dsh-ptc-plus 0.2.1 → 0.2.3

package/README.md

@@ -1,6 +1,9 @@
 # dsh-ptc-plus
 
+English | [简体中文](README.zh.md)
+
 [![Node.js ^22.19.0 || >=24.0.0](https://img.shields.io/badge/Node.js-%5E22.19.0%20%7C%7C%20%3E%3D24.0.0-5fa04e?logo=nodedotjs&logoColor=white)](package.json)
+[![npm version](https://img.shields.io/npm/v/dsh-ptc-plus?logo=npm)](https://www.npmjs.com/package/dsh-ptc-plus)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 [![DeepSeek Harness](https://img.shields.io/badge/DeepSeek%20Harness-PTC%20mode-4b6bfb)](https://github.com/deepseek-ai/deepseek-harness)
 [![Status: community plugin](https://img.shields.io/badge/Status-community%20plugin-lightgrey)](docs/publishing.md)
@@ -70,6 +73,8 @@ edit_run_code({ edits: [{ old_string: 'deps.length', new_string: 'deps' }] })
 
 Only the diff goes in. The full source stays out of the conversation. Exact replacements and regular expressions both have limits, so a bad pattern cannot hang.
 
+When a rejected cell has exactly one validated missing closing token at the end, its diagnostic includes the complete `edit_run_code(...)` call needed to apply that correction and rerun the cell. That generated call carries an `expected_target_call_seq` precondition, so it is rejected without execution if another cell becomes the edit target first. PTC Plus never applies the suggestion automatically; ambiguous repairs or repairs without a persistent target identity still require corrected source.
+
 ### Module syntax
 
 DSH PTC mode executes each `run_code` as an async function body, where static `import` and `export` declarations are invalid. PTC Plus adapts those forms before execution with AST analysis.
@@ -107,10 +112,12 @@ Open **Settings → Plugin configuration** to use the card shown above. The `ena
 
 Every setting applies live and keeps existing bindings. A submitted cell uses one configuration for its complete execution; changes made while it runs apply to cells submitted afterward. A failed change rolls back. Node fixes a worker's V8 old-generation limit when the worker starts, so that one setting is rejected while a session worker is active and can be changed after the session is disposed. A failed enable is rolled back and persisted as disabled.
 
-`cordisToolsEnabled` is off by default. Turning it on atomically adds DSH's official Cordis tools, owner guidance, and `cordis-plugin-development` companion Skill to PTC agents; turning it off removes all three. It neither switches presets nor changes the direct `run_code`/`edit_run_code` surface. Cordis runs model-written plugins against the live DSH runtime, so enabling it requires shell-level trust.
+`cordisToolsEnabled` is off by default. Turning it on atomically adds DSH's official Cordis tools, owner guidance, and exactly the `cordis-plugin-development` companion Skill to PTC agents; sibling Skills in the shipped preset are not exposed. Turning it off removes all three. It neither switches presets nor changes the direct `run_code`/`edit_run_code` surface. Cordis runs model-written plugins against the live DSH runtime, so enabling it requires shell-level trust.
 
 When a Cordis call rejects after a cell has assigned a large host or client source string, that top-level binding remains live. Retry only the Cordis call from a short later cell and reuse the binding instead of resending the source.
 
+After cold recovery or re-enabling Cordis, recorded Cordis values remain historical data but do not prove that process-local Plugins, Runs, approvals, or earlier Inspect observations are still live. PTC Plus adds a bounded recovery context until a new successful Cordis Inspect call validates the current process.
+
 See [Client UI](docs/client-ui.md), [ADR 0019](docs/adr/0019-plugin-settings-and-kill-switch.md), and [ADR 0020](docs/adr/0020-optional-cordis-tools-in-ptc-mode.md).
 
 ## Scope
@@ -119,14 +126,14 @@ PTC Plus provides the session-bound persistent `run_code` layer. DSH and the ope
 
 ## Install
 
-Requires Node.js `^22.19.0 || >=24.0.0` and DSH with TypeScript PTC mode:
+Requires Node.js `^22.19.0 || >=24.0.0` and DSH with TypeScript PTC mode. Install the published package from npm into the profile you use:
 
 ```sh
-dsh plugin --profile <profile> add github:muyuanjin/dsh-ptc-plus#main
+dsh plugin --profile <profile> add dsh-ptc-plus
 dsh --profile <profile> --dump-config
 ```
 
-Other install methods and compatibility details are in the [installation guide](docs/installation.md).
+Restart that DSH profile after installation. Version-pinned npm, GitHub, local-checkout, and tarball installs are covered in the [installation guide](docs/installation.md).
 
 `danger-full-access` is the primary supported experience. The worker isolates lifecycle, not malicious code.
 

package/README.zh.md

@@ -1,6 +1,9 @@
 # dsh-ptc-plus
 
+[English](README.md) | 简体中文
+
 [![Node.js ^22.19.0 || >=24.0.0](https://img.shields.io/badge/Node.js-%5E22.19.0%20%7C%7C%20%3E%3D24.0.0-5fa04e?logo=nodedotjs&logoColor=white)](package.json)
+[![npm version](https://img.shields.io/npm/v/dsh-ptc-plus?logo=npm)](https://www.npmjs.com/package/dsh-ptc-plus)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 [![DeepSeek Harness](https://img.shields.io/badge/DeepSeek%20Harness-PTC%20mode-4b6bfb)](https://github.com/deepseek-ai/deepseek-harness)
 [![Status: community plugin](https://img.shields.io/badge/Status-community%20plugin-lightgrey)](docs/publishing.md)
@@ -70,6 +73,8 @@ edit_run_code({ edits: [{ old_string: 'deps.length', new_string: 'deps' }] })
 
 模型只发改动，完整源码留在对话之外。精确文本替换和正则替换都有限制，坏的正则不会卡住。
 
+当被拒 cell 的末尾可唯一验证为缺少一个闭合符时，诊断会直接给出应用该修正并重运行所需的完整 `edit_run_code(...)` 调用。生成的调用带有 `expected_target_call_seq` 前置条件；如果另一个 cell 已先成为 edit 目标，它会拒绝且不执行。PTC Plus 不会自动应用这项建议；有歧义或没有持久目标身份的修复仍需提交修正后的源码。
+
 ### 模块语法
 
 DSH 的 PTC 模式把每个 `run_code` 当作 async function body 执行，静态 `import` 和 `export` 声明在这个函数体里无效。PTC Plus 会在执行前用 AST 分析适配这些形式。
@@ -107,10 +112,12 @@ import { readFile } from 'node:fs/promises'
 
 所有设置都会实时应用，并保留已有 binding。已提交的 cell 在完整执行期间使用同一份配置；执行期间发生的更新用于随后提交的 cell。更新失败会回滚。Node 在 worker 创建时固定 V8 old-generation 上限，因此活动 session worker 存在时修改这一项会被拒绝，释放 session 后才能修改。启用失败时，运行时会回滚并把设置保持为停用。
 
-`cordisToolsEnabled` 默认关闭。打开后，DSH 官方 Cordis 工具、owner guidance 与 `cordis-plugin-development` companion Skill 会作为一个整体加入 PTC agent，关闭时也会一起移除；它不切换 preset，也不改变 `run_code`/`edit_run_code` 的直接调用面。Cordis 能在实时 DSH runtime 中运行模型编写的插件，开启它需要接受 shell 级信任。
+`cordisToolsEnabled` 默认关闭。打开后，DSH 官方 Cordis 工具、owner guidance 与精确的 `cordis-plugin-development` companion Skill 会作为一个整体加入 PTC agent；同一 shipped preset 目录中的其他 Skill 不会随之暴露。关闭时这三项也会一起移除；它不切换 preset，也不改变 `run_code`/`edit_run_code` 的直接调用面。Cordis 能在实时 DSH runtime 中运行模型编写的插件，开启它需要接受 shell 级信任。
 
 如果 Cordis 调用在 cell 已经赋值大段 host 或 client 源码之后才失败，这些顶层 binding 仍会保留。后续只需在短 cell 中重试 Cordis 调用并复用该 binding，无需再次传输源码。
 
+cold recovery 或重新启用 Cordis 后，已记录的 Cordis value 仍是历史数据，但不能证明进程内 Plugin、Run、approval 或先前 Inspect observation 仍然存活。PTC Plus 会提供有界恢复 context，直到一次新的成功 Cordis Inspect 调用验证当前进程。
+
 详见 [客户端 UI](docs/client-ui.md)、[ADR 0019](docs/adr/0019-plugin-settings-and-kill-switch.md) 与 [ADR 0020](docs/adr/0020-optional-cordis-tools-in-ptc-mode.md)。
 
 ## 范围
@@ -119,14 +126,14 @@ PTC Plus 提供会话绑定的持久 `run_code` 层。原生工具的权限、
 
 ## 安装
 
-要求 Node.js `^22.19.0 || >=24.0.0`，并已安装带 TypeScript PTC 模式的 DSH：
+要求 Node.js `^22.19.0 || >=24.0.0`，并已安装带 TypeScript PTC 模式的 DSH。把 npm 正式包安装到你实际使用的 profile：
 
 ```sh
-dsh plugin --profile <profile> add github:muyuanjin/dsh-ptc-plus#main
+dsh plugin --profile <profile> add dsh-ptc-plus
 dsh --profile <profile> --dump-config
 ```
 
-其他安装方法和兼容性说明见[安装指南](docs/installation.md)。
+安装后重启对应的 DSH profile。固定 npm 版本、GitHub、本地 checkout 和 tarball 安装方式见[安装指南](docs/installation.md)。
 
 `danger-full-access` 是首要支持方式。worker 只隔离生命周期，不隔离恶意代码。
 

package/docs/adr/0005-temporary-rejected-cell-edit-transport.md

@@ -6,7 +6,8 @@ not achieve the intended result. PTC Plus therefore registers `edit_run_code` as
 
 ```ts
 edit_run_code({
-  edits: Array<{ old_string: string; new_string: string }>
+  edits: Array<{ old_string: string; new_string: string }>,
+  expected_target_call_seq?: number
 })
 
 edit_run_code({
@@ -15,7 +16,8 @@ edit_run_code({
     flags: string
     replacement: string
     expected_matches: number
-  }>
+  }>,
+  expected_target_call_seq?: number
 })
 ```
 
@@ -65,7 +67,11 @@ session-log projection captures the eligible target at the edit call event and a
 source only when its target sequence matches that snapshot and its journal is valid and non-noop,
 so live and recovered eligibility derive from the same persisted relation.
 
-The caller sends exactly one of `edits` or `regex_edits`. Exact edits contain at most 16 items; each
+The caller sends exactly one of `edits` or `regex_edits`, plus an optional non-negative
+`expected_target_call_seq` precondition. The precondition must equal the call sequence of the target
+captured for the persisted edit event; a mismatch returns an unedited result before derived
+dispatch. Ordinary model-authored edits omit it and retain latest-target selection. Exact edits
+contain at most 16 items; each
 non-empty `old_string` must differ from `new_string` and occur exactly once in the target. Regular
 expression edits also contain at most 16 items, use unique `gimsu` flags, reject zero-length matches,
 and require an exact `expected_matches` count. All ranges resolve against the original target and
@@ -98,6 +104,22 @@ operation and outcome; changing an aggregate runtime-context snapshot merely to
 would repeat unrelated policy context. Rewrite feedback and unrelated recovery tips retain their
 own independently justified lifecycles.
 
+A live `PTC-C001` at the exact source EOF may carry a validated one-call repair. The analyzer tries
+only the three single-token suffixes `}`, `)`, and `]` against the same binding catalog, reserved
+bindings, redeclaration mode, rewrite policy, and import state as the rejected cell. Exactly one
+candidate must complete preparation without a binding collision, and the existing exact editor
+must be able to express it from a bounded unique source suffix. The rejected call must also have a
+persistent event sequence. The diagnostic then renders those already-validated
+`edit_run_code({ edits: [...], expected_target_call_seq })` arguments on one help line. At dispatch,
+the precondition binds the proof to that rejected cell even if another matching source has become
+editable. This evidence takes precedence over the generic source-length recommendation, but remains
+conditional on
+`edit_run_code` being declared for that request. Zero or multiple candidates, non-EOF errors,
+editor budget failures, missing target identity, and candidates rejected later in preparation
+retain the generic guidance.
+The plugin never applies this repair itself: syntax/preflight acceptance does not prove model
+intent, and explicit edit dispatch preserves DSH authority and truthful history.
+
 ## Alternatives considered
 
 **Rewrite `edit_run_code` to `run_code` before persistence.** This reuses DSH's default `run_code`-only

package/docs/adr/0010-session-log-derived-recovery-tips.md

@@ -6,12 +6,14 @@ The persistent REPL contract must stay short enough for every request, while som
 
 ## Decision
 
-PTC Plus keeps the stable REPL guidance limited to invariants, discovery entry points, and environment-neutral boundaries. `internal/session-log-view.js` scans the event sequence once, pairs settled calls within each open turn, validates execution journals and rewrite records once, and returns immutable facts for edit targeting, successful-run reset, context distance, and canonical DSH system-prompt snapshots. Each snapshot preserves its named sections. `internal/runtime-contexts.js` renders rewrite feedback only when the rewritten cell failed or lacks a valid journal, plus at most one context from the reserved `tools:ptc-plus-tip/<trigger>/<ordinal>` name family. Successful transparent rewrites remain result metadata and do not create aggregate snapshot churn. It never emits edit provenance or target-lifecycle context: those facts belong to the registered tool call/result and its private derived-execution metadata. Tips never change the tool list, tool schemas, or system sections.
+PTC Plus keeps the stable REPL guidance limited to invariants, discovery entry points, and environment-neutral boundaries. `internal/session-log-view.js` scans the event sequence once, pairs settled calls within each open turn, validates execution journals and rewrite records once, and returns immutable facts for edit targeting, successful-run reset, context distance, normalized Cordis call/inspection counts, and canonical DSH system-prompt snapshots. Each snapshot preserves its named sections. `internal/runtime-contexts.js` renders rewrite feedback only when the rewritten cell failed or lacks a valid journal, the fixed `tools:ptc-plus-cordis-recovery` context when a new agent or Cordis enable generation contains historical Cordis transcript without a newer successful live Inspect, plus at most one context from the reserved `tools:ptc-plus-tip/<trigger>/<ordinal>` name family. Successful transparent rewrites remain result metadata and do not create aggregate snapshot churn. It never emits edit provenance or target-lifecycle context: those facts belong to the registered tool call/result and its private derived-execution metadata. These contexts never change the tool list, tool schemas, or system sections.
 
 The default triggers are a repeated binding failure and a failure whose diagnostic or structured cause identifies an executable, shell, or path problem. The first tip is concise. A matching trigger may produce another tip only after `tipCooldownMessages` model-context steps; unresolved matching tips reach the detailed form after `tipEscalationFailures` occurrences. A successful cell resets the unresolved escalation count. Every emitted tip name carries its stable trigger identity and next per-trigger ordinal. Reconstruction accepts only canonical snapshots from DSH's system-prompt owner, treats a named section as one effective-state transition even when another owner's aggregate update repeats it, and ignores legacy or malformed plugin prose. Visible wording does not determine cooldown or escalation identity.
 
 Platform wording names execution-world differences without assuming Windows, WSL, POSIX, a shell, or package-runner availability. `edit_run_code` remains independently available as a fixed real tool and does not depend on a recovery-tip trigger.
 
+The Cordis recovery context is not a failure tip and is not controlled by fatigue settings. It narrows the meaning of recorded values after a lifecycle boundary: they remain historical program data but cannot prove current process-local state. It clears only after a newly settled successful `cordis_inspect*` transcript, does not infer whether the original process survived, and never redispatches a historical effect.
+
 ## Alternatives considered
 
 - **Keep all recovery instructions in the stable system prompt.** This makes every request pay for rare failures and makes platform-specific text look universally applicable.
@@ -20,6 +22,7 @@ Platform wording names execution-world differences without assuming Windows, WSL
 - **Infer tip identity from rendered prose or one fixed section name.** Wording changes would reset history, unrelated plugin text could create false matches, and an unchanged aggregate context would not persist repeated occurrences.
 - **Change the available tools when a tip is needed.** This would break the fixed code-only direct-tool prefix and make failure state observable through schema churn.
 - **Let each runtime-context renderer scan the event log.** Independent scans duplicate parsing and can disagree about call/result pairing, turn boundaries, repair consumption, or successful-run resets. A shared projection keeps event interpretation separate from presentation policy.
+- **Mark all Cordis calls volatile.** This would discard reconstructable REPL bindings and special values merely because their external referents need revalidation. Recorded-value replay and live-state proof are separate contracts.
 
 ## Consequences
 

package/docs/adr/0020-optional-cordis-tools-in-ptc-mode.md

@@ -14,7 +14,7 @@ Tool registration must finish before the prompt assembly returned to the agent;
 
 ## Decision
 
-Add `cordisToolsEnabled: boolean`, default `false`, as a live PTC Plus setting. When enabled, PTC Plus mounts the official `@deepseek-ai/dsh-tool-cordis` plugin and a maintained `@deepseek-ai/dsh-skill-filesystem` provider in each agent scope that exposes `run_code`; disabling it disposes both fibers immediately. The provider resolves the shipped `cordis` preset through the public `agentPresets` service and publishes only its sibling `skills` directory under a PTC Plus-specific provider name. It neither switches the current preset nor includes default roots. If an agent is created before `run_code` becomes visible, the owner retains it as pending and retries on the DSH tools-change signal.
+Add `cordisToolsEnabled: boolean`, default `false`, as a live PTC Plus setting. When enabled, PTC Plus mounts the official `@deepseek-ai/dsh-tool-cordis` plugin and a maintained `@deepseek-ai/dsh-skill-filesystem` provider in each agent scope that exposes `run_code`; disabling it disposes both fibers immediately. The provider resolves the shipped `cordis` preset through the public `agentPresets` service and reads its sibling `skills` root without including default roots. At the public `skills.registerProvider` seam, PTC Plus transparently filters discovery and loading to exactly `cordis-plugin-development`; the maintained filesystem provider still owns parsing, resource bases, watch, invalidation, incomplete observations, and body loading. This prevents unrelated or obsolete sibling Skills from silently enlarging the PTC surface without copying the companion content or switching the current preset. If an agent is created before `run_code` becomes visible, the owner retains it as pending and retries on the DSH tools-change signal.
 
 The Skill provider and official Cordis child fiber form one reversible mount. Both must settle, and the scoped `skills` service must prove that `cordis-plugin-development` resolves from the added provider as model-invocable and loadable, before the first prompt assembly is returned. A prepended public `system-prompt/assemble` waterfall listener is the final race barrier: if collection began before the mount settled, it waits for readiness, discards that stale assembly, and invokes public assembly again so DSH recollects the official providers. It does not synthesize or mutate Cordis schemas or guidance. The Cordis fiber's resolved `inject` declaration is the authoritative required-service list, and its live registrations are the authoritative tool names, schemas, and guidance. A missing or broken preset, Skill service/tool, declared service, publication, or child fiber is a configuration error and rolls back every contribution.
 
@@ -22,6 +22,8 @@ The official plugin also registers Host inspect providers in the process-global
 
 Cordis tools remain native program bindings under `tools.*`. The PTC code-only direct-tool projection remains exactly `[run_code, edit_run_code]`; native agents and unrelated scopes do not inherit this option.
 
+Cordis definitions and Runs are process-local, while PTC journals replay every settled program binding as a recorded value without redispatch. On the first prompt for an agent or a new Cordis enable generation, PTC Plus derives whether normalized journals contain a Cordis transcript. If they do, it emits the fixed `tools:ptc-plus-cordis-recovery` runtime context: recorded values remain historical data, but the model must perform a live read-only Cordis Inspect before relying on prior IDs, state, approvals, or capability observations. The context remains until a newly settled successful `cordis_inspect*` call appears in the session log. It neither asserts that live state was lost nor reruns a mutating call.
+
 ## Alternatives Considered
 
 1. Add the Cordis row to the PTC preset. Rejected: PTC Plus is installed as a host plugin and does not own or fork DSH's shipped preset files; the operator asked for a plugin setting.
@@ -30,7 +32,8 @@ Cordis tools remain native program bindings under `tools.*`. The PTC code-only d
 4. Enable the tools by default. Rejected: the tools can execute model-written plugins against the live runtime and carry a fixed schema cost. That trust and context expansion must be explicit.
 5. Mount one global Cordis tool fiber and hide it from native agents. Rejected: its prompt hook and `@pluginId` context listener would remain global even if tool schemas were restricted, so unrelated agents would inherit behavior they did not enable.
 6. Copy `SKILL.md` into PTC Plus or add the Cordis preset's directory to global Skill roots. Rejected: copied instructions drift, while a global root leaks the optional workflow into agents that did not enable it.
+7. Publish the complete preset-local Skill directory. Rejected: directory membership is not the PTC feature contract; unrelated sibling additions would silently change the model surface and may target a different authoring workflow or tool generation.
 
 ## Consequences
 
-PTC Plus declares the maintained DSH Cordis tool, Skill filesystem, settings, and tool-runtime packages as required peers through the current release channel and mirrors them in development dependencies. They resolve from DSH's installation-maintained profile fallback; installing PTC Plus must not add a profile-local DSH core package instance. When enabled, the official Cordis schemas, guidance, and companion Skill become available together in PTC agent scopes; disabled configurations remain unchanged. Changing this option updates live agent scopes without a DSH restart, including repeated disable/re-enable cycles. A DSH release may rename or reshape its Cordis surface without requiring a mirrored-name change in PTC Plus, provided the public plugin, preset, Skill, and inspect-provider contracts remain compatible.
+PTC Plus declares the maintained DSH Cordis tool, Skill filesystem, settings, and tool-runtime packages as required peers through the current release channel and mirrors them in development dependencies. They resolve from DSH's installation-maintained profile fallback; installing PTC Plus must not add a profile-local DSH core package instance. When enabled, the official Cordis schemas, guidance, and exact companion Skill become available together in PTC agent scopes; disabled configurations remain unchanged. Changing this option updates live agent scopes without a DSH restart, including repeated disable/re-enable cycles. Resume and re-enable may append one bounded recovery snapshot but do not change stable tool schemas or system sections. A DSH release may rename or reshape its Cordis tool surface without requiring a mirrored-name change in PTC Plus, while the named companion Skill remains an explicit compatibility contract and fails activation if unavailable or inconsistent.

package/docs/architecture.md

@@ -20,7 +20,7 @@ DSH 为一个 agent composition 固定选择 `native`、`code` 或 `both`。首
 
 `edit_run_code` 对其持久化 `tool/call` 事件出现时当前 open turn 最近的可编辑 cell 生效，无论该 cell 被拒绝、运行失败，还是成功执行但结果需要微调。执行通过 call event sequence 读取该快照，后续 settlement 或 handler 调度不改变目标；派生 cell 则按外层 `tool/result` event sequence 进入恢复历史，使 cold replay 保持 live kernel 的实际结算顺序。
 调查 tool 不擦除目标；edit 发起后的其他 settlement 不追溯改变其目标；一次成功 edit 生成的新 cell 成为下一次 edit 的目标。调用方必须且只能提交 `edits` 或
-`regex_edits` 之一。`internal/rejected-cell-editor.js` 统一拥有 schema、匹配、replacement 语义、预算和原子源码组装；
+`regex_edits` 之一，并可携带 `expected_target_call_seq` 作为目标前置条件；它与 call event 已捕获目标不一致时，在任何派生 dispatch 前返回未编辑结果。`internal/rejected-cell-editor.js` 统一拥有 schema、匹配、replacement 语义、预算和原子源码组装；
 所有位置都针对原始目标源码解析，全部范围不得重叠，预算通过后才以单次线性扫描物化结果。
 
 注册工具通过 DSH 公共 `tools.execute()` 将完整修改后源码派生执行为 `run_code`。外层历史仍是模型真实发出的
@@ -29,7 +29,7 @@ DSH 为一个 agent composition 固定选择 `native`、`code` 或 `both`。首
 `run_code`。无目标或参数不合法时不执行，返回 `{ edited: false, reason }` 并保留原目标。
 进程内 claim 区分 executing 与 settled：抛错、取消或缺少有效 PTC journal 的派生结果立即释放；已由 journal 证明进入 runtime 的派生执行继续占用旧 target，直到外层 result 的私有 metadata 通过最终 policy 并由 session log 投影为新 target。最终 result 丢失 metadata 时由 `tools/result` 释放。session log 投影在 edit call event 处记录 eligible target，只接受 target call sequence 匹配该快照且 journal 有效、非 noop 的派生源码，因此 live 与 cold recovery 从同一持久关系决定可编辑目标。
 
-`internal/session-log-view.js` 单次前向扫描 session events，分别投影最新执行、可编辑目标、rewrite metadata 和恢复 tip
+`internal/session-log-view.js` 单次前向扫描 session events，分别投影最新执行、可编辑目标、rewrite metadata、规范 journal 中的 Cordis transcript 计数和恢复 tip
 所需事实。`edit_run_code` 不产生专用 runtime context：真实 call/result 已完整表达操作身份和结果，额外 contribution
 只会触发 DSH 聚合 runtime-context 全量快照并重复无关 policy 文本。只有失败或完成状态不可信的 rewrite feedback 才保留独立生命周期；成功的透明改写不产生 runtime context。
 
@@ -40,11 +40,13 @@ return 或打印需要展示的值。失败恢复先按状态分类：解析或
 `run_code` 并复用已有 binding，完整重写只保留给结构性改动或超出编辑预算的修正。能力和命令执行依赖当前 request
 与 execution world，模型必须先探查 live binding、实际 executable 和路径语义，不假设某个平台、shell 或 package runner。
 
+live `PTC-C001` 若精确落在源码 EOF，独立的 bounded analyzer 只把追加单个 `}`、`)`、`]` 的三个源码分别送入该 cell 提交时的同一 preparation context。仅当唯一候选通过、无 binding collision，现有 exact editor 能从不超过固定预算的唯一尾部物化同一源码，并且 runtime 已取得该 rejected `run_code` 的持久 call sequence 时，诊断才输出一行可直接调用的 `edit_run_code({ edits: [...], expected_target_call_seq })`。edit transport 把该 sequence 与其 call event 捕获的目标比较，目标已变化时不编辑也不派生执行。这项 validated repair 优先于长度阈值，但只证明语法/preflight 接受；插件不自动 dispatch，也不改写原始 `run_code`。非 EOF、多候选、多 token、超预算、缺少目标身份或后续 preparation 拒绝均回到原有 length-adaptive help。
+
 稳定指引保留这些跨任务不变量和失败恢复的优先动作。长 cell 失败的短提示直接作为当前 `PTC-X001` 的结构化 `help` 输出，避免一次性建议触发完整 runtime-context 快照；重复绑定失败和当前 execution world 中由诊断确认的 executable、shell 或 path 错误仍由当前 session log 派生为 `tools:ptc-plus-tip/<trigger>/<ordinal>` runtime context，分别提示能力探查或重新确认环境。投影只接受 DSH system-prompt owner 的规范快照，并按命名 section 的有效状态变化重建提示；聚合快照重复同一 section 不增加次数，正文不参与身份判断。
 相同提示受 `tipCooldownMessages` 间隔约束，连续未解决时才升级为详细版本，成功 cell 会重置未解决计数；提示不会改变
 system sections、tool schema 或 tool order，也不假设 Windows、WSL、POSIX、shell 或 package runner。
 
-当前策略位于独立的 `internal/recovery-tips.js` local provider，核心只消费其有界的 named context。未来外部决策插件的接入必须等待稳定的 facts/decision contract；在此之前不猜测跨插件 API，local provider 继续作为 fallback。
+当前策略位于独立的 `internal/recovery-tips.js` local provider，核心只消费其有界的 named context。另一个固定名称 `tools:ptc-plus-cordis-recovery` 只在新 agent 或 Cordis 重新启用代际观察到历史 Cordis transcript 时出现，将 replay value 限定为历史数据，并保持到 session log 出现新的成功 `cordis_inspect*` settlement；它不受疲劳阈值控制、不重放调用，也不推断 live process 是否实际丢失。未来外部决策插件的接入必须等待稳定的 facts/decision contract；在此之前不猜测跨插件 API，local provider 继续作为 fallback。
 
 ## 设置与启用开关
 
@@ -66,7 +68,7 @@ Client half 通过 `settings.plugin.item` 卡片呈现全部配置。`enabled`
 | Replacement | 只有 DSH 拥有的 compaction 或其他显式 surface replacement 可以替换已保留历史；PTC Plus 不用 replacement 表达瞬时状态。 |
 | Independent request | 新的辅助模型调用必须单独说明 route、prefix 和 token 影响，不能用它的缓存表现证明主会话前缀稳定。当前插件不发起辅助模型请求。 |
 
-一次性或会变化的 session 状态必须作为 `PromptAssembly.contexts` 的命名贡献交给 DSH。DSH 将完整快照记录为带来源的 `user/message` 并追加到历史尾部；值未变时不重复，值变化或全部消失时追加更新或 clearance。完整快照携带当时所有 owner 的命名 context，因此任一贡献变化都会使未变化贡献在新的尾部消息中再次出现；这会增加 append-only history token，但不会改写已有前缀。PTC Plus 不通过绕过 prompt assembly 的私有消息通道规避这项宿主聚合成本。此类状态不得进入 `PromptAssembly.sections`，也不得通过增删 tool、改变 schema 字段或调整 tool order 传递。
+一次性或会变化的 session 状态必须作为 `PromptAssembly.contexts` 的命名贡献交给 DSH。DSH 将完整快照记录为带来源的 `user/message` 并追加到历史尾部；值未变时不重复，值变化或全部消失时追加更新或 clearance。完整快照携带当时所有 owner 的命名 context，因此任一贡献变化都会使未变化贡献在新的尾部消息中再次出现；这会增加 append-only history token，但不会改写已有前缀。PTC Plus 不通过绕过 prompt assembly 的私有消息通道规避这项宿主聚合成本。Cordis 恢复 context 使用规范 journal 的历史 transcript 与当前 agent/enable generation 作为事实源，不能从进程内 Plugin registry 直接生成未记录输入。此类状态不得进入 `PromptAssembly.sections`，也不得通过增删 tool、改变 schema 字段或调整 tool order 传递。
 
 所有模型可见输入都必须能从 session log 重建。静态 system/schema 由 `request/header` 保存，动态 context 由带来源的 `user/message` 保存；进程内临时状态不能直接成为未记录的模型输入。在同一插件版本与配置下，普通执行结果、可编辑目标、诊断和其他插件拥有的运行期变化都不得改变 header；`edit_run_code` 的身份与结果由真实 call/result 表达，不生成 edit feedback context。插件升级、显式配置变化、provider/model route 变化、真实 native capability schema 变化，以及 DSH 拥有的 history replacement 可以使缓存从首个变化 token 起失效。
 
@@ -111,7 +113,7 @@ CodeRuntime request 已携带的 owner-provided program namespace 会被原样
 }
 ```
 
-`calls` 只保存 global、member、PTC Value Graph 编码的 args/result 或 error，以及 settlement 序号。cold replay 校验调用名称、参数、数量和提交顺序，并按 recorded settlement order 释放 recorded result；不会重新 dispatch program binding 或重做外部 effect。该规则同样适用于 native tools、owner-provided namespace 和 `code.run`，不按名称分支。若基础设施终止时仍有未结算 binding，heap 回滚到 durable frontier，discarded journal 以最先观察到的 `global.member` 保留 possible-effect boundary。effect、completeness 和 source metadata 属于 capability explorer，不伪装成 journal 字段。
+`calls` 只保存 global、member、PTC Value Graph 编码的 args/result 或 error，以及 settlement 序号。cold replay 校验调用名称、参数、数量和提交顺序，并按 recorded settlement order 释放 recorded result；不会重新 dispatch program binding 或重做外部 effect。该规则同样适用于 native tools、owner-provided namespace 和 `code.run`，不按名称分支。Cordis 的进程内对象不会因此被宣称已恢复；presentation 可以从已验证 transcript 派生重新检查要求，但不能改变 replay。若基础设施终止时仍有未结算 binding，heap 回滚到 durable frontier，discarded journal 以最先观察到的 `global.member` 保留 possible-effect boundary。effect、completeness 和 source metadata 属于 capability explorer，不伪装成 journal 字段。
 
 journal 通过 `run_code.output.presentationMeta` 附着到最终 result，再由 `tools/result` 做两阶段确认。缺失、损坏或被替换的 journal 形成 unknown/volatile 边界；未进入 runtime 的 call 由后续 `confirms` 以对应 `tool/call.seq` 证明为 no-op。volatile 源码保留在原 session log，但不参与 cold replay。
 

package/docs/client-ui.md

@@ -12,7 +12,7 @@ Host half 通过 DSH 公共 `settings` 服务注册命名空间 `ptc-plus`。字
 | 分组 | 字段 | 说明 |
 | --- | --- | --- |
 | 开关 | `enabled` | 关闭后不注册 `run_code`/`edit_run_code`、不修改 system prompt、不创建 session runtime；只保留设置 UI。 |
-| Cordis | `cordisToolsEnabled` | 默认关闭；开启后为 PTC agent 加入创造模式使用的官方 Cordis 工具、指引与 companion Skill。 |
+| Cordis | `cordisToolsEnabled` | 默认关闭；开启后为 PTC agent 加入官方 Cordis 工具、指引与精确的 `cordis-plugin-development` companion Skill，不发布同目录 sibling。 |
 | 计算 | `computeMs` / `maxWallMs` | 单 cell CPU 与墙钟预算。 |
 | 输出 | `maxOutputBytes` / `maxValueNodes` / `maxValueEdges` / `maxValueArrayLength` / `maxValueBigIntDigits` | Value Graph 与输出字节预算。 |
 | Worker | `maxOldGenerationSizeMb` / `maxNestedRunCodeDepth` | kernel worker 内存与嵌套执行深度。 |

package/docs/durability-design.md

@@ -87,7 +87,7 @@ journal、diagnostic、source、cause、call、operation、completion 和 comple
 }
 ```
 
-`settle` 必须是从 0 开始的连续序列。重放按源码产生调用，但不重新 dispatch；它校验 global、member、args 和提交数量，再按 recorded settlement order 释放 recorded value/error。这个 `recorded-value` 承诺重建的是 REPL 计算状态，不表示外部 effect 被重做、撤销或验证。completeness、effect、authority 和 source evidence 属于 capability metadata，不伪装成 journal 字段。
+`settle` 必须是从 0 开始的连续序列。重放按源码产生调用，但不重新 dispatch；它校验 global、member、args 和提交数量，再按 recorded settlement order 释放 recorded value/error。这个 `recorded-value` 承诺重建的是 REPL 计算状态，不表示外部 effect 被重做、撤销或验证。对进程内 Cordis 状态，恢复值明确只是历史数据：Cordis 可见时，固定 runtime context 要求在把旧 ID、Run、approval 或 capability observation 当作当前事实前完成一次新的成功 live Inspect。completeness、effect、authority 和 source evidence 属于 capability metadata，不伪装成 journal 字段。
 
 journal 的 capability-call `args`/`value` 与 completion value 保存 `ptc-value-graph/v1` canonical envelope，不保存 decoded rich JS value，也不依赖递归 `JSON.stringify` 或 `structuredClone`。因此深层数组/对象、own `__proto__`、`undefined`、special number、BigInt、hole、shared identity 和 cycle 不会被外层 session JSON 改写。完整支持域和预算见 [PTC Value Graph V1](value-wire.md)。
 

package/docs/installation.md

@@ -23,7 +23,7 @@ The optional `cordisToolsEnabled` integration requires the current DSH installat
 Use this form after the selected version is available from the npm registry:
 
 ```sh
-dsh plugin --profile <profile> add dsh-ptc-plus@0.2.1
+dsh plugin --profile <profile> add dsh-ptc-plus@0.2.3
 dsh --profile <profile> --dump-config
 ```
 
@@ -60,7 +60,7 @@ pnpm dsh --profile <profile> --dump-config
 
 ```sh
 npm pack
-dsh plugin --profile <profile> add /absolute/path/to/dsh-ptc-plus-0.2.1.tgz
+dsh plugin --profile <profile> add /absolute/path/to/dsh-ptc-plus-0.2.3.tgz
 dsh --profile <profile> --dump-config
 ```
 
@@ -79,4 +79,4 @@ dsh plugin add github:muyuanjin/dsh-ptc-plus#main
 dsh --dump-config
 ```
 
-After an npm release, the package spec may instead be `dsh-ptc-plus@0.2.1`. For a local package, use its absolute tarball path. Restart DSH Desktop after installation. Linux Desktop is not a current DSH Desktop release target; use DSH CLI/Web on Linux.
+After an npm release, the package spec may instead be `dsh-ptc-plus@0.2.3`. For a local package, use its absolute tarball path. Restart DSH Desktop after installation. Linux Desktop is not a current DSH Desktop release target; use DSH CLI/Web on Linux.

package/docs/program-data-plane.md

@@ -18,7 +18,7 @@ DSH authority/policy -> native dispatch -> canonical result
                                       `-> args/result + settlement transcript
 ```
 
-cold replay 校验相同的调用序列并返回 recorded value，不重新执行工具。这保证 REPL 计算状态可重建，但不声称外部 effect 可逆或仍与历史相同。
+cold replay 校验相同的调用序列并返回 recorded value，不重新执行工具。这保证 REPL 计算状态可重建，但不声称外部 effect 可逆或仍与历史相同。Cordis Plugin、Run 和 Inspect observation 属于进程内实时状态；恢复出的 Cordis value 只作为历史数据保留，后续状态性决策必须先按恢复 context 执行新的 live Inspect。
 
 同一 settlement 规则适用于当前 request 中的全部 program binding，包括 owner-provided namespace 与 `code.run`。已结算的 value/error 可进入 durable transcript；若取消、超时或 worker failure 发生时调用仍未结算，cell heap 回滚，discarded journal 以实际 `global.member` 保留 possible-effect boundary。分类来自可观察生命周期，不来自 capability 名称表。
 

package/docs/runtime-reference.md

@@ -8,10 +8,12 @@ The default loose binding mode lets a complete top-level `const` or `let` declar
 
 Every capability namespace is leased to one cell. Captured `tools`, `capabilities`, `repl`, `code`, or member functions expire when that cell ends.
 
-For PTC mode requests using the code-only direct-tool projection, PTC Plus presents two tools in stable order: `run_code` and `edit_run_code`. The latter edits the most recent eligible cell visible when the edit call is dispatched, including a cell that completed successfully but needs a small adjustment. That target remains fixed while the call is in flight; later tool settlements cannot retarget it. The edit accepts exactly one atomic `edits` or `regex_edits` array; invalid or unavailable edits return `{ edited: false, reason }` without executing source or consuming the target.
+For PTC mode requests using the code-only direct-tool projection, PTC Plus presents two tools in stable order: `run_code` and `edit_run_code`. The latter edits the most recent eligible cell visible when the edit call is dispatched, including a cell that completed successfully but needs a small adjustment. That target remains fixed while the call is in flight; later tool settlements cannot retarget it. The edit accepts exactly one atomic `edits` or `regex_edits` array and an optional `expected_target_call_seq` precondition. Invalid, unavailable, or mismatched-target edits return `{ edited: false, reason }` without executing source or consuming the target.
 
 `edit_run_code` is a real registered tool call. Session history and later model requests retain its original name and delta arguments. The plugin executes the materialized source as a host-derived `run_code`, returns only the edit status, value, and logs to the model, and keeps the complete source plus journal in private replay metadata. It does not rewrite assistant history or emit edit-specific runtime context.
 
+When a live parse error occurs exactly at the cell EOF, PTC Plus checks the three single-closing-token corrections `}`, `)`, and `]` with the same preparation context. If exactly one correction succeeds, the existing editor can express it from a bounded unique suffix, and the rejected call has a persistent event identity, `PTC-C001` includes a directly callable `edit_run_code({ edits: [...], expected_target_call_seq })` invocation. The guard must match the target captured when the edit call is persisted, so a later editable cell suppresses execution even when the same literal replacement would match it. The plugin does not apply or execute the correction automatically; ambiguous, broader, and unbound repairs keep the ordinary length-adaptive guidance.
+
 Only values explicitly returned or printed appear in a cell result:
 
 ```ts
@@ -71,10 +73,12 @@ The configuration uses `ptc-plus` as the DSH plugin ID and `dsh-ptc-plus` as the
 
 `enabled: false` is the settings-based kill switch: the Host keeps only the settings namespace and client card, and removes every runtime hook, prompt section, and tool surface. Every setting is applied live when its owner can reconcile it. A submitted cell retains one configuration snapshot through preflight, execution, binding calls, completion validation, and diagnostics; an update accepted while it runs applies to cells submitted afterward. Node fixes a worker's V8 old-generation limit at creation, so changing `maxOldGenerationSizeMb` while a session worker is active is rejected and rolled back rather than reported as applied. Other non-`enabled` updates reconfigure existing owners without replacing session-bound bindings. The settings card is available under Settings → Plugin configuration, shows “已启用” or “已停用”, and disables every control except `enabled` while the plugin is off. If a live enable or reconfiguration cannot install a complete runtime, PTC Plus unwinds or restores every owner and persists the last applied settings; a failed compensating settings write is surfaced as an activation diagnostic. The TypeScript language check is deferred until runtime activation, so a non-TypeScript host can load the plugin in disabled mode but cannot enable it.
 
-`cordisToolsEnabled: true` atomically mounts the official `@deepseek-ai/dsh-tool-cordis` plugin and the shipped `cordis-plugin-development` companion Skill in PTC agent scopes. PTC Plus resolves the official `cordis` preset through DSH's public preset service and publishes only that preset's Skill directory through the maintained filesystem provider; it does not copy the Skill or switch the agent's preset. The first request waits until the Cordis tool fiber, owner guidance, Skill provider, and scoped Skill load are all ready. A missing or broken preset, Skill/tool service, declared Cordis service, inconsistent inspect manifest, or rejected activation fails the setting change and removes every provisional contribution. Disable and agent/runtime disposal remove both fibers. Native agents inherit neither the resulting `tools.*` members nor the Skill, and the code-only direct-tool projection remains `[run_code, edit_run_code]`. Agents whose `run_code` surface appears after creation are retried on the DSH tools-change signal. Cordis can evaluate model-written plugins against the live runtime, so enabling it grants shell-equivalent trust.
+`cordisToolsEnabled: true` atomically mounts the official `@deepseek-ai/dsh-tool-cordis` plugin and exactly the shipped `cordis-plugin-development` companion Skill in PTC agent scopes. PTC Plus resolves the official `cordis` preset through DSH's public preset service, lets the maintained filesystem provider own its Skill root, and filters that provider at the public registration boundary so sibling Skills are never published to the PTC scope. It does not copy the Skill or switch the agent's preset. The first request waits until the Cordis tool fiber, owner guidance, exact Skill provider, and scoped Skill load are all ready. A missing or broken preset, Skill/tool service, declared Cordis service, inconsistent inspect manifest, or rejected activation fails the setting change and removes every provisional contribution. Disable and agent/runtime disposal remove both fibers. Native agents inherit neither the resulting `tools.*` members nor the Skill, and the code-only direct-tool projection remains `[run_code, edit_run_code]`. Agents whose `run_code` surface appears after creation are retried on the DSH tools-change signal. Cordis can evaluate model-written plugins against the live runtime, so enabling it grants shell-equivalent trust.
 
 Keep large Cordis host or client source in a top-level binding before calling a Cordis tool. A parse or validation rejection is a runtime failure, so bindings assigned before it remain live for a short retry cell; reuse the binding instead of resending the source.
 
+Cordis Plugins and Runs are process-local. On a resumed agent or after Cordis is re-enabled, normalized journal calls can restore their recorded return values but do not prove that prior IDs, approvals, Runs, or Inspect observations are live. The fixed `tools:ptc-plus-cordis-recovery` context remains present until a new successful `cordis_inspect*` call is settled. Use that live read-only inspection before a stateful Cordis decision; do not rerun a mutating historical call merely to rebuild state.
+
 `durableReplay: false` starts new kernels without historical REPL state while preserving live bindings in the current process. It does not delete session logs.
 
 Recovery tips are disabled with `tipsEnabled: false`. When enabled, a bounded runtime context in the reserved `tools:ptc-plus-tip/<trigger>/<ordinal>` name family may appear after a repeated binding failure or a diagnostic that identifies an executable, shell, or path problem in the current execution world. The trigger and per-trigger ordinal are reconstructed from canonical named system-prompt snapshots; repeated aggregate copies and visible wording do not advance the history. A tip is subject to `tipCooldownMessages` and becomes detailed only after `tipEscalationFailures` unresolved matches; it never changes the code-only direct-tool list or schema. `edit_run_code` does not emit a runtime context because its real call and result already carry the relevant fact.
@@ -93,7 +97,7 @@ Rewrites are recorded as `meta.dshPtcPlusRewrites` on the tool result (parallel
 
 | Code | Meaning | State effect |
 | --- | --- | --- |
-| `PTC-C001` | The cell cannot be parsed | Not executed; REPL unchanged |
+| `PTC-C001` | The cell cannot be parsed | Not executed; REPL unchanged; a uniquely validated and target-bound single-token EOF closure includes a directly callable declared `edit_run_code` repair; otherwise retry a short corrected cell with `run_code`, use edit for a localized long-cell correction, and resend with `run_code` for broad, ambiguous, or unbound repairs |
 | `PTC-C002` | Preflight rejected a kernel-control import | Not executed; REPL unchanged |
 | `PTC-N001` | Top-level binding conflict | Not executed; REPL unchanged |
 | `PTC-O001` | Unsupported or over-budget output | Cell executed; earlier mutations may exist |

package/internal/cordis-tools-owner.js

@@ -8,6 +8,63 @@ const CORDIS_PRESET_ID = 'cordis'
 const CORDIS_SKILL_NAME = 'cordis-plugin-development'
 const CORDIS_SKILL_PROVIDER = 'ptc-plus-cordis'
 
+function exactCompanionCandidates(observation) {
+  if (Array.isArray(observation)) {
+    return observation.filter(candidate => candidate?.name === CORDIS_SKILL_NAME)
+  }
+  if (observation === null || typeof observation !== 'object'
+    || !Array.isArray(observation.candidates)) return observation
+  return {
+    ...observation,
+    candidates: observation.candidates.filter(candidate => candidate?.name === CORDIS_SKILL_NAME),
+  }
+}
+
+function exactCompanionProvider(provider) {
+  if (provider === null || typeof provider !== 'object'
+    || typeof provider.name !== 'string'
+    || typeof provider.list !== 'function'
+    || typeof provider.get !== 'function') {
+    throw new Error('ptc-plus: DSH Cordis Skill provider is incompatible')
+  }
+  return {
+    ...provider,
+    async list(options) {
+      return exactCompanionCandidates(await Reflect.apply(provider.list, provider, [options]))
+    },
+    async get(candidate, options) {
+      if (candidate?.name !== CORDIS_SKILL_NAME) return undefined
+      const skill = await Reflect.apply(provider.get, provider, [candidate, options])
+      return skill?.name === CORDIS_SKILL_NAME ? skill : undefined
+    },
+  }
+}
+
+function exactCompanionSkillPlugin(skillFilesystemPlugin) {
+  return {
+    ...skillFilesystemPlugin,
+    apply(pluginCtx, config) {
+      if (typeof pluginCtx?.extend !== 'function') {
+        throw new Error('ptc-plus: cordisToolsEnabled requires the DSH Context.extend API')
+      }
+      const skills = pluginCtx.get?.('skills')
+      if (typeof skills?.registerProvider !== 'function') {
+        throw new Error('ptc-plus: cordisToolsEnabled requires the DSH skills.registerProvider API')
+      }
+      const facade = new Proxy(skills, {
+        get(target, property) {
+          if (property === 'registerProvider') {
+            return create => target.registerProvider(control => exactCompanionProvider(create(control)))
+          }
+          const value = Reflect.get(target, property, target)
+          return typeof value === 'function' ? value.bind(target) : value
+        },
+      })
+      return skillFilesystemPlugin.apply(pluginCtx.extend({ skills: facade }), config)
+    },
+  }
+}
+
 function requireFiberServices(agent, fiber, owner) {
   if (typeof agent?.ctx?.get !== 'function') {
     throw new Error('ptc-plus: cordisToolsEnabled requires the DSH agent Context.get API')
@@ -32,8 +89,9 @@ function requireCompanionServices(agent) {
     throw new Error('ptc-plus: cordisToolsEnabled requires the DSH agentPresets.resolve API')
   }
   const skills = agent.ctx.get('skills')
-  if (typeof skills?.list !== 'function' || typeof skills?.get !== 'function') {
-    throw new Error('ptc-plus: cordisToolsEnabled requires the DSH skills list/get APIs')
+  if (typeof skills?.registerProvider !== 'function'
+    || typeof skills.list !== 'function' || typeof skills.get !== 'function') {
+    throw new Error('ptc-plus: cordisToolsEnabled requires the DSH skills registerProvider/list/get APIs')
   }
   if (agent.ctx.tools?.get?.('skill', agent) === undefined) {
     throw new Error('ptc-plus: cordisToolsEnabled requires the DSH skill tool in the PTC agent scope')
@@ -57,10 +115,11 @@ async function requireCompanionSkill(agent, skills) {
     cwd: agent.session?.header?.cwd,
     scope: agent,
   }
-  const summary = (await skills.list(lookup)).find(skill => skill?.name === CORDIS_SKILL_NAME)
-  if (summary?.provider !== CORDIS_SKILL_PROVIDER
+  const owned = (await skills.list(lookup)).filter(skill => skill?.provider === CORDIS_SKILL_PROVIDER)
+  const summary = owned[0]
+  if (owned.length !== 1 || summary?.name !== CORDIS_SKILL_NAME
     || summary.invocation?.modelInvocable !== true) {
-    throw new Error(`ptc-plus: official Cordis companion Skill ${JSON.stringify(CORDIS_SKILL_NAME)} is not model-invocable`)
+    throw new Error(`ptc-plus: official Cordis Skill provider must publish exactly ${JSON.stringify(CORDIS_SKILL_NAME)} as model-invocable`)
   }
   const skill = await skills.get(CORDIS_SKILL_NAME, lookup)
   if (skill?.provider !== CORDIS_SKILL_PROVIDER
@@ -177,6 +236,7 @@ export function createCordisToolsOwner(
   const pending = new Set()
   const cordisInspectLeases = createCordisInspectLeases(ctx)
   const scopedCordisPlugin = cordisInspectLeases.plugin(cordisPlugin)
+  const scopedSkillPlugin = exactCompanionSkillPlugin(skillFilesystemPlugin)
   let disposed = false
 
   const leafErrors = error => error instanceof AggregateError
@@ -242,7 +302,7 @@ export function createCordisToolsOwner(
       const skillDirectory = await companionSkillDirectory(agentPresets)
       if (mount.disposed) return
 
-      const skillFiber = agent.ctx.plugin(skillFilesystemPlugin, {
+      const skillFiber = agent.ctx.plugin(scopedSkillPlugin, {
         providerName: CORDIS_SKILL_PROVIDER,
         includeDefaultRoots: false,
         customSkillDirs: [skillDirectory],

package/internal/direct-surface-owner.js

@@ -59,6 +59,38 @@ function rejection(message) {
   }
 }
 
+export function createCordisRecoveryPolicy(initiallyEnabled) {
+  const states = new WeakMap()
+  let enabled = initiallyEnabled
+  let generation = enabled ? 1 : 0
+  return Object.freeze({
+    reconfigure(nextEnabled) {
+      if (!enabled && nextEnabled) generation += 1
+      enabled = nextEnabled
+    },
+    required(agent, view) {
+      if (!enabled) return false
+      let state = states.get(agent)
+      if (state?.generation !== generation) {
+        state = {
+          generation,
+          baselineInspections: view.cordisTranscript.inspections,
+          required: view.cordisTranscript.calls > 0,
+        }
+        states.set(agent, state)
+      }
+      if (state.required
+        && view.cordisTranscript.inspections > state.baselineInspections) {
+        state.required = false
+      }
+      return state.required
+    },
+    disposeAgent(agent) {
+      states.delete(agent)
+    },
+  })
+}
+
 function presentationState(assembly) {
   const tools = Array.isArray(assembly?.tools) ? assembly.tools : []
   if (!tools.some(tool => tool?.name === RUN_CODE)) {
@@ -110,6 +142,7 @@ export function createDirectSurfaceOwner({
   const compositions = new Map()
   const canonicalRequests = new WeakMap()
   const sessions = new Map()
+  const cordisRecovery = createCordisRecoveryPolicy(runtimeConfig.cordisToolsEnabled)
   let currentCanonicalizeToolCalls = canonicalizeToolCalls
   const tipConfig = {
     enabled: runtimeConfig.tipsEnabled,
@@ -175,6 +208,7 @@ export function createDirectSurfaceOwner({
   return Object.freeze({
     reconfigure(nextConfig) {
       currentCanonicalizeToolCalls = nextConfig.canonicalizeToolCalls
+      cordisRecovery.reconfigure(nextConfig.cordisToolsEnabled)
       tipConfig.enabled = nextConfig.tipsEnabled
       tipConfig.cooldownMessages = nextConfig.tipCooldownMessages
       tipConfig.escalationFailures = nextConfig.tipEscalationFailures
@@ -231,7 +265,11 @@ export function createDirectSurfaceOwner({
         directTools = [adaptRunCodeSchema(runCode), editRunCodeSchema()]
       }
       const runtimeContexts = sessionPtc
-        ? sessionRuntimeContexts(agent, tipConfig)
+        ? sessionRuntimeContexts(agent, tipConfig, {
+          cordisRecoveryRequired(view) {
+            return cordisRecovery.required(agent, view)
+          },
+        })
         : { contexts: [] }
       const contexts = sessionPtc && Array.isArray(assembly.contexts)
         && runtimeContexts.contexts.length > 0
@@ -310,6 +348,7 @@ export function createDirectSurfaceOwner({
     disposeAgent(agent) {
       const id = sessionId(agent)
       compositions.delete(agent)
+      cordisRecovery.disposeAgent(agent)
       if (id !== undefined) clearSession(id)
     },
     disposeSession(session) {

package/internal/edit-transport-owner.js

@@ -12,7 +12,11 @@ import {
   normalizeRewrites,
   validatedRewrites,
 } from './session-journal.js'
-import { editRejectedCell, editRunCodeSchema } from './rejected-cell-editor.js'
+import {
+  EXPECTED_TARGET_CALL_SEQ,
+  editRejectedCell,
+  editRunCodeSchema,
+} from './rejected-cell-editor.js'
 import { editTargetForCall, projectSessionLog } from './session-log-view.js'
 import { RUN_CODE } from './runtime-bridge-owner.js'
 import { isRecord } from './record-utils.js'
@@ -126,6 +130,13 @@ export function createEditTransportOwner(ctx, {
     }
     const edited = editRejectedCell(args, target.source)
     if (!edited.edited) return edited
+    const expectedTargetCallSeq = args[EXPECTED_TARGET_CALL_SEQ]
+    if (expectedTargetCallSeq !== undefined && expectedTargetCallSeq !== target.callSeq) {
+      return {
+        edited: false,
+        reason: `validated repair targets run_code call ${expectedTargetCallSeq}, but this edit captured call ${target.callSeq}`,
+      }
+    }
     if (typeof ctx.tools.execute !== 'function') {
       throw new Error('ptc-plus: DSH tools.execute is required for derived edit execution')
     }

package/internal/failure-reporting.js

@@ -2,6 +2,7 @@ import { diagnostic } from './diagnostic.js'
 
 export const MAX_ERROR_LOG_BYTES = 4 * 1024
 export const FAILURE_HINT_THRESHOLD = 3
+export const LONG_CELL_CODE_UNITS = 2_000
 const BINDING_FAILURE = Symbol('binding failure')
 
 export function markBindingFailure(error) {

package/internal/recovery-tips.js

@@ -1,6 +1,5 @@
 const PLATFORM_CAUSE_CODES = new Set(['EACCES', 'EINVAL', 'ENOTDIR', 'ENOENT', 'UNKNOWN'])
 const TIP_CONTEXT_PREFIX = 'tools:ptc-plus-tip/'
-export const LONG_FAILED_CELL_TIP_CODE_UNITS = 2_000
 const TIP_PREFIXES = Object.freeze({
   'repeated-binding-failure': 'The same binding failure has recurred.',
   'platform-command-failure': 'An executable, shell, or path failed in the current execution world.',

package/internal/rejected-cell-editor.js

@@ -14,6 +14,7 @@ export const EDIT_LIMITS = Object.freeze({
 
 const EDIT_RUN_CODE_EXECUTION_DESCRIPTION = 'Edit and run TypeScript cell'
 const REGEX_EDIT_RUN_CODE_EXECUTION_DESCRIPTION = 'Regex-edit and run TypeScript cell'
+export const EXPECTED_TARGET_CALL_SEQ = 'expected_target_call_seq'
 
 const REGEX_MATCH_SCRIPT = `(() => {
   const replacements = []
@@ -254,7 +255,7 @@ function assemble(source, replacements) {
 export function editRunCodeSchema() {
   return {
     name: 'edit_run_code',
-    description: 'Make a small exact or regular-expression change to the most recent eligible cell captured when this edit call is dispatched, then run the complete corrected cell. A successful edit becomes the next eligible cell. Use this only when replaying the whole cell is safe. If earlier code may already have caused an external effect, use a new run_code cell and its existing variables instead; this tool does not resume at the error location. Send exactly one atomic edits or regex_edits array. Choose edits for a few unique literal fragments; choose regex_edits when one counted pattern covers repeated fragments. Every resolved range must be non-overlapping in the original cell.',
+    description: 'Make a small exact or regular-expression change to the most recent eligible cell captured when this edit call is dispatched, then run the complete corrected cell. A successful edit becomes the next eligible cell. Use this only when replaying the whole cell is safe. If earlier code may already have caused an external effect, use a new run_code cell and its existing variables instead; this tool does not resume at the error location. Send exactly one atomic edits or regex_edits array, plus expected_target_call_seq only when a diagnostic supplies it to bind a validated repair to its rejected cell. Choose edits for a few unique literal fragments; choose regex_edits when one counted pattern covers repeated fragments. Every resolved range must be non-overlapping in the original cell.',
     parameters: {
       type: 'object',
       additionalProperties: false,
@@ -285,6 +286,10 @@ export function editRunCodeSchema() {
             required: ['pattern', 'flags', 'replacement', 'expected_matches'],
           },
         },
+        [EXPECTED_TARGET_CALL_SEQ]: {
+          type: 'integer', minimum: 0,
+          description: 'Optional target precondition copied from a validated diagnostic. The edit is rejected if the captured cell has another call sequence.',
+        },
       },
       oneOf: [{ required: ['edits'] }, { required: ['regex_edits'] }],
     },
@@ -296,32 +301,41 @@ export function editRejectedCell(value, source, timeoutMs = DEFAULT_REGEX_TIMEOU
     return rejection('edit_run_code expects an object with exactly one edits or regex_edits array')
   }
   const keys = Object.keys(value)
-  if (keys.length !== 1 || !['edits', 'regex_edits'].includes(keys[0]) || !Array.isArray(value[keys[0]])) {
+  const operationKeys = keys.filter(key => key === 'edits' || key === 'regex_edits')
+  if (operationKeys.length !== 1 || keys.length > 2
+    || keys.some(key => !['edits', 'regex_edits', EXPECTED_TARGET_CALL_SEQ].includes(key))
+    || !Array.isArray(value[operationKeys[0]])) {
     return rejection('edit_run_code expects exactly one edits or regex_edits array')
   }
+  if (Object.hasOwn(value, EXPECTED_TARGET_CALL_SEQ)
+    && (!Number.isSafeInteger(value[EXPECTED_TARGET_CALL_SEQ])
+      || value[EXPECTED_TARGET_CALL_SEQ] < 0)) {
+    return rejection('edit_run_code expected_target_call_seq must be a non-negative safe integer')
+  }
   if (source === undefined) return rejection('no run_code cell is currently eligible for safe editing')
-  const resolved = keys[0] === 'edits'
+  const operation = operationKeys[0]
+  const resolved = operation === 'edits'
     ? exactReplacements(value.edits, source)
     : regexReplacements(value.regex_edits, source, timeoutMs)
   if (resolved.error !== undefined) return rejection(resolved.error)
   const replacements = resolved.replacements.sort((left, right) => left.start - right.start)
   for (let index = 1; index < replacements.length; index += 1) {
     if (replacements[index].start < replacements[index - 1].end) {
-      return rejection(`${keys[0]}[${replacements[index].index}] overlaps ${keys[0]}[${replacements[index - 1].index}] in the target cell`)
+      return rejection(`${operation}[${replacements[index].index}] overlaps ${operation}[${replacements[index - 1].index}] in the target cell`)
     }
   }
   const preflight = preflightAssembly(source, replacements)
   if (preflight.error !== undefined) {
-    return rejection(keys[0] === 'regex_edits' ? preflight.error.replace(/^edits/, 'regex_edits') : preflight.error)
+    return rejection(operation === 'regex_edits' ? preflight.error.replace(/^edits/, 'regex_edits') : preflight.error)
   }
   const assembled = assemble(source, preflight.replacements)
   if (assembled.error !== undefined) {
-    return rejection(keys[0] === 'regex_edits' ? assembled.error.replace(/^edits/, 'regex_edits') : assembled.error)
+    return rejection(operation === 'regex_edits' ? assembled.error.replace(/^edits/, 'regex_edits') : assembled.error)
   }
   return Object.freeze({
     edited: true,
     code: assembled.code,
-    description: keys[0] === 'edits'
+    description: operation === 'edits'
       ? EDIT_RUN_CODE_EXECUTION_DESCRIPTION
       : REGEX_EDIT_RUN_CODE_EXECUTION_DESCRIPTION,
   })

package/internal/runtime-contexts.js

@@ -2,6 +2,8 @@ import { latestRecoveryTip } from './recovery-tips.js'
 import { projectSessionLog } from './session-log-view.js'
 
 const REWRITE_FEEDBACK = 'tools:ptc-plus-rewrite-info'
+const CORDIS_RECOVERY = 'tools:ptc-plus-cordis-recovery'
+const CORDIS_RECOVERY_TEXT = 'Recorded Cordis values in the recovered REPL are historical data, not proof that process-local Plugins, Runs, approvals, or Inspect observations still exist in the current DSH process. Before relying on prior Cordis IDs, state, or capability data, follow the current Cordis owner guidance and call the live read-only Cordis Inspect bindings through `tools.*`; do not rerun mutating Cordis calls merely to reconstruct history.'
 
 function continuationFeedback(view) {
   const run = view.latestRun
@@ -18,13 +20,17 @@ function continuationFeedback(view) {
 }
 
 /** Build all dynamic PTC contexts from one session-log projection. */
-export function sessionRuntimeContexts(agent, tipConfig) {
+export function sessionRuntimeContexts(agent, tipConfig, options = {}) {
   const view = projectSessionLog(agent)
   const rewrite = continuationFeedback(view)
   const tip = latestRecoveryTip(view, tipConfig)
+  const cordisRecovery = options.cordisRecoveryRequired?.(view) === true
+    ? { name: CORDIS_RECOVERY, text: CORDIS_RECOVERY_TEXT }
+    : undefined
   return Object.freeze({
     contexts: Object.freeze([
       ...(rewrite === undefined ? [] : [{ name: REWRITE_FEEDBACK, text: rewrite }]),
+      ...(cordisRecovery === undefined ? [] : [cordisRecovery]),
       ...(tip === undefined ? [] : [tip]),
     ]),
   })

package/internal/session-cell-executor.js

@@ -9,6 +9,7 @@ import { diagnostic, renderDiagnostic } from './diagnostic.js'
 import {
   firstLine,
   limitLogs,
+  LONG_CELL_CODE_UNITS,
   markBindingFailure,
   messageOf,
   oneLineMessage,
@@ -19,7 +20,7 @@ import { PreflightError, prepareProgram } from './cell-analysis.js'
 import { ModuleRewriteError } from './cell-rewriter.js'
 import { mapSourcePosition } from './source-position-map.js'
 import { durabilityState, transitionDurability } from './session-state.js'
-import { LONG_FAILED_CELL_TIP_CODE_UNITS } from './recovery-tips.js'
+import { validatedEofClosureRepair } from './validated-parse-repair.js'
 
 const OUTPUT_LIMIT_MESSAGE = bytes => `output exceeded ${bytes} bytes; reduce the returned value or keep it in a REPL binding`
 
@@ -49,7 +50,7 @@ function isBindingReferenceError(error) {
       || /Cannot access ['"][^'"]+['"] before initialization/.test(error.message))
 }
 
-function parseDiagnostic(error, source) {
+function parseCellPosition(error) {
   const cellPosition = error instanceof ModuleRewriteError ? error.cellPosition : undefined
   const line = Number.isSafeInteger(cellPosition?.line)
     ? cellPosition.line
@@ -57,16 +58,29 @@ function parseDiagnostic(error, source) {
   const column = Number.isSafeInteger(cellPosition?.column)
     ? cellPosition.column
     : Number.isSafeInteger(error?.loc?.column) ? error.loc.column + 1 : undefined
+  return line !== undefined && line >= 1 && column !== undefined
+    ? { line, column }
+    : undefined
+}
+
+function parseDiagnostic(error, source, position, repair) {
   return diagnostic({
     code: 'PTC-C001',
     severity: 'error',
     phase: 'parse',
     message: `cell could not be parsed: ${oneLineMessage(error)}`,
     stateEffect: 'unchanged',
-    ...(line !== undefined && line >= 1 && column !== undefined ? {
-      source: { cell: 'current', start: { line, column } },
-    } : {}),
-    help: ['repair the reported syntax and retry only this cell'],
+    ...(position === undefined ? {} : {
+      source: { cell: 'current', start: position },
+    }),
+    help: repair === undefined
+      ? source.length >= LONG_CELL_CODE_UNITS
+        ? ['this cell was not executed; when edit_run_code is declared for the current request and the correction is small and localized, use it to avoid resending this long source; otherwise retry only this cell with corrected source in run_code']
+        : ['this cell was not executed; correct the reported syntax and retry only this cell with run_code']
+      : [
+          `this cell was not executed; validated syntax repair: append ${JSON.stringify(repair.delimiter)} at the end of this cell`,
+          `when edit_run_code is declared for the current request, call ${repair.invocation} to apply this correction and rerun the cell; otherwise retry only this cell with the corrected source in run_code`,
+        ],
   })
 }
 
@@ -196,29 +210,41 @@ export class SessionCellExecutor {
       return result
     }
 
-    let prepared
     const catalog = kernel.bindingCatalog.inputs()
-    let looseTopLevelRedeclarations
+    const looseTopLevelRedeclarations = replayRecord === undefined
+      ? config.looseTopLevelRedeclarations
+      : replayRecord.bindingMode === 'loose'
+    const rewritesEnabled = replayRecord === undefined ? {
+      autoRewriteImports: config.autoRewriteImports,
+      autoStripExports: config.autoStripExports,
+      autoSplitRedeclarations: config.autoSplitRedeclarations,
+    } : replayRecord.rewritePolicy
+    const prepareCell = program => prepareProgram(
+      program,
+      catalog.knownBindings,
+      looseTopLevelRedeclarations,
+      request.bindingDescriptors.reservedNames,
+      rewritesEnabled,
+      catalog.importBindings,
+      catalog.importNamespaces,
+    )
+    let prepared
     try {
-      looseTopLevelRedeclarations = replayRecord === undefined
-        ? config.looseTopLevelRedeclarations
-        : replayRecord.bindingMode === 'loose'
-      prepared = prepareProgram(
-        request.program,
-        catalog.knownBindings,
-        looseTopLevelRedeclarations,
-        request.bindingDescriptors.reservedNames,
-        replayRecord === undefined ? {
-          autoRewriteImports: config.autoRewriteImports,
-          autoStripExports: config.autoStripExports,
-          autoSplitRedeclarations: config.autoSplitRedeclarations,
-        } : replayRecord.rewritePolicy,
-        catalog.importBindings,
-        catalog.importNamespaces,
-      )
+      prepared = prepareCell(request.program)
     } catch (error) {
       const result = earlyResult('exception', messageOf(error))
-      const failure = error instanceof PreflightError ? preflightDiagnostic(error) : parseDiagnostic(error, request.program)
+      const position = parseCellPosition(error)
+      const repair = error instanceof PreflightError || replayRecord !== undefined
+        ? undefined
+        : validatedEofClosureRepair({
+            source: request.program,
+            position,
+            prepare: prepareCell,
+            targetCallSeq: request.sourceCallSeq,
+          })
+      const failure = error instanceof PreflightError
+        ? preflightDiagnostic(error)
+        : parseDiagnostic(error, request.program, position, repair)
       result.error.message = renderDiagnostic(failure, request.program)
       kernel.completeJournal(request.journal, 'noop', result, undefined, [failure])
       return result
@@ -466,7 +492,7 @@ export class SessionCellExecutor {
               active.prepared.sourceMap,
             ),
         declared: message.moduleLoadFailed === true ? new Set() : active.prepared.declared,
-        longCellFailure: active.request.program.length >= LONG_FAILED_CELL_TIP_CODE_UNITS,
+        longCellFailure: active.request.program.length >= LONG_CELL_CODE_UNITS,
       })
       active.appliedBindingCatalog = message.moduleLoadFailed === true
         ? active.priorBindingCatalog

package/internal/session-log-view.js

@@ -27,6 +27,20 @@ function isContextStep(event) {
     || (event?.type === 'user/message' && event.data?.source?.kind === 'user')
 }
 
+function cordisTranscriptFacts(timeline) {
+  let calls = 0
+  let inspections = 0
+  for (const result of timeline.results.values()) {
+    for (const call of result?.journal?.calls ?? []) {
+      if (call.global !== 'tools' || typeof call.member !== 'string'
+        || !call.member.startsWith('cordis_')) continue
+      calls += 1
+      if (call.ok === true && call.member.startsWith('cordis_inspect')) inspections += 1
+    }
+  }
+  return Object.freeze({ calls, inspections })
+}
+
 /** Project session events into immutable facts consumed by prompt presentation. */
 export function projectSessionLog(agent, requestedEdit) {
   const events = agent?.session?.events
@@ -39,6 +53,7 @@ export function projectSessionLog(agent, requestedEdit) {
       latestRun: undefined,
       editableRun: undefined,
       repairSource: undefined,
+      cordisTranscript: Object.freeze({ calls: 0, inspections: 0 }),
     })
   }
   let contextStep = 0
@@ -60,6 +75,7 @@ export function projectSessionLog(agent, requestedEdit) {
     : undefined
   const latestRun = timeline.openTurn ? timeline.latestRun : undefined
   const editableRun = timeline.openTurn ? timeline.editableRun : undefined
+  const cordisTranscript = cordisTranscriptFacts(timeline)
   return Object.freeze({
     openTurn: timeline.openTurn,
     contextStep,
@@ -68,6 +84,7 @@ export function projectSessionLog(agent, requestedEdit) {
     latestRun,
     editableRun,
     repairSource: editableRun?.source,
+    cordisTranscript,
     ...(requestedEdit === undefined ? {} : { requestedEditTarget }),
   })
 }

package/internal/session-runtime.js

@@ -432,14 +432,22 @@ export class SessionRuntime {
     request = { ...request, bindings: bindingDescriptors.namespaces, bindingDescriptors }
     const { id: sessionId, session, callId, persistedCallSeq, cwd } = sessionOf(sessionContext)
     let callSeq
+    let sourceCallSeq
     try {
       if (persistedCallSeq !== undefined
         && (!Number.isSafeInteger(persistedCallSeq) || persistedCallSeq < 0)) {
         throw new Error('persisted tool call sequence must be a non-negative safe integer')
       }
-      callSeq = cellConfig.durableReplay
-        ? persistedCallSeq ?? liveToolCallSeq(session, callId, 'run_code')
-        : undefined
+      if (cellConfig.durableReplay) {
+        sourceCallSeq = liveToolCallSeq(session, callId, 'run_code')
+        callSeq = persistedCallSeq ?? sourceCallSeq
+      } else {
+        try {
+          sourceCallSeq = liveToolCallSeq(session, callId, 'run_code')
+        } catch {
+          sourceCallSeq = undefined
+        }
+      }
     } catch (error) {
       return completed({ logs: [], error: { kind: 'recovery', message: `cannot identify current run_code call in session log: ${messageOf(error)}` } })
     }
@@ -471,7 +479,7 @@ export class SessionRuntime {
     const workerReservation = kernel.reserveWorkerConfiguration(cellConfig)
     let result
     try {
-      result = await kernel.run({ ...request, journal, callSeq }, cellConfig)
+      result = await kernel.run({ ...request, journal, callSeq, sourceCallSeq }, cellConfig)
     } finally {
       kernel.releaseWorkerConfiguration(workerReservation)
     }

package/internal/validated-parse-repair.js

@@ -0,0 +1,82 @@
+import { EXPECTED_TARGET_CALL_SEQ, editRejectedCell } from './rejected-cell-editor.js'
+
+const CLOSING_DELIMITERS = Object.freeze(['}', ')', ']'])
+const LINE_TERMINATORS = /\r\n|[\n\r\u2028\u2029]/gu
+export const MAX_PARSE_REPAIR_ANCHOR_CODE_UNITS = 256
+
+function sourceEndPosition(source) {
+  let line = 1
+  let lineStart = 0
+  for (const match of source.matchAll(LINE_TERMINATORS)) {
+    line += 1
+    lineStart = match.index + match[0].length
+  }
+  return { line, column: source.length - lineStart + 1 }
+}
+
+function isSourceEnd(source, position) {
+  if (!Number.isSafeInteger(position?.line) || !Number.isSafeInteger(position?.column)) return false
+  const end = sourceEndPosition(source)
+  return position.line === end.line && position.column === end.column
+}
+
+function startsInsideSurrogatePair(source, index) {
+  if (index <= 0) return false
+  const current = source.charCodeAt(index)
+  const previous = source.charCodeAt(index - 1)
+  return current >= 0xdc00 && current <= 0xdfff && previous >= 0xd800 && previous <= 0xdbff
+}
+
+function boundedUniqueSuffix(source) {
+  const first = Math.max(0, source.length - MAX_PARSE_REPAIR_ANCHOR_CODE_UNITS)
+  for (let start = source.length - 1; start >= first; start -= 1) {
+    if (startsInsideSurrogatePair(source, start)) continue
+    const suffix = source.slice(start)
+    if (source.indexOf(suffix) === source.lastIndexOf(suffix)) return suffix
+  }
+  return undefined
+}
+
+function repairArguments(anchor, delimiter, targetCallSeq) {
+  const edit = Object.freeze({ old_string: anchor, new_string: anchor + delimiter })
+  return Object.freeze({
+    edits: Object.freeze([edit]),
+    [EXPECTED_TARGET_CALL_SEQ]: targetCallSeq,
+  })
+}
+
+function renderInvocation(argumentsValue) {
+  const json = JSON.stringify(argumentsValue)
+    .replaceAll('\u2028', '\\u2028')
+    .replaceAll('\u2029', '\\u2029')
+  return `edit_run_code(${json})`
+}
+
+/** Returns a source-exact edit only when one bounded EOF-closing candidate is valid. */
+export function validatedEofClosureRepair({ source, position, prepare, targetCallSeq }) {
+  if (!Number.isSafeInteger(targetCallSeq) || targetCallSeq < 0
+    || !isSourceEnd(source, position)) return undefined
+  const anchor = boundedUniqueSuffix(source)
+  if (anchor === undefined) return undefined
+  const candidates = []
+  for (const delimiter of CLOSING_DELIMITERS) {
+    const code = source + delimiter
+    let prepared
+    try {
+      prepared = prepare(code)
+    } catch {
+      continue
+    }
+    if (prepared.collisions.length > 0) continue
+    const argumentsValue = repairArguments(anchor, delimiter, targetCallSeq)
+    const edited = editRejectedCell(argumentsValue, source)
+    if (!edited.edited || edited.code !== code) continue
+    candidates.push({ delimiter, arguments: argumentsValue })
+  }
+  if (candidates.length !== 1) return undefined
+  const candidate = candidates[0]
+  return Object.freeze({
+    ...candidate,
+    invocation: renderInvocation(candidate.arguments),
+  })
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-ptc-plus",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "A session-bound agent-native REPL for DeepSeek Harness PTC mode.",
   "type": "module",
   "main": "./index.js",