@tacet-ink/journal-core 0.2.5 → 0.3.0

package/docs/vectors/kat.json

@@ -0,0 +1,145 @@
+{
+  "format": "journal-core-vectors/1",
+  "package_version": "0.3.0",
+  "spec": "docs/format-spec.md",
+  "generator": "scripts/generate-vectors.ts",
+  "note": "Frozen evidence generated once by calling the real primitives; not recomputed in CI (random iv/salt). Verify gate [26] checks presence and shape only.",
+  "rfc9106": {
+    "algorithm": "Argon2id",
+    "version": "0x13",
+    "memory_kib": 32,
+    "iterations": 3,
+    "parallelism": 4,
+    "tag_len": 32,
+    "password_hex": "0101010101010101010101010101010101010101010101010101010101010101",
+    "salt_hex": "00000000000000000000000000000000",
+    "secret": null,
+    "associated_data": null,
+    "expected_tag_hex": "72d2a36fd5c266bcc96121b24937bc253338cdfcbd273713655748c54b4dd503"
+  },
+  "frozen_blobs": [
+    {
+      "source": "verify [14] KAT14",
+      "prefix": "jr2w.",
+      "wire": "jr2w.srO0tba3uLm6u7y9vr/AwURFRkdISUpLTE1OTy8+hmx+AhMYCgPVBH1Q1q1UnjPF9uvN/ie4DoYqh4LGkMTHvHDy/Sku/lMRvoRWfuqSuIlX0rEpVU8HfMajsaYtzaz1zHFQELEIuzTsM6+S",
+      "payload_len": 108,
+      "inputs": {
+        "passphrase": "correct-horse-battery-staple-42",
+        "pin": "482913",
+        "salt1_hex": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
+        "pinSaltPrefix": "tacet-note-pin1:",
+        "hkdf_info": "journal-kek2-v1:jr2w."
+      },
+      "expected_note_key_hex": "c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3"
+    },
+    {
+      "source": "verify [17] KAT17",
+      "prefix": "jr3w.",
+      "wire": "jr3w.BeQ8F6s3DdJWY853l2jRv5dHtVEMd+tjJ3XuIisu2ymuK7IInuqIvxtwPD3WzhTkEtCRr+h7KOfWo5FM6ELGjPxwxHAp5LtM5zcEg8hmCqH3dMX9iHF7IOQl3Ak=",
+      "payload_len": 92,
+      "inputs": {
+        "passphrase": "ＰＡＳＳ１２ｘ",
+        "salt_hex": "f6a511fb29b131869d282d89f9eaa90a"
+      },
+      "expected_note_key_hex": "c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3"
+    },
+    {
+      "source": "verify [17] KAT17",
+      "prefix": "jr3d.",
+      "wire": "jr3d.nOB7P29euSEa+LM8qMSTRe6r32TbBX7nS2R/WyRJ7N1NO+mqXuW5u9HLiLzYObKHq3NURwiEaxD9qwli646qDoG4/5wlHD7UE9nBT485oUeEx/vYIkmOu4muJQ42avl8zX9M1PSgaP+Bk+R9",
+      "payload_len": 108,
+      "inputs": {
+        "passphrase": "ｄｕａｌ－ｆａｃｔｏｒ－ｐａｓｓｐｈｒａｓｅ－４２",
+        "pin": "2580ab",
+        "salt1_hex": "a06bd4b1f293b8c8ebff4b6a02f13a34",
+        "pinSalt3Prefix": "tacet-note-pin3:",
+        "hkdf_info": "journal-kek2-v1:jr3d."
+      },
+      "expected_note_key_hex": "c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3"
+    },
+    {
+      "source": "verify [17] KAT17",
+      "prefix": "jr4w.",
+      "wire": "jr4w.x6cZmk7UVUAf8abE3mLps22+BLTdWGTDOZpTs4DqHFUDUcz5p5VpdIqYub/9r+sE2/hYE1fPb68ABSCdDeEvJVXlGOsbDr9L//xsdFcZZYlRtrMO3APSwJQBrv0=",
+      "payload_len": 92,
+      "inputs": {
+        "passphrase": "v3-generation-passphrase-42",
+        "salt_hex": "31a8d4ae616ccc0a6def28a9b0db4860"
+      },
+      "expected_note_key_hex": "c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3"
+    },
+    {
+      "source": "verify [17] KAT17",
+      "prefix": "jr4d.",
+      "wire": "jr4d.Dz8wgY5Lphif69Fh5fE+54J4YBlUJgfVLHBeM7RGr3HUmplys5FpcIK/AZT8zstvsUSpox2mwnpo4eQA9eqtbRK3kTowaWRyAEjTfx4kJS9eMoPQEWsr+GRRYgtdINlgAoVJxyi/NaCNqhDR",
+      "payload_len": 108,
+      "inputs": {
+        "passphrase": "dual-factor-passphrase-42",
+        "pin": "2580ab",
+        "salt1_hex": "d6ebccb6c9bb3a0d13905183d2b2977d",
+        "pinSalt3Prefix": "tacet-note-pin3:",
+        "hkdf_info": "journal-kek2-v1:jr4d."
+      },
+      "expected_note_key_hex": "c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3c3"
+    },
+    {
+      "source": "verify [20]",
+      "prefix": "jr1r.",
+      "wire": "jr1r.bkvBFdKjNVfidHcfn0WoyyRJLkajWhXF7WmPdc3Q9FCNNxDz+7PgN0x25BjuAZPFi1oP3t+8dblrnSQEltkieBh33xoyChcGKe1wEfaStQF6ITBNb6vBZKVXDEQ=",
+      "payload_len": 92,
+      "inputs": {
+        "rec_token": "62ff0221e30b56740ec210cd36df2e9667841585c6d0fcd5200826b965aa36a5",
+        "identity": "kat-id-0000000000000000",
+        "recKekHkdf": "jr1r.",
+        "recKekSalt": "a1b2c3d4e5f60718293a4b5c6d7e8f90",
+        "hkdf_info": "journal-kek-rec-v1:jr1r."
+      },
+      "expected_note_key_hex": "57c72afacd486194c41227f42311600e287a7d48baa7a3e9de32fa460c089699"
+    },
+    {
+      "source": "verify [20]",
+      "prefix": "jr1w.",
+      "wire": "jr1w.a4xchJ+EPui8iQy5dKpQyGjalu0nlJMsDd0LaLyRrY3mt+6112Se4NvaibymRFHsMg1LgOYsBVy15t0CiU1ipf9g8rniqBmdf1R5LzVXQdNJDCzbAfubPUKc/FE=",
+      "payload_len": 92,
+      "inputs": {
+        "rec_token": "62ff0221e30b56740ec210cd36df2e9667841585c6d0fcd5200826b965aa36a5",
+        "identity": "kat-id-0000000000000000",
+        "recSaltPrefix": "tacet-note-rec1:"
+      },
+      "expected_note_key_hex": "57c72afacd486194c41227f42311600e287a7d48baa7a3e9de32fa460c089699"
+    }
+  ],
+  "credentials": [
+    {
+      "kind": "ph1_legacy",
+      "input": "correct-horse-battery-staple-42",
+      "salt": null,
+      "expected_hex": "7dd095c64aba71ab6c386f3a01508e411007fc3855561a7bdb07c62d9fb98801"
+    },
+    {
+      "kind": "ph1_v2",
+      "input": "correct-horse-battery-staple-42",
+      "salt": "tacet-ph1-v1",
+      "expected_hex": "dc7c78fe83a0b3a84eace16c404c80300a10f93f3235ad5c7d563d5e1aab5baf"
+    },
+    {
+      "kind": "ph1_v3",
+      "input": "ｖ３－ｇｅｎｅｒａｔｉｏｎ－ｐａｓｓｐｈｒａｓｅ－４２",
+      "input_nfkc": "v3-generation-passphrase-42",
+      "salt": "tacet-ph1-v2",
+      "expected_hex": "0d2f022c5e42c710e981feb484157ae35d7cf9542b489ae35b99c8fee001eae6"
+    },
+    {
+      "kind": "ph2_of_ph1_v2",
+      "input": "dc7c78fe83a0b3a84eace16c404c80300a10f93f3235ad5c7d563d5e1aab5baf",
+      "salt": null,
+      "expected_hex": "5860adc190682591654ebb81ca980c08b76a7ea50b2e0191610522caabcdf537"
+    },
+    {
+      "kind": "rec_token_hash",
+      "input": "62ff0221e30b56740ec210cd36df2e9667841585c6d0fcd5200826b965aa36a5",
+      "salt": null,
+      "expected_hex": "f700df2e385610d8295db7f69a6ac3481c456e6f88ec2dee8e44f8e8161f59bd"
+    }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tacet-ink/journal-core",
-  "version": "0.2.5",
+  "version": "0.3.0",
   "description": "Zero-knowledge journal core — e2e crypto, passphrase-only auth, transport, ratelimit. The server never sees plaintext.",
   "homepage": "https://tacet.ink",
   "repository": {
@@ -25,27 +25,69 @@
     "privacy",
     "tacet"
   ],
-  "main": "src/index.ts",
-  "types": "src/index.ts",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "sideEffects": false,
   "exports": {
-    ".": "./src/index.ts",
-    "./client/note-crypto": "./src/client/note-crypto.ts",
-    "./client/keys": "./src/client/keys.ts",
-    "./client/argon2": "./src/client/argon2.ts",
-    "./client/pinlock": "./src/client/pinlock.ts",
-    "./client/bip39": "./src/client/bip39.ts",
-    "./client/wordlist": "./src/client/wordlist.ts",
-    "./server/auth": "./src/server/auth.ts",
-    "./server/ratelimit": "./src/server/ratelimit.ts",
-    "./server/cors": "./src/server/cors.ts",
-    "./server/hash": "./src/server/hash.ts",
-    "./server/env": "./src/server/env.ts",
-    "./server/ladder": "./src/server/ladder.ts"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./client/note-crypto": {
+      "types": "./dist/client/note-crypto.d.ts",
+      "default": "./dist/client/note-crypto.js"
+    },
+    "./client/keys": {
+      "types": "./dist/client/keys.d.ts",
+      "default": "./dist/client/keys.js"
+    },
+    "./client/argon2": {
+      "types": "./dist/client/argon2.d.ts",
+      "default": "./dist/client/argon2.js"
+    },
+    "./client/pinlock": {
+      "types": "./dist/client/pinlock.d.ts",
+      "default": "./dist/client/pinlock.js"
+    },
+    "./client/bip39": {
+      "types": "./dist/client/bip39.d.ts",
+      "default": "./dist/client/bip39.js"
+    },
+    "./client/wordlist": {
+      "types": "./dist/client/wordlist.d.ts",
+      "default": "./dist/client/wordlist.js"
+    },
+    "./server/auth": {
+      "types": "./dist/server/auth.d.ts",
+      "default": "./dist/server/auth.js"
+    },
+    "./server/ratelimit": {
+      "types": "./dist/server/ratelimit.d.ts",
+      "default": "./dist/server/ratelimit.js"
+    },
+    "./server/cors": {
+      "types": "./dist/server/cors.d.ts",
+      "default": "./dist/server/cors.js"
+    },
+    "./server/hash": {
+      "types": "./dist/server/hash.d.ts",
+      "default": "./dist/server/hash.js"
+    },
+    "./server/env": {
+      "types": "./dist/server/env.d.ts",
+      "default": "./dist/server/env.js"
+    },
+    "./server/ladder": {
+      "types": "./dist/server/ladder.d.ts",
+      "default": "./dist/server/ladder.js"
+    }
   },
   "files": [
+    "dist",
+    "docs",
     "src",
     "scripts",
+    "!scripts/generate-vectors.ts",
     "migrations",
     "README.md",
     "LICENSE"
@@ -54,6 +96,8 @@
     "node": ">=24.7.0"
   },
   "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "prepublishOnly": "npm run build",
     "verify": "node --experimental-strip-types scripts/verify-core-crypto.ts",
     "typecheck": "tsc -p ."
   },

package/scripts/verify-core-crypto.ts

@@ -142,15 +142,16 @@ async function A(name: string, cond: boolean | Promise<boolean>, detail = ''): P
 // 帳面契約：--only 態總帳顯形「本輪 X/選段帳 N（N 案非本輪載）」＋OK 標記帶 (--ONLY …) 尾碼；skip 段帳面恆列「未跑非通過」；[24]/[25] runner 自證段隨每輪在場。
 // 段標記 helper（secOpen）：全跑態輸出位元組恆等原 console.log('\n[N] …')；--only 態僅選中段輸出段頭。
 // 毒化矩陣內層 rerun（execFileSync＋POISON_GATE_INNER=1）不傳遞 --only＝內層恆全帳（POISON_GATE_INNER 語意不變）。
-// 段帳＝執行帳（healthy-repo 全跑 runtime 真值，2026-10-10 實測 483）；帳面語意契約（逐段「案 X/帳」
+// 段帳＝執行帳（healthy-repo 全跑 runtime 真值，2026-10-10 實測 492——A2 [26] +8）；帳面語意契約（逐段「案 X/帳」
 // 對 secRan 執行值顯形）：執行 < 帳 的段＝本環境條件態未行使（非 skip 態），--only 期望算術對齊本帳。
 // [23] 執行 18 帳 21＝[23]④ lookup 未配置（0.2.3 單查恆等）／[23]⑤ fail-open（表缺席）兩情境
-// 在本機樹由 [8] PH1_v2_SALT 訊號面真行使（try/catch 異常面）——車道分流非帳面虛報。
+// 在本機樹由 [8]（登入憑證 Argon2id 派生）內登入 lane 的訊號面真行使（try/catch 異常面）——車道分流非帳面虛報。
 // secEnter 跑行為脫鉤 secCases；secCases 鍵只承載段存在／帳面／--only 判準的登記義務
 //（secOpen(22,…) 無段標記行＝慣例 skip 段）。缺帳防線（teeth）：secRan 實跑段必已登記——
-// for (const [k] of secRan) if (!secCases[k] && k !== 22) FAIL；反向缺席段＝帳面誠實「案 0/N · skip」。
-// secCases 只餘 [24]/[25] self-account 與 --only 段存在面＋teeth 三載體（段帳由 secRan 執行自記）。
-const secCases: Record<number, number> = { 1: 3, 2: 7, 3: 9, 4: 4, 5: 3, 6: 20, 7: 27, 8: 8, 9: 22, 10: 5, 11: 41, 12: 50, 13: 39, 14: 18, 15: 59, 16: 15, 17: 14, 18: 39, 19: 17, 20: 47, 21: 10, 23: 18, 24: 5, 25: 3 };
+// for (const [k] of secRan) if (!secCases[k] && k !== 22) FAIL（負向斷言本體在 [25] 段
+//——secCases 全摘即 RED）；反向缺席段＝帳面誠實「案 0/N · skip」。
+// secCases 載體三群：[24]/[25] self-account＋--only 段存在面＋teeth（段帳由 secRan 執行自記）。
+const secCases: Record<number, number> = { 1: 3, 2: 7, 3: 9, 4: 4, 5: 3, 6: 20, 7: 27, 8: 8, 9: 22, 10: 5, 11: 41, 12: 50, 13: 39, 14: 18, 15: 59, 16: 15, 17: 14, 18: 39, 19: 17, 20: 47, 21: 10, 23: 18, 24: 5, 25: 4, 26: 8 };
 function parseOnly(spec: string): { err: string | null; set: number[] } {
   const set = new Set<number>();
   const specStr = spec.trim();
@@ -2524,7 +2525,7 @@ secOpen(21, '[21] CI 供應鏈面（npm ci --ignore-scripts＋dependabot runner
     await A('[21] publish.yml：npm ci --ignore-scripts（tag 驅動無 actor 面；typecheck+verify 先行＝腳本面零在場）',
       srcPy21.includes('npm ci --ignore-scripts'));
   } else {
-    await A('[21] CI 源碼面：.github 缺席環境（tarball 發行樹常態）＝顯性 SKIP（workflow 斷言 4 收斂為 1 SKIP 行——消費端計數帳 479）',
+    await A('[21] CI 源碼面：.github 缺席環境（tarball 發行樹常態）＝顯性 SKIP（workflow 斷言 4 收斂為 1 SKIP 行——消費端計數帳 489）',
       true, 'no .github dir — consumption tree face');
   }
   // 摘除自證（t_760f44e8 治理掃蕩補漏；fs 原語缺席環境＝顯性 FAIL 形自守衛——非 silent true）
@@ -2789,6 +2790,82 @@ secOpen(23, '[23] loginRouteCore ladder 查表守衛（外審 #8 幽靈帳——
 }
 
 };
+// ── 26. 格式規格＋測試向量（docs/format-spec.md＋docs/vectors/*.json；0.3.0 批 A2） ──
+//
+// 單向契約：源碼 → scripts/generate-vectors.ts → JSON（凍結證據，commit 入 repo）→ 本段只檢存在＋shape。
+// 本段不依賴產生器、不重算 KDF（向量含隨機 iv/鹽＝重算即漂移）；BIP39 是確定性轉寫，逐組對照現行原語。
+// teeth：payload 位元組長度＝b64 解碼真值、fields 拼接＝payload 逐位元組、布局長度＝規格表列、
+// 欄位名逐一在規格檔、凍結 blob 逐字＝本閘 KAT 字面（[14]/[17]/[20]）、RFC 9106 期望值＝argon2.ts 常數。
+secOpen(26, '[26] 格式規格＋測試向量（docs/format-spec.md＋docs/vectors 存在性＋shape）'); if (secEnter(26)) {
+{
+  const readJson26 = async (rel: string): Promise<Record<string, unknown> | null> => {
+    try { return JSON.parse(await srcOf(rel)) as Record<string, unknown>; } catch { return null; }
+  };
+  const spec26 = await srcOf('../docs/format-spec.md').catch(() => '');
+  const fam26 = await readJson26('../docs/vectors/families.json');
+  const kat26 = await readJson26('../docs/vectors/kat.json');
+  const bip26 = await readJson26('../docs/vectors/bip39.json');
+  type Vec26 = { prefix: string; family: string; layout: string; kdf: string; aad: string; inputs: Record<string, unknown>; wire: string; payload_len: number; fields: { name: string; offset: number; len: number; hex: string }[] };
+  const vecs26 = (Array.isArray(fam26?.vectors) ? fam26!.vectors : []) as Vec26[];
+  const HEAD26 = ['format', 'package_version', 'spec', 'generator', 'note'];
+  await A('[26] 規格檔＋三向量檔在場且 JSON parse；頂層共通欄齊（format=journal-core-vectors/1、spec/generator 路徑字面——產生器不被閘依賴，發行包不帶產生器）',
+    spec26.length > 0 && !!fam26 && !!kat26 && !!bip26
+    && [fam26, kat26, bip26].every((j) => HEAD26.every((k) => typeof j![k] === 'string') && j!.format === 'journal-core-vectors/1'
+      && j!.spec === 'docs/format-spec.md' && j!.generator === 'scripts/generate-vectors.ts'));
+  // 規格表前綴集（§1 家族逐條表：| `prefix` | 家族 | 布局 | payload | KDF | AAD |）
+  const specRows26 = spec26.split('\n').filter((l) => /^\| `jr[0-9a-z]{2}\.`(（[^|]*）)? \|/.test(l) && /\| (content|salt-external|salt-embedded) \|/.test(l));
+  const specPrefixes26 = new Set(specRows26.map((l) => l.match(/^\| `(jr[0-9a-z]{2}\.)`/)![1]));
+  const vecPrefixes26 = new Set(vecs26.map((v) => v.prefix));
+  await A('[26] 家族覆蓋雙向：規格家族表 16 列前綴集＝families.json 前綴集（15 前綴；jr1w. 兩世代各一組）',
+    specRows26.length === 16 && vecs26.length === 16 && specPrefixes26.size === 15
+    && [...specPrefixes26].every((p) => vecPrefixes26.has(p)) && [...vecPrefixes26].every((p) => specPrefixes26.has(p)));
+  const VKEYS26 = ['prefix', 'family', 'layout', 'kdf', 'aad', 'inputs', 'wire', 'payload_len', 'fields'];
+  await A('[26] families 位元組 shape：payload_len＝wire b64 解碼真長；fields offset 連續、len 總和＝payload_len、hex 拼接＝payload 逐位元組',
+    vecs26.length > 0 && vecs26.every((v) => {
+      if (!VKEYS26.every((k) => k in v) || !v.wire.startsWith(v.prefix)) return false;
+      let payload: Uint8Array;
+      try { payload = unb64Mod(v.wire.slice(v.prefix.length)); } catch { return false; }
+      let off = 0;
+      for (const f of v.fields) { if (f.offset !== off || f.hex.length !== f.len * 2) return false; off += f.len; }
+      return payload.length === v.payload_len && off === v.payload_len && v.fields.map((f) => f.hex).join('') === hex(payload);
+    }));
+  await A('[26] 布局長度＝規格：salt-external 92／salt-embedded 108（pinSalt 頭 16）／content 28+UTF8(plaintext)；且規格家族表該前綴列含同布局＋同長度',
+    vecs26.length > 0 && vecs26.every((v) => {
+      const want = v.layout === 'salt-external' ? 92 : v.layout === 'salt-embedded' ? 108 : v.layout === 'content' ? 28 + enc.encode(String(v.inputs.plaintext)).length : -1;
+      const lenCol = v.layout === 'content' ? '28+n' : String(want);
+      const head = v.layout === 'salt-embedded' ? v.fields[0]?.name === 'pinSalt' && v.fields[0]?.len === 16 : v.fields[0]?.name === 'iv';
+      return want === v.payload_len && head && specRows26.some((l) => l.startsWith('| `' + v.prefix + '`') && l.includes('| ' + v.layout + ' | ' + lenCol + ' |'));
+    }));
+  const KKEYS26 = ['rfc9106', 'frozen_blobs', 'credentials', 'expected_tag_hex', 'expected_note_key_hex', 'expected_hex', 'samples', 'entropy_hex', 'checksum_hex', 'words', 'source'];
+  await A('[26] 欄位名對規格：families 每筆欄名＋fields 子欄（name/offset/len/hex）＋kat/bip39 欄名，逐一以 `欄名` 形出現在 format-spec.md',
+    spec26.length > 0 && [...HEAD26, ...VKEYS26, 'name', 'offset', 'len', 'hex', ...KKEYS26].every((k) => spec26.includes('`' + k + '`'))
+    && KKEYS26.slice(0, 3).every((k) => !!kat26 && k in kat26) && !!bip26 && 'samples' in bip26);
+  const gate26 = await srcOf('./verify-core-crypto.ts');
+  const frozen26 = (Array.isArray(kat26?.frozen_blobs) ? kat26!.frozen_blobs : []) as { prefix: string; wire: string; payload_len: number; expected_note_key_hex: string; source: string }[];
+  const rfc26 = (kat26?.rfc9106 ?? {}) as Record<string, unknown>;
+  const creds26 = (Array.isArray(kat26?.credentials) ? kat26!.credentials : []) as { kind: string; expected_hex: string }[];
+  await A('[26] kat 對帳：RFC 9106 expected_tag_hex＝ARGON_RFC9106_EXPECTED（argon2.ts 常數）；凍結 blob 7 筆逐字＝本閘 KAT 字面（[14]/[17]/[20]）且 payload_len＝解碼真長；憑證樣本 5 筆 hex64',
+    (await import('../src/client/argon2.ts')).ARGON_RFC9106_EXPECTED === rfc26.expected_tag_hex
+    && frozen26.length === 7 && frozen26.every((b) => gate26.includes("'" + b.wire + "'") && b.wire.startsWith(b.prefix)
+      && unb64Mod(b.wire.slice(b.prefix.length)).length === b.payload_len && /^[0-9a-f]{64}$/.test(b.expected_note_key_hex))
+    && creds26.length === 5 && creds26.every((c) => /^[0-9a-f]{64}$/.test(c.expected_hex)));
+  const samples26 = (Array.isArray(bip26?.samples) ? bip26!.samples : []) as { entropy_hex: string; checksum_hex: string; words: string[]; source: string }[];
+  await A('[26] bip39 抽樣 ≥32 組：entropy hex64＋24 詞＋checksum＝SHA-256(entropy)[0]；逐組對照現行轉寫原語（recTokenToWords 逐詞相等——確定性轉寫非 KDF 重算）',
+    samples26.length >= 32 && (await (async () => {
+      for (const s of samples26) {
+        if (!/^[0-9a-f]{64}$/.test(s.entropy_hex) || s.words?.length !== 24) return false;
+        const cs = new Uint8Array(await crypto.subtle.digest('SHA-256', hexToBytes(s.entropy_hex) as BufferSource))[0];
+        if (cs.toString(16).padStart(2, '0') !== s.checksum_hex) return false;
+        if ((await bip.recTokenToWords(s.entropy_hex))?.join(' ') !== s.words.join(' ')) return false;
+      }
+      return true;
+    })()));
+  const pkg26 = JSON.parse(await srcOf('../package.json')) as { files?: string[] };
+  await A('[26] 發行面：package.json files 含 docs（tarball 帶規格＋向量——消費端可對帳）＋產生器排除（!scripts/generate-vectors.ts——[22] scripts 封閉集 2 檔不動）',
+    Array.isArray(pkg26.files) && pkg26.files.includes('docs') && pkg26.files.includes('!scripts/generate-vectors.ts'));
+}
+}
+
 secOpen(24, '[24] runner 契約自證（--only 解析契約 fail-closed＋段級帳面顯形）'); if (secEnter(24)) {
   await A('[24] --only 解析契約（全跑態）：spec 缺席＝onlySet 空集＝secEnter 恆真（CI 形契約不變——npm run verify 全帳；--only 態本面恆真跳過＝帳面由次面承載）',
     !onlyMode() ? (onlySpecRaw === null && parseOnly('').err === 'ERR_ONLY_SPEC_EMPTY' && secEnter(1) && secEnter(23)) : true);
@@ -2809,19 +2886,19 @@ secOpen(24, '[24] runner 契約自證（--only 解析契約 fail-closed＋段級
 }
 
 secOpen(25, '[25] 段級運行樣本：secEnter 真值表＋tag 形帳＋secCases 段帳'); if (secEnter(25)) {
-  await A('[25] secEnter 真值表：bannerless 段全跑態行為（26 未在 secOrder 段帳＝secRan 零位面——帳面逐段只列 secOrder；n=0 恆 false）；全跑態實段 1/15/23 全真',
-    !onlyMode() ? (secEnter(0) === false && (secRan.get(26) ?? 0) === 0 && secEnter(1) && secEnter(15) && secEnter(23)) : true);
+  await A('[25] secEnter 真值表：bannerless 段全跑態行為（27 未在 secOrder 段帳＝secRan 零位面——帳面逐段只列 secOrder；n=0 恆 false）；全跑態實段 1/15/23 全真',
+    !onlyMode() ? (secEnter(0) === false && (secRan.get(27) ?? 0) === 0 && secEnter(1) && secEnter(15) && secEnter(23)) : true);
   await A('[25] tag/spec 形帳：--only 態 (--ONLY …) 括形＋spec 遞增 CSV 非空；全跑態 spec 空＋tag 裸',
     onlyMode() ? (onlyTag().startsWith('(--ONLY ') && onlyTag().endsWith(')') && onlySpecDisp().length > 0)
       : (onlySpecDisp() === '' && onlyTag() === ''));
   await A('[25] secCases 段帳登記義務（負向斷言——teeth）：secRan 實跑段（本機樹 [23]⑤ fail-open 表缺席異常面照行）必已登記；secCases 缺鍵且非 22 段＝RED（secCases 全摘禁令的行為面承載）',
     (() => { for (const [k25] of secRan) if (!secCases[k25] && k25 !== 22) return false; return true; })());
-  await A('[25] self-account：secCases[25] = 3 恰此三案（段帳面 self-proving——帳漂移即本面 RED；secCases 載體面：[24]/[25] 自證段＋--only 段存在面＋teeth 三載體）',
-    secCases[25] === 3 && (secRan.get(25) ?? 0) === 3);
+  await A('[25] self-account：secCases[25] = 4 恰此四案（段帳面 self-proving——帳漂移即本面 RED；secCases 載體面：[24]/[25] 自證段＋--only 段存在面＋teeth 三載體）',
+    secCases[25] === 4 && (secRan.get(25) ?? 0) === 3);
 }
 
 // ── 段級帳面（誠實帳——skip 段恆列帳「未跑非通過」；全跑態逐段案數對 secCases 帳面）──
-const secOrder = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 23, 24, 25];
+const secOrder = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 23, 24, 25, 26];
 const secTotal = secOrder.reduce((a, n) => a + (secCases[n] ?? 0), 0);
 const ranSecs = secOrder.filter((n) => (secRan.get(n) ?? 0) > 0);
 const selTotal = secOrder.filter((n) => !onlyMode() || onlySet.has(n) || n === 24 || n === 25).reduce((a, n) => a + (secCases[n] ?? 0), 0);