dsh-jev-prune 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.1.1 — 2026-10-06
+
+- Accept tools from verified 0.1 and 0.2 release families, dynamically report runtime version and capabilities, and resolve preset-local compaction services for each Agent.
+- Add actual CLI installation and Web preset activation verification, plus an advisory rolling @next CI job. Keep the locked old-host regression fixture.
+
+- Fix #48: scope receipts to asynchronous compaction transactions, clear inherited ownership at host region entry, validate replay input and preserve claim-once/cancellation behavior.
+- Fix #49: invalidate result judgments when the recent user-instruction revision changes, retain effect judgments, refresh before manual actions and discard old-goal responses arriving in flight.
+- Expand simulated-host checks from 113 to 130. The receipt/goal regression subset was reverse-verified against 0.1.0: 14 of its 127 assertions failed.
+
 ## 0.1.0 — 2026-10-06
 
 - Concise English and Chinese project introductions; implementation/configuration history moved behind architecture links.

package/README.md

@@ -7,7 +7,7 @@ Structured judgments from [TypeSafe Jev](https://typesafe.ai) drive DSH's two-la
 
 **English** · [简体中文](README_zh.md)
 
-![license](https://img.shields.io/badge/license-MIT-blue) ![node](https://img.shields.io/badge/node%20%3E%3D22.19-339933) ![dsh](https://img.shields.io/badge/DSH-0.1.x--rc-orange) [![CI](https://github.com/yangyu666/dsh-jev-prune/actions/workflows/ci.yml/badge.svg)](https://github.com/yangyu666/dsh-jev-prune/actions/workflows/ci.yml) ![smoke checks](https://img.shields.io/badge/smoke%20checks-113%20passing-success) [![Listed on dsh-plugin.org](https://dsh-plugin.org/badges/listed.svg)](https://dsh-plugin.org/plugins/yangyu666/dsh-jev-prune)
+![license](https://img.shields.io/badge/license-MIT-blue) ![node](https://img.shields.io/badge/node%20%3E%3D22.19-339933) ![dsh](https://img.shields.io/badge/DSH-0.1.x--rc-orange) [![CI](https://github.com/yangyu666/dsh-jev-prune/actions/workflows/ci.yml/badge.svg)](https://github.com/yangyu666/dsh-jev-prune/actions/workflows/ci.yml) ![smoke checks](https://img.shields.io/badge/smoke%20checks-130%20passing-success) [![Listed on dsh-plugin.org](https://dsh-plugin.org/badges/listed.svg)](https://dsh-plugin.org/plugins/yangyu666/dsh-jev-prune)
 
 ## The problem it solves
 
@@ -71,12 +71,16 @@ Probabilities are consumed as **relative quantiles**, never as a fixed threshold
 
 ## Install and quick start
 
-Requires Node `^22.19.0 || >=24.0.0`; tested against **DSH 0.1.5-rc.2**. The profile needs base pruner/compaction and tokenMeter services. Set `TYPESAFE_API_KEY` in the environment before starting DSH.
+**Version note:** use 0.1.1 for DSH 0.2.0-rc.2. It supports both root and preset-local services and passed actual CLI installation/activation; older 0.1.0 is rejected by this host. [Compatibility evidence and rolling verification](docs/compatibility.md).
+
+Requires Node `^22.19.0 || >=24.0.0`. Regression baseline: **DSH 0.1.5-rc.2**; real CLI install/preset activation verified on **0.2.0-rc.2**. The profile needs pruner/compaction and tokenMeter services. Set `TYPESAFE_API_KEY` before starting DSH.
 
 Install a pinned version:
 
 ```bash
-dsh plugin --profile web add github:yangyu666/dsh-jev-prune#v0.1.0
+dsh plugin --profile web add dsh-jev-prune@0.1.1
+# GitHub alternative:
+dsh plugin --profile web add github:yangyu666/dsh-jev-prune#v0.1.1
 ```
 
 Local development:
@@ -84,7 +88,7 @@ Local development:
 ```bash
 git clone https://github.com/yangyu666/dsh-jev-prune.git
 cd dsh-jev-prune
-git checkout v0.1.0
+git checkout v0.1.1
 npm ci
 npm run check
 npm run smoke
@@ -98,16 +102,14 @@ Without pnpm, run `node scripts/wire_profile.mjs <DSH_HOME> <profile-name>`. Aft
 Start with a dry run in the profile's plugin entry:
 
 ```yaml
-- insert:
-    - id: jev-prune
-      name: dsh-jev-prune
-      config:
-        dryRun: true
-        judgeOn: pressure
-        softLimit: "55%"
-        compactReceipts: true
-        compactOn: pressure
-        compactSoftLimit: "70%"
+- id: jev-prune
+  config:
+    dryRun: true
+    judgeOn: pressure
+    softLimit: "55%"
+    compactReceipts: true
+    compactOn: pressure
+    compactSoftLimit: "70%"
 ```
 
 After inspecting `/jev`, set `dryRun: false` to apply reductions.
@@ -148,8 +150,8 @@ The recording runs the real plugin `apply()`, registered tools and replacement p
 
 - Live judging sends history, paths, snippets and command output to TypeSafe and adds inference cost and latency.
 - Automated CI covers helpers, simulated-host behavior and loading against a locked host dependency tree. It does not exercise a live DSH session end to end.
-- Pending receipts are claim-once, but current fencing does not identify an external concurrent summary's transaction. Avoid concurrent compaction; see [review findings](docs/review-2026-10-05.md).
-- Result judgments are cached by sequence, without task-goal invalidation. Small-population layer-1 fallback can trim at zero pressure ratio.
+- On current source, receipts are scoped to an asynchronous transaction and validated against the selected replay messages; foreign, canceled or mismatched summaries fall back to the host. The published 0.1.0 still has the older session-scoped behavior. See [architecture](docs/ARCHITECTURE.md).
+- Current source invalidates result judgments when the last three user instructions change, retaining effect judgments and discarding in-flight answers for older goals. Small-population layer-1 fallback can still trim at zero pressure ratio.
 - `jev_restore` currently finds region summary checkpoints, truncates each returned event to 4,000 UTF-16 units, and does not directly resolve layer-1 or partial-result replacement IDs. Original events remain in the log.
 
 ## Layout and development

package/README_zh.md

@@ -7,7 +7,7 @@
 
 [English](README.md) · **简体中文**
 
-![license](https://img.shields.io/badge/license-MIT-blue) ![node](https://img.shields.io/badge/node%20%3E%3D22.19-339933) ![dsh](https://img.shields.io/badge/DSH-0.1.x--rc-orange) [![CI](https://github.com/yangyu666/dsh-jev-prune/actions/workflows/ci.yml/badge.svg)](https://github.com/yangyu666/dsh-jev-prune/actions/workflows/ci.yml) ![smoke checks](https://img.shields.io/badge/smoke%20checks-113%20passing-success) [![Listed on dsh-plugin.org](https://dsh-plugin.org/badges/listed.svg)](https://dsh-plugin.org/plugins/yangyu666/dsh-jev-prune)
+![license](https://img.shields.io/badge/license-MIT-blue) ![node](https://img.shields.io/badge/node%20%3E%3D22.19-339933) ![dsh](https://img.shields.io/badge/DSH-0.1.x--rc-orange) [![CI](https://github.com/yangyu666/dsh-jev-prune/actions/workflows/ci.yml/badge.svg)](https://github.com/yangyu666/dsh-jev-prune/actions/workflows/ci.yml) ![smoke checks](https://img.shields.io/badge/smoke%20checks-130%20passing-success) [![Listed on dsh-plugin.org](https://dsh-plugin.org/badges/listed.svg)](https://dsh-plugin.org/plugins/yangyu666/dsh-jev-prune)
 
 ## 它解决什么问题
 
@@ -69,12 +69,16 @@ DSH 自带的上下文回收是**纯体积**的：工具结果超过阈值就掐
 
 ## 安装与快速开始
 
+**版本说明：** DSH 0.2.0-rc.2 请使用 0.1.1，它支持根级和 preset 内服务，已通过真实 CLI 安装与激活；旧的 0.1.0 会被该宿主拒绝。[兼容性证据与滚动验证](docs/compatibility.md)。
+
 要求 Node `^22.19.0 || >=24.0.0`；针对 **DSH 0.1.5-rc.2** 验证。profile 需要基础裁剪、压缩与 tokenMeter 服务。启动 DSH 前在环境中设置 `TYPESAFE_API_KEY`。
 
 固定版本安装：
 
 ```bash
-dsh plugin --profile web add github:yangyu666/dsh-jev-prune#v0.1.0
+dsh plugin --profile web add dsh-jev-prune@0.1.1
+# GitHub 安装方式：
+dsh plugin --profile web add github:yangyu666/dsh-jev-prune#v0.1.1
 ```
 
 本地开发：
@@ -82,7 +86,7 @@ dsh plugin --profile web add github:yangyu666/dsh-jev-prune#v0.1.0
 ```bash
 git clone https://github.com/yangyu666/dsh-jev-prune.git
 cd dsh-jev-prune
-git checkout v0.1.0
+git checkout v0.1.1
 npm ci
 npm run check
 npm run smoke
@@ -96,16 +100,14 @@ dsh plugin --profile web add link:/absolute/path/to/dsh-jev-prune
 先在 profile 的插件条目中开启 dry-run：
 
 ```yaml
-- insert:
-    - id: jev-prune
-      name: dsh-jev-prune
-      config:
-        dryRun: true
-        judgeOn: pressure
-        softLimit: "55%"
-        compactReceipts: true
-        compactOn: pressure
-        compactSoftLimit: "70%"
+- id: jev-prune
+  config:
+    dryRun: true
+    judgeOn: pressure
+    softLimit: "55%"
+    compactReceipts: true
+    compactOn: pressure
+    compactSoftLimit: "70%"
 ```
 
 检查 `/jev` 的判定和排除原因后，设为 `dryRun: false` 执行压缩。
@@ -146,8 +148,8 @@ dsh plugin --profile web add link:/absolute/path/to/dsh-jev-prune
 
 - 在线判定会将历史、路径、代码片段和命令输出发送至 TypeSafe，并增加判定成本与延迟。
 - CI 验证纯函数、模拟宿主行为和锁定宿主依赖树的模块加载；尚不覆盖真实 DSH 会话端到端执行。
-- 回执只能领取一次，但当前令牌无法识别外部并发摘要的事务归属；应避免并发压缩。[审查记录](docs/review-2026-10-05.md)
-- 结果判定按序号缓存，任务目标变化不会使其失效；第一层小样本降级可能在压力比例为零时裁剪。
+- 当前源码将回执绑定到异步事务，并核对所选区间的实际消息；外部、取消或输入不匹配的摘要回退宿主。已发布的 0.1.0 仍使用旧机制。[架构说明](docs/ARCHITECTURE.md)
+- 当前源码在最近三条用户指令变化时使结果判断失效，保留副作用判断，并丢弃旧目标的在途响应。第一层小样本降级仍可能在压力比例为零时裁剪。
 - `jev_restore` 只查区域摘要检查点，每个事件最多返回 4,000 个 UTF-16 单元，尚不能直接解析第一层或逐结果替换的 ID。原始事件仍保存在日志中。
 
 ## 目录与开发

package/docs/ARCHITECTURE.md

@@ -20,6 +20,8 @@ flowchart LR
 
 ## Modules
 
+- `compatibility.js` separates actual runtime version, verified-version evidence and service capabilities. The manifest owns supported release families.
+
 - `jev.js` owns the remote judge protocol, retry classification, batching, and local token estimation.
 - `prune.js` contains layer-1 pure logic: cached-verdict lookup, pressure-budget planning, code-point-safe slicing, and DSH-compatible replacement events.
 - `state.js` converts session events into the bounded state and questions sent to Jev. It also discovers tool names and selects candidates.
@@ -30,16 +32,20 @@ The dependency direction stays toward the pure modules. Host APIs must remain in
 
 ## Runtime flow
 
+New Web profiles isolate compaction services in presets. The root plugin only injects tools, then resolves the active Agent's pruner, compaction and meter through the host `serviceForAgent` API before the base pruning hook. Per-engine hook maps prevent cross-preset sharing; legacy root services remain supported. [Compatibility verification](compatibility.md).
+
 1. A prepended `agent/pre-step` hook builds the current state and asks Jev only for missing verdict axes.
 2. DSH's `compaction-basic` hook calls the synchronously overridden `toolResultPruner.pruneSession`. Layer 1 reads the verdict cache and replaces stale result bodies with head/marker/tail content.
 3. The normal second plugin hook selects read-only call/result pairs whose result and effect verdicts are both low. Fully eligible steps become balanced contiguous ranges; mixed parallel batches become per-result replacements matched by `callId`.
-4. Full ranges run through `compactRegion`. A one-use ownership token lets the temporary `summarize` override inject a deterministic receipt only for that transaction. Mixed batches use DSH's single-node shadow-price + `tool/result` replacement protocol, preserving every pair envelope and every rejected result.
+4. Full ranges run through the captured `compactRegion` in an AsyncLocalStorage transaction. The summary hook checks session, exact replay messages (with an optional system head), cancellation, lifetime and claim-once state. Host calls to the public region entry clear inherited receipt ownership. Mixed batches use DSH's single-node shadow-price + `tool/result` replacement protocol.
 5. Original events remain in the session log. The surface points to replacement or compaction events, and `jev_restore` can retrieve the shadowed text.
 
 ## State and identity
 
 Verdicts are held in a `WeakMap<session, Map<seq, verdict>>`. A layer-1 replacement receives a new seq and records the old seq in `sourceEventSeqs`; cache lookup follows that metadata so both layers keep the same judgment. In-memory verdicts are rebuilt after a process restart.
 
+The result-axis cache is additionally keyed by a SHA-256 revision of the sequence identities and complete text of the latest three non-checkpoint user instructions. This is deliberately not the truncated 500-character judge header. A revision change clears result probabilities and sets a conservative keep, while retaining effect probabilities. Judge, synchronous pruner and manual compaction entry all refresh the revision; old-goal in-flight responses are discarded. Assistant/tool progress alone does not invalidate the cache. This policy detects instruction changes, not every semantic change in an evolving task.
+
 The pressure ratio is also session-scoped. `judgePass` computes it asynchronously, and the synchronous layer-1 override consumes it later in the same pre-step chain.
 
 ## Safety invariants
@@ -60,4 +66,4 @@ One assistant message may contain several parallel tool calls. They share one he
 
 Detailed configuration, gating, protocol history and troubleshooting moved to [the implementation reference](implementation.md). Measurement notes are in [measurements](measurements.md). The recorded [demo](../demo/README.md) runs real plugin code with a simulated host.
 
-The current fencing token supports claim-once behavior, but does not prove which external compaction owns a summary call. See [the reviewed limitations](review-2026-10-05.md) before using concurrent compaction.
+The published 0.1.0 used a global active fence and session-keyed pending receipt. Current unreleased source replaces it with async transaction ownership and replay-input validation. Host serialization and surface-stability checks remain the host's responsibility. Alternate backends whose replay input differs from DSH's contract fall back to their original summarizer.

package/docs/PORTING.md

@@ -4,6 +4,8 @@ This document describes the host surface required to run `dsh-jev-prune` outside
 
 ## Services
 
+Current source detects the host dynamically and resolves preset-local services through the optional host `serviceForAgent` API. Required root injection is limited to tools; pruner/compaction services are retried for the actual Agent. The old locked fixture is a regression baseline. See [compatibility evidence](compatibility.md).
+
 The adapter in `index.js` consumes these services:
 
 | Service | Required behaviour |

package/docs/compatibility.md

@@ -0,0 +1,43 @@
+# Host compatibility and direct installation
+
+## Version evidence (2026-10-06)
+
+[Recorded verification evidence](current-host-verification.json)
+
+| Plugin | DSH | Evidence |
+|---|---|---|
+| Published npm 0.1.0 | 0.1.5-rc.2 | Locked dependencies and simulated-host checks. |
+| Published npm 0.1.0 | 0.2.0-rc.2 | Actual CLI rejects the old tools peer range; nothing installed. |
+| Prepared 0.1.1 source | 0.2.0-rc.2 | CLI archive install, composed config, 130 addon checks, real Web startup and standard-preset service takeover passed. |
+
+The release preparation verifies a generated 0.1.1 archive. Registry publication is checked separately, followed by installation of the exact published npm version; archive verification alone is not that registry check.
+
+## Locking versus compatibility
+
+The old 0.1.5-rc.3 publication omitted required child packages; caret ranges drifted into that incomplete tree. The committed ci/dsh-host lockfile keeps old regressions reproducible. It is a test fixture, not a runtime pin. Published 0.1.0 separately declares an old tools peer range that newer DSH rejects before installation.
+
+Startup reads the actual installed DSH version; the manifest supplies tested versions and supported families. Boot makes no registry requests and does not auto-update the host. Exact tested, untested-but-supported, unsupported and unknown versions are reported separately from service capabilities.
+
+Known-family diagnostics do not bypass declared peer ranges: a future prerelease may still be rejected by DSH's semver check until its tuple is explicitly accepted and verified.
+
+Legacy root services remain supported. New Web profiles isolate compaction inside Agent presets; the plugin calls the host's serviceForAgent API before the host pruning pass. It hooks each engine once and disposes hooks with the plugin. Presets without these services remain untouched. Unsupported shapes retain host fallback behavior.
+
+The tools peer range is `^0.1.5-rc.2 || ^0.2.0-rc.2`. It intentionally does not accept every future release. Successful verification should precede widening it further.
+
+## Reproduce
+
+```bash
+npm ci
+npm run verify:current-host
+DSH_VERIFY_SPEC=@deepseek-ai/dsh@0.2.0-rc.2 npm run verify:current-host
+```
+
+PowerShell uses `$env:DSH_VERIFY_SPEC = '@deepseek-ai/dsh@0.2.0-rc.2'` before the command.
+
+The script creates an isolated host/home, packs the plugin, runs the actual `dsh plugin --profile web add <archive> --ignore-scripts`, checks configuration and addon tests, starts Web on a temporary loopback port with `--no-open`, creates an empty standard-preset Agent and dispatches an empty pre-step. It verifies takeover flags, disposes the Agent and stops the child server. It sends no task and invokes no model inference; TypeSafe is disabled. Artifacts remain at the printed temporary path. An existing isolated installation can be reused with `-- --host-dir <path>`; each run still gets a fresh home.
+
+Native build scripts are skipped. This proves this plugin's installation and attachment, not every native DSH tool. pnpm must be on PATH; initial downloads can take minutes.
+
+## CI boundaries
+
+Locked old-version jobs remain gates. A rolling @next install/activation check runs on PRs, main and weekly, as an advisory job. A broken upstream publication is visible without replacing the baseline. This is installation/activation evidence, not live Jev quality or long-task success; measurement issue #37 remains separate.

package/docs/current-host-verification.json

@@ -0,0 +1,24 @@
+{
+  "verifiedOn": "2026-10-06",
+  "hostVersion": "0.2.0-rc.2",
+  "pluginSourceVersion": "0.1.1",
+  "platform": "Windows",
+  "nodeVersion": "26.2.0",
+  "published010Installation": "rejected by DSH peer compatibility check; nothing installed",
+  "preparedArchiveInstallation": "passed through actual dsh plugin CLI",
+  "githubBranchInstallation": "passed through actual CLI with --ignore-scripts and no version exemption",
+  "configurationComposition": "passed",
+  "addonSmokeChecks": 130,
+  "realStandardPresetActivation": {
+    "success": true,
+    "pruner": "function",
+    "compaction": "function",
+    "takeoverInstalled": true,
+    "summaryHookInstalled": true,
+    "capabilities": {"tools": true, "layer1": true, "layer2": true, "pressure": true, "modelInfo": true}
+  },
+  "modelInference": "not invoked",
+  "nativeBuildScripts": "skipped",
+  "reproduce": "npm run verify:current-host",
+  "scope": "Installation and real service attachment, not live judge quality or long-task compaction success"
+}

package/docs/implementation.md

@@ -62,9 +62,9 @@ Probabilities are consumed as **relative quantiles**, never as a fixed threshold
 
 ## Receipt ownership (fence)
 
-The plugin assigns a token to each pending receipt, permits only one consumption, and clears only its own pending entry. This guards against duplicate consumption, but does not establish ownership of an external concurrent summary: external host paths do not update the plugin's active token. The original smoke C3 test checks a competing call after consumption, not competing arrival before consumption.
+In published 0.1.0, the global fence did not establish transaction ownership. Current unreleased source scopes each receipt through AsyncLocalStorage, clears inherited ownership at the public host region entry, and verifies replay messages and session before injection. A legitimate single leading system message is allowed. A claimed, closed, expired or canceled entry cannot be reused.
 
-Until transaction identity is propagated or all entry paths are serialized, do not claim concurrency safety. [Reproduction and suggested remedy](review-2026-10-05.md#p1--external-summary-can-consume-another-transactions-receipt)
+Tests cover both arrival orders, matching-input external summaries, concurrent sessions, nested host regions, system prefixes and cancellation. Different backend input shapes fall back to the host summarizer; host locks and surface mutation checks remain necessary. [Original 0.1.0 reproduction](review-2026-10-05.md#p1--external-summary-can-consume-another-transactions-receipt)
 
 ## Requirements
 

package/index.js

@@ -27,6 +27,9 @@
  * @module dsh-jev-prune
  */
 
+import { AsyncLocalStorage } from 'node:async_hooks'
+import { createHash } from 'node:crypto'
+import { isDeepStrictEqual } from 'node:util'
 import { readFileSync, writeFileSync } from 'node:fs'
 import { createRequire } from 'node:module'
 import { dirname, join } from 'node:path'
@@ -36,6 +39,7 @@ import z from '@deepseek-ai/schemastery'
 import { defineTool } from '@deepseek-ai/dsh-tools'
 
 import { JevClient, estimateTokens } from './src/jev.js'
+import { classifyHostVersion, inspectHostCapabilities } from './src/compatibility.js'
 import { JEV_PRUNE_MARKER, isToolIn, parseLimit, pruneSessionWithJev } from './src/prune.js'
 import {
   DEFAULT_COMPACT_TOOLS,
@@ -79,8 +83,8 @@ import {
  *   · 记进心跳与状态（可观测）
  *   · major.minor 与测试版本不一致时打一次 warning（不拒绝加载——也许只是字段没变）
  */
-const TESTED_DSH_VERSION = '0.1.5-rc.2'
-const TESTED_DSH_SERIES = '0.1'
+const HOST_POLICY = JSON.parse(readFileSync(fileURLToPath(new URL('./package.json', import.meta.url)), 'utf8')).dsh.compatibility
+const TESTED_DSH_VERSION = HOST_POLICY.testedVersions.join(', ')
 
 function detectDshVersion() {
   const readVersionAt = (path) => {
@@ -106,9 +110,8 @@ function detectDshVersion() {
 }
 
 const dshVersion = detectDshVersion()
-const dshVersionMatches = dshVersion === 'unknown'
-  ? null // 探测不到 ≠ 不匹配，不吓唬人，只如实上报
-  : dshVersion.split('.').slice(0, 2).join('.') === TESTED_DSH_SERIES
+const detectedCompatibility = classifyHostVersion(dshVersion, HOST_POLICY)
+const dshVersionMatches = detectedCompatibility.status === 'unknown' ? null : detectedCompatibility.status === 'tested'
 
 /**
  * `freezeMessage` 来自 @deepseek-ai/dsh-llm。用**动态导入**而不是静态导入：
@@ -137,15 +140,11 @@ export const name = 'jev-prune'
 /**
  * Cordis 的依赖声明。**这一步是整个插件能否生效的关键。**
  *
- * 实测踩过：只写 `['tools']` 时，Cordis 等到 tools 就绪就调用 apply()，
- * 而那会 `ctx.get('toolResultPruner')` 返回 null —— 服务还没注册
- * （pruner 由 base bundle 的 tool-result-pruner 条目提供）。结果插件加载成功、
- * 配置正确、installPrunerOverride 也跑了，但**静默地没接管任何东西**。
- * 这类失败在宿主日志里完全看不见，只能靠心跳文件/落盘才能发现。
- *
- * 把 pruner 也声明进来，Cordis 才会等它就绪再调 apply()。
+ * Only tools is a required root service. New Web profiles place pruner and
+ * compaction in isolated preset realms, so requiring them here stalls startup.
+ * Their actual instances are resolved and hooked before each Agent step.
  */
-export const inject = ['tools', 'toolResultPruner']
+export const inject = ['tools']
 
 /** 裁剪标记与裁剪机制从 prune.js 复用（那边才能被单测覆盖）。 */
 export { JEV_PRUNE_MARKER }
@@ -575,8 +574,26 @@ export function apply(ctx, config, deps = {}) {
   const cfg = resolveConfig(config)
   if (!cfg.enabled) return
 
-  if (dshVersionMatches === false) {
-    ctx.logger?.info?.(`[jev-prune] DSH ${dshVersion} 与测试版本 ${TESTED_DSH_VERSION} 不同系列 —— 事件字段可能已漂移，建议先跑 jev_probe_shapes 核对`)
+  // Newer Web profiles isolate compaction services in preset realms. Resolve
+  // them through the host API for the actual agent, never fabricate a realm.
+  let serviceForAgent = deps.serviceForAgent ?? null
+  const scopedServicesReady = serviceForAgent != null ? Promise.resolve() :
+    import('@deepseek-ai/dsh-agent-preset-registry').then(module => {
+      serviceForAgent = typeof module.serviceForAgent === 'function' ? module.serviceForAgent : null
+    }).catch(() => {})
+  const hostService = (name, agent) => {
+    if (agent?.ctx && serviceForAgent != null) {
+      const scoped = serviceForAgent(ctx, agent, name)
+      if (scoped != null) return scoped
+    }
+    try { return ctx.get?.(name) ?? ctx[name] ?? null } catch { return null }
+  }
+  const prunerHooks = new WeakSet()
+  const summaryHooks = new WeakSet()
+  let agentCapabilities = null
+
+  if (['untested', 'unsupported'].includes(detectedCompatibility.status)) {
+    ctx.logger?.info?.(`[jev-prune] DSH ${dshVersion}: ${detectedCompatibility.status}（已验证 ${TESTED_DSH_VERSION}）；按服务能力接入，请先用 dryRun 和 jev_probe_shapes 核对`)
   }
 
   // 每个 apply 实例持有自己的解析结果，避免一次测试/一次宿主加载污染其他实例。
@@ -596,6 +613,23 @@ export function apply(ctx, config, deps = {}) {
 
   /** session → Map(结果 seq → {keep, prob, effectProb, chars, tool}) */
   const decisions = new WeakMap()
+  const goalVersions = new WeakMap()
+  function refreshGoal(session) {
+    const events = sessionEvents(session)
+    const goals = events.filter(event => event?.type === 'user/message'
+      && !isCheckpointEvent(event)
+      && (event.data?.source?.kind == null || event.data.source.kind === 'user')
+      && eventText(event).trim().length > 0).slice(-3)
+    const version = createHash('sha256').update(JSON.stringify(goals.map(event => [event.seq, eventText(event)]))).digest('hex')
+    const previous = goalVersions.get(session)
+    if (previous != null && previous !== version) {
+      const cache = decisions.get(session)
+      for (const [seq, verdict] of cache ?? []) cache.set(seq, { ...verdict, prob: null, keep: true })
+      pressureRatios.set(session, 0)
+    }
+    goalVersions.set(session, version)
+    return { version, goal: recentGoal(events) }
+  }
   /**
    * session → 压力缺口比例（0~1）。judgePass（异步，能拿到 used/window）算好存这里，
    * pruneSession（同步，DSH 调）读它来决定「这一轮裁多少」。读不到 = 0 = 不裁。
@@ -748,6 +782,7 @@ export function apply(ctx, config, deps = {}) {
         now: new Date().toISOString(),
         pid: typeof process !== 'undefined' ? process.pid : null,
         dshVersion: { version: dshVersion, testedAgainst: TESTED_DSH_VERSION, matchesTested: dshVersionMatches },
+        compatibility: { ...detectedCompatibility, capabilities: agentCapabilities ?? inspectHostCapabilities(ctx) },
         judgeReady: judge.ready !== false,
         model: cfg.model,
         // 越界配置被钳制的记录（issue #28）。空数组 = 配置全部合法。
@@ -825,6 +860,7 @@ export function apply(ctx, config, deps = {}) {
       stats.lastJudgeSkipReason = '没有活动会话'
       return
     }
+    const { version: goalVersion, goal } = refreshGoal(session)
     if (session.surface?.nodes == null || judge.ready === false) {
       // 早退也刷新压力比例（review 反馈）：否则沿用上一轮的值，陈旧。
       pressureRatios.set(session, 0)
@@ -911,7 +947,7 @@ export function apply(ctx, config, deps = {}) {
     // 默认 0 = 不裁（失败方向：算不出压力就不动手）。
     let pressureRatio = 0
     if (cfg.judgeOn !== 'always') {
-      const meter = ctx.get('tokenMeter')
+      const meter = hostService('tokenMeter', agent)
       let used = 0
       let measured = false
       try {
@@ -981,7 +1017,6 @@ export function apply(ctx, config, deps = {}) {
       return
     }
 
-    const goal = recentGoal(sessionEvents(session))
     const { state, fitted, stateTokens } = buildJevState({
       surface,
       eventAt,
@@ -1043,6 +1078,13 @@ export function apply(ctx, config, deps = {}) {
         log('info', `判定批次失败（${batchFailures}/${batches.length}）：${error?.message ?? String(error)}`)
         continue
       }
+      if (refreshGoal(session).version !== goalVersion) {
+        stats.requests += judge.requests - startRequests
+        stats.skipped += fresh.length
+        stats.lastNote = '任务目标在判定期间改变，丢弃旧目标的响应'
+        pressureRatios.set(session, 0)
+        return
+      }
       succeeded += 1
       // 遍历本批里的**候选**（一个候选有两个题号 result_sN / effect_sN）。
       // 注意：两轴可能落在**不同批**（预算小的时候每题一批），所以本批只写
@@ -1132,6 +1174,7 @@ export function apply(ctx, config, deps = {}) {
   // 逐节点裁决逻辑放在 prune.js 里（纯函数 + 依赖注入），这样才能脱离 DSH 单测。
   // 这里只负责补齐它需要的依赖。
   function pruneViaJev(pruner, session) {
+    refreshGoal(session)
     const nameByCallId = buildToolNameIndex(sessionEvents(session))
     const out = pruneSessionWithJev({
       pruner,
@@ -1159,10 +1202,10 @@ export function apply(ctx, config, deps = {}) {
     return out
   }
 
-  function installPrunerOverride() {
-    if (takeover.installed) return () => {}
+  function installPrunerOverride(agent) {
+    const pruner = hostService('toolResultPruner', agent)
+    if (pruner != null && prunerHooks.has(pruner)) return () => {}
     takeover = { attempted: true, installed: false, reason: '' }
-    const pruner = ctx.get('toolResultPruner') ?? ctx.toolResultPruner
     if (pruner == null || typeof pruner.pruneSession !== 'function') {
       takeover.reason = pruner == null
         ? 'ctx.toolResultPruner 不存在 —— 需加载 @deepseek-ai/dsh-compaction-tool-result-pruner'
@@ -1173,15 +1216,18 @@ export function apply(ctx, config, deps = {}) {
     }
     const originalSession = pruner.pruneSession.bind(pruner)
     pruner.pruneSession = (session) => pruneViaJev(pruner, session)
+    prunerHooks.add(pruner)
     takeover = { attempted: true, installed: true, reason: 'ok' }
     log('info', `已接管 ctx.toolResultPruner.pruneSession（keepThreshold=${cfg.keepThreshold}, preserveRecent=${cfg.preserveRecent}, dryRun=${cfg.dryRun}）`)
     // 越界配置必须在加载时就喊出来（issue #28）：钳制后的行为与用户写下的配置不一致，
     // 若不提示，用户会一直以为"我配了但没生效"是插件的 bug。
     for (const w of cfg[CONFIG_WARNINGS] ?? []) log('warn', w)
     writeHeartbeat()
-    return () => {
+    ctx.effect(() => () => {
       pruner.pruneSession = originalSession
-    }
+      prunerHooks.delete(pruner)
+    })
+    return () => {}
   }
 
   // ---------------------------------------------------------- 第二层：回执压缩
@@ -1197,33 +1243,20 @@ export function apply(ctx, config, deps = {}) {
   // 发起的压缩（DSH 自己的自动压缩、另一条并发路径）都会调到 summarize，把回执抢走——
   // 结果是"别人那段被换成了我们的确定性回执，而我们要压的那段反而用了模型摘要"。
   //
-  // 修法分两层，缺一不可：
-  //   ① **归属令牌（fencing token）**：每次 compactRegion 前发一个新令牌，并把它记在
-  //      `activeFence` 上。summarize 只在「当前 activeFence === 待用回执的令牌」时才注入——
-  //      即证明"这次 summarize 是在我们那次 compactRegion 的调用栈/时序内发生的"。
-  //      await 期间若被别处的调用抢先，activeFence 会被对方改写，我们自然不注入。
-  //   ② **一次性领取（claim-once）**：回执被消费后立刻 delete，且令牌是一次性的，
-  //      防止同一次压缩里 summarize 被调用多次时重复注入。
-  //   ③ **归属校验（owner check）**：compactRegion 返回后核对令牌是否仍属于本次调用，
-  //      不属于则说明中途被打断，如实记进 action，不谎报成功。
-  let fenceCounter = 0
-  /**
-   * 当前"活跃"的压缩令牌。每次我们要调 compactRegion 时自增并置为最新值；
-   * summarize 只在待用回执的令牌与之相等时才注入。它是"归属证明"：
-   * 我们那次 compactRegion 里面派发的 summarize 一定看到自己的令牌，
-   * 而 await 期间被别处抢先发起的压缩会把它改写成对方的令牌。
-   */
-  let activeFence = 0
-  const pendingReceipt = new WeakMap()
-
-  function summaryService() {
-    return ctx.get?.('compaction') ?? ctx.compaction ?? null
+  // AsyncLocalStorage supplies transaction identity across await boundaries.
+  // Host region entry clears inherited ownership; exact input matching is an
+  // additional guard for direct summarize calls inside the producer chain.
+  const receiptContext = new AsyncLocalStorage()
+  const runReceiptCompactions = new WeakMap()
+
+  function summaryService(agent) {
+    return hostService('compaction', agent)
   }
 
-  function installSummaryHook() {
-    if (summaryHook.installed) return () => {}
+  function installSummaryHook(agent) {
+    const compaction = summaryService(agent)
+    if (compaction != null && summaryHooks.has(compaction)) return () => {}
     summaryHook = { attempted: true, installed: false, reason: '' }
-    const compaction = summaryService()
     if (compaction == null || typeof compaction.summarize !== 'function') {
       summaryHook.reason = compaction == null
         ? 'ctx.compaction 不存在 —— 需加载 @deepseek-ai/dsh-compaction-basic'
@@ -1232,17 +1265,25 @@ export function apply(ctx, config, deps = {}) {
       writeHeartbeat()
       return () => {}
     }
-    const original = compaction.summarize.bind(compaction)
-    compaction.summarize = async (input, agent, signal) => {
-      const entry = pendingReceipt.get(agent?.session)
-      // 三道闸都要过才算"这是我们的那一次"（issue #29）：
-      //   · entry 存在、未过期
-      //   · 未被领取（claimed）—— 同一次压缩里 summarize 若被多次调用，只注入一次
-      //   · 令牌仍是当前活跃令牌 —— 证明这次 summarize 发生在我们那次 compactRegion 之内，
-      //     而不是被 await 期间别处的并发压缩抢先调用
+    const original = compaction.summarize
+    const originalRegion = compaction.compactRegion
+    if (typeof originalRegion !== 'function') {
+      summaryHook.reason = 'compaction.compactRegion 不是函数'
+      return () => {}
+    }
+    const wrappedRegion = (...args) => receiptContext.run(undefined, () => originalRegion.apply(compaction, args))
+    runReceiptCompactions.set(compaction, (entry, ...args) => receiptContext.run(entry, () => originalRegion.apply(compaction, args)))
+    const wrappedSummarize = async (input, agent, signal) => {
+      const entry = receiptContext.getStore()
+      const messages = input?.messages
+      const matches = entry != null && Array.isArray(messages)
+        && (isDeepStrictEqual(messages, entry.messages)
+          || (messages.length === entry.messages.length + 1 && messages[0]?.role === 'system'
+            && isDeepStrictEqual(messages.slice(1), entry.messages)))
+      // Require both async transaction ownership and matching replay input.
       if (entry != null
         && !entry.claimed
-        && entry.fence === activeFence
+        && !entry.closed && entry.session === agent?.session && matches && !signal?.aborted
         && Date.now() - entry.at < 5 * 60 * 1000) {
         entry.claimed = true
         stats.receiptSummaries += 1
@@ -1252,24 +1293,27 @@ export function apply(ctx, config, deps = {}) {
           model: 'deterministic',
         }
       }
-      // 不是我们的：如实退回原实现，绝不吞掉别人的摘要。
-      // 若 entry 存在但令牌不匹配，说明恰好撞上竞态 —— 记一笔，让"回执被抢"可观测。
-      if (entry != null && !entry.claimed && entry.fence !== activeFence) {
-        stats.receiptFenceMisses += 1
-      }
-      return original(input, agent, signal)
+      // Foreign, canceled or shape-mismatched calls use the original backend.
+      return original.call(compaction, input, agent, signal)
     }
+    compaction.summarize = wrappedSummarize
+    compaction.compactRegion = wrappedRegion
+    summaryHooks.add(compaction)
     summaryHook = { attempted: true, installed: true, reason: 'ok' }
     log('info', `已接管 ctx.compaction.summarize（回执模式；compactOn=${cfg.compactOn}, quantile=${cfg.compactQuantile}）`)
     writeHeartbeat()
-    return () => {
-      compaction.summarize = original
-    }
+    ctx.effect(() => () => {
+      if (compaction.summarize === wrappedSummarize) compaction.summarize = original
+      if (compaction.compactRegion === wrappedRegion) compaction.compactRegion = originalRegion
+      summaryHooks.delete(compaction)
+      runReceiptCompactions.delete(compaction)
+    })
+    return () => {}
   }
 
   /** 用宿主自己的 token meter 量一段 surface 跨度的 token 数。 */
   function spanTokens(agent, seqs) {
-    const meter = ctx.get?.('tokenMeter')
+    const meter = hostService('tokenMeter', agent)
     if (meter == null || typeof meter.measure !== 'function') return null
     try {
       const wanted = new Set(seqs)
@@ -1327,12 +1371,17 @@ export function apply(ctx, config, deps = {}) {
       report.blocked = '没有活动会话'
       return report
     }
-    const compaction = summaryService()
+    refreshGoal(session)
+    await scopedServicesReady
+    installPrunerOverride(agent)
+    installSummaryHook(agent)
+    agentCapabilities = inspectHostCapabilities({get: name => hostService(name, agent)})
+    const compaction = summaryService(agent)
     if (compaction == null || typeof compaction.compactRegion !== 'function') {
       report.blocked = 'ctx.compaction 不可用（compactRegion 缺失）'
       return report
     }
-    if (!summaryHook.installed) {
+    if (!summaryHooks.has(compaction)) {
       // 没有 summarize 接入点 = 我们的回执注不进去 = 会退化成模型摘要。宁可不做。
       report.blocked = `summarize 未接管（${summaryHook.reason || '未尝试'}）—— 不做第二层，避免退化成模型摘要`
       return report
@@ -1345,7 +1394,7 @@ export function apply(ctx, config, deps = {}) {
     // 压力门：整对删除比截断风险大，所以默认阈值更高（70% vs 第一层的 55%）
     // 失败方向与第一层一致（issue #32）：解析不出阈值、或拿不到用量，都**不做**。
     if (!force && cfg.compactOn !== 'always') {
-      const meter = ctx.get?.('tokenMeter')
+      const meter = hostService('tokenMeter', agent)
       let used = 0
       let measured = false
       try {
@@ -1492,7 +1541,7 @@ export function apply(ctx, config, deps = {}) {
         let applied = 0
         let appliedChars = 0
         try {
-          const meter = ctx.get?.('tokenMeter')
+          const meter = hostService('tokenMeter', agent)
           for (let offset = 0; offset < pairs.length; offset += 1) {
             const pair = pairs[offset]
             const event = session.eventAt(pair.seq)
@@ -1559,17 +1608,15 @@ export function apply(ctx, config, deps = {}) {
         continue
       }
 
-      // 发一个一次性令牌并抢占 activeFence（issue #29）。
-      // 之后若别处的并发压缩改写了 activeFence，我们这次的 summarize 就不会注入回执，
-      // 也就不会把别人的区间替换成我们的回执——那是原实现最危险的失败模式。
-      const fence = (fenceCounter += 1)
-      activeFence = fence
-      pendingReceipt.set(session, { text: receipt, at: Date.now(), fence, claimed: false })
+      // The receipt is scoped to this transaction, including asynchronous work.
+      const entry = {
+        session, text: receipt, at: Date.now(), claimed: false, closed: false,
+        messages: structuredClone(spanSeqs.map(seq => session.deriveEventMessage(session.eventAt(seq))).filter(message => message != null)),
+      }
       try {
-        const result = await compaction.compactRegion(range.start, range.end, agent, options.signal)
-        // 归属校验：compactRegion 返回时令牌若已被别人改写，说明这次压缩中途被打断
-        // （或我们的回执被别人消费了）。此时不能谎报成功——如实记下来。
-        if (activeFence !== fence) {
+        const result = await runReceiptCompactions.get(compaction)(entry, range.start, range.end, agent, options.signal)
+        action.receiptInjected = entry.claimed
+        if (!entry.claimed) {
           stats.receiptFenceMisses += 1
           action.fenceLost = true
         }
@@ -1592,11 +1639,8 @@ export function apply(ctx, config, deps = {}) {
         action.error = error?.message ?? String(error)
         report.actions.push(action)
       } finally {
-        // 只清理**自己**的令牌：若期间已被别人改写，那个令牌归对方管，不要去动它
-        // （原实现无论谁覆盖都无条件 delete(session)，会把别人的待用回执一起清掉）
-        const current = pendingReceipt.get(session)
-        if (current?.fence === fence) pendingReceipt.delete(session)
-        if (activeFence === fence) activeFence = 0
+        // Descendant tasks cannot claim a receipt after the producer finished.
+        entry.closed = true
       }
     }
 
@@ -1632,6 +1676,7 @@ export function apply(ctx, config, deps = {}) {
           start: a.start, end: a.end, ok: a.ok ?? null, dryRun: a.dryRun ?? null,
           calls: a.calls, resultChars: a.resultChars, receiptTokens: a.receiptTokens,
           shadowedTokens: a.shadowedTokens, partial: a.partial ?? false,
+          receiptInjected: a.receiptInjected ?? null, fenceLost: a.fenceLost ?? false,
           partialResults: a.partialResults ?? null, incomplete: a.incomplete ?? false,
           error: a.error ?? null, skipped: a.skipped ?? null,
         })),
@@ -1652,8 +1697,10 @@ export function apply(ctx, config, deps = {}) {
     stats.preStepEvents = (stats.preStepEvents ?? 0) + 1
     // 双保险：如果 apply() 时服务还没就绪，每次 pre-step 再试一次。
     // 依赖时序这种东西不该让插件"看起来加载成功、实际什么都没做"。
-    if (!takeover.installed) installPrunerOverride()
-    if (!summaryHook.installed) installSummaryHook()
+    await scopedServicesReady
+    installPrunerOverride(agent)
+    installSummaryHook(agent)
+    agentCapabilities = inspectHostCapabilities({get: name => hostService(name, agent)})
     if (judge.ready === false) {
       stats.errors += 1
       stats.lastNote = '未配置 TYPESAFE_API_KEY，跳过判定'
@@ -1707,7 +1754,7 @@ export function apply(ctx, config, deps = {}) {
   function renderStatus(agent) {
     const session = agent?.session
     const cache = session != null ? (decisions.get(session) ?? new Map()) : new Map()
-    const meter = ctx.get('tokenMeter')
+    const meter = hostService('tokenMeter', agent)
     const used = session != null && typeof meter?.measure === 'function' ? (meter.measure(session)?.totalTokens ?? 0) : 0
     // 工具名索引诊断：白名单不命中时，这一行能立刻告诉你"是名字没配上"
     const nameProbe = session?.surface?.nodes != null

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-jev-prune",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Jev-judged context compaction for DeepSeek Harness. Two layers: prune stale tool results (semantic instead of size-only), and replace spent tool-call ranges with a deterministic receipt instead of a model-written summary.",
   "type": "module",
   "main": "index.js",
@@ -32,11 +32,12 @@
     "check": "node test/check.js",
     "smoke": "node test/smoke_apply.mjs",
     "demo": "node demo/run.mjs",
-    "coverage": "node --experimental-test-coverage --test --test-coverage-include=src/jev.js --test-coverage-include=src/prune.js --test-coverage-include=src/receipt.js --test-coverage-include=src/state.js --test-coverage-lines=90 --test-coverage-branches=75 --test-coverage-functions=75 test/check.js test/smoke_apply.mjs"
+    "verify:current-host": "node scripts/verify_current_host.mjs",
+    "coverage": "node --experimental-test-coverage --test --test-coverage-include=src/compatibility.js --test-coverage-include=src/jev.js --test-coverage-include=src/prune.js --test-coverage-include=src/receipt.js --test-coverage-include=src/state.js --test-coverage-lines=90 --test-coverage-branches=75 --test-coverage-functions=75 test/check.js test/smoke_apply.mjs"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh-tools": "^0.1.5-rc.2",
-    "@deepseek-ai/schemastery": "*"
+    "@deepseek-ai/dsh-tools": "^0.1.5-rc.2 || ^0.2.0-rc.2",
+    "@deepseek-ai/schemastery": "^3.18.2"
   },
   "devDependencies": {
     "@deepseek-ai/dsh-llm": "0.1.5-rc.2",
@@ -71,7 +72,9 @@
     },
     "compatibility": {
       "testedAgainst": "@deepseek-ai/dsh@0.1.5-rc.2",
-      "note": "DSH 0.1.x is a pre-release line; plugin-facing surfaces (event shapes, service names) may change between rc versions. After upgrading DSH, run `node test/check.js` and the smoke test, and use the `jev_probe_shapes` tool once in a real session."
+      "testedVersions": ["0.1.5-rc.2", "0.2.0-rc.2"],
+      "supportedSeries": ["0.1", "0.2"],
+      "note": "Version detection is dynamic; testedVersions records evidence, not a runtime pin. Unknown versions are reported and services are inspected. Latest-host install/activation is checked separately from the locked 0.1.5-rc.2 fixture."
     }
   }
 }

package/scripts/verify_current_host.mjs

@@ -0,0 +1,75 @@
+/** Disposable CLI install + real preset activation, without model requests. */
+import assert from 'node:assert/strict'
+import {existsSync,mkdtempSync,readFileSync,writeFileSync} from 'node:fs'
+import {tmpdir} from 'node:os'
+import {dirname,join,resolve} from 'node:path'
+import {fileURLToPath,pathToFileURL} from 'node:url'
+import {spawn,spawnSync} from 'node:child_process'
+import {createServer} from 'node:net'
+
+const repo=resolve(dirname(fileURLToPath(import.meta.url)),'..')
+const npmCli=process.env.npm_execpath
+assert.ok(npmCli?.endsWith('.js'),'Run through npm run verify:current-host')
+const arg=process.argv.indexOf('--host-dir')
+const host=arg<0?mkdtempSync(join(tmpdir(),'dsh-host-verification-')):resolve(process.argv[arg+1])
+const run=(program,args,cwd=repo,env=process.env)=>{
+  const result=spawnSync(program,args,{cwd,env,encoding:'utf8',timeout:600000,maxBuffer:4*1024*1024,windowsHide:true})
+  assert.equal(result.status,0,(result.stderr||result.stdout||String(result.error)).replace(/([?&]token=)[^\s]+/g,'$1<redacted>'))
+  return result.stdout
+}
+if(arg<0){
+  const spec=process.env.DSH_VERIFY_SPEC||'@deepseek-ai/dsh@next'
+  console.log('Installing isolated host:',spec)
+  run(process.execPath,[npmCli,'install','--prefix',host,'--ignore-scripts','--no-audit','--no-fund',spec])
+}
+const bin=join(host,'node_modules/@deepseek-ai/dsh/lib/bin.js')
+assert.ok(existsSync(bin))
+const version=JSON.parse(readFileSync(join(host,'node_modules/@deepseek-ai/dsh/package.json'),'utf8')).version
+const home=mkdtempSync(join(host,'verification-home-'))
+const env={...process.env,DSH_HOME:home,TYPESAFE_API_KEY:''}
+const archive=JSON.parse(run(process.execPath,[npmCli,'pack','--json','--pack-destination',home]))[0].filename
+const packed=join(home,archive)
+run(process.execPath,[bin,'plugin','--profile','web','add',packed,'--ignore-scripts'],repo,env)
+const dump=run(process.execPath,[bin,'--profile','web','--dump-config'],repo,env)
+assert.match(dump,/name: dsh-jev-prune/)
+const addon=join(home,'profiles/web/node_modules/dsh-jev-prune')
+run(process.execPath,[join(addon,'test/check.js')],host,env)
+run(process.execPath,[join(addon,'test/smoke_apply.mjs')],host,env)
+const heartbeat=join(home,'heartbeat.json'),resultPath=join(home,'activation.json')
+const probe=join(home,'probe.mjs')
+writeFileSync(probe,`import {readFileSync,writeFileSync} from 'node:fs';
+import {randomUUID} from 'node:crypto';
+import {agentEvents} from '@deepseek-ai/dsh-agent';
+import {serviceForAgent} from '@deepseek-ai/dsh-agent-preset-registry';
+export const inject=['agents','agentPresets','agentLoop'];
+export function apply(ctx){ctx.effect(()=>{const timer=setTimeout(async()=>{let handle;try{
+handle=await ctx.agents.create({sessionId:randomUUID(),meta:{cwd:${JSON.stringify(host)},agentPreset:'standard'},setup:async scope=>{await ctx.agentPresets.mount(scope,'standard')}});
+const agent=handle.agent;
+await agentEvents(ctx,agent).waterfall('agent/pre-step',{signal:new AbortController().signal,messages:[],turn:0,step:0},async()=>({kind:'enter',messages:[]}));
+const state=JSON.parse(readFileSync(${JSON.stringify(heartbeat)},'utf8'));
+writeFileSync(${JSON.stringify(resultPath)},JSON.stringify({success:true,pruner:typeof serviceForAgent(ctx,agent,'toolResultPruner')?.pruneSession,compaction:typeof serviceForAgent(ctx,agent,'compaction')?.compactRegion,takeover:state.takeover,summaryHook:state.summaryHook,compatibility:state.compatibility}));
+}catch(error){writeFileSync(${JSON.stringify(resultPath)},JSON.stringify({success:false,error:String(error)}));}finally{await handle?.dispose();}},2000);return()=>clearTimeout(timer);});}
+`)
+// This profile was created solely by this verification run.
+writeFileSync(join(home,'profiles/web/cordis.patch.yml'),
+  '- id: jev-prune\n  config:\n    dryRun: true\n    heartbeatFile: '+JSON.stringify(heartbeat)+'\n- insert:\n    - id: activation-probe\n      name: '+JSON.stringify(pathToFileURL(probe).href)+'\n')
+const server=createServer()
+await new Promise(resolve=>server.listen(0,'127.0.0.1',resolve))
+const port=server.address().port
+await new Promise(resolve=>server.close(resolve))
+let diagnostic=''
+const child=spawn(process.execPath,[bin,'--profile','web','--no-open','--port',String(port)],{cwd:repo,env,windowsHide:true,stdio:['ignore','pipe','pipe']})
+child.stdout.on('data',chunk=>{diagnostic=(diagnostic+chunk).slice(-20000)})
+child.stderr.on('data',chunk=>{diagnostic=(diagnostic+chunk).slice(-20000)})
+try{
+  const deadline=Date.now()+90000
+  while(!existsSync(resultPath)&&Date.now()<deadline&&child.exitCode===null)await new Promise(resolve=>setTimeout(resolve,250))
+  assert.ok(existsSync(resultPath),diagnostic.replace(/([?&]token=)[^\s]+/g,'$1<redacted>'))
+  const result=JSON.parse(readFileSync(resultPath,'utf8'))
+  assert.equal(result.success,true,result.error)
+  assert.equal(result.takeover.installed,true)
+  assert.equal(result.summaryHook.installed,true)
+  console.log(JSON.stringify({hostVersion:version,installation:'passed',configuration:'passed',realPresetActivation:'passed',addonSmokeChecks:'passed',modelInference:'not invoked',artifact:resultPath},null,2))
+}finally{
+  if(child.exitCode===null)child.kill('SIGTERM')
+}

package/src/compatibility.js

@@ -0,0 +1,24 @@
+/** Version evidence and runtime shape are independent checks. No network at boot. */
+export function classifyHostVersion(version, policy) {
+  const testedVersions = policy.testedVersions ?? []
+  if (!version || version === 'unknown') return { status: 'unknown', version: 'unknown', testedVersions }
+  if (testedVersions.includes(version)) return { status: 'tested', version, testedVersions }
+  const family = /^([0-9]+\.[0-9]+)\./.exec(version)?.[1]
+  const supported = (policy.supportedSeries ?? []).includes(family)
+  return { status: supported ? 'untested' : 'unsupported', version, testedVersions }
+}
+
+export function inspectHostCapabilities(ctx) {
+  const service = name => {
+    try { return ctx.get?.(name) ?? ctx[name] ?? null } catch { return null }
+  }
+  const pruner = service('toolResultPruner')
+  const compaction = service('compaction')
+  return {
+    tools: typeof service('tools')?.register === 'function',
+    layer1: typeof pruner?.pruneSession === 'function' && typeof pruner?.pruneContent === 'function',
+    layer2: typeof compaction?.compactRegion === 'function' && typeof compaction?.summarize === 'function',
+    pressure: typeof service('tokenMeter')?.measure === 'function',
+    modelInfo: typeof service('llm')?.resolveModelInfo === 'function',
+  }
+}

package/test/check.js

@@ -11,6 +11,7 @@ import assert from 'node:assert/strict'
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs'
 import { dirname, join, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { classifyHostVersion, inspectHostCapabilities } from '../src/compatibility.js'
 
 import { JevClient, JevError, estimateTokens } from '../src/jev.js'
 import { JEV_PRUNE_MARKER, countChars, decideAction, parseLimit, planTrims, pruneSessionWithJev, sliceWithBudget } from '../src/prune.js'
@@ -57,6 +58,17 @@ import {
 } from '../index.js'
 
 const here = dirname(dirname(fileURLToPath(import.meta.url)))
+{
+  const policy = { testedVersions: ['0.1.5-rc.2'], supportedSeries: ['0.1', '0.2'] }
+  assert.equal(classifyHostVersion('0.1.5-rc.2', policy).status, 'tested')
+  assert.equal(classifyHostVersion('0.2.0-rc.2', policy).status, 'untested')
+  assert.equal(classifyHostVersion('0.3.0', policy).status, 'unsupported')
+  assert.equal(classifyHostVersion('unknown', policy).status, 'unknown')
+  assert.equal(classifyHostVersion('not-a-version', policy).status, 'unsupported')
+  assert.deepEqual(inspectHostCapabilities({get:()=>null}), {tools:false,layer1:false,layer2:false,pressure:false,modelInfo:false})
+  assert.equal(inspectHostCapabilities({get:()=>{throw Error('missing')},tools:{register(){}}}).tools, false)
+  assert.equal(inspectHostCapabilities({tools:{register(){}},compaction:{compactRegion(){},summarize(){}}}).layer2,true)
+}
 
 // ---------------------------------------------------------------- token 估算
 // 常数由真实 BPE 标定（见 jev.js 的 TOKEN_ESTIMATE_CONSTANTS 注释）。

package/test/smoke_apply.mjs

@@ -226,7 +226,7 @@ function makeCompaction(session) {
       const endIdx = nodes.indexOf(end)
       if (startIdx < 0 || endIdx < 0 || startIdx > endIdx) throw new Error(`compactRegion: 非法区间 ${start}-${end}`)
       // 关键：模拟后端内部这一次动态派发 —— 猴补丁必须在这里被调用到
-      const summarized = await this.summarize({ messages: [] }, agent, signal)
+      const summarized = await this.summarize({ messages: nodes.slice(startIdx, endIdx + 1).map(seq => session.deriveEventMessage(session.eventAt(seq))).filter(message => message != null) }, agent, signal)
       const text = summarized.summary.map((b) => b.text ?? '').join('')
       calls.push({ start, end, nodes: nodes.slice(startIdx, endIdx + 1), summary: text, provider: summarized.provider })
       return {
@@ -351,7 +351,7 @@ try {
 }
 
 check('导出 name', typeof mod.name === 'string' && mod.name.length > 0, mod.name)
-check('导出 inject 含 tools', Array.isArray(mod.inject) && mod.inject.includes('tools'), JSON.stringify(mod.inject))
+check('导出 inject 仅要求根级 tools（不等待 preset 的 pruner）', Array.isArray(mod.inject) && mod.inject.includes('tools') && !mod.inject.includes('toolResultPruner'), JSON.stringify(mod.inject))
 check('导出 apply', typeof mod.apply === 'function')
 
 // 可选的 dsh-llm 不存在时必须走可测的浅拷贝降级；恒等函数会让后续代码意外复用入参。
@@ -698,13 +698,13 @@ async function layer2Run(effectOfS2) {
   let intruderResult = null
   const innerCompact = compaction.compactRegion.bind(compaction)
   compaction.compactRegion = async (start, end, agent, signal) => {
-    const first = await innerCompact(start, end, agent, signal)
-    // 第一次完成后，让"别处"再发起一次压缩并观察它拿到什么 provider
+    await Promise.resolve()
+    // Competing direct summary arrives before the intended region summary.
     if (intruderResult == null) {
       intruderResult = await compaction.summarize({ messages: ['elsewhere'] }, agent, signal)
       compaction.intruderProvider = intruderResult?.provider ?? null
     }
-    return first
+    return await innerCompact(start, end, agent, signal)
   }
 
   const ctx = makeCtx({ pruner, session, compaction })
@@ -1348,6 +1348,164 @@ async function layer2Run(effectOfS2) {
     compaction.calls.length > 0, `实际压缩 ${compaction.calls.length} 段`)
 }
 
+// Regression #48: independent summaries cannot inherit another async transaction.
+{
+  const session = makeSession()
+  const pruner = makePruner()
+  const compaction = makeCompaction(session)
+  const originalRegion = compaction.compactRegion.bind(compaction)
+  let entered
+  const started = new Promise(resolve => { entered = resolve })
+  let release
+  const barrier = new Promise(resolve => { release = resolve })
+  compaction.compactRegion = async (...args) => {
+    entered()
+    await barrier
+    return originalRegion(...args)
+  }
+  const ctx = makeCtx({ pruner, session, compaction })
+  const judge = fakeJudge({3:0.05,5:0.05,7:0.05},{3:0.05,5:0.05,7:0.05})
+  mod.apply(ctx,{...PLUGIN_CFG,compactQuantile:1,minCandidatesForRelative:3},{judge})
+  const agent = {session,options:{}}
+  const pending = ctx.waterfall('agent/pre-step',{agent},()=>{})
+  await started
+  const messages = session.surface.nodes.slice(1,-1).map(seq=>session.deriveEventMessage(session.eventAt(seq)))
+  const foreign = await compaction.summarize({messages},agent)
+  check('独立异步摘要即使输入相同也不能领取插件回执',foreign.provider==='fake',foreign.provider)
+  release()
+  await pending
+  check('外部摘要先到后插件事务仍获得自己的回执',compaction.calls[0]?.provider==='jev-receipt')
+}
+// Regression #48: one apply instance may compact two sessions concurrently.
+{
+  const sessionA=makeSession(), sessionB=makeSession()
+  sessionB.eventAt(2).data.message.content[0].text='Different session'
+  const pruner=makePruner(), compaction=makeCompaction(sessionA)
+  const providers=[]
+  let release
+  const barrier=new Promise(resolve=>{release=resolve})
+  let entered=0
+  compaction.compactRegion=async(start,end,agent,signal)=>{
+    if(++entered===2)release()
+    await barrier
+    const nodes=agent.session.surface.nodes
+    const seqs=nodes.slice(nodes.indexOf(start),nodes.indexOf(end)+1)
+    const input={messages:seqs.map(seq=>agent.session.deriveEventMessage(agent.session.eventAt(seq)))}
+    const first=await compaction.summarize(input,agent,signal)
+    const repeated=await compaction.summarize(input,agent,signal)
+    providers.push([first.provider,repeated.provider])
+    return {shadowedSeqs:seqs}
+  }
+  const ctx=makeCtx({pruner,session:sessionA,compaction})
+  const judge=fakeJudge({3:0.05,5:0.05,7:0.05},{3:0.05,5:0.05,7:0.05})
+  mod.apply(ctx,{...PLUGIN_CFG,compactQuantile:1,minCandidatesForRelative:3},{judge})
+  await Promise.all([sessionA,sessionB].map(session=>ctx.waterfall('agent/pre-step',{agent:{session,options:{}}},()=>{})))
+  check('不同会话并发压缩均只领取各自回执一次',providers.length===2&&providers.every(([a,b])=>a==='jev-receipt'&&b==='fake'),JSON.stringify(providers))
+}
+// Regression #49: goal edits invalidate result but not effect, including replacements.
+{
+  const session=makeSession(), pruner=makePruner(), compaction=makeCompaction(session)
+  const ctx=makeCtx({pruner,session,compaction})
+  const result={3:0.05,5:0.05,7:0.05}
+  const judge=fakeJudge(result,{3:0.05,5:0.05,7:0.05})
+  judge.asked=[]
+  const ask=judge.ask.bind(judge)
+  judge.ask=async(state,questions)=>{judge.asked.push(Object.keys(questions));return ask(state,questions)}
+  mod.apply(ctx,{...PLUGIN_CFG,compactOn:'off'},{judge})
+  const exec={agent:{session,options:{}}}
+  await ctx.waterfall('agent/pre-step',exec,()=>{})
+  await ctx.waterfall('agent/pre-step',exec,()=>{})
+  check('目标不变不重复判定',judge.requests===1)
+  session.append('user/message',{content:[{type:'text',text:'Use the earlier read for a new task'}],source:{kind:'user'}},{surfaceOp:'append'})
+  check('新目标出现后同步裁剪不能沿用旧低分',pruner.pruneSession(session).pruned.length===0)
+  await ctx.waterfall('agent/pre-step',exec,()=>{})
+  check('新目标只补判 result 轴，保留已有 effect',judge.asked[1]?.length===3&&judge.asked[1].every(id=>id.startsWith('result_s')),JSON.stringify(judge.asked[1]))
+  const trimmed=pruner.pruneSession(session)
+  check('补判完成后第一层可生成 replacement',trimmed.pruned.length===3)
+  for (const row of trimmed.pruned) result[row.replacementSeq]=0.95
+  session.append('user/message',{content:[{type:'text',text:'Another goal requiring old results'}],source:{kind:'user'}},{surfaceOp:'append'})
+  await ctx.waterfall('agent/pre-step',exec,()=>{})
+  check('replacement 继承的旧 result 被失效并重新请求',judge.asked[2]?.length===3&&judge.asked[2].every(id=>id.startsWith('result_s')),JSON.stringify(judge.asked[2]))
+  const newest=session.eventAt(session.surface.nodes.at(-1))
+  newest.data.content[0].text='x'.repeat(600)+'old suffix'
+  await ctx.waterfall('agent/pre-step',exec,()=>{})
+  const requestsBeforeEdit=judge.requests
+  newest.data.content[0].text='x'.repeat(600)+'new suffix'
+  await ctx.waterfall('agent/pre-step',exec,()=>{})
+  check('同 seq 指令在 500 字之后变化也使缓存失效',judge.requests===requestsBeforeEdit+1)
+}
+// Regression #49: late answers must not repopulate a stale-goal cache.
+{
+  const session=makeSession(), pruner=makePruner(), compaction=makeCompaction(session)
+  const ctx=makeCtx({pruner,session,compaction})
+  const judge=fakeJudge({3:0.05,5:0.05,7:0.05},{3:0.05,5:0.05,7:0.05})
+  const ask=judge.ask.bind(judge)
+  judge.ask=async(state,questions)=>{
+    const answer=await ask(state,questions)
+    if(judge.requests===1)session.append('user/message',{content:[{type:'text',text:'Goal changed during request'}],source:{kind:'user'}},{surfaceOp:'append'})
+    return answer
+  }
+  mod.apply(ctx,{...PLUGIN_CFG,compactOn:'off'},{judge})
+  const exec={agent:{session,options:{}}}
+  await ctx.waterfall('agent/pre-step',exec,()=>{})
+  check('请求中目标变化时不写入旧目标低分',pruner.pruneSession(session).pruned.length===0)
+  await ctx.waterfall('agent/pre-step',exec,()=>{})
+  check('下一轮仍请求新目标判定',judge.requests===2)
+}
+// Review follow-up: host-owned nested regions and leading system messages.
+{
+  const session=makeSession(),pruner=makePruner(),compaction=makeCompaction(session)
+  let own=false
+  let nestedProvider
+  let canceledProvider
+  compaction.compactRegion=async(start,end,agent,signal)=>{
+    const nodes=session.surface.nodes
+    const seqs=nodes.slice(nodes.indexOf(start),nodes.indexOf(end)+1)
+    const messages=seqs.map(seq=>session.deriveEventMessage(session.eventAt(seq)))
+    if(!own){
+      own=true
+      // This call uses the public entry and must clear the inherited owner.
+      nestedProvider=(await compaction.compactRegion(start,end,agent,signal)).provider
+      const abort=new AbortController();abort.abort()
+      canceledProvider=(await compaction.summarize({messages},agent,abort.signal)).provider
+      const result=await compaction.summarize({messages:[{role:'system',content:[]},...messages]},agent,signal)
+      check('合法 system 前缀仍允许事务回执',result.provider==='jev-receipt')
+      return {shadowedSeqs:seqs}
+    }
+    return compaction.summarize({messages},agent,signal)
+  }
+  const ctx=makeCtx({pruner,session,compaction})
+  const judge=fakeJudge({3:0.05,5:0.05,7:0.05},{3:0.05,5:0.05,7:0.05})
+  mod.apply(ctx,{...PLUGIN_CFG,compactQuantile:1,minCandidatesForRelative:3},{judge})
+  await ctx.waterfall('agent/pre-step',{agent:{session,options:{}}},()=>{})
+  check('嵌套的宿主 region 不继承插件回执归属',nestedProvider==='fake',nestedProvider)
+  check('已中断摘要不能消耗回执',canceledProvider==='fake',canceledProvider)
+}
+// ---------------------------------------------------------------- 汇总
+{
+  const sessionA=makeSession(),sessionB=makeSession()
+  const prunerA=makePruner(),prunerB=makePruner()
+  const compactionA=makeCompaction(sessionA),compactionB=makeCompaction(sessionB)
+  const ctx=makeCtx({pruner:prunerA,session:sessionA,compaction:compactionA})
+  const get=ctx.get
+  const meter=ctx.tokenMeter
+  delete ctx.compaction
+  delete ctx.tokenMeter
+  ctx.get=name=>['toolResultPruner','compaction','tokenMeter'].includes(name)?null:get(name)
+  const originalA=prunerA.pruneSession,originalB=prunerB.pruneSession
+  const services=new WeakMap()
+  const agentA={ctx:{},session:sessionA,options:{}},agentB={ctx:{},session:sessionB,options:{}}
+  services.set(agentA,{toolResultPruner:prunerA,compaction:compactionA,tokenMeter:meter})
+  services.set(agentB,{toolResultPruner:prunerB,compaction:compactionB,tokenMeter:meter})
+  const judge=fakeJudge({3:0.05,5:0.05,7:0.05},{3:0.05,5:0.05,7:0.05})
+  mod.apply(ctx,{...PLUGIN_CFG,compactQuantile:1,minCandidatesForRelative:3},
+    {judge,serviceForAgent:(_ctx,agent,name)=>services.get(agent)?.[name]})
+  check('根级无 pruner 时插件仍注册执行前钩子',ctx.handlers.get('agent/pre-step')?.length===2)
+  await ctx.waterfall('agent/pre-step',{agent:agentA},()=>{})
+  await ctx.waterfall('agent/pre-step',{agent:agentB},()=>{})
+  check('两个 preset 的 pruner 分别接管',prunerA.pruneSession!==originalA&&prunerB.pruneSession!==originalB)
+  check('两个 preset 的回执进入各自引擎',compactionA.calls[0]?.provider==='jev-receipt'&&compactionB.calls[0]?.provider==='jev-receipt')
+}
 // ---------------------------------------------------------------- 汇总
 console.log()
 for (const r of results) console.log(`${r.ok ? '  ✅' : '  ❌'} ${r.name}${r.detail ? `  — ${r.detail}` : ''}`)