thincoder 0.12.60 → 0.12.62

package/src/provider/errors.mjs

@@ -1,7 +1,7 @@
 /**
  * provider/errors.mjs — 错误分类与流规则编译族（2026-09-05 module-split：core.mjs
  * 557 > 500 硬限——parseRetryAfter/isNonRetryableError/betaBaseURL/compileStreamRules
- * verbatim 迁入，语义零变；core.mjs import 回（chat/listModels 调用点零改）。
+ * verbatim 迁入，语义零变；core.mjs import 回（chat 调用点零改）。
  * 注：retry.mjs（anthropic/google/responses 通道）自 2026-09-08 起导入本文件的
  * parseRetryAfter/isNonRetryableError（ENG-SESSION-PROVIDER-CLEANUP D2.2/D2.4 去重——
  * 单实现；早先的"循环依赖回避"复制已随依赖方向实测消解）。
@@ -74,3 +74,28 @@ export function compileStreamRules(rules) {
     }
   }).filter(Boolean)
 }
+
+/**
+ * Provider-level pre-flight error (MODEL-400-FIX F-1 — 请求体组装前断言): carries the
+ * provider identity so a fail-fast throw is readable ("which provider + what to fix")
+ * instead of a wire-time serde 400 or a bare message without context.
+ */
+export class ProviderError extends Error {
+  constructor(provider, message) {
+    super(`provider "${provider?.name ?? provider?.model ?? "unknown"}": ${message}`)
+    this.name = "ProviderError"
+  }
+}
+
+/**
+ * F-1 (MODEL-400-FIX) 根因兜底——请求体组装前断言：渠道裸克隆（`{...渠道}`——渠道只带
+ * 默认单值 `model`，克隆链未重派生 `.model` 时）provider.model 为 undefined/null——
+ * JSON.stringify 会丢 undefined 键 → 无 model 请求 → serde 400。
+ * fail-fast 报可读错误（带 provider 名 + 修复线索），不发病体。core.mjs chatImpl openai body 组装
+ * 前调用（单行——core.mjs 500 行硬限）。
+ */
+export function assertProviderModel(provider) {
+  if (!provider.model) {
+    throw new ProviderError(provider, "model is undefined — provider cloned without model re-derivation (set providers[].model — the channel default model)")
+  }
+}

package/src/provider/google.mjs

@@ -7,6 +7,7 @@
 import { proxyFetch } from "../proxy.mjs"
 import { requestWithRetry } from "./retry.mjs"
 import { effectiveFetchTimeoutMs } from "./core.mjs"
+import { abortError, timeoutError } from "../abort-provenance.mjs"
 
 /** OpenAI 语义 tool_choice → Gemini FunctionCallingConfig（2026-08-31 能力层）。 */
 function mapFunctionCallingConfig(choice) {
@@ -104,7 +105,7 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, on
   // Gemini uses API key as query parameter
   const url = `${provider.baseURL}/models/${provider.model}:streamGenerateContent?alt=sse&key=${encodeURIComponent(provider.apiKey)}`
 
-  if (signal?.aborted) throw Object.assign(new DOMException("Aborted", "AbortError"), { reason: signal.reason })
+  if (signal?.aborted) throw abortError(signal, "provider", "transport-google")
 
   // 会诊 #6：TPM/RPM 闸门 + 记账
   const { rateGate, recordRate, estimateRequestTokens } = await import("./rate.mjs")
@@ -116,7 +117,7 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, on
   const response = await requestWithRetry(
     () => proxyFetch(url, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: { ...(provider.headers ?? {}), "Content-Type": "application/json" }, // 定制头展开（PROVIDER.md §21）——定制头在前、内置头在后：内置头胜出
       body: JSON.stringify(body),
       // 2026-09-01：同 core.mjs——绝对墙钟废除；响应头阶段 fetchTimeoutMs（600s 默认），body 阶段读侧 idle 管
       signal,
@@ -199,7 +200,7 @@ async function parseGeminiStream(response, { onToken, onReasoning, signal }) {
   const armIdle = () => {
     if (idleTimer) clearTimeout(idleTimer)
     idleTimer = setTimeout(() => {
-      try { response.body?.destroy(new Error(`SSE idle timeout: no data for ${READ_IDLE_MS / 1000}s`)) } catch { /* already gone */ }
+      try { response.body?.destroy(timeoutError(`SSE idle timeout: no data for ${READ_IDLE_MS / 1000}s`, "provider", "google-sse-idle")) } catch { /* already gone */ }
     }, READ_IDLE_MS)
     idleTimer.unref?.()
   }
@@ -208,9 +209,7 @@ async function parseGeminiStream(response, { onToken, onReasoning, signal }) {
     for await (const chunk of response.body) {
       armIdle()
       if (signal?.aborted) {
-        const e = new DOMException("Aborted", "AbortError")
-        e.reason = signal.reason
-        throw e
+        throw abortError(signal, "provider", "transport-google")
       }
       buffer += decoder.decode(chunk, { stream: true })
       // BOM 剥除（会诊 #12）：首个 chunk 可能带 \uFEFF，否则首个 data 事件静默丢失

package/src/provider/index.mjs

@@ -2,5 +2,6 @@
  * provider/index.mjs — backward-compatible re-export
  * import { chat } from "./provider" → resolves to this file
  */
-export { chat, createProvider, listModels, stripImagesForTextModel } from "./core.mjs"
+export { chat, createProvider, stripImagesForTextModel } from "./core.mjs"
+export { listModels } from "./list-models.mjs"
 export { RETRYABLE_STATUS, _rateHooks, estimateText, estimateRequestTokens, rateGate, recordRate } from "./rate.mjs"

package/src/provider/list-models.mjs

@@ -0,0 +1,93 @@
+/**
+ * list-models.mjs — provider 模型清单拉取（GET /models，按 provider.format 分派——PROVIDER.md §16 M1）。
+ *
+ * 2026-09-10 自 core.mjs 迁出（原实现仅 OpenAI 形状）+ 扩 anthropic / google 两分支：
+ * - openai（缺省/未知 format——与 chat 分派缺省一致）：`GET {baseURL}/models` + Bearer；解析 `data[].id`
+ * - anthropic：`GET {baseURL}/models?limit=1000` + `x-api-key` / `anthropic-version`；`has_more` 时以
+ *   `last_id` 作 `after_id` 翻页跟随（≤10 页——防死循环）
+ * - google：`GET {baseURL}/models?key=…&pageSize=1000`；剥 `models/` 前缀；`nextPageToken` 翻页跟随（≤10 页）
+ *
+ * URL 组合 = `{baseURL}` + 相对路径，与 chat 各 transport 同构——baseURL 自带版本段
+ * （claude 预设 `…/v1` → `…/v1/models`；gemini 预设 `…/v1beta` → `…/v1beta/models`）。
+ * 超时制度沿用原实现（整体 15s + header 15s + body idle 15s；翻页时逐页各自计时；调用方可传
+ * `signal` 短路）。HTTP 非 2xx / 网络失败**抛出**（调用方决定降级——与现实现同）；
+ * 解析保持防御性（字段缺失即跳过该项）。候选不过滤非对话模型（embedding 等——§16.6 #14）。
+ */
+import { proxyFetch } from "../proxy.mjs"
+
+const LIST_TIMEOUT_MS = 15_000
+/** 翻页上限（cursor loop 防死循环——任一分页失败即整体抛出，不部分返回）。 */
+const MAX_PAGES = 10
+const ANTHROPIC_VERSION = "2023-06-01"
+
+/** 单页 GET + JSON 解析（非 2xx → throw；畸形 JSON → null——解析侧各自防御）。 */
+async function fetchJson(provider, url, headers, signal) {
+  const opts = {
+    headers,
+    signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(LIST_TIMEOUT_MS)]) : AbortSignal.timeout(LIST_TIMEOUT_MS),
+    _headerTimeoutMs: LIST_TIMEOUT_MS,
+    _bodyIdleMs: LIST_TIMEOUT_MS,
+  }
+  const response = await (provider.proxyUri ? proxyFetch(url, opts, provider.proxyUri) : fetch(url, opts))
+  if (!response.ok) {
+    const text = await response.text().catch(() => "")
+    throw new Error(`GET /models failed ${response.status}: ${text}`)
+  }
+  return response.json().catch(() => null)
+}
+
+/** 防御性收集：字段缺失/非字符串项跳过。 */
+function collect(rows, pick) {
+  if (!Array.isArray(rows)) return []
+  const out = []
+  for (const row of rows) {
+    const v = pick(row)
+    if (typeof v === "string" && v) out.push(v)
+  }
+  return out
+}
+
+async function listOpenai(provider, signal) {
+  const url = `${provider.baseURL}/models`
+  const data = await fetchJson(provider, url, { ...(provider.headers ?? {}), Authorization: `Bearer ${provider.apiKey ?? ""}` }, signal)
+  return collect(data?.data, (m) => m?.id)
+}
+
+async function listAnthropic(provider, signal) {
+  const headers = { ...(provider.headers ?? {}), "x-api-key": provider.apiKey ?? "", "anthropic-version": ANTHROPIC_VERSION }
+  const base = `${provider.baseURL}/models?limit=1000`
+  const out = []
+  let afterId = null
+  for (let page = 0; page < MAX_PAGES; page++) {
+    const url = afterId ? `${base}&after_id=${encodeURIComponent(afterId)}` : base
+    const data = await fetchJson(provider, url, headers, signal)
+    out.push(...collect(data?.data, (m) => m?.id))
+    if (!data?.has_more) return out
+    afterId = typeof data?.last_id === "string" && data.last_id ? data.last_id : null
+    if (!afterId) return out // has_more 但无游标——无法继续，避免死循环
+  }
+  return out
+}
+
+async function listGoogle(provider, signal) {
+  const headers = { ...(provider.headers ?? {}) }
+  const base = `${provider.baseURL}/models?key=${encodeURIComponent(provider.apiKey ?? "")}&pageSize=1000`
+  const out = []
+  let pageToken = null
+  for (let page = 0; page < MAX_PAGES; page++) {
+    const url = pageToken ? `${base}&pageToken=${encodeURIComponent(pageToken)}` : base
+    const data = await fetchJson(provider, url, headers, signal)
+    out.push(...collect(data?.models, (m) => (typeof m?.name === "string" ? m.name.replace(/^models\//, "") : null)))
+    if (typeof data?.nextPageToken !== "string" || !data.nextPageToken) return out
+    pageToken = data.nextPageToken
+  }
+  return out
+}
+
+/** List available model IDs from the provider's /models endpoint (format 分派——M1)。 */
+export async function listModels(provider, { signal } = {}) {
+  const format = provider?.format
+  if (format === "anthropic") return listAnthropic(provider, signal)
+  if (format === "google") return listGoogle(provider, signal)
+  return listOpenai(provider, signal)
+}

package/src/provider/rate.mjs

@@ -2,6 +2,7 @@
  * provider/rate.mjs — TPM/RPM proactive throttling gate
  * Sliding-window accounting; pre-check budget before sending requests; sleep until window frees space when over budget.
  */
+import { abortError } from "../abort-provenance.mjs"
 
 export const RETRYABLE_STATUS = new Set([408, 409, 425, 429, 500, 502, 503, 504])
 export const MAX_RETRIES = 3
@@ -86,7 +87,7 @@ export async function rateGate(provider, estimated, onWait, signal) {
     waitMs = Math.max(waitMs, 50)
     onWait?.({ phase: "gate", seconds: Math.ceil(waitMs / 1000) })
     await _rateHooks.sleep(waitMs)
-    if (signal?.aborted) throw new DOMException("Aborted", "AbortError")
+    if (signal?.aborted) throw abortError(signal, "provider", "rate-gate")
   }
 }
 

package/src/provider/responses.mjs

@@ -420,6 +420,8 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, on
   // rateGate/recordRate 对齐 core（responses body 无 messages 键——按本地全量 messages 估算）
   const estimated = estimateRequestTokens({ messages })
   await rateGate(provider, estimated, onWait, signal)
+  // 定制头展开（PROVIDER.md §21）：provider.headers 在前、内置头在后——同名内置头胜出（三处 fetch 共用）
+  const headers = { ...(provider.headers ?? {}), "Content-Type": "application/json", Authorization: `Bearer ${provider.apiKey}` }
 
   // round2 复验 #1（2026-08-31）：retry 层对 4xx 非可重试是 throw 而非返回——
   // requestWithRetry 从不返回 400/404 响应 → 下方 isChainInvalidError 分支原来不可达（D6 死代码）。
@@ -429,7 +431,7 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, on
     response = await requestWithRetry(
       () => proxyFetch(`${provider.baseURL}/responses`, {
         method: "POST",
-        headers: { "Content-Type": "application/json", Authorization: `Bearer ${provider.apiKey}` },
+        headers,
         body: JSON.stringify(body),
         signal,
           _headerTimeoutMs: effectiveFetchTimeoutMs(provider),
@@ -448,7 +450,7 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, on
     response = await requestWithRetry(
       () => proxyFetch(`${provider.baseURL}/responses`, {
         method: "POST",
-        headers: { "Content-Type": "application/json", Authorization: `Bearer ${provider.apiKey}` },
+        headers,
         body: JSON.stringify(fullBody),
         signal,
           _headerTimeoutMs: effectiveFetchTimeoutMs(provider),
@@ -466,7 +468,7 @@ export async function chat(provider, { messages, tools, onToken, onReasoning, on
     response = await requestWithRetry(
       () => proxyFetch(`${provider.baseURL}/responses`, {
         method: "POST",
-        headers: { "Content-Type": "application/json", Authorization: `Bearer ${provider.apiKey}` },
+        headers,
         body: JSON.stringify(fresh2.body),
         signal,
           _headerTimeoutMs: effectiveFetchTimeoutMs(provider),

package/src/provider/sse.mjs

@@ -2,6 +2,7 @@
  * provider/sse.mjs — SSE stream reader
  * Extracted from core.mjs. Parses Server-Sent Events for LLM chat responses.
  */
+import { abortError, timeoutError } from "../abort-provenance.mjs"
 
 /**
  * Normalize provider cache fields into DeepSeek-style prompt_cache_hit/miss_tokens.
@@ -174,7 +175,7 @@ export async function readSSE(response, { onToken, onReasoning, rules, signal, f
   const armIdle = () => {
     if (idleTimer) clearTimeout(idleTimer)
     idleTimer = setTimeout(() => {
-      try { response.body?.destroy(new Error(`SSE idle timeout: no data for ${READ_IDLE_MS / 1000}s`)) } catch { /* already gone */ }
+      try { response.body?.destroy(timeoutError(`SSE idle timeout: no data for ${READ_IDLE_MS / 1000}s`, "provider", "sse-idle")) } catch { /* already gone */ }
     }, READ_IDLE_MS)
     idleTimer.unref?.()
   }
@@ -183,9 +184,7 @@ export async function readSSE(response, { onToken, onReasoning, rules, signal, f
     for await (const chunk of response.body) {
       armIdle()
       if (signal?.aborted) {
-        const e = new DOMException("The operation was aborted", "AbortError")
-        e.reason = signal.reason
-        throw e
+        throw abortError(signal, "provider", "stream-read")
       }
       buffer += decoder.decode(chunk, { stream: true })
       // UTF-8 BOM 剥除（2026-08-31 会诊 #12）：某些网关/负载均衡在流首注入 \uFEFF，

package/src/proxy.mjs

@@ -6,6 +6,7 @@ import { connect } from "node:net";
 import { connect as tlsConnect } from "node:tls";
 import { PassThrough } from "node:stream";
 import { URL } from "node:url";
+import { abortError, timeoutError } from "./abort-provenance.mjs";
 
 const FETCH_TIMEOUT = 15_000
 
@@ -52,12 +53,6 @@ export function injectProxy(providers, config) {
   }
 }
 
-function abortError(signal) {
-  const e = new DOMException("The operation was aborted", "AbortError")
-  e.reason = signal?.reason
-  return e
-}
-
 /**
  * 在已建立的 socket 上发 HTTP 请求，响应头到齐即 resolve（流式）。
  * 返回 Response-like: { ok, status, headers: Headers, body: PassThrough(异步迭代), text(): Promise<string> }
@@ -76,15 +71,15 @@ export function streamHttpResponse(sock, urlStr, opts = {}, timeout = FETCH_TIME
     const headers = opts.headers ?? {}
     const signal = opts.signal
 
-    if (signal?.aborted) { sock.destroy(); return reject(abortError(signal)) }
+    if (signal?.aborted) { sock.destroy(); return reject(abortError(signal, "provider", "proxy")) }
 
     const body = new PassThrough()
     let settled = false
     let headerBuf = ""
     let idleTimer = null
 
-    const timer = setTimeout(() => fail(new Error("Response timeout")), timeout)
-    const onAbort = () => { sock.destroy(); fail(abortError(signal)) }
+    const timer = setTimeout(() => fail(timeoutError("Response timeout", "provider", "proxy-header")), timeout)
+    const onAbort = () => { sock.destroy(); fail(abortError(signal, "provider", "proxy")) }
     signal?.addEventListener("abort", onAbort, { once: true })
 
     function cleanup() {
@@ -101,7 +96,7 @@ export function streamHttpResponse(sock, urlStr, opts = {}, timeout = FETCH_TIME
     /** body 阶段空闲看门狗：每次数据到达重置；无数据超时 → 断流（流式消费方抛错） */
     function armIdle() {
       clearTimeout(idleTimer)
-      if (bodyIdleMs > 0) idleTimer = setTimeout(() => body.destroy(new Error("Response body timeout (idle)")), bodyIdleMs)
+      if (bodyIdleMs > 0) idleTimer = setTimeout(() => body.destroy(timeoutError("Response body timeout (idle)", "provider", "proxy-body-idle")), bodyIdleMs)
     }
 
     sock.on("data", (d) => {
@@ -190,11 +185,11 @@ export function tunnelHttps(urlStr, opts, proxyUri, timeout = FETCH_TIMEOUT) {
     const headerTimeoutMs = Number.isFinite(opts?._headerTimeoutMs) ? opts._headerTimeoutMs : 60_000
     const bodyIdleMs = opts?._bodyIdleMs ?? 120_000
 
-    if (signal?.aborted) return reject(abortError(signal))
+    if (signal?.aborted) return reject(abortError(signal, "provider", "proxy"))
 
     const sock = connect({ host: proxy.hostname, port: Number(proxy.port) || 3128 })
     const timer = setTimeout(() => { sock.destroy(); reject(new Error("Proxy CONNECT timeout")) }, timeout)
-    const onAbort = () => { sock.destroy(); reject(abortError(signal)) }
+    const onAbort = () => { sock.destroy(); reject(abortError(signal, "provider", "proxy")) }
     signal?.addEventListener("abort", onAbort, { once: true })
     sock.on("connect", () => sock.write(`CONNECT ${target.hostname}:${target.port || 443} HTTP/1.1\r\nHost: ${target.hostname}\r\n\r\n`))
 
@@ -229,14 +224,14 @@ function tcpConnectProxy(proxyUri, signal, timeout) {
   return new Promise((resolve, reject) => {
     const proxy = new URL(proxyUri)
     const sock = connect({ host: proxy.hostname, port: Number(proxy.port) || 3128 })
-    if (signal?.aborted) { sock.destroy(); return reject(abortError(signal)) }
+    if (signal?.aborted) { sock.destroy(); return reject(abortError(signal, "provider", "proxy")) }
     const onAbort = () => sock.destroy()
     signal?.addEventListener("abort", onAbort, { once: true })
     const timer = setTimeout(() => { sock.destroy(); reject(new Error("Proxy CONNECT timeout")) }, timeout)
     const onError = (e) => { clearTimeout(timer); reject(new Error(`Proxy CONNECT failed (${e.code ?? e.message})`)) }
     const onClose = () => {
       clearTimeout(timer)
-      reject(signal?.aborted ? abortError(signal) : new Error("Proxy connection closed before tunnel established"))
+      reject(signal?.aborted ? abortError(signal, "provider", "proxy") : new Error("Proxy connection closed before tunnel established"))
     }
     sock.once("connect", () => {
       clearTimeout(timer)

package/src/session-gc.mjs

@@ -19,7 +19,7 @@
  * import，启动钩子（session.mjs resumeSlot 包装）只一行调用。
  */
 
-import { readdirSync, readFileSync, statSync, unlinkSync, existsSync } from "node:fs"
+import { readdirSync, readFileSync, statSync, unlinkSync, existsSync, rmSync } from "node:fs"
 import { join, dirname, basename } from "node:path"
 import { configDir } from "./config.mjs"
 import { sessionPath, isProcessAlive } from "./session-slots.mjs"
@@ -153,7 +153,14 @@ export function deleteColdCwd(hash, { dir = sessionsDir(), now = Date.now(), ali
   if (!target) return { ok: false, reason: "not-cold", deleted: [] }
   const deleted = []
   for (const name of target.files) {
-    try { unlinkSync(join(dir, name)); deleted.push(name) } catch { /* 占用/竞态——跳过 */ }
+    const p = join(dir, name)
+    try {
+      // §14.3.8（TUI-OOM-ROOTCAUSE）：目录项（记录存储 sidecar `{prefix}.N.d`）递归删——
+      // 现 unlinkSync 对目录静默跳过（旧实现漏删 sidecar）；数据文件维持 unlink。
+      if (statSync(p).isDirectory()) rmSync(p, { recursive: true, force: true })
+      else unlinkSync(p)
+      deleted.push(name)
+    } catch { /* 占用/竞态——跳过 */ }
   }
   return { ok: true, deleted }
 }

package/src/session-guard.mjs

@@ -11,6 +11,17 @@
 
 import { existsSync, readFileSync, renameSync, statSync } from "node:fs"
 import { basename } from "node:path"
+// §14.3.8①（修正轮 #1）：.bak 轮转对**非本会话活动绑定面**联动改名 sidecar（`{p}.d → {bak}.d`）。
+import { RECORD_DIR_SUFFIX } from "./session-store.mjs"
+
+/** 轮转时随迁记录存储（.bak 路径联动）——本会话活动绑定面跳过（防拔掉活动存储）。 */
+function moveSidecar(src, dst, agent) {
+  const dir = src + RECORD_DIR_SUFFIX
+  if (agent?._recordStore?.dir === dir) return // 本会话活动绑定面——原地保留（§14.3.8①）
+  try {
+    if (existsSync(dir)) renameSync(dir, dst + RECORD_DIR_SUFFIX)
+  } catch { /* 随迁失败不阻断轮转（现场原地保留——读侧身份核验兜底） */ }
+}
 
 export function guardForeignSlotFile(agent, p, slot) {
   try {
@@ -29,6 +40,7 @@ export function guardForeignSlotFile(agent, p, slot) {
     if (diskIsNewer || diskForeign || (diskStart && diskStart !== myStart)) {
       const bak = `${p}.bak-${Date.now()}`
       renameSync(p, bak)
+      moveSidecar(p, bak, agent)
       console.error(`[session] slot ${slot} holds ${diskIsNewer ? `a newer-version file (v${disk.version})` : diskForeign ? `a foreign-cwd file (${disk.cwd})` : `another session (start ${diskStart}, ours ${myStart})`} — preserved as ${basename(bak)}`)
       agent._slotMtime = st.mtimeMs
       return bak

package/src/session-segments.mjs

@@ -0,0 +1,100 @@
+/**
+ * session-segments.mjs — 记录存储的段文件原语 + 人读线条目形态（TUI-OOM-ROOTCAUSE 批）。
+ *
+ * 机制契约全文 = docs/design/SESSION.md §14.3（D2 单一权威源）；本文件 = 「段 IO + 条目
+ * 形态」叶子层（`session-store.mjs` 拆分产物——503+ 行越 500 硬限，§14.5 表列模块按职责
+ * 拆分；store 继续 re-export 全部公开名，调用面零改）。零项目内依赖（仅 `node:`）。
+ */
+
+import { readdirSync, readFileSync } from "node:fs"
+
+/** 常量单源（§14.3.2）：每段消息数 / sidecar 目录后缀。 */
+export const RECORD_SEG_MESSAGES = 100
+export const RECORD_DIR_SUFFIX = ".d"
+
+/** 观测计数（测试缝——AC-RS9「恢复只读末段」以段读次数断言）。 */
+export const _storeStats = { segmentReads: 0, segmentWrites: 0, appendedEntries: 0, catchUpRetries: 0 }
+
+const LEGACY_TRANSIENT_PREFIXES = [
+  "[System reminder: working directory snapshot:",
+  "[Relevant memories from previous sessions",
+]
+
+/** legacy transient 判定（旧进程写进人读线的机器注入——落盘/展示均跳过）。 */
+export function isLegacyTransient(m) {
+  return (
+    m?.role === "user" &&
+    typeof m.content === "string" &&
+    LEGACY_TRANSIENT_PREFIXES.some((p) => m.content.startsWith(p))
+  )
+}
+
+/** Slim the HUMAN line for storage（自 session.mjs 迁出——§14.5）：机器线（contextHistory）
+ *  逐字节保持。Copy-on-write ONLY（两线经 pushReal 共享对象引用）：tool args → 300 字符头
+ *  截断 / tool content → 500 / 多模态 user → 保留 text、丢 image_url。 */
+export function slimForDisplay(m) {
+  if (m && Array.isArray(m.content)) {
+    const textParts = m.content.filter((p) => p?.type !== "image_url")
+    if (textParts.length === m.content.length) return m
+    return { ...m, content: textParts }
+  }
+  if (m && m.role === "assistant" && Array.isArray(m.tool_calls)) {
+    let changed = false
+    const tool_calls = m.tool_calls.map((tc) => {
+      const args = tc.function?.arguments
+      if (typeof args === "string" && args.length > 300) {
+        changed = true
+        return { ...tc, function: { ...tc.function, arguments: args.slice(0, 300) + "…" } }
+      }
+      return tc
+    })
+    return changed ? { ...m, tool_calls } : m
+  }
+  if (m && m.role === "tool" && typeof m.content === "string" && m.content.length > 500) {
+    return { ...m, content: m.content.slice(0, 500) + "\n… (truncated for storage)" }
+  }
+  return m
+}
+
+/** 记录条目过滤（与 saveSession 同源）：transient 机器注入与 legacy-transient 前缀不进记录。 */
+export function shouldAppend(m) {
+  return !!m && typeof m === "object" && !m.transient && !isLegacyTransient(m)
+}
+
+/** 真实 user 消息（turnCount/firstMessage 口径——同 session-slots.extractSlotMeta）。 */
+export function isRealUserMsg(m) {
+  return m?.role === "user" && typeof m.content === "string" && !m.content.startsWith("[System reminder:")
+}
+
+/** sidecar 目录路径（`{slot 文件路径}.d`——同目录同前缀）。 */
+export function recordDirOf(slotFile) { return slotFile + RECORD_DIR_SUFFIX }
+
+/** 段文件名（六位零填充）。 */
+export function segName(n) { return `seg-${String(n).padStart(6, "0")}.jsonl` }
+
+/** 段号升序表（readdir——不读内容）。 */
+export function listSegments(dir) {
+  let names
+  try { names = readdirSync(dir) } catch { return [] }
+  const out = []
+  for (const n of names) {
+    const m = /^seg-(\d+)\.jsonl$/.exec(n)
+    if (m) out.push(Number(m[1]))
+  }
+  return out.sort((a, b) => a - b)
+}
+
+/** 读段（原始行——去尾空行）；读失败按空段容忍（读路径尽力面）。 */
+export function readSegmentLines(path) {
+  _storeStats.segmentReads++
+  let text
+  try { text = readFileSync(path, "utf8") } catch { return [] }
+  const lines = text.split("\n")
+  if (lines.length > 0 && lines[lines.length - 1] === "") lines.pop()
+  return lines
+}
+
+/** 逐行容错解析：半行/损坏行 → undefined（调用方跳过——不抛、不自动修复）。 */
+export function tryParse(line) {
+  try { return JSON.parse(line) } catch { return undefined }
+}

package/src/session-slots.mjs

@@ -18,6 +18,8 @@ import { migrateHashLength } from "./session-migrate.mjs"
 // legacy 过滤）属 session.mjs（500 行内不迁移）——静态环仅此一处：函数声明实例化期已初始化、
 // 只函数体内运行时使用（环安全）；VS Code 端 session-slots ↔ session-io 同构镜像。
 import { loadSlotFile, isLegacyTransient } from "./session.mjs"
+// TUI-OOM-ROOTCAUSE 批（SESSION.md §14.3.8）：删槽联动记录存储（store 零项目内依赖——无环）。
+import { unlinkRecordStore } from "./session-store.mjs"
 
 let currentSessionId = null
 
@@ -135,9 +137,11 @@ function extractSlotMeta(history, activeProvider, updatedAt, title = "") {
   }
 }
 
-/** Extract preview summary from session data for manifest storage (with current timestamp) */
+/** Extract preview summary from session data for manifest storage (with current timestamp)
+ *  MODEL-MERGE-SESSION：摘要升级带 activeModel——listSlots 合成显 "p:m"（双端同规则）。 */
 export function slotDigest(data) {
   const meta = extractSlotMeta(data.history ?? [], data.activeProvider, data.updatedAt, data.title ?? "")
+  if (data.activeModel) meta.activeModel = data.activeModel
   return { ts: Date.now(), ...meta }
 }
 
@@ -356,6 +360,7 @@ function loadSlotMeta(cwd, slot, v) {
     const data = JSON.parse(readFileSync(p, "utf8"))
     const history = data.history ?? []
     const meta = extractSlotMeta(history, data.activeProvider, data.updatedAt ?? ts, data.title ?? "")
+    if (data.activeModel) meta.activeModel = data.activeModel
     return { ts, ...meta }
   } catch {
     return { ts }
@@ -381,7 +386,9 @@ export function listSlots(cwd) {
         messageCount: meta.messageCount ?? 0,
         turnCount: meta.turnCount ?? 0,
         firstMessage: meta.firstMessage ?? "",
-        activeProvider: meta.activeProvider ?? "",
+        // MODEL-MERGE-SESSION 摘要 "p:m"：activeProvider 保持裸渠道名——列表消费面显复合
+        // （旧摘要无 activeModel → 回退裸渠道名——新老兼容；cmd-session/VSC sessions 行免改）
+        activeProvider: meta.activeProvider ? (meta.activeModel ? `${meta.activeProvider}:${meta.activeModel}` : meta.activeProvider) : "",
         updatedAt: meta.updatedAt ?? meta.ts,
         updatedDate: new Date(meta.updatedAt ?? meta.ts).toLocaleString(),
         title: meta.title ?? "",
@@ -400,6 +407,7 @@ export function deleteSlot(cwd, slot) {
   delete m.slots[n]
   delete m.slotSessions?.[n] // orphan session-id entries bloat the manifest forever
   try { unlinkSync(slotPath(cwd, n)) } catch { /* missing file is fine */ }
+  unlinkRecordStore(slotPath(cwd, n)) // §14.3.8：删槽连带删除记录存储（sidecar）
   if (m.active === n) delete m.active
   // setActive: true —— 显式表达"删到 active 时 active 置空"的意图（saveManifest 默认
   // 保留 fresh.active，2026-09-01 会诊三家 🟡）