in）＋ guest 選配拒絕面');
+// 分享包裹（jrsw.，wrapShare 選配）＋ jr3s. roundtrip（t_7710c766 目標 8：閘本有 roundtrip 斷言缺席）
+const TACET_SHARE: NoteCryptoConfig = { ...TACET, wrapShare: 'jrsw.' };
+const shareWrapped = await wrapNoteKeyShare(TACET_SHARE, noteKey, 'share-pass-42');
+await A('分享包裹前綴 jrsw.', shareWrapped.wrapped.startsWith('jrsw.'));
+await A('分享 salt = 16B hex', /^[0-9a-f]{32}$/.test(shareWrapped.salt));
+const shareUnwrapped = await unwrapNoteKeyShare(TACET_SHARE, shareWrapped.wrapped, 'share-pass-42', shareWrapped.salt);
+await A('jrsw unwrap 等值 noteKey（extractable 再 export）',
+  shareUnwrapped !== null && hex(new Uint8Array(await crypto.subtle.exportKey('raw', shareUnwrapped))) === origRaw);
+await A('分享錯密語 → null', (await unwrapNoteKeyShare(TACET_SHARE, shareWrapped.wrapped, 'wrong-share-pass', shareWrapped.salt)) === null);
+await A('分享錯 salt → null', (await unwrapNoteKeyShare(TACET_SHARE, shareWrapped.wrapped, 'share-pass-42', 'zz'.repeat(16))) === null);
+await A('分享 malformed salt（zz 字元）→ null（t_7710c766：salt1 hex 形檢查）',
+  (await unwrapNoteKeyShare(TACET_SHARE, shareWrapped.wrapped, 'share-pass-42', '0'.repeat(31) + 'z')) === null);
+await A('分享 payload 長度不符 → null',
+  (await unwrapNoteKeyShare(TACET_SHARE, shareWrapped.wrapped.slice(0, -3) + 'abc', 'share-pass-42', shareWrapped.salt)) === null);
+await A('未配置 wrapShare → 分享解包 null（opt-in 拒絕面）',
+  (await unwrapNoteKeyShare(TACET, shareWrapped.wrapped, 'share-pass-42', shareWrapped.salt)) === null);
+await A('本機包裹 roundtrip 經 loadLocalWrap 通路（clearLocalWrap 在場面）',
+  (async () => { await storeLocalWrap(TACET, localIdentity, noteKey); return true; })());
+await A('clearLocalWrap 摘除本機包裹', (() => { clearLocalWrap(TACET, localIdentity); return TACET.store.get(TACET.store.noteKeyWrap(localIdentity)) === null; })());
+await A('buildBindPayload 四件套輸出面（wrapped/wrappedRec/recTokenHash 同 wrapNoteKey 直呼）',
+  (async () => {
+    const p = await buildBindPayload(TACET, noteKey, pass, recToken, identityA);
+    return p.wrapped.startsWith('jr1w.') && p.wrappedRec.startsWith('jr1w.') &&
+      /^[0-9a-f]{32}$/.test(p.salt) && /^[0-9a-f]{64}$/.test(p.recTokenHash);
+  })());
+await A('buildBindPayload unwrap 等值 noteKey（wrapped 面救得回）',
+  (async () => {
+    const p = await buildBindPayload(TACET, noteKey, pass, recToken, identityA);
+    const k = await unwrapNoteKey(TACET, p.wrapped, pass, p.salt);
+    return k !== null && hex(new Uint8Array(await crypto.subtle.exportKey('raw', k))) === origRaw;
+  })());
+const bindPayloadProbe = await buildBindPayload(TACET, noteKey, pass, recToken, identityA);
+await A('[14] buildBindPayload wrappedRec 去重帳（p.wrappedRec ≠ p.wrapped＋rec 套件 unwrapNoteKeyWithRecToken 救回 origRaw）',
+  (async () => {
+    if (bindPayloadProbe.wrappedRec === bindPayloadProbe.wrapped) return false;
+    const kRec = await unwrapNoteKeyWithRecToken(TACET, bindPayloadProbe.wrappedRec, recToken, identityA);
+    return kRec !== null && hex(new Uint8Array(await crypto.subtle.exportKey('raw', kRec))) === origRaw;
+  })());
+await A('[14] buildBindPayload recTokenHash 去重帳（p.recTokenHash === recTokenHash(recToken) 恆等；錯綁 passphrase 即 RED）',
+  bindPayloadProbe.recTokenHash === (await recTokenHash(recToken)) && bindPayloadProbe.recTokenHash !== (await recTokenHash(pass)));
 const bareCfgLocal: NoteCryptoConfig = { ...TACET }; // 無 cipherLocal 欄
 let localCfgThrow = '';
 try { await encryptLocal(bareCfgLocal, noteKey, '{}', 'jr1:n1'); } catch (e) { localCfgThrow = (e as Error).message; }
@@ -506,6 +571,559 @@ await A('配置 guest → decryptNote 舊明文相容層原樣（既有契約不
 await A('既有 guest 配置 roundtrip 不受選配收編影響',
   (await decryptNote(TACET, makeHeldKey(), cipherGuest, 'noteId:n1', { current: () => identityA })) === note);
 
+// guest 空 identity 拒絕面（t_7710c766 目標 3）：K_u = SHA-256(prefix ‖ '') 靜默產出「空帳號金鑰」是誤配炸彈
+const TACET_GUESTOK: NoteCryptoConfig = { ...TACET }; // cipherGuest='jr1g.' 在場，專測 identity 面
+const emptyIdp = { current: () => '' };
+let emptyIdMsg: string | null = null;
+try { await encryptNote(TACET_GUESTOK, makeHeldKey(), note, 'noteId:n1', emptyIdp); } catch (e) { emptyIdMsg = (e as Error).message; }
+await A("guest 加密面空 identity → throw ERR_NO_IDENTITY（falsy 一體：空字串/undefined/null）",
+  emptyIdMsg === 'ERR_NO_IDENTITY');
+// 空白 '  ' 是 truthy：K_u 照派生＝加密面照常（呼叫端責任面）；誠實界線＝「非 falsy 不擋」的行為證據
+let wsCipher = '';
+try { wsCipher = await encryptNote(TACET_GUESTOK, makeHeldKey(), note, 'noteId:n1', { current: () => '  ' }); } catch { /* 不該發生 */ }
+await A('guest 空白 identity 是 truthy → 照派生不擋（非 falsy 不拒的誠實界線；行為面）', wsCipher.startsWith('jr1g.'));
+await A('guest 解密面空 identity → null（對稱面 fail-closed）',
+  (await decryptNote(TACET_GUESTOK, makeHeldKey(), cipherGuest, 'noteId:n1', emptyIdp)) === null);
+await A('guest 空 identity 的既有 roundtrip 恆正常（identity 在場零新拒絕面）',
+  (await decryptNote(TACET_GUESTOK, makeHeldKey(), cipherGuest, 'noteId:n1', { current: () => identityA })) === note);
+
+// 畸形配置 ''（空字串）正規化面（follow-up ②，t_44239f5f）：空字串前綴＝startsWith('') 恆真，
+// bound 列會被誤導 guest 分支回 null。正規化後：加密面與未配置同拒、解密面 bound 照解、
+// guest 密文（他家族形）null——與「未配置」行為完全同構。
+const TACET_EMPTYGUEST: NoteCryptoConfig = { ...TACET, cipherGuest: '' };
+await A("畸形 guest 前綴 '' → encryptNote guest 路徑同 ERR_GUEST_NOT_CONFIGURED（truthiness 對稱）",
+  (await (async () => { try { await encryptNote(TACET_EMPTYGUEST, makeHeldKey(), note, 'noteId:n1', { current: () => identityA }); return null; } catch (e) { return (e as Error).message; } })()) === 'ERR_GUEST_NOT_CONFIGURED');
+await A("畸形 guest 前綴 '' → decryptNote bound 密文照解（不誤導 guest 分支回 null）",
+  (await decryptNote(TACET_EMPTYGUEST, heldBound, cipherBound, 'noteId:n1', { current: () => identityA })) === note);
+await A("畸形 guest 前綴 '' → decryptNote guest 密文 null（guest 家族整面拒絕）",
+  (await decryptNote(TACET_EMPTYGUEST, makeHeldKey(), cipherGuest, 'noteId:n1', { current: () => identityA })) === null);
+await A("畸形 guest 前綴 '' → decryptNote 舊明文相容層同「未配置」形（null，不當明文）",
+  (await decryptNote(TACET_EMPTYGUEST, makeHeldKey(), '純舊明文', 'x', { current: () => identityA })) === null);
+
+// ── 12. 伺服器端原語（t_7710c766 目標 8：makeInboundCipher/validWrappedKey/pickKeyPackage/
+//         checkRate/timingSafeEq）＋ 本機鎖定全函式（pinlock jr1p.，目標 8） ──────────
+
+console.log('\n[12] 伺服器端原語（auth/ratelimit/hash）＋ 本機鎖定（pinlock）');
+// ratelimit 行為面（t_b91ed07f；r2 MAJOR-2 收口）：真 node:sqlite 直載 UPSERT…RETURNING 單句，
+// 行為斷言全數「真生產函式 checkRate 直驅」——D1 形 shim 包 node:sqlite 只做 D1 run() 的
+// {results} 回帶形，無測試端 glue 副本。表名直插 SQL＝注入面驗證；放行判準 count<=max
+// 單一真相。同 IP 真併發不 undercount 的 D1 活線證據見卡 comments（wrangler dev 探針：
+// UPSERT…RETURNING 於 wrangler 4.129.0 workerd 逐發回真值；併發首發兩發計數 1→2）。
+type RateRow = { ip: string; window_start: number; count: number };
+const RATE: RateWindow = { table: 'login_rate', windowMs: 60_000, max: 3 };
+const makeRateDb = (): {
+  db: {
+    exec: (s: string) => void;
+    prepare: (s: string) => { all: (...p: unknown[]) => Array<Record<string, unknown>>; get: (...p: unknown[]) => Record<string, unknown> | undefined };
+  };
+  row: (ip: string) => RateRow | undefined;
+  runRaw: (sql: string) => void;
+  check: (ip: string) => Promise<boolean>;
+} => {
+  const { DatabaseSync } = (globalThis as unknown as {
+    process?: { getBuiltinModule?: (id: string) => { DatabaseSync?: unknown } };
+  }).process?.getBuiltinModule?.('node:sqlite') ?? {};
+  if (!DatabaseSync) throw new Error('ERR_SQLITE_UNAVAILABLE');
+  const db = new (DatabaseSync as new (p: string) => {
+    exec: (s: string) => void;
+    prepare: (s: string) => { all: (...p: unknown[]) => Array<Record<string, unknown>>; get: (...p: unknown[]) => Record<string, unknown> | undefined };
+  })(':memory:');
+  db.exec('CREATE TABLE login_rate (ip TEXT PRIMARY KEY, window_start INTEGER, count INTEGER)');
+  return {
+    db,
+    row: (ip: string) =>
+      db.prepare('SELECT * FROM login_rate WHERE ip = ?').get(ip) as RateRow | undefined,
+  runRaw: (sql) => db.exec(sql),
+    // 真 checkRate 直驅：?1/?2/?3 有名參數語意在 node:sqlite 與 workerd 一致（端對端探針實證，見卡 comments）。
+    check: (ip) =>
+      checkRate(
+        {
+          DB: {
+            prepare: (sql: string) => ({
+              bind: (...p: unknown[]) => ({
+                run: async () => ({ results: db.prepare(sql).all(...p), meta: {} }),
+              }),
+            }),
+          },
+        } as unknown as Parameters<typeof checkRate>[0],
+        RATE,
+        ip,
+      ),
+  };
+};
+await A('rate：真 checkRate 窗內首發 pass（D1-shim 直驅；RETURNING n=1）', await (async () => {
+  const r = makeRateDb();
+  return (await r.check('ip-1')) === true && JSON.stringify(r.row('ip-1'))?.includes('"count":1');
+})());
+await A('rate：同 IP 連發衝突臂計數 1→2（UPSERT 單句原子——同鍵衝突逐發累計不 undercount；真併發面由 D1 活線探針承載見卡 comments）', await (async () => {
+  const r = makeRateDb();
+  return (await r.check('ip-c')) === true && (await r.check('ip-c')) === true && r.row('ip-c')?.count === 2;
+})());
+await A('rate：同 IP 三發 pass、第四發 reject（真 checkRate；放行判準 count<=max）', await (async () => {
+  const r = makeRateDb();
+  const seq = [await r.check('ip-3'), await r.check('ip-3'), await r.check('ip-3'), await r.check('ip-3')];
+  return seq[0] === true && seq[1] === true && seq[2] === true && seq[3] === false;
+})());
+await A('rate：真 checkRate 窗口過期整窗重置（舊窗 seed→重置發放行且 n=1 不吃 max 帽；window_start 換新至真時鐘）', await (async () => {
+  const r = makeRateDb();
+  r.runRaw("INSERT INTO login_rate (ip, window_start, count) VALUES ('ip-w', 1000, 99)");
+  const ok = (await r.check('ip-w')) === true;
+  const row = r.row('ip-w');
+  return ok && row?.count === 1 && (row?.window_start ?? 0) > 1_700_000_000_000;
+})());
+await A('rate：真 checkRate count 不封頂（超額發照實累計 6——審計可見非靜默吞）', await (async () => {
+  const r = makeRateDb();
+  for (let i = 0; i < 6; i++) await r.check('ip-m');
+  return r.row('ip-m')?.count === 6;
+})());
+await A('rate：真 checkRate 他 IP 隔離（計數互不干擾）', await (async () => {
+  const r = makeRateDb();
+  await r.check('ip-a');
+  await r.check('ip-b'); await r.check('ip-b');
+  return r.row('ip-a')?.count === 1 && r.row('ip-b')?.count === 2;
+})());
+await A('rate：checkRate 呼叫端形（env.DB.prepare→bind→run；餵 D1 的 SQL 直插面）＋fail-open', await (async () => {
+  const calls: string[] = [];
+  const env12 = { DB: {
+    prepare: (sql: string) => ({
+      bind: (..._p: unknown[]) => ({ run: async () => { calls.push(sql); throw new Error('D1_DOWN'); } }),
+    }),
+  } };
+  const ok = await checkRate(env12 as unknown as Parameters<typeof checkRate>[0], RATE, 'ip-fail');
+  return ok === true && calls.length === 1 && calls[0].startsWith('INSERT INTO') && calls[0].includes('RETURNING');
+})());
+await A('rate：表名注入拒絕（直插 SQL 面）', await (async () => {
+  try { await checkRate({ DB: { prepare: () => { throw new Error('SHOULD_NOT_PREPARE'); } } } as unknown as Parameters<typeof checkRate>[0], { table: 'x; DROP TABLE users--', windowMs: 1000, max: 3 }, 'ip'); return false; }
+  catch (e) { return String((e as Error).message).startsWith('ERR_RATE_TABLE_NAME'); }
+})());
+await A('rate：表名 \\w 合法（字母數字底線）', await (async () => {
+  try { await checkRate({ DB: { prepare: () => { throw new Error('D1_DOWN_FAILOPEN'); } } } as unknown as Parameters<typeof checkRate>[0], { table: 'login_rate_2', windowMs: 1000, max: 3 }, 'ip'); return true; }
+  catch (e) { return String((e as Error).message).startsWith('ERR_RATE_TABLE_NAME') === false && String((e as Error).message).includes('D1_DOWN_FAILOPEN'); }
+})());
+await A('rate：RETURNING 異形回應守衛 fail-open（results 空／alias 斷裂——與儲存故障同向，r2 MINOR-3 不反向 deny）', await (async () => {
+  const mkEnv = (run: () => Promise<unknown>) =>
+    ({ DB: { prepare: () => ({ bind: () => ({ run }) }) } } as unknown as Parameters<typeof checkRate>[0]);
+  const empty = await checkRate(mkEnv(async () => ({ results: [] })), RATE, 'ip');
+  const alias = await checkRate(mkEnv(async () => ({ results: [{ m: 1 }] })), RATE, 'ip');
+  return empty === true && alias === true;
+})());
+await A('rate：SQL_RATE_BUMP 常數形（UPSERT…RETURNING…count AS n；{table} 佔位）',
+  /^INSERT INTO \{table\} \(ip, window_start, count\) VALUES \(\?1, \?2, 1\)\n\s+ON CONFLICT\(ip\) DO UPDATE SET\n\s+count\s+= CASE WHEN window_start <= \?3 THEN 1 ELSE count \+ 1 END,\n\s+window_start = CASE WHEN window_start <= \?3 THEN \?2 ELSE window_start END\n\s+RETURNING count AS n$/.test(SQL_RATE_BUMP));
+await A('AUTH_RATE 契約（60s 窗 max 10）', AUTH_RATE.windowMs === 60_000 && AUTH_RATE.max === 10);
+const sessA = generateSessionToken();
+const sessB = generateSessionToken();
+await A('generateSessionToken hex64', /^[0-9a-f]{64}$/.test(sessA));
+await A('generateSessionToken 兩次相異', sessA !== sessB);
+await A('timingSafeEq 等值 true', timingSafeEq(sessA, sessA));
+await A('timingSafeEq 異值 false', timingSafeEq(sessA, sessB) === false);
+await A('timingSafeEq 長度異 false', timingSafeEq(sessA, sessA.slice(0, 32)) === false);
+await A('timingSafeEq 空串等值', timingSafeEq('', ''));
+await A('timingSafeEq 空串異值 false', !timingSafeEq('', 'x'));
+
+const formats: CipherFormats = { cipherPrefixes: ['jr1u.', 'jr1b.'], wrapPrefix: 'jr1w.', cipherMax: 5000 };
+const inbound = makeInboundCipher(formats);
+await A('inboundCipher：前綴密文原樣入庫', inbound('jr1b.' + b64(new Uint8Array(32))) === 'jr1b.' + b64(new Uint8Array(32)));
+await A('inboundCipher：超限密文丟棄（截斷必壞）', inbound('jr1b.' + b64(new Uint8Array(4000))) === null);
+await A('inboundCipher：超限明文截到上限照收', inbound('字'.repeat(7000))?.length === 5000);
+await A('inboundCipher：b64 慣例照收', inbound(b64(new Uint8Array(64))) !== null);
+await A('inboundCipher：控制字元垃圾丟棄', inbound('bad\x00junk') === null);
+await A('inboundCipher：真明文照收', inbound('純明文') === '純明文');
+await A('inboundCipher：非字串 null', inbound(42) === null);
+await A('isCipherFor：家族前綴 true／非家族 false',
+  isCipherFor('jr1b.abc', formats) && isCipherFor('jr1u.abc', formats) && !isCipherFor('jr2x.abc', formats));
+await A('isCipherFor 空字首組態 → false（\x27\x27 態 startsWith(\x27\x27) 恆真 accept-all——run 574 MINOR-3：cipherPrefixRe 守衛不覆蓋直讀 tuple 面，同向收口；非字串 false 契約照舊）',
+  (() => {
+    const emptyTuple: CipherFormats = { cipherPrefixes: ['', ''], wrapPrefix: 'jr1w.', cipherMax: 5000 };
+    const mixed: CipherFormats = { cipherPrefixes: ['', 'jr1b.'], wrapPrefix: 'jr1w.', cipherMax: 5000 };
+    return isCipherFor('jr1g.abc', emptyTuple) === false && isCipherFor('純明文', emptyTuple) === false &&
+      isCipherFor('jr1g.abc', mixed) === false && // 混合形：空槽摘除、真前綴面承載
+      isCipherFor('jr1b.abc', mixed) === true && // 真前綴面零誤傷
+      isCipherFor(null, formats) === false; // 非字串 false 面（typed 形合法態；運行時 typeof 守衛承載 unknown 呼叫端）
+  })());
+await A('makeInboundCipher regex 跳脫全字面（r2 MAJOR-1 辨別形重推——探針新舊碼輸出一手實測，兩向分歧各一）',
+  (() => {
+    // 舊碼 .replace('.','\\.') 只跳第一個點，前綴含 regex 符號（| ( )）時家族 regex 失真，
+    // 兩方向輸出分歧（一手對照探針帳面：tmp probe-d1.cjs，main 舊碼 vs 分支新碼）：
+    // ①完整前綴形『a.b|c()』+A*600（真家族密文標記）：正碼辨得前綴 → >max 密文丟棄 null；
+    //   舊碼 regex 辨不出自家前綴 → 誤落明文截斷（>max 密文截半損毀＝舊碼 slice(0,500)）。
+    // ②點前截形『a.b』+A*600：舊碼 a\.b 殘臂（從頭起 b64 全程）誤咬 → 丟棄 null；
+    //   正碼前綴不完整非家族 → 明文截斷照收 slice(0,500)。兩形缺一即探針無齒（r1 教訓）。
+    const f: CipherFormats = { cipherPrefixes: ['a.b|c()', 'jr1b.'], wrapPrefix: 'jr1w.', cipherMax: 500 };
+    const m = makeInboundCipher(f);
+    const full = 'a.b|c()' + 'A'.repeat(600);
+    const dotHead = 'a.b' + 'A'.repeat(600);
+    return m(full) === null && m(dotHead) === dotHead.slice(0, 500);
+  })());
+// N-7（t_580f9c54）：cipherPrefixRe 空字首組態毒形——never-match 守衛的行為面。
+// run 574 r2 校正（新舊碼組裝對照一手實測 /tmp/t580f9c54-r2/n7-corrected-probe.mjs）：舊碼
+// `[]` 與 `['']` 組裝出 byte-identical `^()[A-Za-z0-9+/]+={0,2}$`（join('|') 同為空串），
+// `['','']` 僅多空首選交替 `^(|)…`＝同面——真洞＝無點純 b64 串（≤200）在舊碼
+// validWrappedKey/pickKeyPackage 放行（NON-NULL）；帶點前綴向量（'jr1w.'+b64）舊碼本就 null
+// （'.' 在 b64 charset 外）＝帳面無承載。r1 版敘事（charset 恆假自帶防線／空槽首選交替洞）經
+// run 574 一手實證俱誤——本段已按實測帳重寫（revert-poison 案為守衛還原面的直接承載）。
+// 守衛後（usable 過濾＋never-match）：家族/re 面整面拒絕；inboundCipher 輸出面 zero delta
+// （家族路摘除後長路徑 b64≤max 短路進 legacy 慣例層、超限丟棄、明文相容層照收——出口與舊碼
+// RE 路徑恆等，probe 33 組合實證）；混合『['','jr1b.']』形只摘空槽、真前綴家族面照活（降級非全拒）。
+await A('N-7 真洞還原面：無點純 b64 ≤200 空字首組態 → null（cipherPrefixRe never-match——守衛摘除即翻紅；三組態）',
+  (() => {
+    const pureB64 = b64(new Uint8Array(32)); // 無點 b64（44 字符）——舊碼本就放行＝真洞載體（帶點向量舊碼本就 null，無承載）
+    const emptyTuple = ['', ''];
+    return validWrappedKey(pureB64, []) === null &&
+      validWrappedKey(pureB64, emptyTuple) === null &&
+      validWrappedKey(pureB64, '') === null; // string 形空前綴同面
+  })());
+await A('N-7 pickKeyPackage 空字首組態 → 整組放棄（validWrappedKey never-match 傳播——wrapped/salt 同 null）',
+  (() => {
+    const p = pickKeyPackage({ wrapped: b64(new Uint8Array(32)), salt: 'a'.repeat(32) }, ['', '']);
+    return p.wrapped === null && p.salt === null;
+  })());
+await A('inboundCipher 空字首組態：輸出面 zero delta（family RE 摘除後長路徑 b64≤max 落 legacy 慣例層、超限丟棄、明文相容層照收——probe 33 組合實證舊≡新，僅路徑歸層從家族 RE 移到 b64 慣例層）',
+  (() => {
+    const mEmpty = makeInboundCipher({ cipherPrefixes: ['', ''], wrapPrefix: 'jr1w.', cipherMax: 500 });
+    const mOneEmpty = makeInboundCipher({ cipherPrefixes: ['', 'jr1b.'], wrapPrefix: 'jr1w.', cipherMax: 500 });
+    const plain = '純明文日記內容';
+    const pureB64 = b64(new Uint8Array(32)); // 44 字符 >40＝legacy b64 慣例面（家族路拒絕後的唯一去處）
+    return mEmpty(plain) === plain.slice(0, 500) && // 明文相容層照收（家族守衛不誤傷 prefix 無關面）
+      mEmpty(pureB64) === pureB64 && // 家族路摘除後 b64 落 legacy 慣例層（與舊碼 RE+慣例短路出口恆等）
+      mOneEmpty('jr1b.' + b64(new Uint8Array(32))) === 'jr1b.' + b64(new Uint8Array(32)) && // 混合形只摘空槽——真前綴家族面照活
+      mOneEmpty(plain) === plain.slice(0, 500);
+  })()); // 真前綴放行面對照＝下兩案「validWrappedKey：合法包裹／pickKeyPackage：成對成立」（同體放行帳，不另立重複案）
+await A('validWrappedKey：合法包裹 true／超長 null／非法前綴 null',
+  validWrappedKey('jr1w.' + b64(new Uint8Array(32)), 'jr1w.') !== null &&
+  validWrappedKey('jr1w.' + b64(new Uint8Array(300)), 'jr1w.') === null &&
+  validWrappedKey('jr9x.' + b64(new Uint8Array(32)), 'jr1w.') === null);
+await A('validHash64／validSalt 形狀', validHash64('a'.repeat(64)) !== null && validHash64('zz') === null && validSalt('a'.repeat(32)) !== null && validSalt('zz') === null);
+const pkgOk = pickKeyPackage({ wrapped: 'jr1w.' + b64(new Uint8Array(32)), salt: 'a'.repeat(32) }, 'jr1w.');
+await A('pickKeyPackage：成對成立', pkgOk.wrapped !== null && pkgOk.salt !== null);
+await A('pickKeyPackage：缺 salt 整組放棄',
+  (() => { const p = pickKeyPackage({ wrapped: 'jr1w.' + b64(new Uint8Array(32)) }, 'jr1w.'); return p.wrapped === null && p.salt === null; })());
+await A('pickKeyPackage：缺 wrapped 整組放棄',
+  (() => { const p = pickKeyPackage({ salt: 'a'.repeat(32) }, 'jr1w.'); return p.wrapped === null && p.salt === null; })());
+await A('pickKeyPackage：錯前綴整組放棄',
+  (() => { const p = pickKeyPackage({ wrapped: 'jr9x.' + b64(new Uint8Array(32)), salt: 'a'.repeat(32) }, 'jr1w.'); return p.wrapped === null; })());
+
+// 本機鎖定（jr1p.）：全函式 roundtrip＋嚴格檢查面（t_7710c766：pinlock 閘本有斷言缺席）
+const PINLOCK: PinLockConfig = { pinLock: 'jr1p.', pinLockSaltPrefix: 'tacet-pinlock-v1:', pinLockAad: 'notekey-pinlock' };
+const pinWrapped = await wrapNoteKeyPinLock(PINLOCK, noteKey, '2580ab');
+await A('jr1p 包裹前綴 jr1p.', pinWrapped.startsWith('jr1p.'));
+const pinUnwrapped = await unwrapNoteKeyPinLock(PINLOCK, pinWrapped, '2580ab');
+await A('jr1p unwrap 等值 noteKey（extractable 再 export）',
+  pinUnwrapped !== null && hex(new Uint8Array(await crypto.subtle.exportKey('raw', pinUnwrapped))) === origRaw);
+await A('jr1p 錯 PIN → null', (await unwrapNoteKeyPinLock(PINLOCK, pinWrapped, '999999')) === null);
+await A('jr1p 空 PIN unwrap → null（解包面誠實拒絕）', (await unwrapNoteKeyPinLock(PINLOCK, pinWrapped, '  ')) === null);
+await A('jr1p PIN 大小寫/空白正規化等價', (await unwrapNoteKeyPinLock(PINLOCK, pinWrapped, ' ２５８０ＡＢ ')) !== null);
+await A('jr1p 空_PIN wrap 拒絕形', await (async () => {
+  try { await wrapNoteKeyPinLock(PINLOCK, noteKey, ''); return false; } catch (e) { return (e as Error).message === 'ERR_PINLOCK_EMPTY'; }
+})());
+await A('jr1p 未配置 cfg → wrap 拒絕（opt-in 律）', await (async () => {
+  try { await wrapNoteKeyPinLock({}, noteKey, '2580ab'); return false; } catch { return true; }
+})());
+await A('jr1p 未配置 cfg → unwrap null',
+  (await unwrapNoteKeyPinLock({ pinLock: 'jr1p.' }, pinWrapped, '2580ab')) === null);
+await A('jr1p payload 竄改 pinSalt 區 → null（自描述完整性）', await (async () => {
+  const bytes = unb64Mod(pinWrapped.slice('jr1p.'.length)); bytes[3] ^= 0x01;
+  return (await unwrapNoteKeyPinLock(PINLOCK, 'jr1p.' + b64(bytes), '2580ab')) === null;
+})());
+await A('jr1p payload 竄改 ct 尾 → null', await (async () => {
+  const bytes = unb64Mod(pinWrapped.slice('jr1p.'.length)); bytes[bytes.length - 1] ^= 0x01;
+  return (await unwrapNoteKeyPinLock(PINLOCK, 'jr1p.' + b64(bytes), '2580ab')) === null;
+})());
+await A('jr1p 跨家族：jr1w. 字串餵 pinlock → null',
+  (await unwrapNoteKeyPinLock(PINLOCK, wrapped, '2580ab')) === null);
+await A('jr1p 跨家族：jr1p. 字串餵 jr1w unwrap → null',
+  (await unwrapNoteKey(TACET2, pinWrapped, pass, salt)) === null);
+
+// ── 13. 新契約面（t_7710c766：hex fail-closed／salt hex 形收口／PH1 鹽注入／錯誤碼語意分離） ──
+
+console.log('\n[13] unwrap 驗證統一新契約（fail-closed ＋ 語意分離）');
+// hexToBytes fail-closed（目標 #2；note-crypto 與 bip39 同步——bip39 面是 HEX64_RE 前置自守）
+await A('hexToBytes 合法輸出不變（舊碼同值；新向量）', hexToBytes('00ff10').join(',') === '0,255,16');
+await A('hexToBytes 大小寫正規化（新行為，舊碼同值）', (() => { const a = Array.from(hexToBytes('AB')); const b = Array.from(hexToBytes('ab')); return a.length === b.length && a.every((v, i) => v === b[i]); })());
+await A("hexToBytes 非法字元 'zz' → throw ERR_BAD_HEX", await (async () => {
+  try { hexToBytes('zz'); return false; } catch (e) { return (e as Error).message === 'ERR_BAD_HEX'; }
+})());
+await A('hexToBytes 奇數長度 → throw', await (async () => {
+  try { hexToBytes('abc'); return false; } catch (e) { return (e as Error).message === 'ERR_BAD_HEX'; }
+})());
+await A('hexToBytes 空字串 → throw', await (async () => {
+  try { hexToBytes(''); return false; } catch (e) { return (e as Error).message === 'ERR_BAD_HEX'; }
+})());
+await A(`hexToBytes 全形正規化（'${'ｆｆ'}'）→ Bytes [255] 等值`, (() => { try { return Array.from(hexToBytes('ｆｆ')).join(',') === '255'; } catch { return false; } })());
+await A(`hexToBytes 全形數字（'２ｆ'）→ Bytes 等值（NFKC 窗殲滅——round 1 MINOR-4：parse 原始串 NaN 歸零殘形）`, (() => { try { return Array.from(hexToBytes('２ｆ')).join(',') === '47'; } catch { return false; } })());
+await A('bip39 hexToBytes 同步（HEX64_RE 自守前提下的舊向量不變）', (await bip.recTokenToWords('ab'.repeat(32)))?.length === 24);
+await A('unwrap：鹽 hex 非法字元 → 假錯誤誘餌面 null（原碼靜默歸零會錯誤炸出成功路徑）',
+  (await unwrapNoteKey(TACET2, dual.wrapped, passD, 'a'.repeat(31) + 'z')) === null);
+await A('unwrapNoteKeyDual：salt1 hex 非法字元 ' + 'z' + ' → null（鹽內嵌族 own 檢查照舊——收口本體=鹽外置族）',
+  (await unwrapNoteKeyDual(TACET2, dual.wrapped, passD, pinD, 'a'.repeat(31) + 'z')) === null);
+await A('unwrapNoteKeyDual：salt1 hex 奇數長 → null', (await unwrapNoteKeyDual(TACET2, dual.wrapped, passD, pinD, 'a'.repeat(31))) === null);
+await A('unwrapNoteKey3：salt hex 形檢查照舊（既有契約不變）',
+  (await unwrapNoteKey3(TACET3, w3.wrapped, pass, 'a'.repeat(31) + 'z')) === null);
+// 舊碼（無 rawHex 長度/形檢）下 32-hex 假 noteKey 與 'zz' 前綴零化 hex 皆 NON-NULL＝假金鑰生產器。
+const craftKek = (async (): Promise<CryptoKey> => {
+  // deriveKek 鏡像（未匯出）：PBKDF2-SHA256(pass, salt, 600k) → AES-GCM-256。
+  const keyMat = await crypto.subtle.importKey('raw', enc.encode(pass), 'PBKDF2', false, ['deriveKey']);
+  return crypto.subtle.deriveKey({ name: 'PBKDF2', salt: hexToBytes(salt) as BufferSource, iterations: PBKDF2_ITERATIONS, hash: 'SHA-256' }, keyMat, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+})();
+// 鍛造面（格式嚴格契約的可觀察承載；毒化前提）：KEK 已知者可造任意形 payload——
+// 舊碼（無 rawHex 長度/形檢）下 'zz' 前綴零化 hex 與 32-hex 假 noteKey 皆 NON-NULL＝假金鑰生產器。
+// round 1 審查 MAJOR-1 校正：鍛造 encrypt 必帶 additionalData('notekey')＝與 decryptWithKey
+// 同 AAD——缺 AAD 的鍛造 GCM 層恆拒＝rawHex 形檢從未執行（斷言空轉）。
+// craftKek 鏡像真 deriveKek（同 pass 同 salt 同 600k）＝鍛造鏈與真 unwrap 同 KEK：
+// 有效形鍛造真解開（NON-NULL 自證鏈活）、畸形形由各檢查點拒——機制面直接可觀察。
+// AAD 單一化（r2 NIT-a）：F_AAD 是四鍛造向量唯一 AAD 源（對 decryptWithKey 同 AAD 律的 helper 收口）。
+const F_AAD: BufferSource = enc.encode('notekey');
+await A('MAJOR-1 機制面：帶 AAD 鍛造 ct 可解回 rawHex（形檢層可達＝斷言活）', await (async () => {
+  const kekC = await craftKek;
+  const ivC = crypto.getRandomValues(new Uint8Array(12));
+  const ctC = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv: ivC, additionalData: F_AAD }, kekC, enc.encode('zz' + 'a'.repeat(62)) as BufferSource));
+  return (await decryptWithKey(kekC, new Uint8Array([...ivC, ...ctC]), 'notekey')) === 'zz' + 'a'.repeat(62);
+})());
+await A('MAJOR-1 空轉形：同 payload 無 AAD 鍛造 → decryptWithKey null（GCM 層恆拒＝round 1 空轉病理）', await (async () => {
+  const kekC = await craftKek;
+  const ivC = crypto.getRandomValues(new Uint8Array(12));
+  const ctC = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv: ivC }, kekC, enc.encode('zz' + 'a'.repeat(62)) as BufferSource));
+  return (await decryptWithKey(kekC, new Uint8Array([...ivC, ...ctC]), 'notekey')) === null;
+})());
+await A('鍛造有效形 92B payload（64-hex 假 noteKey）→ NON-NULL（鍛造鏈自證：真解到 importAesGcm＝假金鑰真產出）', await (async () => {
+  const kekC = await craftKek;
+  const ivC = crypto.getRandomValues(new Uint8Array(12));
+  const ctC = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv: ivC, additionalData: F_AAD }, kekC, enc.encode('ab'.repeat(32)) as BufferSource));
+  const p = new Uint8Array(12 + ctC.byteLength); p.set(ivC, 0); p.set(ctC, 12);
+  const k = await unwrapNoteKey(TACET, 'jr1w.' + b64(p), pass, salt);
+  if (k === null) return false;
+  const raw = new Uint8Array(await crypto.subtle.exportKey('raw', k));
+  return raw.length === 32 && raw.every((b: number) => b === 0xab);
+})());
+await A('鍛造 92B payload 的零化 hex rawHex（zz 前綴）→ null（rawHex HEX_RE 形檢＋hexToBytes fail-closed 雙層——單摘任一被次層接住，P2 同摘 6F 才翻；帶 AAD 真解後形檢拒）', await (async () => {
+  const kekC = await craftKek;
+  const ivC = crypto.getRandomValues(new Uint8Array(12));
+  const ctC = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv: ivC, additionalData: F_AAD }, kekC, enc.encode('zz' + 'a'.repeat(62)) as BufferSource));
+  const p = new Uint8Array(12 + ctC.byteLength); p.set(ivC, 0); p.set(ctC, 12);
+  return (await unwrapNoteKey(TACET, 'jr1w.' + b64(p), pass, salt)) === null;
+})());
+// 短 payload 鍛造（60B：iv+ct(hex32假 noteKey)）→ null：openNoteKey 嚴格長度檢的可觀察承載
+//（僅 hexToBytes fail-closed 擋不住「合法 hex 的假 32B 金鑰」——長度檢獨立承載）。
+await A('鍛造 60B payload（合法 hex 32B 假 noteKey，帶 AAD）→ null（openNoteKey 嚴格 92B 長度檢＋rawHex 64B 長度雙層——P1b 同摘才翻）', await (async () => {
+  const kekC = await craftKek;
+  const ivC = crypto.getRandomValues(new Uint8Array(12));
+  const ctC = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv: ivC, additionalData: F_AAD }, kekC, enc.encode('ab'.repeat(16)) as BufferSource));
+  const p = new Uint8Array(12 + ctC.byteLength); p.set(ivC, 0); p.set(ctC, 12);
+  return (await unwrapNoteKey(TACET, 'jr1w.' + b64(p), pass, salt)) === null;
+})());
+await A('encryptWithKey 產物餵 unwrap（長度恆不符 60B）→ null（短 payload 鍛造面對照）', await (async () => {
+  const kekC = await craftKek;
+  const short = await encryptWithKey(kekC, 'ab'.repeat(16), 'notekey'); // iv12+ct48 = 60B ≠ 92B
+  return (await unwrapNoteKey(TACET, 'jr1w.' + short, pass, salt)) === null;
+})());
+// guest 空 identity 自洽密文面（P5 的行為承載）：手工以 K_u(prefix‖'') 造密文——
+// 舊碼（守衛缺席）下 deriveGuestKey('')＝同一把「空帳號金鑰」→ 解開＝NON-NULL 假相；
+// 新契約下解密面守衛先擋＝null。這是解密面守衛唯一真咬的行為向量。
+await A('guest 空 identity 自洽密文 → decryptNote null（「空帳號金鑰」整族拒絕＝解密面守衛承載）', await (async () => {
+  const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', enc.encode('tacet-note-u1')));
+  const kuEmpty = await crypto.subtle.importKey('raw', digest, { name: 'AES-GCM' }, false, ['encrypt', 'decrypt']);
+  const cipherEmpty = 'jr1g.' + await encryptWithKey(kuEmpty, note, 'noteId:n1');
+  return (await decryptNote(TACET_GUESTOK, makeHeldKey(), cipherEmpty, 'noteId:n1', emptyIdp)) === null;
+})());
+// 錯誤碼語意分離（目標 6）：空 PIN ≠ 未配置；jr3d 兩 case 同碼分流
+await A('wrapNoteKeyDual 空 PIN → ERR_PIN_EMPTY（非 NOT_CONFIGURED）', await (async () => {
+  try { await wrapNoteKeyDual(TACET2, noteKey, passD, ''); return false; } catch (e) { return (e as Error).message === 'ERR_PIN_EMPTY'; }
+})());
+await A('wrapNoteKeyDual 空 PIN 全形空白正規化後 → ERR_PIN_EMPTY', await (async () => {
+  try { await wrapNoteKeyDual(TACET2, noteKey, passD, '　'); return false; } catch (e) { return (e as Error).message === 'ERR_PIN_EMPTY'; }
+})());
+await A('wrapNoteKeyDual 未配置 wrapDual → ERR_DUAL_NOT_CONFIGURED（契約不變）', await (async () => {
+  try { await wrapNoteKeyDual(TACET, noteKey, passD, pinD); return false; } catch (e) { return (e as Error).message === 'ERR_DUAL_NOT_CONFIGURED'; }
+})());
+await A('wrapNoteKeyDual3 空 PIN → ERR_PIN_EMPTY（t_7710c766：兩 case 同碼分流）', await (async () => {
+  try { await wrapNoteKeyDual3(TACET3, noteKey, passD, ''); return false; } catch (e) { return (e as Error).message === 'ERR_PIN_EMPTY'; }
+})());
+await A('wrapNoteKeyDual3 未配置 wrapDual3 → ERR_JR3W_NOT_CONFIGURED（契約不變）', await (async () => {
+  try { await wrapNoteKeyDual3({}, noteKey, passD, pinD); return false; } catch (e) { return (e as Error).message === 'ERR_JR3W_NOT_CONFIGURED'; }
+})());
+// PH1 鹽注入（目標 4）：預設舊值零行為變更
+await A('derivePh1Argon 預設鹽零行為變更（同 pass 同值）',
+  (await derivePh1Argon('probe-determinism-pass-42')) === ph1v2a);
+async function srcOf(rel: string): Promise<string> {
+  // node 內建模組動態存取（structured type，零 node types 依賴——argon2.ts getBuiltinModule 母型同構；
+  // TS2591 types 帽下 import('node:fs') 靜態/動態皆炸＝此繞法）
+  const fs = (globalThis as unknown as {
+    process?: { getBuiltinModule?: (id: string) => { readFileSync?: (p: string, enc: string) => string } | undefined };
+  }).process?.getBuiltinModule?.('node:fs');
+  if (!fs?.readFileSync) throw new Error('ERR_FS_UNAVAILABLE');
+  return fs.readFileSync(new URL(rel, import.meta.url).pathname, 'utf8');
+}
+await A('derivePh1Argon 預設分支源碼面 = encode(PH1_V2_SALT)（鹽預設單一真相錨；同-pass 同值斷言對預設值漂移無承載力）',
+  /saltArg \?\? new TextEncoder\(\)\.encode\(PH1_V2_SALT\)/.test(await srcOf('../src/client/argon2.ts')));
+await A('derivePh1Argon 自選鹽 → 不同派生值', (await derivePh1Argon('probe-determinism-pass-42', new Uint8Array(12))) !== ph1v2a);
+await A('derivePh1Argon 自選鹽 hex64 形', /^[0-9a-f]{64}$/.test(await derivePh1Argon('x', new Uint8Array(12))));
+await A('PH1_V2_SALT re-export 在場（index barrel；其他產品可見可注入同源鹽）', PH1_V2_SALT === 'tacet-ph1-v1');
+// index barrel 新匯出（目標 5）：clearLocalWrap/buildBindPayload（review「缺匯出」條誤差已校正＝本卡以閘承載）
+await A('index barrel 匯出 clearLocalWrap/buildBindPayload', await (async () => {
+  const src = await import('../src/index.ts');
+  return typeof src.clearLocalWrap === 'function' && typeof src.buildBindPayload === 'function';
+})());
+// PinLockConfig 死欄退場（t_7710c766）：型別面真齒＝excess-property 探針（round 1 審查 MINOR-3：
+// 舊形 typeof cfg==='object' 恆真空轉）。r2 MINOR-2 實測校正（t_580f9c54；行號帳由 P12 毒化 tsc 輸出承載
+// 而非註解寫死——新增段推移行號＝註解行號帳漂移，NIT-a 同病禁再犯）：required 復活形＝TS2741（PINLOCK
+// 常數面）＋TS2345（未配置兩案），optional 復活形＝舊形探針未帶該欄＝excess-property 檢照不到＝tsc 0 綠——robust 形＝pristine 就在探針字面量帶 `noteKeyExtractable:
+// undefined as never`＋前置 @ts-expect-error：欄位復活任何形（required/optional/false 字面量）都多出待位錯誤＝TS2578 紅；
+// pristine 態錯誤恰由 expect-error 吸收＝全 repo tsc 0 綠（探針字面量缺 false 形欄不另生錯＝零加值面除名）。
+// 本面綠態＝core+tacet 摘欄後編譯綠。@ts-expect-error 常駐在場（robust 形，見上註）；pristine 態恰由其吸收。
+// @ts-expect-error — 死欄退場待位錯誤面（pristine 恰此一待位錯由本指令吸收；欄位復活任何形＝本指令反噬 TS2578＝P12 案紅）
+const _cfgProbe: PinLockConfig = { pinLock: 'jr1p.', pinLockSaltPrefix: 'p:', pinLockAad: 'notekey-pinlock', noteKeyExtractable: undefined as never };
+void _cfgProbe;
+// 壞 b64 面向量（openNoteKey 誠實契約「任何不符恆回 null 不拋」的可觀察承載——round 1 MINOR-5）：
+await A('鍛造壞 base64 面字符 → unwrapNoteKey null（openNoteKey unb64 拋點吞收＝不拋契約；家族面毒化形＝頂層 crash，本面包 try/catch 收乾淨 ✗）', await (async () => {
+  try {
+    return (await unwrapNoteKey(TACET, 'jr1w.' + '!!not-base64!!', pass, salt)) === null;
+  } catch { return false; } // 吞收契約破形（本體或呼叫端漏 catch）＝本面 false 紅，非 runner crash
+})());
+await A('openNoteKey 直接呼叫：壞 base64 → null 不拋（本體吞收點）', await (async () => {
+  const kekC = await craftKek;
+  return (await openNoteKey('jr1w.' + '!!not-base64!!', kekC, 'notekey', 'jr1w.')) === null;
+})());
+
+// ── 14. 效能形契約（卡C t_7361b68c：零行為變更——輸出 byte 等價是合約；錨面咬「形」） ──
+//
+// 效能批的閘承載物理：執行時間不能進閘（機器相依）——咬「並行形在場＋串行殘留歸零」
+// 靜態錨＋「Argon 串行刻意保留」負向＋b64 輸出等價行為面＋Max-Age/sideEffects 字面＋
+// ikm 組裝序行為向量（KAT14 凍結 blob）。執行帳（node 26.8.1 實測，2026-10-04）：
+// buildBindPayload 串行 133-152ms→並行 68-84ms；dual 串行 234→並行 179ms median；
+// b64 4MiB 132-181ms→18ms。瀏覽器帳=review 222ms→27ms。
+
+console.log('\n[14] 效能形契約（buildBindPayload 並行／b64 分塊／argon 禁並行／CORS Max-Age／sideEffects）');
+
+const noteCryptoSrc14 = await srcOf('../src/client/note-crypto.ts');
+const argon2Src14 = await srcOf('../src/client/argon2.ts');
+const corsSrc14 = await srcOf('../src/server/cors.ts');
+await A('[14] buildBindPayload 兩段共用 Promise.all 並行錨（wrapNoteKey＋wrapNoteKeyWithRecToken）',
+  /await Promise\.all\(\[\r?\n\s*wrapNoteKey\(cfg, noteKey, passphrase\),\r?\n\s*wrapNoteKeyWithRecToken\(cfg, noteKey, recToken, identity\)/.test(noteCryptoSrc14));
+await A('[14] deriveKek2 pass/pin 兩段 PBKDF2 共用 Promise.all 並行錨（RHS 指令序面）',
+  /await Promise\.all\(\[\r?\n\s*derivePbkdf2Bits\(passphrase, salt1, PBKDF2_ITERATIONS\),\r?\n\s*derivePbkdf2Bits\(pin,/.test(noteCryptoSrc14));
+await A('[14] deriveKek2Argon 正向串行錨（pass/pin 兩段 deriveArgon2id 串行在場）',
+  /const passBits = await deriveArgon2id\(/.test(argon2Src14) && /const pinBits = await deriveArgon2id\(/.test(argon2Src14));
+await A('[14] argon2 destructure 並行形歸零（舊串行面對稱收口——r2 MAJOR-1 防逆向回歸）',
+  argon2Src14.split('const [passBits, pinBits] = await Promise.all([').length === 1);
+await A('[14] buildBindPayload 舊串行形歸零（await wrapNoteKeyWithRecToken 串行殘留）',
+  !noteCryptoSrc14.includes('await wrapNoteKeyWithRecToken'));
+await A('[14] deriveKek2 舊串行形歸零（串行 passBits 殘留）',
+  !/const passBits = await derivePbkdf2Bits/.test(noteCryptoSrc14));
+// r2 MAJOR-1：並行錨升左手側——destructure 與 Promise.all 相鄰形恰一，對調滑接（pin‖pass）
+// 即 RED（RHS 指令序不變＝原本體並行錨不動，兩錨分工：RHS 面／組件序面）。
+await A('[14] deriveKek2 destructure 左手側恰一（const [passBits, pinBits] ＋ Promise.all 相鄰形——swap 滑接即 RED）',
+  noteCryptoSrc14.split('const [passBits, pinBits] = await Promise.all([').length === 2);
+// MAJOR-1 行為面：bea6ab8 逐值凍結 jr2w. blob（手工 pristine 組裝＝passBits@0‖pinBits@32 序）——
+// destructure 對調滑接產 pin‖pass ikm＝本 blob 不可解（reviewer rev-harm 雙向一手：pristine 自解
+// true／互解 null；r2 樹 A/C/B/D/E/F 六腿同帳，探針存證 kanban 工作區）。凍結定值自足：
+// salt1 'a1'×16／pinSalt 0xb2+i×16／iv 0x44+i×12／raw 'c3'×32／pass/pin 明寫——重放＝按定值
+// 重建 KEK2（HKDF info 'journal-kek2-v1:jr2w.'、aad 'notekey2'）比對 unwrap=raw。
+const KAT14 = {
+  blob: 'jr2w.srO0tba3uLm6u7y9vr/AwURFRkdISUpLTE1OTy8+hmx+AhMYCgPVBH1Q1q1UnjPF9uvN/ie4DoYqh4LGkMTHvHDy/Sku/lMRvoRWfuqSuIlX0rEpVU8HfMajsaYtzaz1zHFQELEIuzTsM6+S',
+  salt1: 'a1'.repeat(16),
+  pass: 'correct-horse-battery-staple-42',
+  pin: '482913',
+  raw: 'c3'.repeat(32), // 計算式構造（手打對數面禁止——r2 首跑 1 FAIL 即手打 raw 對數錯的實證）
+};
+await A('[14] jr2w. ikm 組裝序行為向量（bea6ab8 凍結 blob unwrap=raw——destructure 對調滑接不可解）',
+  (async () => {
+    const k = await unwrapNoteKeyDual(TACET2, KAT14.blob, KAT14.pass, KAT14.pin, KAT14.salt1);
+    if (k === null) return false;
+    return hex(new Uint8Array(await crypto.subtle.exportKey('raw', k))) === KAT14.raw;
+  })());
+await A('[14] argon 側禁並行警示在場（deriveKek2Argon 串行刻意——hash-wasm 共享記憶體池）',
+  /禁並行/.test(argon2Src14) && !argon2Src14.includes('await Promise.all'));
+await A('[14] b64 分塊 apply 錨＋舊逐位元組形歸零（fromCharCode(bytes[i]) 殘留）',
+  noteCryptoSrc14.includes('String.fromCharCode.apply(null, bytes.subarray(i, i + 8192)') &&
+  !noteCryptoSrc14.includes('String.fromCharCode(bytes[i])'));
+// b64 行為面：分塊後輸出必逐位元組等價（本閘起手 b64 是獨立複製＝黃金對照）；邊界尺寸
+//（0/1/7/8191/8192/8193）咬窗緣、65539 非 8192 倍數咬長尾、4MiB 咬分塊多輪＋unb64 全往返。
+const b64Ref14 = (bytes: Uint8Array): string => {
+  let bin = '';
+  for (let i = 0; i < bytes.byteLength; i++) bin += String.fromCharCode(bytes[i]);
+  return btoa(bin);
+};
+{
+  let boundsEq = true;
+  for (const size of [0, 1, 7, 8191, 8192, 8193]) {
+    const buf = new Uint8Array(size);
+    for (let i = 0; i < size; i++) buf[i] = (i * 7 + 3) & 0xff;
+    if (modB64(buf) !== b64Ref14(buf)) boundsEq = false;
+  }
+  await A('[14] b64 輸出等價：邊界尺寸 0/1/7/8191/8192/8193 逐位元組對照', boundsEq);
+}
+await A('[14] b64 輸出等價：65539（非 8192 倍數長尾）逐位元組對照', (() => {
+  const buf = new Uint8Array(65539);
+  for (let i = 0; i < buf.length; i++) buf[i] = (i * 13 + 5) & 0xff;
+  return modB64(buf) === b64Ref14(buf);
+})());
+await A('[14] b64 輸出等價：4MiB 多區塊＋unb64 roundtrip 逐位元組',
+  (() => {
+    const buf = new Uint8Array(4 * 1024 * 1024);
+    for (let i = 0; i < buf.length; i++) buf[i] = i & 0xff;
+    const s = modB64(buf);
+    if (s !== b64Ref14(buf)) return false;
+    const back = unb64Mod(s);
+    if (back.byteLength !== buf.byteLength) return false;
+    for (let i = 0; i < buf.length; i++) if (back[i] !== buf[i]) return false;
+    return true;
+  })());
+await A('[14] CORS_HEADERS 帶 Access-Control-Max-Age（preflight 快取 86400）',
+  CORS_HEADERS['Access-Control-Max-Age'] === '86400' && /'Access-Control-Max-Age': '86400'/.test(corsSrc14));
+await A('[14] CORS 其餘三頭零變（ACAO *／Methods GET, POST, OPTIONS／Headers Content-Type, Authorization）',
+  CORS_HEADERS['Access-Control-Allow-Origin'] === '*' &&
+  CORS_HEADERS['Access-Control-Allow-Methods'] === 'GET, POST, OPTIONS' &&
+  CORS_HEADERS['Access-Control-Allow-Headers'] === 'Content-Type, Authorization');
+await A('[14] corsResponse 仍完整轉發四頭（corsResponse 面帶 Max-Age）',
+  (() => {
+    const h = new Headers({ 'x-probe': '1' });
+    const out = corsResponse(new Response('ok', { headers: h }));
+    return Object.entries(CORS_HEADERS).every(([k, v]) => out.headers.get(k) === v) && out.headers.get('x-probe') === '1';
+  })());
+{
+  const fsPkg14 = (globalThis as unknown as {
+    process?: { getBuiltinModule?: (id: string) => { readFileSync?: (p: string, enc: string) => string } | undefined };
+  }).process?.getBuiltinModule?.('node:fs');
+  const pkg14 = JSON.parse(fsPkg14!.readFileSync!(new URL('../package.json', import.meta.url).pathname, 'utf8')) as { sideEffects?: boolean; version: string };
+  await A('[14] package.json sideEffects:false（tree-shake server 模組＋BIP39 詞表）', pkg14.sideEffects === false);
+  // sideEffects 前提（round 2 MINOR-1 升級）：src 標目 **遞迴** 枚舉（硬編碼清單退場——新模組
+  // 自動入掃），頂層語句白名單化＋**宣告行初始化式呼叫面檢查**（const x = fn() 形＝執行點；
+  // Object.freeze(...)/純常數結構白名單——wordlist.ts:7 即此形）。
+  await A('[14] sideEffects 前提：src 頂層零副作用語句＋宣告行初始化式零裸呼叫（Object.freeze 白名單）',
+    await (async () => {
+      const fs14 = (globalThis as unknown as {
+        process?: { getBuiltinModule?: (id: string) => { readFileSync?: (p: string, enc: string) => string; readdirSync?: (p: string) => string[] } | undefined };
+      }).process?.getBuiltinModule?.('node:fs');
+      if (!fs14?.readFileSync || !fs14?.readdirSync) return false;
+      const urlOf = (p: string) => new URL(`../${p}`, import.meta.url).pathname;
+      const listTs = (dir: string): string[] => fs14.readdirSync!(urlOf(dir)).flatMap((e: string) => {
+        const full = `${dir}/${e}`;
+        let isDir = false;
+        try { fs14.readdirSync!(urlOf(full)); isDir = true; } catch { isDir = false; }
+        if (isDir) return listTs(full);
+        return e.endsWith('.ts') ? [full] : [];
+      });
+      const files = listTs('src');
+      if (files.length < 12) return false; // 枚舉自守衛：src 樹不該少於既有 12 模組
+      let offenders = 0;
+      for (const f of files) {
+        const lines = fs14.readFileSync!(urlOf(f), 'utf8').split('\n');
+        for (const line of lines) {
+          if (/^[a-zA-Z(/{\[]/.test(line)) {
+            // 頂層語句白名單：import/export＋註解＋純宣告（const/let/var/function/async/
+            // interface/type/enum/class/declare）——其餘字母開頭頂層＝執行面 side effect。
+            if (/^(import\b|export\b|\/\*\*|\*|\/\/|const\b|let\b|var\b|function\b|async\b|interface\b|type\b|enum\b|class\b|declare\b)/.test(line)) {
+              // 宣告行初始化面：const x = <呼叫形>()＝模組載入即執行（NIT MINOR-1 缺口）。
+              // 白名單：Object.freeze（純凍結常數）。其餘呼叫形初始化＝offender。
+              if (/^(const\b|let\b|var\b|export const\b).*=.*\b[A-Za-z_$][\w$]*\(\s*[^)]/.test(line) &&
+                  !/Object\.freeze\(/.test(line)) offenders++;
+            } else offenders++;
+          }
+        }
+      }
+      return offenders === 0;
+    })());
+}
+
 // ── 決議 ────────────────────────────────────────────────────────────────────
 
 console.log(`\n${passed} 斷言全綠` + (failures.length ? `；${failures.length} 失敗` : ''));