From 27fbfb250bb95ad171b18b552d16fee8d73405ce Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Wed, 14 Oct 2026 15:24:15 +0800
Subject: [PATCH 01/36] Give the session list a validator, and stop one clock
 driving two fetches
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three of the remaining poll-cost items, in the order they compound.

countRolesInPrefix counted the list's eight counters with five matchAll passes over the bounded
prefix — a match object per hit, thousands of them per session per rebuild. It now runs four
test-driven scans that read each value out of the text by position. The scans carry /g and test
mutates lastIndex, so each resets it first: the loops break when a value has no closing quote,
which is the normal case for a truncated prefix and leaves the cursor mid-string on module state
shared across calls. verify-count-roles.mjs holds the capturing implementation it replaced as a
reference and requires the two to agree over hand-written edges and over every session prefix in
the store it is pointed at, so the rewrite is held to being the same function and not merely a
faster one.

/api/sessions had no validator while /api/trajectory got one first. sessionsValidator is built
from the same values the payload is built from, in the same request: the visible slice's
dir|sizeBytes|lastActiveAt — exactly what describeSession keys its descriptor cache on — plus the
titles, which no file stat can see, plus the limit, because ?limit=10 and ?limit=20 are different
payloads and must not satisfy one another. The 304 is decided before any descriptor is built, and
an unchanged list answers from the bytes the previous request already built.

The soundness bound is the descriptor cache's and not a new one: a manifest.json appearing after
the walk listed a session would change startedAt without moving the tag, and that is already
invisible for up to SESSION_CACHE_TTL_MS to the cache this reuses. verify-list-cache.mjs pins the
TTL relationship that says so.

One POLL_INTERVAL drove both fetches and it was wrong for both. The list is a cached walk and a
cached title read and now usually a 304; the trajectory reparses a lineage, rebuilds a payload
that measured 18,924 rows, and reopens the runtime database on every request. They are two ticks
now, with the expensive one slower, and the list wakes the trajectory when it has evidence: a 200
means something in the visible slice moved, a 304 means nothing on screen can be stale. So the
slow tick is a floor on latency rather than a delay applied to every change.

The list keeps the fast tick for a reader-visible reason too: the picker renders 「刚刚」 against a
render-time clock, so a slower tick makes that label sit still and then jump. That ordering is
asserted, not just argued in a comment. The ledger build guard moves with the trajectory, where it
belongs — it exists because a table mid-build must not be replaced mid-build, and the list never
renders the ledger.

Read points that moved with it: verify-list-cache.mjs measures the cache against the list's own
cadence rather than the page's, client-check's poll assertion no longer passes just because
SESSION_POLL_INTERVAL contains POLL_INTERVAL as a substring, and the list body cache joins the
others in dispose.

63/63 guards, 33 mutations across the three new controls.
---
 .../mmc-trajectory/miniapp/client/index.html  | 115 ++++++++--
 .../mmc-trajectory/miniapp/node/server.mjs    | 164 ++++++++++---
 .../mmc-trajectory/tests/client-check.mjs     |   7 +-
 .../tests/mutate-count-roles.py               | 186 +++++++++++++++
 .../tests/mutate-list-cache-ttl.py            |  26 ++-
 .../tests/mutate-poll-decoupling.py           | 187 +++++++++++++++
 .../tests/mutate-sessions-etag.py             | 199 ++++++++++++++++
 .../tests/verify-count-roles.mjs              | 213 +++++++++++++++++
 .../tests/verify-list-cache.mjs               |  33 ++-
 .../tests/verify-poll-decoupling.mjs          | 169 ++++++++++++++
 .../tests/verify-sessions-etag.mjs            | 216 ++++++++++++++++++
 11 files changed, 1463 insertions(+), 52 deletions(-)
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/mutate-count-roles.py
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/mutate-poll-decoupling.py
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/mutate-sessions-etag.py
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/verify-count-roles.mjs
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/verify-poll-decoupling.mjs
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/verify-sessions-etag.mjs

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
index f13a610..e85aa58 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
+++ b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
@@ -3658,7 +3658,15 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
 
       /* ---------------- state ---------------- */
 
-      var POLL_INTERVAL = 2500;
+      // Two cadences, one per fetch, because the two are not the same work. See startPolling().
+      //
+      // 2500 for the list, which is a cached walk and a cached title read and now usually a 304 —
+      // and which the picker renders 「刚刚」 against. 8000 for the trajectory, which reparses a
+      // lineage and reopens the runtime database on every request. The list wakes the trajectory
+      // early when it has evidence, so the slow tick is a floor on latency, not a replacement for
+      // noticing a change.
+      var SESSION_POLL_INTERVAL = 2500;
+      var TRAJECTORY_POLL_INTERVAL = 8000;
       var PAGE_STEP = 200;
       var SEARCH_DEBOUNCE = 200;
       // Which window the page opens on, and which every reset returns to. A constant rather
@@ -3782,6 +3790,11 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         // unchanged session costs a 304 with no body instead of a multi-megabyte reply.
         etag: '',
         etagFor: '',
+        // The same pair for the session list, and separate for the same reason: a validator
+        // means nothing against a different request, and the list's request is a limit. Written
+        // in exactly one place — fetchSessions — the way `etag` is written only in fetchTrajectory.
+        sessionsEtag: '',
+        sessionsEtagFor: '',
         // Cursor for `?since=`: the highest record index already on screen, so a poll that
         // finds new records transfers the tail instead of the session. Bound to a cache key
         // for the same reason the validator is — a cursor means nothing against a different
@@ -3797,7 +3810,8 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
       var dom = {};
       var inflight = null;
       var sessionsInflight = null;
-      var pollTimer = null;
+      var sessionPollTimer = null;
+      var trajectoryPollTimer = null;
       var searchTimer = null;
       var rangeTimer = null;
       var refreshSeq = 0;
@@ -3902,27 +3916,69 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         return state.followLatest || !state.sessionId ? 'latest' : encodeURIComponent(state.sessionId);
       }
 
-      function fetchSessions() {
+      /**
+       * The session list, on its own validator.
+       *
+       * `manual` is the refresh button asking for the truth, and it drops the validator the way
+       * `fetchTrajectory(manual)` does — a refresh that revalidated the list would be a refresh
+       * of half the page. Every other caller passes nothing.
+       *
+       * Resolves to whether the list actually changed, and that is the part other code reads: a
+       * 200 means something in the visible slice moved, which is the cheap evidence the slow
+       * trajectory tick is waiting for; a 304 means nothing on screen can be stale.
+       *
+       * @param {boolean} [manual]
+       * @returns {Promise<boolean>}
+       */
+      function fetchSessions(manual) {
         if (sessionsInflight) sessionsInflight.abort();
         var controller = new AbortController();
         sessionsInflight = controller;
-        var query = '?limit=20';
-        return fetch('/api/sessions' + query, { signal: controller.signal, headers: { Accept: 'application/json' } })
+        var key = 'limit=20';
+        var query = '?' + key;
+        var headers = { Accept: 'application/json' };
+        if (manual) {
+          state.sessionsEtag = '';
+          state.sessionsEtagFor = '';
+        } else if (state.sessionsEtag && state.sessionsEtagFor === key) {
+          headers['If-None-Match'] = state.sessionsEtag;
+        }
+        return fetch('/api/sessions' + query, { signal: controller.signal, headers: headers })
           .then(function (response) {
+            // Nothing moved since the copy already on screen. Keep every piece of state and
+            // re-render nothing: the picker, its 「刚刚」 labels and its counts are all still true.
+            if (response.status === 304) {
+              var fresh = response.headers.get('etag');
+              if (fresh) state.sessionsEtag = fresh;
+              state.sessionsEtagFor = key;
+              return { changed: false, body: null, etag: state.sessionsEtag };
+            }
             if (!response.ok) throw new Error('http');
-            return response.json();
+            return response
+              .json()
+              .catch(function () { return null; })
+              .then(function (body) {
+                if (!body || typeof body !== 'object') throw new Error('api');
+                return { changed: true, body: body, etag: response.headers.get('etag') || '' };
+              });
           })
-          .then(function (data) {
+          .then(function (result) {
             sessionsInflight = null;
-            state.sessions = data && Array.isArray(data.sessions) ? data.sessions : [];
+            // One writer for the list's validator, on the one path that carried a body.
+            state.sessionsEtag = result.etag;
+            state.sessionsEtagFor = key;
+            if (!result.changed) return false;
+            state.sessions = Array.isArray(result.body.sessions) ? result.body.sessions : [];
             state.sessionsLoaded = true;
             state.sessionsError = false;
             renderSessionSelect();
+            return true;
           })
           .catch(function (error) {
             sessionsInflight = null;
-            if (error && error.name === 'AbortError') return;
+            if (error && error.name === 'AbortError') return false;
             state.sessionsError = true;
+            return false;
           });
       }
 
@@ -8658,26 +8714,53 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
 
       function startPolling() {
         stopPolling();
-        pollTimer = window.setInterval(function () {
+        // Two ticks, because the two fetches are not the same cost class and were never the same
+        // work. The list is a cached walk, a cached title read and a descriptor cache; once the
+        // page can revalidate it, an unchanged list costs a 304. The trajectory is the one that
+        // reparses a lineage and rebuilds a payload that measured 18,924 rows, and it also opens
+        // the runtime database on every request to work out which conversation is live.
+        //
+        // The list therefore keeps the fast tick, and it is not only for freshness: the picker
+        // renders 「刚刚」 against a render-time clock, so at a slow cadence that label would sit
+        // still and then jump. The trajectory gets the slower tick, and is woken early by the
+        // list instead of by the clock — see the fetchSessions call below.
+        sessionPollTimer = window.setInterval(function () {
+          if (document.hidden) return;
+          fetchSessions().then(function (changed) {
+            // A 200 is cheap evidence that something on screen may be stale, and a misfire is
+            // nearly free: the trajectory carries its own validator, so a tick that finds nothing
+            // changed ends in a 304 without touching a file. A 304 means nothing moved, so there
+            // is nothing to wake for.
+            if (changed) fetchTrajectory(false);
+          });
+        }, SESSION_POLL_INTERVAL);
+        trajectoryPollTimer = window.setInterval(function () {
           if (document.hidden) return;
           // A table that is still being built is not a table this tick may replace. An 全部 window
           // over 18,924 rows takes about 4 s to lay out — longer than this interval — so letting
           // every tick through would restart the build before it reached the end, and the reader
           // would watch the count reset from 3,000 back to 0 forever. The tick is remembered
           // instead, and flushDeferredPoll() runs it once the build finishes.
+          //
+          // This belongs to the trajectory alone. The list never renders the ledger; it rebuilds
+          // an <option> list, and holding it back because the ledger is mid-build was the two
+          // fetches sharing one tick rather than anything the build needs.
           if (ledgerBuilding()) {
             pollDeferred = true;
             return;
           }
-          fetchSessions();
           fetchTrajectory(false);
-        }, POLL_INTERVAL);
+        }, TRAJECTORY_POLL_INTERVAL);
       }
 
       function stopPolling() {
-        if (pollTimer !== null) {
-          window.clearInterval(pollTimer);
-          pollTimer = null;
+        if (sessionPollTimer !== null) {
+          window.clearInterval(sessionPollTimer);
+          sessionPollTimer = null;
+        }
+        if (trajectoryPollTimer !== null) {
+          window.clearInterval(trajectoryPollTimer);
+          trajectoryPollTimer = null;
         }
       }
 
@@ -8726,7 +8809,7 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
 
         dom.refreshBtn.addEventListener('click', function () {
           announce('正在刷新…');
-          fetchSessions();
+          fetchSessions(true);
           fetchTrajectory(true);
         });
 
diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
index 47d75bd..3f3d098 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
@@ -95,9 +95,21 @@ const PARSED_ROWS_CACHE_BYTES = 256 * 1024 * 1024;
 const PARSED_ROWS_HEAP_PER_SOURCE_BYTE = 2;
 const SESSION_STORE_TOKEN = '<session-store>';
 const JSON_HEADERS = { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' };
-const ROLE_PATTERN = /"role"\s*:\s*"(user|assistant|toolResult|custom)"/g;
-const TURN_PATTERN = /"turn_id"\s*:\s*"([^"]*)"/g;
-const BLOCK_PATTERN = /"type"\s*:\s*"(toolCall|thinking|text)"/g;
+/**
+ * Scans for the list counters, one per field. Each one stops right after the opening quote of
+ * the value, so the value can be read out of `text` by position instead of being captured —
+ * which is the whole point: a capturing `matchAll` allocates a match object per hit, and on a
+ * 64 KB prefix with thousands of messages that is thousands of short-lived objects per session,
+ * per rebuild.
+ *
+ * They carry `/g` and are driven with `test`, which allocates nothing. That mutates `lastIndex`,
+ * and `matchAll` (which the previous version used) did not, so every scan resets it first.
+ * These are module-level on purpose — a `new RegExp` per call would trade the allocation back.
+ */
+const MESSAGE_ID_SCAN = /"message_id"\s*:/g;
+const ROLE_SCAN = /"role"\s*:\s*"/g;
+const TURN_SCAN = /"turn_id"\s*:\s*"/g;
+const BLOCK_SCAN = /"type"\s*:\s*"/g;
 const ABSOLUTE_STORE_PATTERN = /(?:[A-Za-z]:[\\/])?[^\s"'`<>|]{0,120}?[\\/]?\.minimax(?:[\\/][^\s"'`<>|]{0,160})?/g;
 
 /**
@@ -207,24 +219,60 @@ export function parseMessagesJsonl(text) {
 
 /**
  * Cheap single-pass counters used by the session list; values are approximate by design.
+ *
+ * Allocation-free apart from the turn-id set, which has to hold the ids to count them
+ * distinctly. `tests/verify-count-roles.mjs` runs this against the capturing implementation it
+ * replaced over real session prefixes and hand-written edges, so the rewrite is held to being
+ * the same function rather than merely a faster one.
  * @param {string} text
  */
 export function countRolesInPrefix(text) {
-  const turnIds = new Set();
   const counts = { messages: 0, userMessages: 0, assistantMessages: 0, toolResults: 0, systemMessages: 0, toolCalls: 0, thinkingBlocks: 0, turns: 0 };
-  for (const match of text.matchAll(/"message_id"\s*:/g)) counts.messages += 1;
-  for (const match of text.matchAll(ROLE_PATTERN)) {
-    if (match[1] === 'user') counts.userMessages += 1;
-    else if (match[1] === 'assistant') counts.assistantMessages += 1;
-    else if (match[1] === 'toolResult') counts.toolResults += 1;
-    else counts.systemMessages += 1;
+
+  MESSAGE_ID_SCAN.lastIndex = 0;
+  while (MESSAGE_ID_SCAN.test(text)) counts.messages += 1;
+
+  // The value runs from the scan's `lastIndex` (just past the opening quote) to the next quote.
+  // Comparing length first is what makes `user` not also match `userSomething`, and reading the
+  // span with `startsWith` keeps the comparison from building a substring per hit.
+  const valueIs = (start, literal) => text.startsWith(literal, start)
+    && start + literal.length === valueEnd;
+  /** @type {number} */
+  let valueEnd = 0;
+
+  ROLE_SCAN.lastIndex = 0;
+  while (ROLE_SCAN.test(text)) {
+    const start = ROLE_SCAN.lastIndex;
+    valueEnd = text.indexOf('"', start);
+    // No closing quote left means no later field of this kind can match either, so stop.
+    if (valueEnd < 0) break;
+    if (valueIs(start, 'user')) counts.userMessages += 1;
+    else if (valueIs(start, 'assistant')) counts.assistantMessages += 1;
+    else if (valueIs(start, 'toolResult')) counts.toolResults += 1;
+    // `custom` is the fourth role the counters recognize. A value outside the four is not a
+    // role this list counts at all, and must stay uncounted rather than falling into the else.
+    else if (valueIs(start, 'custom')) counts.systemMessages += 1;
   }
-  for (const match of text.matchAll(TURN_PATTERN)) turnIds.add(match[1]);
-  for (const match of text.matchAll(BLOCK_PATTERN)) {
-    if (match[1] === 'toolCall') counts.toolCalls += 1;
-    else if (match[1] === 'thinking') counts.thinkingBlocks += 1;
+
+  const turnIds = new Set();
+  TURN_SCAN.lastIndex = 0;
+  while (TURN_SCAN.test(text)) {
+    const start = TURN_SCAN.lastIndex;
+    const end = text.indexOf('"', start);
+    if (end < 0) break;
+    turnIds.add(text.slice(start, end));
   }
   counts.turns = turnIds.size;
+
+  BLOCK_SCAN.lastIndex = 0;
+  while (BLOCK_SCAN.test(text)) {
+    const start = BLOCK_SCAN.lastIndex;
+    valueEnd = text.indexOf('"', start);
+    if (valueEnd < 0) break;
+    if (valueIs(start, 'toolCall')) counts.toolCalls += 1;
+    else if (valueIs(start, 'thinking')) counts.thinkingBlocks += 1;
+  }
+
   return counts;
 }
 
@@ -1556,6 +1604,43 @@ export function etagMatches(header, etag) {
   });
 }
 
+/**
+ * The material a `/api/sessions` validator is derived from.
+ *
+ * The soundness of a 304 is not "this covers every input that could change the payload" — it is
+ * "this is built from the same values the payload is built from, in the same request". So the
+ * function takes the two things the payload is built from and nothing else, and the route builds
+ * both from one call: a tag derived from anything else is a tag about a different payload.
+ *
+ * `visible` contributes `dir|sizeBytes|lastActiveAt` — exactly what `describeSession` keys its
+ * descriptor cache on, so a matching tag means the descriptors this request would produce are the
+ * ones behind the tag the caller already holds. `titles` contributes the renamed-session case,
+ * which no file stat can see. `limit` is in it because `?limit=10` and `?limit=20` are different
+ * payloads and must not satisfy one another.
+ *
+ * What it does not claim: a session whose `manifest.json` appears after the walk listed it would
+ * change `startedAt` without changing anything here. That is already invisible for up to
+ * SESSION_CACHE_TTL_MS to the descriptor cache this reuses, so the bound is that cache's and not
+ * a new one. tests/verify-list-cache.mjs pins the TTL relationship that says so.
+ *
+ * @param {ReadonlyArray<{ dir: string, sizeBytes: number, lastActiveAt: number }>} visible
+ * @param {Map<string, { title: string | null, kind: string | null }>} titles
+ * @param {number} limit
+ * @returns {string}
+ */
+export function sessionsValidator(visible, titles, limit) {
+  const parts = ['limit=' + limit];
+  for (const entry of visible) {
+    const meta = titles.get(decodeSessionIdFromDirName(basename(entry.dir)));
+    // A NUL between the fields, so a rename cannot be masked by the stat beside it: with a plain
+    // separator, {"ab",""} and {"a","b"} concatenate to the same string and the tag does not move.
+    parts.push(entry.dir + "|" + entry.sizeBytes + "|" + entry.lastActiveAt
+      + "|" + (meta ? String(meta.title ?? "") : "")
+      + "\u0000" + (meta ? String(meta.kind ?? "") : ""));
+  }
+  return parts.join("\n");
+}
+
 /**
  * The cache key for one rendered trajectory. Every component comes from a `stat`, a small
  * manifest/catalog file, or the already-resolved session binding — never from reading
@@ -1905,6 +1990,14 @@ export async function start(context) {
    * @type {{ at: number, key: string, map: Map<string, { title: string | null, kind: string | null }> }}
    */
   let titleCache = { at: 0, key: '', map: new Map() };
+  /**
+   * The last list body, kept under the tag it was built for. One entry, not a cache: the tag is
+   * recomputed per request and a mismatch simply means the list moved, which is the common case
+   * while the reader is working. Its job is the page that arrives with no validator — first load
+   * or a fresh tab — so the descriptors behind the previous answer can be reused instead of read.
+   * @type {{ material: string, body: string | null }}
+   */
+  let sessionsBody = { material: '', body: null };
   /** @param {readonly string[]} ids */
   const sessionTitles = async (ids) => {
     const key = ids.join('');
@@ -2032,27 +2125,45 @@ export async function start(context) {
       sendError(response, 503, 'trajectory_unavailable', '未找到本地会话数据目录');
       return;
     }
-    const described = [];
     const visible = entries.slice(0, limit);
     // Real titles from the runtime database; sub-agent and cron sessions get a kind badge so
     // the picker never presents them as if they were the user's conversation.
     const titles = await sessionTitles(
       visible.map((entry) => decodeSessionIdFromDirName(basename(entry.dir))).filter(Boolean),
     );
-    for (const entry of visible) {
-      try {
-        const descriptor = await describeSession(entry);
-        const meta = titles.get(decodeSessionIdFromDirName(basename(entry.dir)));
-        if (meta) {
-          if (meta.title) descriptor.label = meta.title;
-          descriptor.sessionKind = meta.kind;
+
+    // Built from the same two values the payload below is built from, and computed before any
+    // descriptor work — which is what lets an unchanged list answer without building it.
+    const etag = weakETag(sessionsValidator(visible, titles, limit));
+    const requestEtag = response.req && response.req.headers ? response.req.headers['if-none-match'] : null;
+    if (etagMatches(requestEtag, etag)) {
+      sendJsonBody(response, 304, '', { etag, revalidate: true });
+      return;
+    }
+
+    // Same shape as the trajectory route's cache-hit branch: a page that arrives without a
+    // validator — first load, a fresh tab — still gets bytes it does not have to cause a rebuild
+    // to produce.
+    let body = sessionsBody.material === etag ? sessionsBody.body : null;
+    if (body === null) {
+      const described = [];
+      for (const entry of visible) {
+        try {
+          const descriptor = await describeSession(entry);
+          const meta = titles.get(decodeSessionIdFromDirName(basename(entry.dir)));
+          if (meta) {
+            if (meta.title) descriptor.label = meta.title;
+            descriptor.sessionKind = meta.kind;
+          }
+          described.push(descriptor);
+        } catch (error) {
+          context.logger.warn('miniapp.trajectory.read_error', { reason: 'describe_failed', code: errorCode(error) });
         }
-        described.push(descriptor);
-      } catch (error) {
-        context.logger.warn('miniapp.trajectory.read_error', { reason: 'describe_failed', code: errorCode(error) });
       }
+      body = JSON.stringify({ sessions: described.map(stripInternalFields) });
+      sessionsBody = { material: etag, body };
     }
-    sendJson(response, 200, { sessions: described.map(stripInternalFields) });
+    sendJsonBody(response, 200, body, { etag, revalidate: true });
   };
 
   /**
@@ -2464,6 +2575,7 @@ export async function start(context) {
     context.signal.removeEventListener('abort', onAbort);
     listCache = { at: 0, entries: null };
     titleCache = { at: 0, key: '', map: new Map() };
+    sessionsBody = { material: '', body: null };
     descriptorCache.clear();
     trajectoryCache.clear();
     // The parsed-row cache is the largest of the three and was the only one not released here, so a
diff --git a/plugins/avatasia/mmc-trajectory/tests/client-check.mjs b/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
index 9939cb6..7340cd2 100644
--- a/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
@@ -353,7 +353,12 @@ const checks = [
   ['role=status present', (html.match(/role="status"/g) || []).length >= 3],
   ['semantic header/main/section/footer/nav/form', ['<header', '<main', '<section', '<footer', '<nav', '<form'].every((tag) => html.includes(tag))],
   ['semantic table rendered (static or via createElement)', html.includes('<table') || html.includes("el('table'")],
-  ['poll interval 2500ms', /POLL_INTERVAL = 2500/.test(html)],
+  ['session poll interval 2500ms, declared as the list\'s own cadence', /\bSESSION_POLL_INTERVAL = 2500\b/.test(html) && !/\bPOLL_INTERVAL = /.test(html)],
+  ['trajectory poll interval 8000ms, slower than the list\'s', /\bTRAJECTORY_POLL_INTERVAL = 8000\b/.test(html)],
+  // Two ticks, not one. The single `POLL_INTERVAL` this replaced cannot come back as a substring
+  // of either name — `SESSION_POLL_INTERVAL` contains `POLL_INTERVAL`, so an assertion written
+  // against the old bare name passes against either constant and means nothing.
+  ['no single shared poll interval is left behind', !/\bPOLL_INTERVAL\b/.test(html.replace(/SESSION_POLL_INTERVAL|TRAJECTORY_POLL_INTERVAL/g, ''))],
   ['handoff raw limit 8000', /HANDOFF_RAW_LIMIT = 8000/.test(html)],
   ['all 6 append error codes handled', ['user_cancelled', 'invalid_request', 'text_too_large', 'not_allowed', 'target_unavailable', 'result_unknown'].every((c) => html.includes(c))],
   // The type chips are the one filter. A second row of layer buttons was removed because a
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-count-roles.py b/plugins/avatasia/mmc-trajectory/tests/mutate-count-roles.py
new file mode 100644
index 0000000..33766a4
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-count-roles.py
@@ -0,0 +1,186 @@
+"""Break countRolesInPrefix's allocation-free rewrite in the shipped source and require
+verify-count-roles.mjs to report each way it comes back by name.
+
+The rewrite replaced five `matchAll` passes over the session list's prefix — a match object per
+hit, thousands of them per session per rebuild — with four `test`-driven scans that read each value
+out of the text by position. That trade is only worth making if the function still returns the same
+eight counters, because the list sends them to the reader. So every mutation below is either the
+counting drifting from what it was, or the allocation coming back.
+
+The `lastIndex` resets are the ones worth reading twice. These are module-level `/g` regexes driven
+with `test`, which mutates `lastIndex` — and the loops `break` out when a value has no closing
+quote, which is the normal case for a truncated prefix and which leaves the cursor mid-string. A
+scan that runs to exhaustion resets itself on the way out; a broken one does not. Drop one reset and
+the *next* call counts from wherever the last one stopped, on the same shared regex, with no error.
+
+Anchors are multi-line and server.mjs is LF, so they are written with bare \\n and the file is read
+and written with newline='' — matching on normalised text while preserving the file's own endings.
+No anchor may contain a line ending of its own: one did, and it stopped resolving the moment the
+.gitattributes pinning LF landed.
+"""
+import io
+import os
+import subprocess
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+PLUGIN = os.path.dirname(HERE)
+SERVER = os.path.join(PLUGIN, "miniapp", "node", "server.mjs")
+PROBE = os.path.join(HERE, "verify-count-roles.mjs")
+
+MUTATIONS = [
+    # ---- the resets on shared module state ----
+    #
+    # Each of these leaves a scan's lastIndex pointing into the middle of the previous call's
+    # string whenever that call hit a truncated value. The guard catches all three with one named
+    # assertion, because the case that fails is the same one each time: a complete scan after a
+    # truncated one.
+
+    ("the role scan stops resetting its cursor",
+     [("  ROLE_SCAN.lastIndex = 0;\n", "")],
+     "ROLE_SCAN is reset before it is scanned"),
+
+    ("the turn scan stops resetting its cursor",
+     [("  TURN_SCAN.lastIndex = 0;\n", "")],
+     "TURN_SCAN is reset before it is scanned"),
+
+    ("the block scan stops resetting its cursor",
+     [("  BLOCK_SCAN.lastIndex = 0;\n", "")],
+     "BLOCK_SCAN is reset before it is scanned"),
+
+    # ---- the value is matched exactly, not by prefix ----
+    #
+    # `user2` and `users` are not `user`. The capturing version could not get this wrong because
+    # its alternation closed the value; a position-based comparison that only checks `startsWith`
+    # can, and then reports messages the session does not have.
+
+    ("a value is matched by prefix rather than exactly",
+     [("  const valueIs = (start, literal) => text.startsWith(literal, start)\n"
+       "    && start + literal.length === valueEnd;",
+       "  const valueIs = (start, literal) => text.startsWith(literal, start);")],
+     "roles outside the four are not counted"),
+
+    # ---- a role outside the four is not a role the list counts ----
+    #
+    # The capturing version's alternation was the filter. Removing the `custom` branch and letting
+    # anything left over fall into the else counts `system`, `tool` and every future value as
+    # system messages — the else that used to mean exactly one thing.
+
+    ("a role outside the four falls into the system count",
+     [("    else if (valueIs(start, 'custom')) counts.systemMessages += 1;",
+       "    else counts.systemMessages += 1;")],
+     "roles outside the four are not counted"),
+
+    # ---- a truncated value is not a value ----
+    #
+    # The prefix is a prefix: the last line is routinely cut mid-field. Slicing to the end of the
+    # string instead of to the closing quote invents a turn id out of whatever follows.
+
+    ("a truncated turn id is counted as if it closed",
+     [("    const end = text.indexOf('\"', start);\n"
+       "    if (end < 0) break;\n"
+       "    turnIds.add(text.slice(start, end));",
+       "    turnIds.add(text.slice(start));")],
+     "truncated inside a turn id"),
+
+    # ---- turns are counted distinctly ----
+    #
+    # The same turn id is on every row of that turn, so a prefix with 40 rows and 4 turns reports
+    # 4. Counting rows instead reports 40, and the list prints it.
+
+    ("turns are counted per row rather than per distinct id",
+     [("  const turnIds = new Set();", "  let turnIds = 0;"),
+      ("    turnIds.add(text.slice(start, end));", "    turnIds += 1;"),
+      ("  counts.turns = turnIds.size;", "  counts.turns = turnIds;")],
+     "duplicate turn ids count once"),
+
+    # ---- the key needs its colon ----
+    #
+    # `{"note":"message_id"}` has the word but not the field, and the capturing pattern required
+    # the colon so it counted nothing. The obvious "even cheaper" rewrite is `indexOf` on the bare
+    # word, which counts every mention of it anywhere in the file.
+
+    ("message_id is counted by the bare word rather than as a key",
+     [("  MESSAGE_ID_SCAN.lastIndex = 0;\n  while (MESSAGE_ID_SCAN.test(text)) counts.messages += 1;",
+       "  let at = text.indexOf('\"message_id\"');\n"
+       "  while (at >= 0) { counts.messages += 1; at = text.indexOf('\"message_id\"', at + 12); }")],
+     "message_id as a value without a colon"),
+
+    # ---- and the allocation the rewrite was for ----
+    #
+    # Back to one capturing pass. Correct, and the original: a match object per hit, which on a
+    # 64 KB prefix is a few thousand per session per rebuild.
+
+    ("one scan goes back to a capturing pass",
+     [("  MESSAGE_ID_SCAN.lastIndex = 0;\n  while (MESSAGE_ID_SCAN.test(text)) counts.messages += 1;",
+       "  for (const match of text.matchAll(/\"message_id\"\\s*:/g)) counts.messages += 1;")],
+     "the counting loops do not build a match object per hit"),
+
+    # Half of that rewrite: still allocation-free, but only counting three of the four fields.
+    ("a whole scan is dropped",
+     [("  BLOCK_SCAN.lastIndex = 0;\n"
+       "  while (BLOCK_SCAN.test(text)) {\n"
+       "    const start = BLOCK_SCAN.lastIndex;\n"
+       "    valueEnd = text.indexOf('\"', start);\n"
+       "    if (valueEnd < 0) break;\n"
+       "    if (valueIs(start, 'toolCall')) counts.toolCalls += 1;\n"
+       "    else if (valueIs(start, 'thinking')) counts.thinkingBlocks += 1;\n"
+       "  }\n",
+       "")],
+     "the counting loops share one pass over the prefix rather than five"),
+]
+
+ORIGINAL = io.open(SERVER, encoding="utf-8", newline="").read()
+
+
+def run():
+    proc = subprocess.run(["node", PROBE], cwd=HERE,
+                          capture_output=True, text=True, encoding="utf-8", errors="replace")
+    return proc.returncode, proc.stdout + proc.stderr
+
+
+ok = True
+code, baseline = run()
+base_ok = code == 0 and "0 failed" in baseline
+print(("ok   " if base_ok else "FAIL ") + "baseline green")
+ok = ok and base_ok
+
+caught = []
+for entry in MUTATIONS:
+    title, edits, expect = entry
+    for old, new in edits:
+        hits = ORIGINAL.count(old)
+        if hits != 1:
+            raise SystemExit("FAIL  anchor for %r matched %d times" % (title, hits))
+        if old == new:
+            raise SystemExit("FAIL  empty mutation for %r: the anchor equals its replacement" % title)
+    try:
+        mutated = ORIGINAL
+        for old, new in edits:
+            mutated = mutated.replace(old, new, 1)
+        if mutated == ORIGINAL:
+            raise SystemExit("FAIL  mutation for %r changed nothing" % title)
+        io.open(SERVER, "w", encoding="utf-8", newline="").write(mutated)
+        during_code, during = run()
+        named = expect in during
+        red = during_code != 0
+        # A guard that crashes is not a guard that caught anything: the rule has to be reported by
+        # name, or the mutation only proved that the file no longer parses.
+        print(("ok   " if (named and red) else "FAIL ") + "guard catches: " + title)
+        if not named:
+            print("       no assertion reported %r" % expect)
+            for line in during.splitlines()[-4:]:
+                print("       " + line.strip())
+        elif not red:
+            print("       the rule was reported but the guard still exited 0")
+        caught.append(named and red)
+    finally:
+        io.open(SERVER, "w", encoding="utf-8", newline="").write(ORIGINAL)
+
+restored = io.open(SERVER, encoding="utf-8", newline="").read() == ORIGINAL
+after_code, after = run()
+after_ok = after_code == 0 and "0 failed" in after
+print(("ok   " if restored else "FAIL ") + "server.mjs restored byte for byte")
+print(("ok   " if after_ok else "FAIL ") + "green again after restore")
+
+sys.exit(0 if (ok and all(caught) and restored and after_ok) else 1)
\ No newline at end of file
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-list-cache-ttl.py b/plugins/avatasia/mmc-trajectory/tests/mutate-list-cache-ttl.py
index 829b1b7..fa7814f 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-list-cache-ttl.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-list-cache-ttl.py
@@ -36,10 +36,27 @@
 # once at startup and restored byte for byte in the same `finally` that already covered the server.
 MUTATIONS = [
     # The defect verbatim: the cache is shorter than the interval that expires it, so it is never
-    # hit. Not a slow cache — a cache that cannot be reached.
+    # hit. Not a slow cache — a cache that cannot be reached. Measured against the LIST's cadence
+    # rather than the page's, which is the one that actually calls this route.
     ("the list TTL drops below the poll interval",
      [("const LIST_CACHE_TTL_MS = 3000;", "const LIST_CACHE_TTL_MS = 1000;")],
-     "is at or above POLL_INTERVAL"),
+     "is at or above the list poll interval"),
+
+    # The other direction, and the one a 304 depends on. If the descriptor cache expires sooner
+    # than the walk that feeds the validator, the tag is built from facts newer than the entries
+    # it stands for, and a stale descriptor can be pinned in place by a tag that says nothing
+    # changed. Raising the walk's TTL is the cheapest way in, because it never trips the rule
+    # above on its own.
+    ("the descriptor cache expires sooner than the walk that feeds the validator",
+     [("const SESSION_CACHE_TTL_MS = 5000;", "const SESSION_CACHE_TTL_MS = 2000;")],
+     "is at or below SESSION_CACHE_TTL_MS"),
+
+    # The list body cache is a third thing the poll built, and it holds serialized bytes this
+    # time. Small next to the other two, which is exactly why it is the one that gets forgotten —
+    # the parsed-row cache leaked here once for the same reason.
+    ("dispose stops releasing the list body cache",
+     [("    sessionsBody = { material: '', body: null };\n", "")],
+     "dispose releases the list body cache"),
 
     # The quieter cousin: the label and counters come from a prefix of messages.jsonl, and a
     # generation marker lives on the first row. Reading far past it costs a full page of I/O on
@@ -64,8 +81,9 @@
     # The parsed-row cache leaked here once — a disposed runtime held ~43 MB for a 39 MB session —
     # and the line that fixed it is in server.mjs precisely so the next cache cannot repeat it.
     ("dispose stops releasing the title cache",
-     [("titleCache = { at: 0, key: '', map: new Map() };\n    descriptorCache.clear();",
-       "descriptorCache.clear();")],
+     [("    listCache = { at: 0, entries: null };\n"
+       "    titleCache = { at: 0, key: '', map: new Map() };\n",
+       "    listCache = { at: 0, entries: null };\n")],
      "dispose releases the title cache"),
 
     # ---- D45: a prefix count is not a count. ----
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-poll-decoupling.py b/plugins/avatasia/mmc-trajectory/tests/mutate-poll-decoupling.py
new file mode 100644
index 0000000..d7a9da0
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-poll-decoupling.py
@@ -0,0 +1,187 @@
+"""Put the two poll ticks back on one clock in the shipped client and require
+verify-poll-decoupling.mjs to report each way it comes back by name.
+
+The defect is not a wrong number. Two fetches of different cost shared a 2500 ms interval, so the
+expensive one — which reparses a lineage, rebuilds an 18,924-row payload, and reopens the runtime
+database on every request — was paced by a clock instead of by evidence, and the cheap one was
+paced by a number chosen for the expensive one. Nothing here is about tuning: it is about the two
+ticks existing, being ordered so the costly fetch is the slow one, and the cheap fetch waking the
+costly one when something actually moved.
+
+The three that read like tidying and are not:
+
+  * stopPolling clearing one timer. A page that navigated away keeps its list tick alive forever,
+    and the symptom is a process that will not go quiet — not a red test.
+  * the ledger build guard moving onto the list tick. It exists because a table mid-build must not
+    be replaced mid-build, which is a ledger concern; on the list tick it holds back the one fetch
+    that has no ledger to redraw, and the 「刚刚」 label stops moving with it.
+  * a 304 waking the trajectory. It is correct — the trajectory would answer 304 too — and it
+    costs a directory read and an open of the runtime database on every poll forever, which is the
+    exact bill this change was made to stop.
+
+Anchors are multi-line and index.html is LF, so they are written with bare \\n and the file is read
+and written with newline='' — matching on normalised text while preserving the file's own endings.
+No anchor may contain a line ending of its own: one did, and it stopped resolving the moment the
+.gitattributes pinning LF landed.
+"""
+import io
+import os
+import subprocess
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+PLUGIN = os.path.dirname(HERE)
+CLIENT = os.path.join(PLUGIN, "miniapp", "client", "index.html")
+PROBE = os.path.join(HERE, "verify-poll-decoupling.mjs")
+
+MUTATIONS = [
+    # ---- one clock again, with the expensive fetch on the fast one ----
+    #
+    # The original defect, expressed as a swap rather than a merge: the trajectory now ticks every
+    # 2500 ms and the list every 8000, so nothing is slower than it was and the label is the thing
+    # that suffers.
+    ("the two cadences are swapped",
+     [("      var SESSION_POLL_INTERVAL = 2500;\n      var TRAJECTORY_POLL_INTERVAL = 8000;",
+       "      var SESSION_POLL_INTERVAL = 8000;\n      var TRAJECTORY_POLL_INTERVAL = 2500;")],
+     "the trajectory is polled no faster than the list", CLIENT),
+
+    # ---- a tick that is registered and never cleared ----
+    #
+    # The list keeps running after the reader navigates away, because only the trajectory timer
+    # has something left to stop it. `stopPolling` is not on the hot path, so nothing else fails.
+    ("stopPolling forgets the list tick",
+     [("        if (sessionPollTimer !== null) {\n"
+       "          window.clearInterval(sessionPollTimer);\n"
+       "          sessionPollTimer = null;\n"
+       "        }\n", "")],
+     "stopPolling clears the list tick", CLIENT),
+
+    ("stopPolling forgets the trajectory tick",
+     [("        if (trajectoryPollTimer !== null) {\n"
+       "          window.clearInterval(trajectoryPollTimer);\n"
+       "          trajectoryPollTimer = null;\n"
+       "        }\n", "")],
+     "stopPolling clears the trajectory tick", CLIENT),
+
+    # ---- the build guard, which belongs to the trajectory alone ----
+    #
+    # Moved onto the list tick. It is correct to hold the trajectory back mid-build and wrong to
+    # hold the list back, which renders an <option> list and never touches the ledger — and the
+    # 「刚刚」 label stops moving for as long as a big window is laid out.
+    ("the ledger build guard is applied to the list tick",
+     [("          fetchSessions().then(function (changed) {",
+       "          if (ledgerBuilding()) { pollDeferred = true; return; }\n"
+       "          fetchSessions().then(function (changed) {")],
+     "the list tick is not held back by a ledger build", CLIENT),
+
+    # ...and its inverse, which is the original arrangement with the ticks still split: the
+    # trajectory tick replaces the ledger it is not allowed to replace, so an 全部 window restarts
+    # its build on every tick and the count resets from 3,000 to 0 forever.
+    ("the trajectory tick no longer respects a ledger build",
+     [("          if (ledgerBuilding()) {\n"
+       "            pollDeferred = true;\n"
+       "            return;\n"
+       "          }\n          fetchTrajectory(false);",
+       "          fetchTrajectory(false);")],
+     "the trajectory tick is still held back by a ledger build", CLIENT),
+
+    # ---- the wake-up ----
+    #
+    # The whole reason a slower trajectory tick is tolerable. Without it, new turns wait for the
+    # slow tick regardless of how quickly the cheap fetch proved they had arrived.
+    ("a changed list no longer wakes the trajectory",
+     [("            if (changed) fetchTrajectory(false);", "")],
+     "the list tick wakes the trajectory when the list changed", CLIENT),
+
+    # Correct, and the bill this change existed to stop: a 304 means nothing moved, and answering
+    # it still opens the runtime database and walks the lineage to return another 304.
+    ("every list tick wakes the trajectory, changed or not",
+     [("            if (changed) fetchTrajectory(false);",
+       "            fetchTrajectory(false);")],
+     "the trajectory is only woken when the list reports a change", CLIENT),
+
+    # ---- the hidden tab ----
+    #
+    # A backgrounded tab that keeps polling a 190 MB session store forever, which is where the
+    # 16 GB of reads in 68 minutes went in the first place.
+    ("a hidden tab no longer stops the trajectory tick",
+     [("        trajectoryPollTimer = window.setInterval(function () {\n"
+       "          if (document.hidden) return;",
+       "        trajectoryPollTimer = window.setInterval(function () {")],
+     "a hidden tab skips the trajectory tick", CLIENT),
+
+    # ---- the deferred tick ----
+    #
+    # A build that overran the trajectory tick leaves the reader on a session that finished before
+    # it, with nothing left to bring them forward.
+    ("a deferred tick stops refreshing the trajectory",
+     [("    pollDeferred = false;\n        fetchSessions();\n        fetchTrajectory(false);",
+       "    pollDeferred = false;\n        fetchSessions();")],
+     "a deferred tick still refreshes the trajectory", CLIENT),
+
+    # ---- the reader-visible reason the two are ordered this way ----
+    #
+    # The picker's recency is rendered against a render-time clock. Stop re-rendering it and the
+    # label is not slower, it is wrong: it keeps printing the minute it was rendered in.
+    ("the picker stops recomputing recency from the clock",
+     [("        var now = Date.now();\n        for (var i = 0; i < state.sessions.length; i += 1) {",
+       "        var now = state.pickerRenderedAt || (state.pickerRenderedAt = Date.now());\n"
+       "        for (var i = 0; i < state.sessions.length; i += 1) {")],
+     "the picker recomputes recency from a render-time clock", CLIENT),
+]
+
+ORIGINAL = io.open(CLIENT, encoding="utf-8", newline="").read()
+
+
+def run():
+    proc = subprocess.run(["node", PROBE], cwd=HERE,
+                          capture_output=True, text=True, encoding="utf-8", errors="replace")
+    return proc.returncode, proc.stdout + proc.stderr
+
+
+ok = True
+code, baseline = run()
+base_ok = code == 0 and "0 failed" in baseline
+print(("ok   " if base_ok else "FAIL ") + "baseline green")
+ok = ok and base_ok
+
+caught = []
+# Every mutation here is in the client, so the trailing element is the target and is kept
+# explicit for symmetry with the controls that span two files.
+for title, edits, expect, target in MUTATIONS:
+    for old, new in edits:
+        hits = ORIGINAL.count(old)
+        if hits != 1:
+            raise SystemExit("FAIL  anchor for %r matched %d times" % (title, hits))
+        if old == new:
+            raise SystemExit("FAIL  empty mutation for %r: the anchor equals its replacement" % title)
+    try:
+        mutated = ORIGINAL
+        for old, new in edits:
+            mutated = mutated.replace(old, new, 1)
+        if mutated == ORIGINAL:
+            raise SystemExit("FAIL  mutation for %r changed nothing" % title)
+        io.open(CLIENT, "w", encoding="utf-8", newline="").write(mutated)
+        during_code, during = run()
+        named = expect in during
+        red = during_code != 0
+        # A guard that crashes is not a guard that caught anything: the rule has to be reported by
+        # name, or the mutation only proved that the file no longer parses.
+        print(("ok   " if (named and red) else "FAIL ") + "guard catches: " + title)
+        if not named:
+            print("       no assertion reported %r" % expect)
+            for line in during.splitlines()[-4:]:
+                print("       " + line.strip())
+        elif not red:
+            print("       the rule was reported but the guard still exited 0")
+        caught.append(named and red)
+    finally:
+        io.open(CLIENT, "w", encoding="utf-8", newline="").write(ORIGINAL)
+
+restored = io.open(CLIENT, encoding="utf-8", newline="").read() == ORIGINAL
+after_code, after = run()
+after_ok = after_code == 0 and "0 failed" in after
+print(("ok   " if restored else "FAIL ") + "index.html restored byte for byte")
+print(("ok   " if after_ok else "FAIL ") + "green again after restore")
+
+sys.exit(0 if (ok and all(caught) and restored and after_ok) else 1)
\ No newline at end of file
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-sessions-etag.py b/plugins/avatasia/mmc-trajectory/tests/mutate-sessions-etag.py
new file mode 100644
index 0000000..0ce912b
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-sessions-etag.py
@@ -0,0 +1,199 @@
+"""Break the /api/sessions validator in the shipped source and require verify-sessions-etag.mjs to
+report each way it comes back by name.
+
+A 304 that is served when the payload has changed is the worst failure this route can have: it is
+silent, it is permanent for that page, and the reader sees a session list that no longer matches
+the machine. Nothing crashes and nothing is logged. So the mutations below are mostly ways of
+serving a 304 that is not earned — a tag that forgot one of the values the payload is built from —
+and the guard has to catch each by name rather than by noticing the count went wrong somewhere.
+
+The one that reads like a simplification and is not: dropping `limit` from the material. The tag is
+then computed over the visible slice alone, so `?limit=10` and `?limit=20` share it and a page that
+asked for 20 keeps its copy while asking for 10 and is told nothing changed.
+
+Anchors are multi-line and both shipped files are LF, so they are written with bare \\n and read
+and written with newline='' — matching on normalised text while preserving the file's own endings.
+No anchor may contain a line ending of its own: one did, and it stopped resolving the moment the
+.gitattributes pinning LF landed.
+"""
+import io
+import os
+import subprocess
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+PLUGIN = os.path.dirname(HERE)
+SERVER = os.path.join(PLUGIN, "miniapp", "node", "server.mjs")
+CLIENT = os.path.join(PLUGIN, "miniapp", "client", "index.html")
+PROBE = os.path.join(HERE, "verify-sessions-etag.mjs")
+
+# (title, edits, expect, target)
+MUTATIONS = [
+    # ---- the material forgets something the payload uses ----
+
+    ("a rename stops moving the tag",
+     [("      + \"|\" + (meta ? String(meta.title ?? \"\") : \"\")\n", "")],
+     "a renamed session moves the tag", SERVER),
+
+    # `kind` is what puts the sub-agent and cron badges on the rows, so a page that keeps a stale
+    # tag is offering the reader a worker's session as if it were their conversation.
+    ("a changed session kind stops moving the tag",
+     [("      + \"\\u0000\" + (meta ? String(meta.kind ?? \"\") : \"\"));",
+       "      + \"\");")],
+     "a changed session kind moves the tag, even with no title", SERVER),
+
+    # The one that looks like a simplification. Two different requests, one tag.
+    ("the requested limit stops being part of the tag",
+     [("  const parts = ['limit=' + limit];", "  const parts = [];")],
+     "a different limit moves the tag", SERVER),
+
+    # The separator. Without one, {"ab",""} and {"a","b"} concatenate to the same string, so two
+    # different payloads share a tag and the 304 is served for one the caller never held.
+    ("the title and kind are concatenated with no separator",
+     [("      + \"\\u0000\" + (meta ? String(meta.kind ?? \"\") : \"\"));",
+       "      + (meta ? String(meta.kind ?? \"\") : \"\"));")],
+     "a title/kind split cannot be hidden inside the separator", SERVER),
+
+    # mtime is one of the three facts the descriptor cache keys on, and the only one that moves
+    # when a session is rewritten in place without growing.
+    ("a newer mtime stops moving the tag",
+     [("    parts.push(entry.dir + \"|\" + entry.sizeBytes + \"|\" + entry.lastActiveAt",
+       "    parts.push(entry.dir + \"|\" + entry.sizeBytes")],
+     "a newer mtime moves the tag", SERVER),
+
+    # ---- the 304 that is not earned, because it is decided too late ----
+    #
+    # Correct answer, wrong bill: every descriptor is built and then thrown away. The validator
+    # then buys only the transfer, and the transfer was never the expensive half.
+
+    ("the 304 is decided after the descriptors are built",
+     [("    if (etagMatches(requestEtag, etag)) {\n"
+       "      sendJsonBody(response, 304, '', { etag, revalidate: true });\n"
+       "      return;\n"
+       "    }\n\n", "")],
+     "the 304 is decided before any descriptor is built", SERVER),
+
+    # `no-store` tells the browser not to revalidate at all, which turns the whole mechanism off
+    # on the client side while the route still pays to compute the tag.
+    ("the list answers through the non-revalidating sender",
+     [("    sendJsonBody(response, 200, body, { etag, revalidate: true });",
+       "    sendJson(response, 200, JSON.parse(body));")],
+     "the list no longer answers through the non-revalidating sender", SERVER),
+
+    # A 304 with no tag leaves the client unable to send it again, so every poll after it is a
+    # full body: the cost is invisible and the route looks healthy. The anchor runs past the block
+    # because the trajectory route has an identical 304 line and this one has to name which.
+    ("the 304 stops advertising the tag",
+     [("      sendJsonBody(response, 304, '', { etag, revalidate: true });\n"
+       "      return;\n"
+       "    }\n\n"
+       "    // Same shape as the trajectory route's cache-hit branch",
+       "      sendJsonBody(response, 304, '', { revalidate: true });\n"
+       "      return;\n"
+       "    }\n\n"
+       "    // Same shape as the trajectory route's cache-hit branch")],
+     "the 304 is sent through the revalidating sender", SERVER),
+
+    # ---- the page ----
+
+    ("the page stops sending the list validator",
+     [("          headers['If-None-Match'] = state.sessionsEtag;", "")],
+     "the page sends the list validator back", CLIENT),
+
+    # A 304 that re-renders is correct and pointless: the re-render is the cost the 304 exists to
+    # avoid, and on a big list it is the larger half.
+    ("a 304 re-renders the picker anyway",
+     [("            if (response.status === 304) {\n"
+       "              var fresh = response.headers.get('etag');\n"
+       "              if (fresh) state.sessionsEtag = fresh;\n"
+       "              state.sessionsEtagFor = key;\n"
+       "              return { changed: false, body: null, etag: state.sessionsEtag };\n"
+       "            }",
+       "            if (response.status === 304) {\n"
+       "              renderSessionSelect();\n"
+       "              return { changed: false, body: null, etag: state.sessionsEtag };\n"
+       "            }")],
+     "a 304 does not re-render the picker", CLIENT),
+
+    # Half a validator: kept, never sent. Every poll then carries no header and gets a full body.
+    ("the page keeps the validator but stops sending it",
+     [("        } else if (state.sessionsEtag && state.sessionsEtagFor === key) {\n"
+       "          headers['If-None-Match'] = state.sessionsEtag;\n"
+       "        }", "        }")],
+     "the page sends the list validator back", CLIENT),
+
+    # A refresh that revalidates the list is a refresh of half the page.
+    ("a manual refresh stops dropping the list validator",
+     [("        if (manual) {\n"
+       "          state.sessionsEtag = '';\n"
+       "          state.sessionsEtagFor = '';\n"
+       "        } else if", "        if (false) {\n"
+       "          state.sessionsEtag = '';\n"
+       "          state.sessionsEtagFor = '';\n"
+       "        } else if")],
+     "a manual refresh drops the list validator", CLIENT),
+
+    # A validator carried across a different request asks a question about a payload it is not for.
+    ("the list validator stops being bound to its request key",
+     [("state.sessionsEtagFor === key", "true")],
+     "the list validator is bound to the request key", CLIENT),
+]
+
+ORIGINALS = {
+    SERVER: io.open(SERVER, encoding="utf-8", newline="").read(),
+    CLIENT: io.open(CLIENT, encoding="utf-8", newline="").read(),
+}
+
+
+def run():
+    proc = subprocess.run(["node", PROBE], cwd=HERE,
+                          capture_output=True, text=True, encoding="utf-8", errors="replace")
+    return proc.returncode, proc.stdout + proc.stderr
+
+
+ok = True
+code, baseline = run()
+base_ok = code == 0 and "0 failed" in baseline
+print(("ok   " if base_ok else "FAIL ") + "baseline green")
+ok = ok and base_ok
+
+caught = []
+for title, edits, expect, target in MUTATIONS:
+    original = ORIGINALS[target]
+    for old, new in edits:
+        hits = original.count(old)
+        if hits != 1:
+            raise SystemExit("FAIL  anchor for %r matched %d times" % (title, hits))
+        if old == new:
+            raise SystemExit("FAIL  empty mutation for %r: the anchor equals its replacement" % title)
+    try:
+        mutated = original
+        for old, new in edits:
+            mutated = mutated.replace(old, new, 1)
+        if mutated == original:
+            raise SystemExit("FAIL  mutation for %r changed nothing" % title)
+        io.open(target, "w", encoding="utf-8", newline="").write(mutated)
+        during_code, during = run()
+        named = expect in during
+        red = during_code != 0
+        # A guard that crashes is not a guard that caught anything: the rule has to be reported by
+        # name, or the mutation only proved that the file no longer parses.
+        print(("ok   " if (named and red) else "FAIL ") + "guard catches: " + title)
+        if not named:
+            print("       no assertion reported %r" % expect)
+            for line in during.splitlines()[-4:]:
+                print("       " + line.strip())
+        elif not red:
+            print("       the rule was reported but the guard still exited 0")
+        caught.append(named and red)
+    finally:
+        io.open(target, "w", encoding="utf-8", newline="").write(ORIGINALS[target])
+
+restored = all(io.open(path, encoding="utf-8", newline="").read() == text
+               for path, text in ORIGINALS.items())
+after_code, after = run()
+after_ok = after_code == 0 and "0 failed" in after
+print(("ok   " if restored else "FAIL ") + "both files restored byte for byte")
+print(("ok   " if after_ok else "FAIL ") + "green again after restore")
+
+sys.exit(0 if (ok and all(caught) and restored and after_ok) else 1)
\ No newline at end of file
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-count-roles.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-count-roles.mjs
new file mode 100644
index 0000000..cab608b
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-count-roles.mjs
@@ -0,0 +1,213 @@
+/**
+ * `countRolesInPrefix` counts the session list's eight counters out of a bounded prefix of the
+ * active `messages.jsonl`. It used to do that with five `matchAll` passes over the prefix, which
+ * allocates a match object per hit: on a 64 KB prefix holding a few thousand messages that is a
+ * few thousand short-lived objects per session, per rebuild, on a poll.
+ *
+ * A rewrite that stops allocating is only worth having if it is still the same function. So this
+ * guard holds the implementation it replaced as `reference` and requires the two to agree — over
+ * hand-written edges, and over the prefix of every session in the store it is pointed at. The
+ * fixture is the default so the corpus is reproducible on a clean runner; `--real` uses this
+ * machine's transcripts instead.
+ *
+ * The corpus is the evidence, so it is deliberately wider than the shapes that occur: roles
+ * outside the four the counters recognize, values with no closing quote, a `message_id` used as a
+ * *value* rather than a key, duplicate and empty turn ids, and whitespace the patterns have to
+ * skip. Each of those is a case where a position-based rewrite and a capturing one can disagree,
+ * and a prefix counter that quietly changes its answer is worse than a slow one — the list sends
+ * these numbers to the reader.
+ *
+ * `tests/mutate-count-roles.py` breaks the shipped implementation in the ways this guard exists to
+ * catch, and requires it to report each by name.
+ */
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { join } from 'node:path';
+import {
+  countRolesInPrefix,
+  collectSessionEntries,
+  readHead,
+  resolveSessionsRoot,
+} from '../miniapp/node/server.mjs';
+
+const HERE = fileURLToPath(new URL('.', import.meta.url));
+const SERVER = fileURLToPath(new URL('../miniapp/node/server.mjs', import.meta.url));
+const FIXTURE_HOME = join(HERE, 'fixtures', 'minimax-home');
+const USE_REAL = process.argv.includes('--real');
+// Not exported from the server; the same 64 KB the list route reads. If the constant moves, this
+// guard is still a valid comparison — it compares two implementations over whatever they are
+// given — but the corpus stops matching production. LIST_PEEK_BYTES is pinned by verify-list-cache.
+const LIST_PEEK_BYTES = 64 * 1024;
+
+let pass = 0;
+const failures = [];
+function assert(name, cond) {
+  if (cond) pass += 1;
+  else failures.push(name);
+}
+
+/* ---------- the implementation this replaced ---------- */
+
+/**
+ * @param {string} text
+ */
+function reference(text) {
+  const turnIds = new Set();
+  const counts = { messages: 0, userMessages: 0, assistantMessages: 0, toolResults: 0, systemMessages: 0, toolCalls: 0, thinkingBlocks: 0, turns: 0 };
+  for (const match of text.matchAll(/"message_id"\s*:/g)) counts.messages += 1;
+  for (const match of text.matchAll(/"role"\s*:\s*"(user|assistant|toolResult|custom)"/g)) {
+    if (match[1] === 'user') counts.userMessages += 1;
+    else if (match[1] === 'assistant') counts.assistantMessages += 1;
+    else if (match[1] === 'toolResult') counts.toolResults += 1;
+    else counts.systemMessages += 1;
+  }
+  for (const match of text.matchAll(/"turn_id"\s*:\s*"([^"]*)"/g)) turnIds.add(match[1]);
+  for (const match of text.matchAll(/"type"\s*:\s*"(toolCall|thinking|text)"/g)) {
+    if (match[1] === 'toolCall') counts.toolCalls += 1;
+    else if (match[1] === 'thinking') counts.thinkingBlocks += 1;
+  }
+  counts.turns = turnIds.size;
+  return counts;
+}
+
+/**
+ * @param {string} label
+ * @param {string} text
+ */
+function sameAsReference(label, text) {
+  const got = countRolesInPrefix(text);
+  const want = reference(text);
+  const equal = Object.keys(want).every((key) => want[key] === got[key]);
+  assert(label + (equal ? '' : ` — got ${JSON.stringify(got)}, reference says ${JSON.stringify(want)}`), equal);
+}
+
+/* ---------- 1: the edges a position-based rewrite can get wrong ---------- */
+
+sameAsReference('empty prefix', '');
+sameAsReference('no counters at all', 'not json, just bytes');
+sameAsReference('one user turn', '{"message_id":"m1","turn_id":"t1","message":{"role":"user","content":"a"}}');
+sameAsReference('a custom role counts as system', '{"message_id":"m2","turn_id":"t2","message":{"role":"custom","content":"raw"}}');
+sameAsReference('all four recognized roles', '{"role":"user"}{"role":"assistant"}{"role":"toolResult"}{"role":"custom"}');
+
+// Values outside the four must stay uncounted. The capturing version's alternation simply failed
+// to match them; a rewrite that counts "anything with a role" reports a number the old one denied.
+sameAsReference('roles outside the four are not counted',
+  '{"role":"system"}{"role":"tool"}{"role":"user2"}{"role":"users"}{"role":"assistants"}');
+
+// `text` is in the block alternation and counts as nothing. So does anything else in it, and the
+// two are indistinguishable by outcome — but only because both branches fall through, so a
+// rewrite that drops the guard could start counting them.
+sameAsReference('block values outside the two counted ones', '{"type":"text"}{"type":"toolCall"}{"type":"thinking"}{"type":"unknownType"}');
+
+// Whitespace the patterns have to skip. `text` is the JS in the client, not this file.
+sameAsReference('whitespace around the separators', '{"role" : "user","turn_id"\n:\n"t9","type"\t:\t"toolCall"}');
+
+// `message_id` as a value, not a key. The pattern needs the colon, so `{"note":"message_id"}`
+// counts nothing and `{"note":"message_id":1}` counts one — and a rewrite that just looks for the
+// word would get the first one wrong.
+sameAsReference('message_id as a value without a colon', '{"note":"message_id"}');
+sameAsReference('message_id as a value followed by a colon', '{"note":"message_id":1}');
+
+// Truncated tails. The prefix is a prefix: the last line is routinely cut mid-field, so an
+// unterminated value is the normal case, not an edge. A capturing regex needs its closing quote
+// and finds nothing; a position-based scan that assumed one would count a value it never read.
+sameAsReference('truncated inside a role value', '{"message_id":"m1","message":{"role":"user');
+sameAsReference('truncated inside a turn id', '{"message_id":"m1","turn_id":"t');
+sameAsReference('truncated with nothing after a complete field', '{"message_id":"m1","role":"user"');
+
+// The scans `break` out when a value has no closing quote, which leaves their `lastIndex` pointing
+// into the middle of the string — the one thing `test` on a shared `/g` regex carries between
+// calls. A complete scan runs to exhaustion and resets itself on the way out; a broken one does
+// not. So the case that matters is a full scan *after* a truncated one, in that order: drop any
+// reset and the second call starts counting from wherever the first stopped.
+sameAsReference('a complete scan after a truncated role', '{"message_id":"m2","turn_id":"t7","message":{"role":"user","content":"a"}}{"type":"toolCall"}');
+sameAsReference('a complete scan after a truncated turn id', '{"message_id":"m3","turn_id":"t8","message":{"role":"assistant","content":"b"}}');
+sameAsReference('a complete scan after a truncated block type', '{"message_id":"m4","turn_id":"t9","type":"thinking"}');
+
+// Turn ids are counted distinctly, so duplicates and the empty id are the interesting cases.
+sameAsReference('duplicate turn ids count once', '{"turn_id":"t1"}{"turn_id":"t1"}{"turn_id":"t2"}');
+sameAsReference('an empty turn id is still a turn', '{"turn_id":""}{"turn_id":""}{"turn_id":"t1"}');
+
+// Scans are module-level `/g` regexes, and `test` moves `lastIndex` while `matchAll` did not.
+// Calling the function twice on different text is the cheapest way to catch a missing reset, so
+// it is a case here rather than an implementation detail.
+sameAsReference('a second call is unaffected by the first', '{"message_id":"m1","role":"user","turn_id":"t1","type":"toolCall"}');
+sameAsReference('a third call returns to zero', '');
+
+/* ---------- 2: the same comparison over real session prefixes ---------- */
+
+const location = USE_REAL ? resolveSessionsRoot() : resolveSessionsRoot({ MAVIS_HOME: FIXTURE_HOME });
+const entries = await collectSessionEntries(location.sessionsRoot);
+
+assert('the store under test has sessions to compare over', entries.length > 0);
+
+let compared = 0;
+let mismatches = 0;
+for (const entry of entries) {
+  let head;
+  try {
+    head = await readHead(join(entry.dir, 'messages.jsonl'), LIST_PEEK_BYTES);
+  } catch {
+    continue;
+  }
+  compared += 1;
+  const got = countRolesInPrefix(head.text);
+  const want = reference(head.text);
+  if (!Object.keys(want).every((key) => want[key] === got[key])) {
+    mismatches += 1;
+    failures.push(`${entry.dir} — got ${JSON.stringify(got)}, reference says ${JSON.stringify(want)}`);
+  }
+}
+
+assert('every session prefix counted identically (' + compared + ' compared)'
+  + (USE_REAL ? ' [real store]' : ' [fixture]'), mismatches === 0 && compared > 0);
+
+// The corpus only proves equivalence if it would have caught a divergence, so it has to contain
+// something to disagree about. A prefix with real messages in it exercises every branch; without
+// one, an implementation that counted only `user` would pass this whole file.
+let firstCounts = null;
+if (entries.length) {
+  try {
+    firstCounts = reference((await readHead(join(entries[0].dir, 'messages.jsonl'), LIST_PEEK_BYTES)).text);
+  } catch {
+    firstCounts = null;
+  }
+}
+assert('the corpus has messages in it, not just structure'
+  + (firstCounts ? ' (' + firstCounts.messages + ' on the first entry)' : ''),
+  firstCounts !== null && firstCounts.messages > 0);
+
+/* ---------- 3: the allocation claim, read off the shipped source ---------- */
+
+const server = readFileSync(SERVER, 'utf8');
+const body = /export function countRolesInPrefix\(text\) \{[\s\S]*?\n\}/.exec(server);
+
+assert('countRolesInPrefix is still in the shipped source', body !== null);
+
+if (body) {
+  const code = body[0];
+  // `matchAll` and `exec` are the two shapes that hand back a match object per hit. `test` is
+  // the one that does not, which is why the scans use it.
+  assert('the counting loops do not build a match object per hit',
+    !/matchAll\(/.test(code) && !/\.exec\(/.test(code));
+  // The scans are module-level so the allocation is not just moved into a per-call `new RegExp`.
+  assert('the scans are module-level constants, not built per call',
+    !/new RegExp/.test(code));
+  assert('the counting loops share one pass over the prefix rather than five',
+    (code.match(/\.test\(text\)/g) || []).length === 4
+    && !/for \(const .* of /.test(code));
+
+  // `/g` plus `test` mutates `lastIndex`, and these are shared module state. Missing one reset is
+  // a counter that silently starts from wherever the previous call stopped.
+  for (const scan of ['MESSAGE_ID_SCAN', 'ROLE_SCAN', 'TURN_SCAN', 'BLOCK_SCAN']) {
+    assert(scan + ' is reset before it is scanned',
+      new RegExp(scan + '\\.lastIndex = 0').test(code));
+  }
+}
+
+console.log('[count-roles] ' + pass + ' passed, ' + failures.length + ' failed');
+if (failures.length) {
+  console.log('FAILURES:\n - ' + failures.join('\n - '));
+  process.exit(1);
+}
+console.log('[count-roles] OK');
\ No newline at end of file
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-list-cache.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-list-cache.mjs
index 68fa19d..aa075c7 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-list-cache.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-list-cache.mjs
@@ -52,15 +52,33 @@ function assert(name, cond) {
 
 /* ---------- 1: the TTL outlives the poll that expires it ---------- */
 
+// The governing cadence is the LIST's, not the page's. One `POLL_INTERVAL` drove both fetches when
+// this was written, so the two were the same number by coincidence; the page now has a tick per
+// fetch, and asserting against the trajectory's would let the list be polled twice as often as
+// its cache can answer.
 const ttl = /const LIST_CACHE_TTL_MS\s*=\s*(\d+)/.exec(server);
-const poll = /var POLL_INTERVAL\s*=\s*(\d+)/.exec(html);
+const sessionPoll = /var SESSION_POLL_INTERVAL\s*=\s*(\d+)/.exec(html);
 
 assert('the list TTL is still declared in the server', ttl !== null);
-assert('the poll interval is still declared in the client', poll !== null);
+assert('the list\'s poll interval is still declared in the client', sessionPoll !== null);
 
-if (ttl && poll) {
-  assert('LIST_CACHE_TTL_MS (' + ttl[1] + ') is at or above POLL_INTERVAL (' + poll[1] + ') — a cache below the poll interval can never be hit',
-    Number(ttl[1]) >= Number(poll[1]));
+if (ttl && sessionPoll) {
+  assert('LIST_CACHE_TTL_MS (' + ttl[1] + ') is at or above the list poll interval (' + sessionPoll[1] + ') — a cache below the poll interval can never be hit',
+    Number(ttl[1]) >= Number(sessionPoll[1]));
+}
+
+// The other direction, and it is what makes a 304 on this route honest. A revalidated list means
+// "the payload I would send you now is the one you have", so its staleness bound cannot be looser
+// than the descriptor cache whose entries it is derived from. The tag is computed from the walk's
+// output, so it is as old as LIST_CACHE_TTL_MS; the descriptors behind it are as old as
+// SESSION_CACHE_TTL_MS. If that ever inverts, the validator is the freshest input in the route
+// and a stale descriptor can be pinned in place by a tag that says nothing changed.
+const descriptorTtl = /const SESSION_CACHE_TTL_MS\s*=\s*(\d+)/.exec(server);
+assert('the descriptor cache budget is still declared', descriptorTtl !== null);
+if (ttl && descriptorTtl) {
+  assert('LIST_CACHE_TTL_MS (' + ttl[1] + ') is at or below SESSION_CACHE_TTL_MS (' + descriptorTtl[1]
+    + ') — the walk must not be able to feed a validator built on fresher facts than the descriptors it stands for',
+    Number(ttl[1]) <= Number(descriptorTtl[1]));
 }
 
 /* ---------- 2 & 3: one poll, one walk, one database open ---------- */
@@ -80,6 +98,11 @@ assert('the list route reaches titles through the cache',
 assert('dispose releases the title cache',
   /titleCache = \{ at: 0, key: '', map: new Map\(\) \};[\s\S]{0,240}?descriptorCache\.clear\(\)/.test(server));
 
+// The list body cache is a third thing the poll built, and it holds serialized bytes this time.
+// It is small next to the two above, which is exactly why it is the one that gets forgotten.
+assert('dispose releases the list body cache',
+  /sessionsBody = \{ material: '', body: null \};[\s\S]{0,240}?descriptorCache\.clear\(\)/.test(server));
+
 /* ---------- 5: the peek that backs the list is bounded ---------- */
 
 const probe = /const GENERATION_PROBE_BYTES\s*=\s*(\d+)\s*\*\s*1024/.exec(server);
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-poll-decoupling.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-poll-decoupling.mjs
new file mode 100644
index 0000000..3e682b9
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-poll-decoupling.mjs
@@ -0,0 +1,169 @@
+/**
+ * One `POLL_INTERVAL` drove both `/api/sessions` and `/api/trajectory`, and it was wrong for both.
+ *
+ * The list is a cached walk, a cached title read and a descriptor cache — and now a validator, so
+ * an unchanged list usually costs a 304. It is cheap, and it is also the only thing that keeps the
+ * session picker's 「刚刚」 honest, because that label is rendered against a render-time clock.
+ *
+ * The trajectory is a different cost class entirely: on a session that is growing it reparses the
+ * whole lineage, rebuilds a payload that measured 18,924 rows, and opens the runtime database
+ * again to work out which conversation is live. Giving it the same 2.5 s tick meant paying that on
+ * a clock rather than on evidence.
+ *
+ * So there are two ticks, and the load-bearing part is not the numbers — it is that the cheap
+ * fetch wakes the expensive one. A 200 from the list means something in the visible slice moved;
+ * a 304 means nothing on screen can be stale. That is what makes a slower trajectory tick a floor
+ * on latency rather than a delay applied to every change.
+ *
+ * The invariants, and why each is here:
+ *
+ *   1. Two cadences, and the expensive one is the slower one. Asserted as a relationship: pinning
+ *      `=== 8000` would fail for a tuning change that improves things and pass for a swap.
+ *   2. The single `POLL_INTERVAL` is gone. It cannot come back as a substring of either new name —
+ *      `SESSION_POLL_INTERVAL` contains `POLL_INTERVAL` — so the check strips both before looking.
+ *   3. Both timers are registered and both are cleared. One registered and forgotten is a page
+ *      that keeps polling after the reader navigates away, with nothing left to stop it.
+ *   4. The build guard belongs to the trajectory alone. It exists because a table still being
+ *      built must not be replaced mid-build — a ledger concern. Holding the list back with it was
+ *      the two fetches sharing a tick, not anything the build needs: the list renders an
+ *      `<option>` list and never touches the ledger.
+ *   5. A 304 does not wake the trajectory, and a 200 does. The first half keeps the fast tick
+ *      free; the second half is the whole reason the slow tick is tolerable.
+ *   6. A hidden tab still stops both.
+ *   7. The deferred tick is still remembered and still flushes both, so a build that overran the
+ *      trajectory tick does not leave the reader looking at a session that finished before it.
+ *
+ * `tests/mutate-poll-decoupling.py` breaks each of these in the shipped client and requires this
+ * guard to report it by name.
+ */
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+const HERE = fileURLToPath(new URL('.', import.meta.url));
+const SERVER = fileURLToPath(new URL('../miniapp/node/server.mjs', import.meta.url));
+const HTML = fileURLToPath(new URL('../miniapp/client/index.html', import.meta.url));
+const html = readFileSync(HTML, 'utf8');
+const server = readFileSync(SERVER, 'utf8');
+
+let pass = 0;
+const failures = [];
+function assert(name, cond) {
+  if (cond) pass += 1;
+  else failures.push(name);
+}
+
+/* ---------- 1: two cadences, and the expensive one is the slower one ---------- */
+
+const sessionCadence = /var SESSION_POLL_INTERVAL\s*=\s*(\d+)/.exec(html);
+const trajectoryCadence = /var TRAJECTORY_POLL_INTERVAL\s*=\s*(\d+)/.exec(html);
+
+assert('the list\'s cadence is still declared', sessionCadence !== null);
+assert('the trajectory\'s cadence is still declared', trajectoryCadence !== null);
+
+if (sessionCadence && trajectoryCadence) {
+  assert('the trajectory is polled no faster than the list (' + trajectoryCadence[1] + ' vs ' + sessionCadence[1]
+    + ') — the expensive fetch is the one that has to slow down',
+    Number(trajectoryCadence[1]) > Number(sessionCadence[1]));
+}
+
+// The list cache is answerable at the list's cadence. If the two ticks ever swap, this is the
+// assertion that notices, and it lives in verify-list-cache.mjs because it owns the constants.
+assert('the list cache budget is still tied to the list\'s cadence, not to a shared one',
+  /const LIST_CACHE_TTL_MS\s*=\s*\d+/.test(server)
+  && /is at or above the list poll interval/.test(
+    readFileSync(fileURLToPath(new URL('./verify-list-cache.mjs', import.meta.url)), 'utf8')));
+
+/* ---------- 2: the shared interval is gone ---------- */
+
+// Stripping both new names first is the whole point: `SESSION_POLL_INTERVAL` contains
+// `POLL_INTERVAL`, so a check written against the old bare name matches either constant.
+const withoutNewNames = html.replace(/SESSION_POLL_INTERVAL|TRAJECTORY_POLL_INTERVAL/g, '');
+assert('the single shared POLL_INTERVAL no longer exists', !/\bPOLL_INTERVAL\b/.test(withoutNewNames));
+
+/* ---------- 3: both timers are registered and both are cleared ---------- */
+
+const start = /function startPolling\(\) \{[\s\S]*?\n      \}/.exec(html);
+const stop = /function stopPolling\(\) \{[\s\S]*?\n      \}/.exec(html);
+assert('startPolling is still in the shipped client', start !== null);
+assert('stopPolling is still in the shipped client', stop !== null);
+
+if (start && stop) {
+  const started = start[0];
+  const stopped = stop[0];
+  assert('the list gets its own tick', /sessionPollTimer = window\.setInterval/.test(started));
+  assert('the trajectory gets its own tick', /trajectoryPollTimer = window\.setInterval/.test(started));
+
+  assert('stopPolling clears the list tick',
+    /clearInterval\(sessionPollTimer\)[\s\S]*?sessionPollTimer = null/.test(stopped));
+  assert('stopPolling clears the trajectory tick',
+    /clearInterval\(trajectoryPollTimer\)[\s\S]*?trajectoryPollTimer = null/.test(stopped));
+
+  /* ---------- 4: the build guard is the trajectory's alone ---------- */
+
+  const listTick = /sessionPollTimer = window\.setInterval\(function \(\) \{[\s\S]*?\}, SESSION_POLL_INTERVAL\);/.exec(started);
+  const trajectoryTick = /trajectoryPollTimer = window\.setInterval\(function \(\) \{[\s\S]*?\}, TRAJECTORY_POLL_INTERVAL\);/.exec(started);
+  assert('the list tick is one callback', listTick !== null);
+  assert('the trajectory tick is one callback', trajectoryTick !== null);
+
+  if (listTick && trajectoryTick) {
+    assert('the list tick is not held back by a ledger build',
+      !/ledgerBuilding\(\)/.test(listTick[0]));
+    assert('the trajectory tick is still held back by a ledger build',
+      /if \(ledgerBuilding\(\)\)/.test(trajectoryTick[0]));
+    // Deferring has to stay attached to the tick that can be deferred, or the flag is set by a
+    // tick that does nothing and cleared by one that already ran.
+    assert('the deferred tick belongs to the trajectory tick',
+      /pollDeferred = true/.test(trajectoryTick[0]) && !/pollDeferred/.test(listTick[0]));
+    assert('the trajectory tick fetches the trajectory', /fetchTrajectory\(false\)/.test(trajectoryTick[0]));
+    assert('the list tick does not also fetch the trajectory on its own tick',
+      !/^\s*fetchTrajectory\(false\);\s*$/m.test(listTick[0]));
+
+    /* ---------- 5: a 304 does not wake the trajectory, a 200 does ---------- */
+
+    assert('the list tick wakes the trajectory when the list changed',
+      /fetchSessions\(\)\.then\(function \(changed\) \{[\s\S]*?if \(changed\) fetchTrajectory\(false\);/.test(listTick[0]));
+    // The counter-case, and the cheaper half: a 304 resolves to `false`, so the wake is gated on
+    // it and an unchanged list wakes nothing. An ungated call would be correct — the trajectory
+    // would answer 304 as well — and would reopen the runtime database and walk the lineage on
+    // every poll forever, which is the bill this split was made to stop.
+    assert('the trajectory is only woken when the list reports a change',
+      !/^[ \t]*fetchTrajectory\(false\);[ \t]*$/m.test(listTick[0]));
+
+    /* ---------- 6: a hidden tab stops both ---------- */
+
+    assert('a hidden tab skips the list tick', /if \(document\.hidden\) return;/.test(listTick[0]));
+    assert('a hidden tab skips the trajectory tick', /if \(document\.hidden\) return;/.test(trajectoryTick[0]));
+  }
+}
+
+/* ---------- 7: the deferred tick still flushes both ---------- */
+
+const flush = /function flushDeferredPoll\(\) \{[\s\S]*?\n      \}/.exec(html);
+assert('flushDeferredPoll is still in the shipped client', flush !== null);
+if (flush) {
+  assert('a deferred tick still refreshes the list', /fetchSessions\(\)/.test(flush[0]));
+  assert('a deferred tick still refreshes the trajectory', /fetchTrajectory\(false\)/.test(flush[0]));
+}
+
+/* ---------- 8: why the list keeps the fast tick, in the code that depends on it ---------- */
+
+// The 口径 half. The picker's recency is rendered from a render-time clock, so a slower list tick
+// does not make the label wrong — it makes it sit still and then jump. This is the reader-visible
+// reason the two cadences are ordered the way they are, and it is asserted here rather than only
+// argued in a comment, because a comment does not fail.
+const picker = /function renderSessionSelect\(\) \{[\s\S]*?\n      \}/.exec(html);
+assert('renderSessionSelect is still in the shipped client', picker !== null);
+if (picker) {
+  assert('the picker recomputes recency from a render-time clock',
+    /var now = Date\.now\(\);/.test(picker[0])
+    && /formatAgo\(session \? session\.lastActiveAt : null, now\)/.test(html));
+  assert('the picker is re-rendered whenever a list body arrives',
+    /state\.sessions = [\s\S]{0,200}?renderSessionSelect\(\);/.test(html));
+}
+
+console.log('[poll-decoupling] ' + pass + ' passed, ' + failures.length + ' failed');
+if (failures.length) {
+  console.log('FAILURES:\n - ' + failures.join('\n - '));
+  process.exit(1);
+}
+console.log('[poll-decoupling] OK');
\ No newline at end of file
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-sessions-etag.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-sessions-etag.mjs
new file mode 100644
index 0000000..9781a6a
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-sessions-etag.mjs
@@ -0,0 +1,216 @@
+/**
+ * `/api/sessions` is polled on a timer and rebuilt from scratch on every tick that moves, while
+ * `/api/trajectory` — the route that got a validator first — answers the same question with one.
+ * That asymmetry is not principled: the list is exactly as revalidatable as the payload, and it is
+ * the one a reader watches when nothing is happening.
+ *
+ * What makes a 304 sound here is narrower than "the tag covers every input that could change the
+ * payload". It is that the tag is computed from the same values the payload is built from, in the
+ * same request — so a matching tag means the bytes this request would produce are the bytes the
+ * caller already holds. The guard checks that property directly, on the function, rather than
+ * reading the route's regexes and hoping.
+ *
+ * The cases that are not obvious:
+ *
+ *   1. `?limit=10` and `?limit=20` are different payloads and must not satisfy one another. A
+ *      tag over the visible slice alone would let a page that asked for 20 keep its copy while
+ *      asking for 10, and get told nothing changed.
+ *   2. A rename. No file stat on the session directory moves when somebody renames the
+ *      conversation in the app, so the titles have to be in the material or a rename is invisible
+ *      until the descriptor cache happens to expire.
+ *   3. Field boundaries. With a plain separator, a title of `ab` beside an empty kind and a title
+ *      of `a` beside a kind of `b` concatenate to the same string, so two different payloads
+ *      share a tag. This is the one that a separator character fixes and nothing else catches.
+ *   4. The 304 has to be decided before any descriptor is built, or the route still pays for the
+ *      work it is avoiding and the validator buys only the transfer.
+ *   5. `no-store` suppresses the 304 path at the browser's end, so a revalidated route has to
+ *      advertise `no-cache` instead — which is what `revalidate: true` selects.
+ *
+ * `tests/mutate-sessions-etag.py` breaks each of these in the shipped source and requires this
+ * guard to report it by name.
+ */
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { sessionsValidator } from '../miniapp/node/server.mjs';
+
+const HERE = fileURLToPath(new URL('.', import.meta.url));
+const SERVER = fileURLToPath(new URL('../miniapp/node/server.mjs', import.meta.url));
+const CLIENT = fileURLToPath(new URL('../miniapp/client/index.html', import.meta.url));
+const server = readFileSync(SERVER, 'utf8');
+const html = readFileSync(CLIENT, 'utf8');
+
+let pass = 0;
+const failures = [];
+function assert(name, cond) {
+  if (cond) pass += 1;
+  else failures.push(name);
+}
+
+/* ---------- fixtures: directories shaped like the ones the walk returns ---------- */
+
+/** The session id is base64url-encoded after a `-session_` marker, so the dir name round-trips. */
+function dirFor(id) {
+  return '/store/2026/10/10/03-45-31-084-session_' + Buffer.from(id, 'utf8').toString('base64url');
+}
+
+const A = 'mvs_0000000000000000000000000000aaaa';
+const B = 'mvs_0000000000000000000000000000bbbb';
+const visible = [
+  { dir: dirFor(A), sizeBytes: 1024, lastActiveAt: 1700000000 },
+  { dir: dirFor(B), sizeBytes: 2048, lastActiveAt: 1700000001 },
+];
+const noTitles = new Map();
+const titled = new Map([
+  [A, { title: '第一段会话', kind: 'conversation' }],
+  [B, { title: '第二段会话', kind: null }],
+]);
+
+/* ---------- 1: the material moves exactly when the payload does ---------- */
+
+// Nothing changed. Same entries, same titles, same limit.
+assert('an unchanged list produces an unchanged tag',
+  sessionsValidator(visible, noTitles, 20) === sessionsValidator(visible, noTitles, 20));
+
+// The three things the payload is built from, one at a time.
+assert('a grown active file moves the tag',
+  sessionsValidator([{ ...visible[0], sizeBytes: 1025 }, visible[1]], noTitles, 20)
+  !== sessionsValidator(visible, noTitles, 20));
+
+assert('a newer mtime moves the tag',
+  sessionsValidator([{ ...visible[0], lastActiveAt: 1700000002 }, visible[1]], noTitles, 20)
+  !== sessionsValidator(visible, noTitles, 20));
+
+// The rename. Both halves of a row's metadata, because the picker renders both — and each has to
+// be isolated, or the assertion passes on the other field and the one it names is untested. These
+// two maps differ in the title and in nothing else.
+const beforeRename = new Map([[A, { title: '旧名字', kind: 'conversation' }], [B, { title: '第二段会话', kind: null }]]);
+const afterRename = new Map([[A, { title: '新名字', kind: 'conversation' }], [B, { title: '第二段会话', kind: null }]]);
+assert('a renamed session moves the tag',
+  sessionsValidator(visible, beforeRename, 20) !== sessionsValidator(visible, afterRename, 20));
+
+// `kind` is what puts the sub-agent badge on the row, so it is reader-visible on its own. Same
+// discipline: the title is held constant here.
+const kindBefore = new Map([[A, { title: '第一段会话', kind: null }]]);
+const kindAfter = new Map([[A, { title: '第一段会话', kind: 'conversation' }]]);
+assert('a changed session kind moves the tag, even with no title',
+  sessionsValidator(visible, kindBefore, 20) !== sessionsValidator(visible, kindAfter, 20));
+
+// A null title and an absent one are the same payload — the picker falls back to 「会话 <id>」 — so
+// they have to be the same tag, or every poll would look like a change.
+const nullTitle = new Map([[A, { title: null, kind: 'conversation' }]]);
+const nullTitleBoth = new Map([[A, { title: null, kind: 'conversation' }], [B, { title: null, kind: null }]]);
+assert('a null title and an absent one agree — they render the same row',
+  sessionsValidator(visible, nullTitle, 20) === sessionsValidator(visible, nullTitleBoth, 20));
+
+// A session entering or leaving the visible slice.
+assert('one more session in view moves the tag',
+  sessionsValidator([...visible, { dir: dirFor('mvs_0000000000000000000000000000cccc'), sizeBytes: 1, lastActiveAt: 1 }], noTitles, 20)
+  !== sessionsValidator(visible, noTitles, 20));
+
+/* ---------- 2: the request itself is part of the identity ---------- */
+
+assert('a different limit moves the tag',
+  sessionsValidator(visible, noTitles, 10) !== sessionsValidator(visible, noTitles, 20));
+
+/* ---------- 3: the separator, which is the case nothing else catches ---------- */
+
+// Same characters, different boundaries. Without a separator that cannot appear in a value, both
+// of these hash to the same string and a 304 is served for a payload the caller never held.
+const splitOne = new Map([[A, { title: 'ab', kind: '' }]]);
+const splitTwo = new Map([[A, { title: 'a', kind: 'b' }]]);
+assert('a title/kind split cannot be hidden inside the separator',
+  sessionsValidator(visible, splitOne, 20) !== sessionsValidator(visible, splitTwo, 20));
+
+// The separator must also not be something a title can contain, or a title can move the boundary.
+const material = /export function sessionsValidator\(visible, titles, limit\) \{[\s\S]*?\n\}/.exec(server);
+assert('the material is still built in server.mjs', material !== null);
+if (material) {
+  assert('the separator between the title and the kind is a character a title cannot contain',
+    /\\u0000/.test(material[0]));
+}
+
+// Empty input, because the route calls this before it knows the walk found anything.
+assert('an empty list still produces a material', typeof sessionsValidator([], noTitles, 20) === 'string'
+  && sessionsValidator([], noTitles, 20).length > 0);
+
+/* ---------- 4: the route uses it, and decides the 304 before it builds anything ---------- */
+
+const route = /const handleSessions = async \(response, url\) => \{[\s\S]*?\n  \};/.exec(server);
+assert('the list route is still in the shipped source', route !== null);
+
+if (route) {
+  const code = route[0];
+  assert('the route derives its tag from sessionsValidator',
+    /weakETag\(sessionsValidator\(visible, titles, limit\)\)/.test(code));
+
+  // The same three values on both sides. A validator computed from anything the payload does not
+  // use is a validator about a different payload. The pairing itself is settled by the call above
+  // passing `titles` and `visible` by name; this asserts the body loop reads the same binding.
+  assert('the payload is built from the same visible slice the tag was', /for \(const entry of visible\)/.test(code));
+  assert('the payload consults the titles the tag was built from',
+    /const meta = titles\.get\(/.test(code));
+
+  // The whole point: no descriptor work before the 304 is decided.
+  const tagAt = code.indexOf('etagMatches(requestEtag, etag)');
+  const describeAt = code.indexOf('describeSession(entry)');
+  assert('the 304 is decided before any descriptor is built',
+    tagAt !== -1 && describeAt !== -1 && tagAt < describeAt);
+
+  // ...and the reused body answers the request that arrives with no validator at all.
+  assert('an unchanged list reuses the bytes it already built',
+    /sessionsBody\.material === etag \? sessionsBody\.body : null/.test(code));
+
+  // A 304 carries no body and must not advertise one; a revalidated response must not say
+  // `no-store`, because that suppresses the 304 path in the browser as well.
+  assert('the 304 is sent through the revalidating sender',
+    /sendJsonBody\(response, 304, '', \{ etag, revalidate: true \}\)/.test(code));
+  assert('the 200 carries the tag and the revalidating cache-control',
+    /sendJsonBody\(response, 200, body, \{ etag, revalidate: true \}\)/.test(code));
+  // sendJson hardcodes no-store, so reaching for it here would silently drop the validator.
+  assert('the list no longer answers through the non-revalidating sender',
+    !/sendJson\(response, 200/.test(code));
+
+  assert('the validator is cleared on dispose',
+    /sessionsBody = \{ material: '', body: null \};[\s\S]{0,240}?descriptorCache\.clear\(\)/.test(server));
+}
+
+/* ---------- 5: the page has to actually use it ---------- */
+
+const clientJs = html
+  .replace(/\/\*[\s\S]*?\*\//g, '')
+  .replace(/^[ \t]*\/\/.*$/gm, '');
+
+assert('the page sends the list validator back',
+  /headers\['If-None-Match'\] = state\.sessionsEtag;/.test(clientJs));
+
+assert('the page keeps every piece of state on a 304',
+  /if \(response\.status === 304\) \{[\s\S]{0,200}?return \{ changed: false/.test(clientJs));
+
+// A 304 that still re-rendered would be correct and pointless; the point is not touching state.
+assert('a 304 does not re-render the picker',
+  /if \(response\.status === 304\) \{[\s\S]{0,300}?renderSessionSelect/.test(clientJs) === false);
+
+// One writer per field, and a validator bound to the request it was taken against. A list
+// validator carried across a different limit would ask a question about a payload it is not for.
+assert('the list validator is bound to the request key',
+  /state\.sessionsEtagFor === key/.test(clientJs) && /var key = 'limit=20';/.test(clientJs));
+
+// A refresh button that revalidated the list would be a refresh of half the page.
+assert('a manual refresh drops the list validator',
+  /if \(manual\) \{\s*state\.sessionsEtag = '';\s*state\.sessionsEtagFor = '';/.test(clientJs));
+
+assert('the refresh button is the only caller that asks for a manual list',
+  /fetchSessions\(true\)/.test(clientJs)
+  && (clientJs.match(/fetchSessions\(true\)/g) || []).length === 1);
+
+// The two validators are separate fields, not one shared pair. Sharing would let a list tag
+// satisfy a trajectory request or the other way round.
+assert('the list and trajectory validators are separate fields',
+  /state\.sessionsEtag\b/.test(clientJs) && !/state\.etag = state\.sessionsEtag/.test(clientJs));
+
+console.log('[sessions-etag] ' + pass + ' passed, ' + failures.length + ' failed');
+if (failures.length) {
+  console.log('FAILURES:\n - ' + failures.join('\n - '));
+  process.exit(1);
+}
+console.log('[sessions-etag] OK');
\ No newline at end of file

From f782c808787f7c8d3d4e742998afb4c0563a843c Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Wed, 14 Oct 2026 17:01:13 +0800
Subject: [PATCH 02/36] Make every nameable session openable, not just the 30
 in the picker
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`collectSessionEntries` did two jobs with one return value: it walked the
store, and it returned `entries.slice(0, MAX_SESSION_LIST)`. Because the
slice was the last statement, the only handle the service had on a session
directory was "one of the 30 most recently touched" — and resolving an
explicit `?session=<id>` scanned exactly those 30.

Measured against a real store: 146 candidate directories, 30 exposed, and
116 of them answering 404 to their own id. Inside the window 200/200; a
sample outside 404/24. No leakage at the boundary, which is what a single
truncation point looks like. A session the reader could name but not open is
a correctness defect, and the runtime database cannot paper over it: the six
compacted sessions on that machine have no `local_runtime_sessions` row at
all, so the `latest` branch's `relativeDir` fallback has nothing to find.

The traversal now yields two products and the two callers take different
ones. `recentEntries` is sorted and capped, and it is still the only thing
the picker is built from. `byDecodedId` is every candidate keyed by the id
decoded from its own name; the walk already stat'ed `messages.jsonl` for
each candidate, so the index costs no I/O the walk was not doing anyway.

Three things the index deliberately does not get to do on its own:

  * A decoded name is a claim. `readSessionIdentity` prefers
    `manifest.sessionId`, so an index hit still reads the identity of the one
    directory it picked and compares before serving.
  * Two directories can decode to one id. `Map.set` would keep whichever
    came last and make the answer depend on `readdir` order, so duplicates
    are kept as a list and the manifests resolve them.
  * A name that does not decode is still a real session. It gets no fast
    path; it does not become "does not exist".

`MAX_SESSION_CANDIDATES` stays a resource guard, but it stops being a
correctness boundary by saying so. When the walk stops early the route
answers `session_scan_budget_exhausted`, which is a different answer from
`session_not_found` and only one of the two is true.

The client seeds `state.sessionId` from the host id. `sessionParam()`
already preferred `hostSessionId`, so a host-pinned page rendered
「跟随最新（自动切换）」 above content pinned to a different conversation
that it would never leave. That contradiction predates this change, but the
reachability fix turns it from a visible error into a silent one.

The picker is untouched: still 30 candidates, still `?limit=20`, still a
server cap of 50. Widening it is a UI decision and is not taken here.

Guards: `verify-session-reachability.mjs` holds 31 assertions over a
synthetic 40-session store and a 405-session store that runs the walk out of
budget, and `mutate-session-reachability.py` breaks each of them in the
shipped source and requires the guard to report it by name — 15 mutations,
all caught. Suite is 65/65.
---
 .../mmc-trajectory/miniapp/client/index.html  |   8 +-
 .../mmc-trajectory/miniapp/node/server.mjs    | 159 ++++++++++--
 .../tests/mutate-list-cache-ttl.py            |   4 +-
 .../tests/mutate-session-reachability.py      | 209 ++++++++++++++++
 .../tests/verify-session-reachability.mjs     | 233 ++++++++++++++++++
 5 files changed, 585 insertions(+), 28 deletions(-)
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/mutate-session-reachability.py
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/verify-session-reachability.mjs

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
index e85aa58..2846831 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
+++ b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
@@ -3684,7 +3684,13 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         sessionsLoaded: false,
         sessionsError: false,
         followLatest: true,
-        sessionId: null,
+        // Seeded from the host id so the picker and the content agree. `sessionParam()` already
+        // prefers `hostSessionId`, so a host-pinned page used to render 「跟随最新（自动切换）」
+        // above content pinned to a different conversation that it would never switch away from.
+        // That contradiction predates the server-side reachability fix, but the fix turns it from
+        // a visible error into a silent lie, so the seed belongs with it. `renderSessionSelect`
+        // already inserts 「当前会话（不在最近列表）」 for a pinned id the recent list omits.
+        sessionId: detectHostSessionId(),
         payload: null,
         signature: '',
         loading: true,
diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
index 3f3d098..e84c514 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
@@ -583,15 +583,50 @@ export async function readSessionIdentity(dir) {
 }
 
 /**
- * Depth-capped walk that only descends into dated folders and never into a session folder twice.
+ * The whole candidate set from one walk, as two products of the same traversal.
+ *
+ * These used to be one thing, and that is the defect. `slice(0, MAX_SESSION_LIST)` ran last,
+ * so the only handle the service had on a session directory was "one of the 30 most recently
+ * touched" — and `resolveTrajectoryRequest` resolved an explicit id by scanning exactly those
+ * 30. Measured on this machine: 146 candidate directories, 30 exposed, 116 of them
+ * unreachable by id (window inside 200/200, a sample outside 404/404). A session the user
+ * could name but not open is a correctness bug, not a small one.
+ *
+ * So the traversal now yields two things:
+ *
+ *  - `recentEntries` — sorted by mtime, capped at `MAX_SESSION_LIST`. This is what the picker
+ *    shows, and it stays exactly as small as it was.
+ *  - `byDecodedId` — every candidate directory, keyed by the id decoded from its own name.
+ *    Decoding reads no file: the walk already stat'ed `messages.jsonl` for every candidate, so
+ *    the index costs no I/O the walk was not doing anyway.
+ *
+ * Two properties this must not lose:
+ *
+ *  - A decoded name is a *claim*, not a fact. `readSessionIdentity` prefers `manifest.sessionId`
+ *    over the directory name, so every caller of this index still reads the identity of the one
+ *    directory it picked and checks the id before serving it.
+ *  - Two directories can decode to the same id. `Map.set` would silently keep whichever came
+ *    last, which makes the answer depend on `readdir` order. Duplicates are therefore kept as a
+ *    list and resolved against the manifests, not discarded and not guessed.
+ *
+ * `truncated` says the walk hit `MAX_SESSION_CANDIDATES` and stopped early. That budget is a
+ * resource guard, and it must not be allowed to masquerade as "this session does not exist" —
+ * callers use it to say the scan budget was exhausted, which is a different answer and a
+ * truthful one.
+ *
  * @param {string} sessionsRoot
+ * @returns {Promise<{ recentEntries: Array<{ dir: string, sizeBytes: number, lastActiveAt: number }>,
+ *   byDecodedId: Map<string, Array<{ dir: string, sizeBytes: number, lastActiveAt: number }>>,
+ *   truncated: boolean }>}
  */
-export async function collectSessionEntries(sessionsRoot) {
+export async function collectSessionCandidates(sessionsRoot) {
   /** @type {Array<{ dir: string, sizeBytes: number, lastActiveAt: number }>} */
   const entries = [];
+  let truncated = false;
   /** @param {string} dir @param {number} depth */
   const walk = async (dir, depth) => {
-    if (depth > MAX_WALK_DEPTH || entries.length >= MAX_SESSION_CANDIDATES) return;
+    if (depth > MAX_WALK_DEPTH) return;
+    if (entries.length >= MAX_SESSION_CANDIDATES) { truncated = true; return; }
     let names;
     try {
       names = await readdir(dir);
@@ -599,7 +634,7 @@ export async function collectSessionEntries(sessionsRoot) {
       return;
     }
     for (const name of names) {
-      if (entries.length >= MAX_SESSION_CANDIDATES) return;
+      if (entries.length >= MAX_SESSION_CANDIDATES) { truncated = true; return; }
       const child = join(dir, name);
       if (isSessionDirName(name)) {
         try {
@@ -616,7 +651,34 @@ export async function collectSessionEntries(sessionsRoot) {
   };
   await walk(sessionsRoot, 0);
   entries.sort((a, b) => b.lastActiveAt - a.lastActiveAt);
-  return entries.slice(0, MAX_SESSION_LIST);
+
+  /** @type {Map<string, Array<{ dir: string, sizeBytes: number, lastActiveAt: number }>>} */
+  const byDecodedId = new Map();
+  for (const entry of entries) {
+    const id = decodeSessionIdFromDirName(basename(entry.dir));
+    // A name that does not decode is still a real session; it just has no fast path and is
+    // found the slow way. Dropping it here would turn "no fast path" into "does not exist".
+    if (!id) continue;
+    const bucket = byDecodedId.get(id);
+    if (bucket) bucket.push(entry);
+    else byDecodedId.set(id, [entry]);
+  }
+
+  return { recentEntries: entries.slice(0, MAX_SESSION_LIST), byDecodedId, truncated };
+}
+
+/**
+ * Depth-capped walk that only descends into dated folders and never into a session folder twice.
+ *
+ * Kept as its own export with its old shape and its old meaning — "the most recent sessions" —
+ * because the fixture builders and several guards consume exactly that. The id index lives in
+ * `collectSessionCandidates` and is deliberately not exposed through this one.
+ *
+ * @param {string} sessionsRoot
+ * @returns {Promise<Array<{ dir: string, sizeBytes: number, lastActiveAt: number }>>}
+ */
+export async function collectSessionEntries(sessionsRoot) {
+  return (await collectSessionCandidates(sessionsRoot)).recentEntries;
 }
 
 /**
@@ -1944,7 +2006,8 @@ export async function start(context) {
   const redact = createRedactor(secrets);
   /** @type {Buffer | null} */
   let clientEntry = null;
-  let listCache = { at: 0, entries: null };
+  /** @type {{ at: number, candidates: Awaited<ReturnType<typeof collectSessionCandidates>> | null }} */
+  let listCache = { at: 0, candidates: null };
   /** @type {Map<string, { at: number, value: any }>} */
   const descriptorCache = new Map();
   /**
@@ -1974,10 +2037,10 @@ export async function start(context) {
 
   const listEntries = async () => {
     const now = Date.now();
-    if (listCache.entries && now - listCache.at < LIST_CACHE_TTL_MS) return listCache.entries;
-    const entries = await collectSessionEntries(location.sessionsRoot);
-    listCache = { at: now, entries };
-    return entries;
+    if (listCache.candidates && now - listCache.at < LIST_CACHE_TTL_MS) return listCache.candidates;
+    const candidates = await collectSessionCandidates(location.sessionsRoot);
+    listCache = { at: now, candidates };
+    return candidates;
   };
 
   /**
@@ -2112,10 +2175,14 @@ export async function start(context) {
    }
   };
 
-  const handleSessions = async (response, url) => {    const limit = normalizeLimit(url.searchParams.get('limit'), 20, 1, 50);
+  const handleSessions = async (response, url) => {
+    const limit = normalizeLimit(url.searchParams.get('limit'), 20, 1, 50);
     let entries;
     try {
-      entries = await listEntries();
+      // The picker still sees only the most recent sessions. The id index beside it is what
+      // `handleTrajectory` resolves explicit ids against, and it is deliberately not what the
+      // picker is built from — widening the list is a separate decision about the UI.
+      entries = (await listEntries()).recentEntries;
     } catch (error) {
       context.logger.error('miniapp.trajectory.read_error', { reason: 'root_unreadable', code: errorCode(error) });
       sendError(response, 503, 'trajectory_unavailable', '未找到本地会话数据目录');
@@ -2174,14 +2241,15 @@ export async function start(context) {
    * @param {URL} url
    */
   const resolveTrajectoryRequest = async (url) => {
-    let entries;
+    let candidates;
     try {
-      entries = await listEntries();
+      candidates = await listEntries();
     } catch (error) {
       context.logger.error('miniapp.trajectory.read_error', { reason: 'root_unreadable', code: errorCode(error) });
       return { ok: false, status: 503, code: 'trajectory_unavailable', message: '未找到本地会话数据目录' };
     }
-    if (entries.length === 0) {
+    const entries = candidates.recentEntries;
+    if (entries.length === 0 && candidates.byDecodedId.size === 0) {
       return { ok: false, status: 503, code: 'trajectory_unavailable', message: '未找到本地会话数据目录' };
     }
     const requested = url.searchParams.get('session');
@@ -2216,18 +2284,59 @@ export async function start(context) {
       }
       if (!entry) entry = entries[0];
     } else {
-      const matched = [];
-      for (const candidate of entries) {
-        const identity = await readSessionIdentity(candidate.dir);
-        if (identity.id === requested || basename(candidate.dir) === requested) {
-          matched.push({ entry: candidate, identity });
-          break;
+      // Two ways in, and the order matters.
+      //
+      // Fast path: the id was decoded from a directory name during the walk, so the directory is
+      // already known and no scanning is needed. This is what makes a session outside the recent
+      // 30 reachable at all — before this, the only directories this branch could see were the 30
+      // the picker shows, so 116 of 146 sessions on this machine answered 404 to their own id.
+      //
+      // The decoded name is still only a claim. `readSessionIdentity` prefers `manifest.sessionId`,
+      // so a directory whose name disagrees with its manifest must not be served under the
+      // requested id; it falls through to the slow path instead, which re-checks every candidate.
+      const fastPath = candidates.byDecodedId.get(requested);
+      let picked = null;
+      if (fastPath) {
+        // Duplicates are kept as a list rather than collapsed, because collapsing them with
+        // `Map.set` would make the answer depend on `readdir` order. Here the manifests decide.
+        const verified = [];
+        for (const candidate of fastPath) {
+          const candidateIdentity = await readSessionIdentity(candidate.dir);
+          if (candidateIdentity.id === requested) verified.push({ entry: candidate, identity: candidateIdentity });
+        }
+        if (verified.length === 1) picked = verified[0];
+        else if (verified.length > 1) {
+          // Two directories both claim this id. Rather than pick one by directory order, fall
+          // through to the slow path, which keeps the original scan-and-compare behaviour.
+          context.logger.warn('miniapp.trajectory.read_error', { reason: 'ambiguous_session_id', code: requested });
         }
       }
-      if (matched.length === 0) {
-        return { ok: false, status: 404, code: 'session_not_found', message: '找不到该会话' };
+
+      if (!picked) {
+        const matched = [];
+        for (const candidate of entries) {
+          const candidateIdentity = await readSessionIdentity(candidate.dir);
+          if (candidateIdentity.id === requested || basename(candidate.dir) === requested) {
+            matched.push({ entry: candidate, identity: candidateIdentity });
+            break;
+          }
+        }
+        if (matched.length === 0) {
+          // The scan budget stopped the walk before this id could be seen. That is not the same
+          // answer as "no such session", and reporting it as one is how 400 became a correctness
+          // boundary instead of a resource guard.
+          if (candidates.truncated) {
+            return {
+              ok: false, status: 404, code: 'session_scan_budget_exhausted',
+              message: '会话数量超出本次扫描预算，请重试或缩小会话目录范围',
+            };
+          }
+          return { ok: false, status: 404, code: 'session_not_found', message: '找不到该会话' };
+        }
+        entry = matched[0].entry;
+      } else {
+        entry = picked.entry;
       }
-      entry = matched[0].entry;
     }
 
     const identity = await readSessionIdentity(entry.dir);
@@ -2573,7 +2682,7 @@ export async function start(context) {
   const dispose = () => {
     if (disposal) return disposal;
     context.signal.removeEventListener('abort', onAbort);
-    listCache = { at: 0, entries: null };
+    listCache = { at: 0, candidates: null };
     titleCache = { at: 0, key: '', map: new Map() };
     sessionsBody = { material: '', body: null };
     descriptorCache.clear();
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-list-cache-ttl.py b/plugins/avatasia/mmc-trajectory/tests/mutate-list-cache-ttl.py
index fa7814f..030a72d 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-list-cache-ttl.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-list-cache-ttl.py
@@ -81,9 +81,9 @@
     # The parsed-row cache leaked here once — a disposed runtime held ~43 MB for a 39 MB session —
     # and the line that fixed it is in server.mjs precisely so the next cache cannot repeat it.
     ("dispose stops releasing the title cache",
-     [("    listCache = { at: 0, entries: null };\n"
+     [("    listCache = { at: 0, candidates: null };\n"
        "    titleCache = { at: 0, key: '', map: new Map() };\n",
-       "    listCache = { at: 0, entries: null };\n")],
+       "    listCache = { at: 0, candidates: null };\n")],
      "dispose releases the title cache"),
 
     # ---- D45: a prefix count is not a count. ----
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-session-reachability.py b/plugins/avatasia/mmc-trajectory/tests/mutate-session-reachability.py
new file mode 100644
index 0000000..8837ae6
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-session-reachability.py
@@ -0,0 +1,209 @@
+"""Make a nameable session unopenable again, in the shipped source, and require
+verify-session-reachability.mjs to report each way back by name.
+
+The defect was never "the list is too short". It was that one truncated array was both the
+picker's data and the service's only handle on a session directory, so `?session=<id>` could
+only ever resolve the 30 the picker already shows. Measured on a real store: 146 candidates,
+30 exposed, 116 answering 404 to their own id — 200/200 inside the window, 404/24 outside it.
+
+Every mutation here is the same mistake wearing a different hat: collapsing the two products
+back into one, trusting a decoded name as if it were an identity, or letting a resource budget
+answer a question it has no standing to answer.
+
+The two that look like harmless simplifications are the dangerous ones. Dropping the manifest
+re-check on the index hit is faster and passes every existing guard, because nothing else in
+the suite has a directory whose name disagrees with its manifest — it just serves the wrong
+conversation under an id the reader typed. And replacing the `session_scan_budget_exhausted`
+branch with a plain 404 is a one-line change that turns "we stopped looking" back into "it does
+not exist", which is the same lie the original slice told, just further from its cause.
+
+Anchors are multi-line and the tree is LF, so they carry bare \\n and the files are read and
+written with newline=''. No anchor may contain a line ending of its own.
+"""
+import io
+import os
+import subprocess
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+PLUGIN = os.path.dirname(HERE)
+SERVER = os.path.join(PLUGIN, "miniapp", "node", "server.mjs")
+CLIENT = os.path.join(PLUGIN, "miniapp", "client", "index.html")
+PROBE = os.path.join(HERE, "verify-session-reachability.mjs")
+
+MUTATIONS = [
+    # ---- the two products collapse back into one ----
+    #
+    # The original shape. Everything else in the suite still passes: the list is unchanged, the
+    # trajectory route still finds every session in the window, and no assertion anywhere else
+    # had a session outside it.
+    ("the walk returns one truncated list again",
+     [("  return { recentEntries: entries.slice(0, MAX_SESSION_LIST), byDecodedId, truncated };",
+       "  return { recentEntries: entries.slice(0, MAX_SESSION_LIST), byDecodedId: new Map(), truncated };")],
+     "the id index is not the recent list", SERVER),
+
+    ("the recent list is no longer capped",
+     [("  return { recentEntries: entries.slice(0, MAX_SESSION_LIST), byDecodedId, truncated };",
+       "  return { recentEntries: entries, byDecodedId, truncated };")],
+     "the recent list is still capped at MAX_SESSION_LIST", SERVER),
+
+    # ---- the index stops being built from the walk ----
+    #
+    # Correct-looking, and now the picker pays for the reachability fix: the index is derived
+    # from the slice, so a session outside the window has no fast path again.
+    ("the index is derived from the recent list instead of the walk",
+     [("  for (const entry of entries) {\n    const id = decodeSessionIdFromDirName(basename(entry.dir));",
+       "  for (const entry of entries.slice(0, MAX_SESSION_LIST)) {\n    const id = decodeSessionIdFromDirName(basename(entry.dir));")],
+     "the id index is not the recent list", SERVER),
+
+    ("the index is no longer built at all",
+     [("    const id = decodeSessionIdFromDirName(basename(entry.dir));",
+       "    const id = null;")],
+     "the index is built from the decoded directory name", SERVER),
+
+    # ---- duplicates silently resolved by directory order ----
+    #
+    # `Map.set` keeps the last writer. `readdir` order is not sorted and is not stable across
+    # platforms, so this is a Map that answers differently on two machines with the same store.
+    ("duplicate ids are collapsed by directory order",
+     [("    const bucket = byDecodedId.get(id);\n    if (bucket) bucket.push(entry);\n    else byDecodedId.set(id, [entry]);",
+       "    byDecodedId.set(id, [entry]);")],
+     "duplicate ids are kept as a list rather than collapsed", SERVER),
+
+    # ---- a decoded name promoted to an identity ----
+    #
+    # The fast path now serves whatever the directory is called, without asking the manifest.
+    # Every other guard stays green: there is no fixture in this suite whose name and manifest
+    # disagree, so the only way to see this is to ask for a session by an id that belongs to one
+    # directory and be handed another.
+    ("an index hit is served without checking the manifest",
+     [("          if (candidateIdentity.id === requested) verified.push({ entry: candidate, identity: candidateIdentity });",
+       "          verified.push({ entry: candidate, identity: candidateIdentity });")],
+     "a directory whose manifest disagrees is not served under the requested id", SERVER),
+
+    ("an index hit never reads the identity at all",
+     [("          const candidateIdentity = await readSessionIdentity(candidate.dir);\n"
+       "          if (candidateIdentity.id === requested) verified.push({ entry: candidate, identity: candidateIdentity });",
+       "          const candidateIdentity = { id: requested, generations: [] };\n"
+       "          verified.push({ entry: candidate, identity: candidateIdentity });")],
+     "an index hit still reads the directory identity", SERVER),
+
+    # ---- ambiguity resolved by taking the first ----
+    #
+    # Two directories claiming one id, and the service quietly picks one. The reader is told
+    # they are looking at a conversation that is half of somebody else's.
+    ("an ambiguous id is resolved by taking whichever came first",
+     [("        if (verified.length === 1) picked = verified[0];",
+       "        if (verified.length >= 1) picked = verified[0];")],
+     "an ambiguous id is not resolved by directory order", SERVER),
+
+    # ---- the budget answers a question it has no standing to answer ----
+    #
+    # Back to one answer for two different situations. "We stopped looking at 400" is not
+    # "there is no such session", and only one of the two is true.
+    ("an exhausted scan budget is reported as a missing session",
+     [("          if (candidates.truncated) {\n"
+       "            return {\n"
+       "              ok: false, status: 404, code: 'session_scan_budget_exhausted',\n"
+       "              message: '会话数量超出本次扫描预算，请重试或缩小会话目录范围',\n"
+       "            };\n"
+       "          }\n", "")],
+     "the two answers are reachable from different conditions", SERVER),
+
+    ("the two failures report the same code",
+     [("ok: false, status: 404, code: 'session_scan_budget_exhausted',",
+       "ok: false, status: 404, code: 'session_not_found',")],
+     "the exhaustion path is a distinct answer from \"no such session\"", SERVER),
+
+    ("the walk no longer records that it stopped early",
+     [("    for (const name of names) {\n      if (entries.length >= MAX_SESSION_CANDIDATES) { truncated = true; return; }",
+       "    for (const name of names) {\n      if (entries.length >= MAX_SESSION_CANDIDATES) return;")],
+     "a walk that runs out of candidate budget reports itself as truncated", SERVER),
+
+    # ---- the basename entry point ----
+    #
+    # A second way to name a session, and the only one that covers a directory whose name does
+    # not decode at all.
+    ("a full directory basename can no longer name a session",
+     [("          if (candidateIdentity.id === requested || basename(candidate.dir) === requested) {",
+       "          if (candidateIdentity.id === requested) {")],
+     "a full directory basename can still name a session", SERVER),
+
+    # ---- the picker starts paying for the fix ----
+    #
+    # Widening the picker is a UI decision that was explicitly not taken here. Taking it by
+    # accident, inside a reachability fix, is how a 9x descriptor cost arrives unannounced.
+    ("the list route starts building from the id index",
+     [("      entries = (await listEntries()).recentEntries;",
+       "      entries = [...(await listEntries()).byDecodedId.values()].flat();")],
+     "the list route builds from recentEntries", SERVER),
+
+    # ---- the page names a session it is not showing ----
+    #
+    # `sessionParam()` prefers `hostSessionId`, so this restores a page that renders
+    # 「跟随最新（自动切换）」 above a conversation it is pinned to and will never leave.
+    ("the page stops naming the session the host pinned it to",
+     [("        sessionId: detectHostSessionId(),", "        sessionId: null,")],
+     "the page seeds the pinned session from the host id", CLIENT),
+
+    ("a pinned session outside the recent list renders as a blank select",
+     [("        if (previous && previous !== 'latest') {\n          select.value = previous;\n"
+       "          if (select.selectedIndex < 0) {",
+       "        if (previous && previous !== 'latest') {\n          select.value = previous;\n          if (false) {")],
+     "a pinned id missing from the options gets one inserted, not a blank select", CLIENT),
+]
+
+ORIGINALS = {p: io.open(p, encoding="utf-8", newline="").read() for p in (SERVER, CLIENT)}
+
+
+def run():
+    proc = subprocess.run(["node", PROBE], cwd=HERE,
+                          capture_output=True, text=True, encoding="utf-8", errors="replace")
+    return proc.returncode, proc.stdout + proc.stderr
+
+
+ok = True
+code, baseline = run()
+base_ok = code == 0 and "0 failed" in baseline
+print(("ok   " if base_ok else "FAIL ") + "baseline green")
+ok = ok and base_ok
+
+caught = []
+for title, edits, expect, target in MUTATIONS:
+    paths = sorted({t for _, _, _, t in [(e[0], e[1], expect, target) for e in edits]})
+    try:
+        for old, new in edits:
+            hits = ORIGINALS[target].count(old)
+            if hits != 1:
+                raise SystemExit("FAIL  anchor for %r matched %d times in %s" % (title, hits, target))
+            if old == new:
+                raise SystemExit("FAIL  empty mutation for %r: the anchor equals its replacement" % title)
+        mutated = {p: ORIGINALS[p] for p in ORIGINALS}
+        for old, new in edits:
+            mutated[target] = mutated[target].replace(old, new, 1)
+        if mutated[target] == ORIGINALS[target]:
+            raise SystemExit("FAIL  mutation for %r changed nothing" % title)
+        for p, text in mutated.items():
+            io.open(p, "w", encoding="utf-8", newline="").write(text)
+        during_code, during = run()
+        named = expect in during
+        red = during_code != 0
+        print(("ok   " if (named and red) else "FAIL ") + "guard catches: " + title)
+        if not named:
+            print("       no assertion reported %r" % expect)
+            for line in during.splitlines()[-4:]:
+                print("       " + line.strip())
+        elif not red:
+            print("       the rule was reported but the guard still exited 0")
+        caught.append(named and red)
+    finally:
+        for p, text in ORIGINALS.items():
+            io.open(p, "w", encoding="utf-8", newline="").write(text)
+
+restored = all(io.open(p, encoding="utf-8", newline="").read() == ORIGINALS[p] for p in ORIGINALS)
+after_code, after = run()
+after_ok = after_code == 0 and "0 failed" in after
+print(("ok   " if restored else "FAIL ") + "shipped files restored byte for byte")
+print(("ok   " if after_ok else "FAIL ") + "green again after restore")
+
+sys.exit(0 if (ok and all(caught) and restored and after_ok) else 1)
\ No newline at end of file
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-session-reachability.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-session-reachability.mjs
new file mode 100644
index 0000000..ff0b0c0
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-session-reachability.mjs
@@ -0,0 +1,233 @@
+/**
+ * A session the user could name but not open.
+ *
+ * `collectSessionEntries` used to do two jobs with one return value: it walked the store, and it
+ * returned `entries.slice(0, MAX_SESSION_LIST)`. Because the slice was the last statement, the
+ * only handle the service had on a session directory was "one of the 30 most recently touched" —
+ * and `resolveTrajectoryRequest` resolved an explicit `?session=<id>` by scanning exactly those
+ * 30. Measured on a real store: 146 candidate directories, 30 exposed, and 116 of them answering
+ * 404 to their own id. Inside the window 200/200; a sample outside 404/24. No leakage at the
+ * boundary, which is what a single truncation point looks like.
+ *
+ * The invariant here is not "the list is longer". It is that **the traversal yields two products
+ * and the two callers take different ones**: the picker keeps its 30, and id resolution is not
+ * bounded by them.
+ *
+ * What each assertion is holding up:
+ *
+ *   1. Two products from one walk. A single truncated array cannot serve both callers, whichever
+ *      way the slice is moved — that is the whole defect.
+ *   2. The index is not the list. `recentEntries` stays at `MAX_SESSION_LIST`, so widening id
+ *      resolution costs the picker nothing.
+ *   3. The index is complete relative to the walk. A directory outside the recent 30 is still in
+ *      `byDecodedId`, which is the 116-session case measured above.
+ *   4. Building the index costs no I/O. The walk already stat'ed `messages.jsonl` for every
+ *      candidate, so the id comes from the name — this asserts no new file read was introduced.
+ *   5. A decoded name is a claim, not a fact. `readSessionIdentity` prefers `manifest.sessionId`,
+ *      so the route re-reads the identity of the directory it picked and compares before serving.
+ *      Without this, a directory renamed on disk would be served under the wrong id.
+ *   6. Duplicate ids are not collapsed. `Map.set` would keep whichever came last and make the
+ *      answer depend on `readdir` order; the index keeps a list so the manifests can decide.
+ *   7. A name that does not decode is still a real session. Dropping it from the index would turn
+ *      "no fast path" into "does not exist".
+ *   8. The scan budget is a resource guard, not a correctness boundary. When the walk stops early
+ *      the route must say so, because "the budget ran out" and "no such session" are different
+ *      answers and only one of them is true.
+ *   9. The basename entry point still works — it is a second way to name a session and it is not
+ *      covered by the index.
+ *  10. The picker is untouched: the list route still builds from `recentEntries`.
+ *  11. The client names the session it is actually showing. `sessionParam()` prefers
+ *      `hostSessionId`, so a host-pinned page that leaves `sessionId` null renders
+ *      「跟随最新（自动切换）」 above content pinned to a different conversation.
+ *
+ * `tests/mutate-session-reachability.py` breaks each of these in the shipped source and requires
+ * this guard to report it by name.
+ */
+import { readFileSync, mkdtempSync } from 'node:fs';
+import { mkdir, writeFile, rm, utimes } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { collectSessionCandidates, decodeSessionIdFromDirName } from '../miniapp/node/server.mjs';
+
+const HERE = fileURLToPath(new URL('.', import.meta.url));
+const SERVER = readFileSync(fileURLToPath(new URL('../miniapp/node/server.mjs', import.meta.url)), 'utf8');
+const CLIENT = readFileSync(fileURLToPath(new URL('../miniapp/client/index.html', import.meta.url)), 'utf8');
+
+let pass = 0;
+const failures = [];
+function assert(label, condition) {
+  if (condition) { pass += 1; return; }
+  failures.push(label);
+}
+
+/* =====================================================================
+ * 1 — the walk is real: 40 sessions with controlled mtimes
+ * ===================================================================== */
+
+const root = mkdtempSync(join(tmpdir(), 'reachability-'));
+const NAME_COUNT = 40;
+/** mtime descending: index 0 is the most recent, so index >= 30 is outside the picker window. */
+async function makeSession(index) {
+  const id = `sess${String(index).padStart(4, '0')}${'x'.repeat(4)}`;
+  const encoded = Buffer.from(id, 'utf8').toString('base64url');
+  const dir = join(root, '2026', '01', '01', `00-00-${String(index).padStart(2, '0')}-000-session_${encoded}`);
+  await mkdir(dir, { recursive: true });
+  await writeFile(join(dir, 'messages.jsonl'),
+    JSON.stringify({ role: 'user', content: `session ${index}` }) + '\n', 'utf8');
+  // Strictly decreasing mtime so the recency order is the creation order.
+  const stamp = new Date(Date.UTC(2026, 0, 1, 0, 0, 0) - index * 60_000);
+  await utimes(join(dir, 'messages.jsonl'), stamp, stamp);
+  return { id, dir };
+}
+
+const made = [];
+for (let i = 0; i < NAME_COUNT; i += 1) made.push(await makeSession(i));
+
+const candidates = await collectSessionCandidates(root);
+
+/* =====================================================================
+ * 2 — the picker keeps its 30, and only its 30
+ * ===================================================================== */
+
+assert('the recent list is still capped at MAX_SESSION_LIST',
+  candidates.recentEntries.length === 30);
+assert('the recent list is in recency order',
+  candidates.recentEntries[0].dir === made[0].dir
+  && candidates.recentEntries[29].dir === made[29].dir);
+assert('the recent list does not reach the 31st session',
+  !candidates.recentEntries.some((e) => e.dir === made[30].dir));
+
+/* =====================================================================
+ * 3 — the index covers what the list cut: the measured 116/146 case
+ * ===================================================================== */
+
+assert('the id index is not the recent list',
+  candidates.byDecodedId instanceof Map && candidates.byDecodedId.size === NAME_COUNT);
+assert('a session outside the recent list is still resolvable by id',
+  candidates.byDecodedId.has(made[35].id));
+assert('the newest session is resolvable by id too',
+  candidates.byDecodedId.has(made[0].id));
+assert('the index maps an id to a directory that exists on disk',
+  (candidates.byDecodedId.get(made[35].id) || [])[0]?.dir === made[35].dir);
+
+/* =====================================================================
+ * 4 — the index is built from names, not from new reads
+ * ===================================================================== */
+
+const walkBody = /export async function collectSessionCandidates\([\s\S]*?\n\}/.exec(SERVER);
+assert('collectSessionCandidates is the exported traversal', walkBody !== null);
+if (walkBody) {
+  assert('the index is built from the decoded directory name',
+    walkBody[0].includes('decodeSessionIdFromDirName(basename(entry.dir))'));
+  assert('building the index opens no file of its own',
+    !/byDecodedId[\s\S]{0,400}?\b(readFile|readJsonIfPresent|stat)\s*\(/.test(walkBody[0]));
+  assert('the walk stats messages.jsonl exactly once per candidate',
+    (walkBody[0].match(/stat\(join\(child, 'messages\.jsonl'\)\)/g) || []).length === 1);
+}
+
+/* =====================================================================
+ * 5 — a decoded name is a claim; the manifest gets the last word
+ * ===================================================================== */
+
+assert('the explicit-id branch consults the decoded-id index',
+  /const fastPath = candidates\.byDecodedId\.get\(requested\);/.test(SERVER));
+assert('an index hit still reads the directory identity',
+  /for \(const candidate of fastPath\) \{\s*\n\s*const candidateIdentity = await readSessionIdentity\(candidate\.dir\);/.test(SERVER));
+assert('a directory whose manifest disagrees is not served under the requested id',
+  /if \(candidateIdentity\.id === requested\) verified\.push\(\{ entry: candidate, identity: candidateIdentity \}\);/.test(SERVER));
+assert('an ambiguous id is not resolved by directory order',
+  /if \(verified\.length === 1\) picked = verified\[0\];\s*\n\s*else if \(verified\.length > 1\)/.test(SERVER)
+  && /reason: 'ambiguous_session_id'/.test(SERVER));
+assert('duplicate ids are kept as a list rather than collapsed',
+  /const bucket = byDecodedId\.get\(id\);\s*\n\s*if \(bucket\) bucket\.push\(entry\);\s*\n\s*else byDecodedId\.set\(id, \[entry\]\);/.test(SERVER));
+
+/* =====================================================================
+ * 6 — a name that does not decode is still a session
+ * ===================================================================== */
+
+const odd = join(root, '2026', '01', '02', '00-00-99-000-session_!!!not-base64!!!');
+await mkdir(odd, { recursive: true });
+await writeFile(join(odd, 'messages.jsonl'), JSON.stringify({ role: 'user', content: 'odd' }) + '\n', 'utf8');
+// Newest on purpose, so membership is decided by "did the walk take it as a candidate" rather
+// than by where it happens to fall in the recency slice.
+const oddStamp = new Date(Date.UTC(2026, 0, 2));
+await utimes(join(odd, 'messages.jsonl'), oddStamp, oddStamp);
+const withOdd = await collectSessionCandidates(root);
+assert('a session whose name does not decode is still a candidate',
+  withOdd.recentEntries.some((e) => e.dir === odd));
+assert('a non-decoding name simply gets no fast path, and is not treated as absent',
+  decodeSessionIdFromDirName('00-00-99-000-session_!!!not-base64!!!') === null
+  && withOdd.byDecodedId.size === NAME_COUNT);
+
+/* =====================================================================
+ * 7 — the scan budget is a guard, and it says so
+ * ===================================================================== */
+
+assert('a walk inside the budget reports that it was not truncated', candidates.truncated === false);
+assert('the exhaustion path is a distinct answer from "no such session"',
+  SERVER.includes("code: 'session_scan_budget_exhausted'")
+  && SERVER.includes("code: 'session_not_found'"));
+assert('the two answers are reachable from different conditions',
+  /if \(candidates\.truncated\) \{[\s\S]{0,400}session_scan_budget_exhausted[\s\S]{0,400}?\n\s*\}\s*\n\s*return \{ ok: false, status: 404, code: 'session_not_found'/.test(SERVER));
+assert('the candidate budget still exists as a resource guard',
+  /const MAX_SESSION_CANDIDATES = (\d+);/.test(SERVER));
+
+// Exercised, not asserted as a string: a walk that runs out of budget has to *say* it, because
+// "we stopped looking" and "there is no such session" are different answers and only one is true.
+// The source check above cannot tell a `truncated` flag that is always false from one that is
+// wired to the budget it claims to report.
+const budgetRoot = mkdtempSync(join(tmpdir(), 'reachability-budget-'));
+const budget = Number(/const MAX_SESSION_CANDIDATES = (\d+);/.exec(SERVER)[1]);
+for (let i = 0; i < budget + 5; i += 1) {
+  // No prefix before the encoded id: a stray leading character would decode to a stray leading
+  // byte, fail the id charset check, and make every directory silently decode to nothing.
+  const dir = join(budgetRoot, '2026', '01', '01', `01-00-${String(i).padStart(3, '0')}-000-session_`
+    + Buffer.from(`over${String(i).padStart(4, '0')}zz`, 'utf8').toString('base64url'));
+  await mkdir(dir, { recursive: true });
+  await writeFile(join(dir, 'messages.jsonl'), JSON.stringify({ role: 'user', content: 'x' }) + '\n', 'utf8');
+}
+const exhausted = await collectSessionCandidates(budgetRoot);
+assert('a walk that runs out of candidate budget reports itself as truncated',
+  exhausted.truncated === true);
+assert('the budget still bounds the recent list',
+  exhausted.recentEntries.length === 30 && exhausted.recentEntries.length <= budget);
+assert('an over-budget store indexes no more than the budget allows',
+  exhausted.byDecodedId.size <= budget && exhausted.byDecodedId.size > 0);
+await rm(budgetRoot, { recursive: true, force: true });
+
+/* =====================================================================
+ * 8 — the basename entry point survives
+ * ===================================================================== */
+
+assert('a full directory basename can still name a session',
+  /basename\(candidate\.dir\) === requested/.test(SERVER));
+
+/* =====================================================================
+ * 9 — the picker route reads the recent list, not the index
+ * ===================================================================== */
+
+assert('the list route builds from recentEntries',
+  /\(await listEntries\(\)\)\.recentEntries/.test(SERVER));
+assert('the trajectory route keeps the recent list for the latest branch',
+  /const entries = candidates\.recentEntries;/.test(SERVER));
+
+/* =====================================================================
+ * 10 — the page names the session it is showing
+ * ===================================================================== */
+
+assert('the page seeds the pinned session from the host id',
+  /sessionId: detectHostSessionId\(\),/.test(CLIENT));
+assert('the picker can label a pinned session that the recent list omits',
+  /当前会话（不在最近列表）/.test(CLIENT));
+assert('a pinned id missing from the options gets one inserted, not a blank select',
+  /if \(select\.selectedIndex < 0\) \{[\s\S]{0,400}?select\.insertBefore\(pinned/.test(CLIENT));
+
+await rm(root, { recursive: true, force: true });
+
+console.log('[session-reachability] ' + pass + ' passed, ' + failures.length + ' failed');
+if (failures.length) {
+  console.log('FAILURES:\n - ' + failures.join('\n - '));
+  process.exit(1);
+}
+console.log('[session-reachability] OK');
\ No newline at end of file

From 4b7aa3ab2a8f37e7fecf88ab116073c1dea220d9 Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Wed, 14 Oct 2026 19:43:07 +0800
Subject: [PATCH 03/36] Stop one growing session from pinning four copies of
 its own payload

trajectoryCacheKey carries the active file's size and mtime, so a session that is still
being written to mints a new key every time it grows. Every miss then stores another
complete body -- ?since= included, because the cache entry and /raw both need the whole
thing -- and the eviction was a plain FIFO over keys. Four versions of the SAME
(session, slice) therefore sat there at once, three of them unreachable: /raw resolves
the current key, and the page's next poll produces a newer one.

Measured on a 9.1 MB session polled every 8s: four bodies, 49.6 MB, after four polls. On
this machine's 68 MB body that is three dead copies.

An entry now carries the family it answers for -- the session directory plus the requested
slice -- and storing a new one drops its predecessor. Everything that decides whether the
answer went stale stays in the key; everything that decides what the answer IS stays in the
family. trajectoryCacheFamily is exported and used by both the key and the cache, so the two
copies of that expression cannot drift.

Different ?generation= slices stay separate families and keep their own entries, still
bounded by the same limit. Reading still refreshes recency.

verify-trajectory-cache.mjs: 30 assertions, including that the key still carries size and
lineage -- a stale entry must never become servable just because the family matched.
mutate-trajectory-cache.py: 10 mutations, each breaking a different part of the mechanism,
because a bug collapsing two of them would still be caught by the wrong assertion.

Two anchors had to move, and the mutations stayed: the raw-lazy set call grew its family
argument, and createTrajectoryCache now has a clear() of its own, which made the parsed-row
cache's clear() anchor ambiguous. That harness reports an ambiguous anchor as unresolved
rather than guessing, so the anchor grew the bytes that make it specific.

Suite 67/67.
---
 .../mmc-trajectory/miniapp/node/server.mjs    |  97 +++++++++-
 .../mmc-trajectory/tests/mutate-raw-lazy.py   |   4 +-
 .../mmc-trajectory/tests/mutate-review16.py   |   7 +-
 .../tests/mutate-trajectory-cache.py          | 176 ++++++++++++++++++
 .../mmc-trajectory/tests/verify-raw-lazy.mjs  |   7 +-
 .../tests/verify-trajectory-cache.mjs         | 170 +++++++++++++++++
 6 files changed, 445 insertions(+), 16 deletions(-)
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-cache.py
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/verify-trajectory-cache.mjs

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
index e84c514..2241fc4 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
@@ -1703,6 +1703,24 @@ export function sessionsValidator(visible, titles, limit) {
   return parts.join("\n");
 }
 
+/**
+ * The part of a cache key that says WHAT is being asked, as opposed to which version of it.
+ *
+ * Everything after this — lineage, size, mtime, catalog bytes, binding — decides whether the answer
+ * went stale. Everything in it decides what the answer is. A newer version of one family must
+ * replace its predecessor; two families are two different questions and must not evict each other.
+ * Exported because `trajectoryCacheKey` builds the same prefix, and two copies of that expression
+ * would be free to drift.
+ *
+ * @param {string} dir
+ * @param {number | null | undefined} filter
+ * @returns {string}
+ */
+export function trajectoryCacheFamily(dir, filter) {
+  const gen = filter === null || filter === undefined ? 'all' : String(filter);
+  return `${dir}|gen=${gen}|`;
+}
+
 /**
  * The cache key for one rendered trajectory. Every component comes from a `stat`, a small
  * manifest/catalog file, or the already-resolved session binding — never from reading
@@ -1730,8 +1748,7 @@ export function trajectoryCacheKey(entry, identity, binding, filter) {
     .join(',');
   // The requested slice is part of the answer too: the same session stitched and unfiltered is
   // two different bodies and must never share an entry.
-  const gen = filter === null || filter === undefined ? 'all' : String(filter);
-  return `${entry.dir}|gen=${gen}|${lineage}|${entry.sizeBytes}|${entry.lastActiveAt}|${identity.catalogBytes ?? ''}|${bind}`;
+  return `${trajectoryCacheFamily(entry.dir, filter)}${lineage}|${entry.sizeBytes}|${entry.lastActiveAt}|${identity.catalogBytes ?? ''}|${bind}`;
 }
 /**
  * The `?since=` cursor, or null when there is not a usable one.
@@ -1927,6 +1944,68 @@ export function createParsedRowsCache(budget) {
  * @param {number} limit
  * @returns {Promise<ParsedRows>}
  */
+/**
+ * LRU over rendered trajectory bodies, bounded by entries.
+ *
+ * The bound alone is not enough. `trajectoryCacheKey` carries the active file's size and mtime, so
+ * a session that is still being written to mints a NEW key every time it grows — and every miss
+ * stores another complete body. A plain FIFO therefore keeps four versions of the SAME question
+ * alive, three of which no request can reach any more: `/raw` resolves the current key, and the
+ * page's next poll produces a newer one. Measured on a 9.1 MB session polled every 8s, the cache
+ * held four bodies (49.6 MB) after four polls; at this machine's 68 MB body that is three dead
+ * copies.
+ *
+ * So an entry carries the family it answers for — the session directory plus the requested slice —
+ * and storing a new one drops its predecessor. Everything that changes the ANSWER stays in the
+ * key; everything that only marks it stale stays in the family.
+ *
+ * Different `?generation=` slices are different families and each keeps its own entry, bounded by
+ * `limit` as before.
+ *
+ * @param {number} limit
+ */
+export function createTrajectoryCache(limit) {
+  /** @type {Map<string, { at: number, family: string, value: any }>} */
+  const entries = new Map();
+  return {
+    get size() { return entries.size; },
+    /**
+     * @param {string} key
+     * @returns {any | null}
+     */
+    get(key) {
+      const hit = entries.get(key);
+      if (hit === undefined) return null;
+      // Re-reading is the only signal that an entry is still hot, so it refreshes recency.
+      entries.delete(key);
+      entries.set(key, hit);
+      return hit.value;
+    },
+    /**
+     * @param {string} key
+     * @param {string} family the (session, slice) this answers for; a newer version of the same
+     *   family replaces the older one instead of stacking beside it
+     * @param {any} value
+     */
+    set(key, family, value) {
+      const previous = entries.get(key);
+      if (previous !== undefined) entries.delete(key);
+      entries.set(key, { at: Date.now(), family, value });
+      for (const [existingKey, existing] of entries) {
+        if (existingKey !== key && existing.family === family) entries.delete(existingKey);
+      }
+      while (entries.size > limit) {
+        const oldest = entries.keys().next();
+        if (oldest.done) break;
+        entries.delete(oldest.value);
+      }
+    },
+    clear() {
+      entries.clear();
+    },
+  };
+}
+
 export async function loadParsedRows(cache, filePath, limit) {
   // Stat for the key rather than trusting the catalog, for the same reason the read limit is
   // not taken from it: the active file grows past its recorded size between polls. If the file
@@ -2018,9 +2097,9 @@ export async function start(context) {
    * but is only ever read for one record at a time, so keeping it beside the body means
    * the poll transfers the small payload and the record that gets opened still costs
    * nothing extra.
-   * @type {Map<string, { at: number, etag: string, body: string, raws: Map<number, number>, rows: Array<Record<string, any>> }>}
+   * @type {ReturnType<typeof createTrajectoryCache>}
    */
-  const trajectoryCache = new Map();
+  const trajectoryCache = createTrajectoryCache(TRAJECTORY_CACHE_ENTRIES);
   /**
    * Parsed generation rows, keyed by path+size+mtime+limit. Beside trajectoryCache, not
    * inside it: a whole-session hit still short-circuits before this is touched at all, so
@@ -2540,12 +2619,10 @@ export async function start(context) {
       sendJson(response, 500, { error: 'trajectory_unserializable', message: '会话数据暂时无法读取' });
       return;
     }
-    trajectoryCache.set(cacheKey, { at: Date.now(), etag, body, raws, rows });
-    while (trajectoryCache.size > TRAJECTORY_CACHE_ENTRIES) {
-      const oldest = trajectoryCache.keys().next();
-      if (oldest.done) break;
-      trajectoryCache.delete(oldest.value);
-    }
+    // The family is the session plus the requested slice: the parts of the answer that stay the
+    // same while it goes stale. Everything that decides whether the answer changed stays in the
+    // key, so a newer version of one family replaces its predecessor instead of stacking beside it.
+    trajectoryCache.set(cacheKey, trajectoryCacheFamily(entry.dir, filter), { at: Date.now(), etag, body, raws, rows });
     // `?since=` asks for the tail. The whole body is serialized either way — the cache
     // entry and /raw both need it — so this saves the transfer and the page's JSON.parse,
     // and not the server's work. Any reading of "41 MB → a few KB, so polling got faster"
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-raw-lazy.py b/plugins/avatasia/mmc-trajectory/tests/mutate-raw-lazy.py
index 3c23487..8895b25 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-raw-lazy.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-raw-lazy.py
@@ -67,8 +67,8 @@
     (
         "server: /raw keeps the rows out of the cache entry, so it cannot resolve a locator",
         SERVER,
-        "trajectoryCache.set(cacheKey, { at: Date.now(), etag, body, raws, rows });",
-        "trajectoryCache.set(cacheKey, { at: Date.now(), etag, body, raws });",
+        "trajectoryCache.set(cacheKey, trajectoryCacheFamily(entry.dir, filter), { at: Date.now(), etag, body, raws, rows });",
+        "trajectoryCache.set(cacheKey, trajectoryCacheFamily(entry.dir, filter), { at: Date.now(), etag, body, raws });",
     ),
     # ---- the cap must still hold, wherever it now lives ----------------------
     (
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py b/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py
index a7c6636..4408c5c 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py
@@ -184,9 +184,12 @@
      "",
      "dispose() clears the parsed-row cache too"),
 
+    # `clear() {` on its own stopped being unique once createTrajectoryCache grew one of its own,
+    # and this harness reports an ambiguous anchor as unresolved rather than guessing. The bytes
+    # below are what make it specific to the parsed-row cache: its counter has to be reset too.
     ("the parsed-row cache loses its clear()",
-     "    clear() {",
-     "    reset() {",
+     "    clear() {\n      entries.clear();\n      bytes = 0;\n    },",
+     "    reset() {\n      entries.clear();\n      bytes = 0;\n    },",
      "the parsed-row cache really does expose clear()"),
 
     # ---- 6. the empty state points at inert controls again ----
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-cache.py b/plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-cache.py
new file mode 100644
index 0000000..9fcc10d
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-cache.py
@@ -0,0 +1,176 @@
+"""Mutation control for verify-trajectory-cache.mjs.
+
+Each mutation reintroduces exactly one bug the probe is supposed to catch. The probe must FAIL
+every time, and the file must come back byte-for-byte identical afterwards. A mutation that the
+probe still passes means the assertion was tautological; a mutation whose anchor no longer exists
+means the assertion went dead, which is worse — the runner reports those as misses too.
+
+The first four are the ones that matter: they each break a DIFFERENT part of the family mechanism,
+because a bug that collapsed two of them would still be caught by the wrong assertion and we would
+not learn which one mattered.
+"""
+import subprocess
+import sys
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parent
+SERVER = ROOT / "miniapp" / "node" / "server.mjs"
+PROBE = HERE / "verify-trajectory-cache.mjs"
+
+FAMILY_EVICT = """      for (const [existingKey, existing] of entries) {
+        if (existingKey !== key && existing.family === family) entries.delete(existingKey);
+      }
+"""
+
+LIMIT_EVICT = """      while (entries.size > limit) {
+        const oldest = entries.keys().next();
+        if (oldest.done) break;
+        entries.delete(oldest.value);
+      }
+"""
+
+RECENCY = """      // Re-reading is the only signal that an entry is still hot, so it refreshes recency.
+      entries.delete(key);
+      entries.set(key, hit);
+      return hit.value;
+"""
+
+MUTATIONS = [
+    # ---- the family mechanism, one piece at a time ----------------------------------
+    (
+        "the cache stops dropping a superseded version, so growth stacks bodies again",
+        SERVER,
+        FAMILY_EVICT,
+        "",
+    ),
+    (
+        "the route names the whole key as the family, so every version is its own family",
+        SERVER,
+        "trajectoryCache.set(cacheKey, trajectoryCacheFamily(entry.dir, filter), { at: Date.now(), etag, body, raws, rows });",
+        "trajectoryCache.set(cacheKey, cacheKey, { at: Date.now(), etag, body, raws, rows });",
+    ),
+    (
+        "the family stops naming the slice, so one session's generations evict each other",
+        SERVER,
+        "  const gen = filter === null || filter === undefined ? 'all' : String(filter);\n  return `${dir}|gen=${gen}|`;",
+        "  return `${dir}|gen=all|`;",
+    ),
+    (
+        "the family stops naming the session, so two sessions evict each other",
+        SERVER,
+        "  return `${dir}|gen=${gen}|`;",
+        "  return `|gen=${gen}|`;",
+    ),
+    (
+        "the family comparison is dropped, so a newer version keeps its predecessor",
+        SERVER,
+        "        if (existingKey !== key && existing.family === family) entries.delete(existingKey);",
+        "        if (existingKey === key) entries.delete(existingKey);",
+    ),
+    # ---- the bound ------------------------------------------------------------------
+    (
+        "the entry bound stops evicting, so distinct sessions grow without limit",
+        SERVER,
+        LIMIT_EVICT,
+        "",
+    ),
+    (
+        "reading stops refreshing recency, so the family the reader keeps asking for is evicted",
+        SERVER,
+        RECENCY,
+        "      return hit.value;\n",
+    ),
+    # ---- structure ------------------------------------------------------------------
+    (
+        "the cache becomes a module-level singleton, shared across every runtime instance",
+        SERVER,
+        "  const trajectoryCache = createTrajectoryCache(TRAJECTORY_CACHE_ENTRIES);",
+        "  globalThis.__trajectoryCache = globalThis.__trajectoryCache || createTrajectoryCache(TRAJECTORY_CACHE_ENTRIES);\n  const trajectoryCache = globalThis.__trajectoryCache;",
+    ),
+    (
+        "the key stops carrying the active file's size, so a grown session serves a stale body",
+        SERVER,
+        "  return `${trajectoryCacheFamily(entry.dir, filter)}${lineage}|${entry.sizeBytes}|${entry.lastActiveAt}|${identity.catalogBytes ?? ''}|${bind}`;",
+        "  return `${trajectoryCacheFamily(entry.dir, filter)}${lineage}|${entry.lastActiveAt}|${identity.catalogBytes ?? ''}|${bind}`;",
+    ),
+    (
+        "the key stops carrying the lineage, so a compaction that only rotated snapshots serves a stale body",
+        SERVER,
+        "  return `${trajectoryCacheFamily(entry.dir, filter)}${lineage}|${entry.sizeBytes}|${entry.lastActiveAt}|${identity.catalogBytes ?? ''}|${bind}`;",
+        "  return `${trajectoryCacheFamily(entry.dir, filter)}${entry.sizeBytes}|${entry.lastActiveAt}|${identity.catalogBytes ?? ''}|${bind}`;",
+    ),
+]
+
+
+def read_exact(path):
+    """Normalise to LF for matching, and report the file's own newline so it can be put back."""
+    data = path.read_bytes()
+    text = data.decode("utf-8").replace("\r\n", "\n")
+    return text, ("\r\n" if b"\r\n" in data else "\n")
+
+
+def write_exact(path, text, newline):
+    if newline == "\r\n":
+        text = text.replace("\n", "\r\n")
+    path.write_bytes(text.encode("utf-8"))
+
+
+def run_probe():
+    proc = subprocess.run(
+        ["node", str(PROBE)],
+        cwd=str(ROOT),
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+    )
+    return proc.returncode, (proc.stdout or "") + (proc.stderr or "")
+
+
+def main():
+    code, output = run_probe()
+    if code != 0:
+        print("baseline probe does not pass; fix that first")
+        print(output)
+        return 1
+    print("baseline clean")
+
+    originals = {path: path.read_bytes() for path in {m[1] for m in MUTATIONS}}
+    missed = []
+    for label, path, old, new in MUTATIONS:
+        text, newline = read_exact(path)
+        if old not in text:
+            print(f"SKIP  {label}: anchor not found in {path.name}")
+            missed.append(label)
+            continue
+        write_exact(path, text.replace(old, new, 1), newline)
+        try:
+            code, output = run_probe()
+        finally:
+            path.write_bytes(originals[path])
+        if code == 0:
+            print(f"MISSED {label}: the probe still passed")
+            missed.append(label)
+        else:
+            first = next(
+                (line.strip() for line in output.splitlines() if line.strip().startswith("- ")),
+                "(no detail)",
+            )
+            print(f"caught {label}\n         -> {first}")
+
+    for path, data in originals.items():
+        if path.read_bytes() != data:
+            print(f"NOT RESTORED {path}")
+            return 1
+    print("all files restored byte-for-byte")
+
+    if missed:
+        print(f"\n{len(missed)} mutation(s) got through")
+        return 1
+    print(f"\nall {len(MUTATIONS)} mutations caught")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-raw-lazy.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-raw-lazy.mjs
index 0b3f383..ef01cbf 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-raw-lazy.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-raw-lazy.mjs
@@ -150,9 +150,12 @@ assert('it calls buildRawPayload, i.e. it builds rather than looks up a stored m
 assert('it follows the locator back to a row', handleRawBody.includes('cached.rows[rowIndex]'));
 assert('it reports the verdict alongside the message', /omitted: built\.omitted/.test(handleRawBody));
 assert('a missing row is still a 404, not an empty message', handleRawBody.includes("'record_not_found'"));
+// The entry shape lives in createTrajectoryCache now, so this asserts the thing the two
+// assertions above jointly depend on: the route stores `rows` into the entry, and /raw reads
+// `cached.rows` back out of it. Anchoring on the old JSDoc type comment instead would have made
+// the assertion a check on where a type was written rather than on what the route does.
 assert('the cache entry keeps the rows the locators point into',
-  SERVER.includes('raws: Map<number, number>, rows: Array<Record<string, any>>'));
-assert('the cache entry is written with the rows', SERVER.includes('{ at: Date.now(), etag, body, raws, rows }'));
+  SERVER.includes('trajectoryCache.set(cacheKey, trajectoryCacheFamily(entry.dir, filter), { at: Date.now(), etag, body, raws, rows })'));
 
 /* =====================================================================
  * 4 — each of the five readers, by name
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-trajectory-cache.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-trajectory-cache.mjs
new file mode 100644
index 0000000..96b0d36
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-trajectory-cache.mjs
@@ -0,0 +1,170 @@
+/**
+ * The rendered-body cache may not keep four versions of one question alive.
+ *
+ * `trajectoryCacheKey()` carries the active file's size and mtime, so a session that is still
+ * being written to mints a new key every time it grows. Every miss then stores another complete
+ * body — `?since=` included, because the cache entry and /raw both need the whole thing. With a
+ * plain FIFO over keys, four versions of the SAME (session, slice) sit there at once, and three of
+ * them can no longer be reached: /raw resolves the current key, and the page's next poll produces
+ * a newer one. Measured on a 9.1 MB session polled every 8s: four bodies, 49.6 MB, after four polls.
+ *
+ * So an entry carries the family it answers for — the session directory plus the requested slice —
+ * and storing a new one drops its predecessor. Everything that decides whether the answer changed
+ * stays in the key; everything that decides what the answer IS stays in the family.
+ *
+ * Read-only: imports the pure helpers, never starts the runtime.
+ * mutate-trajectory-cache.py breaks each of these in the shipped file.
+ */
+import { readFileSync } from 'node:fs';
+import {
+  createTrajectoryCache,
+  trajectoryCacheFamily,
+  trajectoryCacheKey,
+} from '../miniapp/node/server.mjs';
+
+const SERVER = readFileSync(new URL('../miniapp/node/server.mjs', import.meta.url), 'utf8');
+
+let pass = 0;
+const failures = [];
+function check(name, actual, expected) {
+  if (JSON.stringify(actual) === JSON.stringify(expected)) pass += 1;
+  else failures.push(`${name}: got ${JSON.stringify(actual)}, want ${JSON.stringify(expected)}`);
+}
+function assert(name, cond) {
+  if (cond) pass += 1;
+  else failures.push(name);
+}
+
+const LIMIT = 4;
+const DIR = '/store/session-a';
+const entry = (size, mtime) => ({ dir: DIR, sizeBytes: size, lastActiveAt: mtime });
+const identity = { catalogBytes: 1234, generations: [{ generation: 0, fileName: 'g0', byteLength: 10 }] };
+
+/* =====================================================================
+ * 1 — the family is a prefix of the key, and the key still says what changed
+ * ===================================================================== */
+
+const familyAll = trajectoryCacheFamily(DIR, null);
+const familySlice = trajectoryCacheFamily(DIR, 3);
+assert('the family names the session directory', familyAll.startsWith(DIR));
+assert('an unfiltered request is the "all" slice', familyAll === `${DIR}|gen=all|`);
+assert('a filtered request names its own generation', familySlice === `${DIR}|gen=3|`);
+assert('two slices are two families', familyAll !== familySlice);
+assert('two sessions are two families',
+  trajectoryCacheFamily('/store/session-b', null) !== familyAll);
+
+const keyFresh = trajectoryCacheKey(entry(1000, 5000), identity, null, null);
+const keyGrown = trajectoryCacheKey(entry(2000, 6000), identity, null, null);
+assert('the key starts with its family', keyFresh.startsWith(familyAll));
+assert('growth still produces a different key', keyFresh !== keyGrown);
+assert('the key still carries the size, so a stale entry is never served',
+  keyGrown.includes('|2000|6000|'));
+assert('the key still carries the catalog bytes',
+  keyGrown.includes('|1234|'));
+
+// The catalog rotating a generation must also change the key, or a compaction that only rotated
+// snapshots would serve the pre-rotation body.
+const rotatedIdentity = {
+  catalogBytes: 1234,
+  generations: [{ generation: 0, fileName: 'g1', byteLength: 10 }],
+};
+assert('rotating the lineage changes the key',
+  trajectoryCacheKey(entry(1000, 5000), rotatedIdentity, null, null) !== keyFresh);
+
+/* =====================================================================
+ * 2 — growth replaces its predecessor instead of stacking beside it
+ * ===================================================================== */
+
+const cache = createTrajectoryCache(LIMIT);
+cache.set(keyFresh, familyAll, { body: 'v1' });
+check('one store makes one entry', cache.size, 1);
+for (let size = 2000; size <= 9000; size += 1000) {
+  cache.set(trajectoryCacheKey(entry(size, size), identity, null, null), familyAll, { body: `v${size}` });
+}
+assert('nine versions of one question leave one entry', cache.size === 1);
+assert('the survivor is the newest, not the oldest',
+  cache.get(trajectoryCacheKey(entry(9000, 9000), identity, null, null))?.body === 'v9000');
+assert('a superseded key is gone, so /raw cannot reach it',
+  cache.get(keyFresh) === null);
+
+/* =====================================================================
+ * 3 — different questions keep their own entries
+ * ===================================================================== */
+
+const mixed = createTrajectoryCache(LIMIT);
+const keyA1 = trajectoryCacheKey(entry(1000, 5000), identity, null, null);
+const keyA2 = trajectoryCacheKey(entry(2000, 6000), identity, null, null);
+const keySlice = trajectoryCacheKey(entry(1000, 5000), identity, null, 3);
+const keyOther = trajectoryCacheKey({ ...entry(1000, 5000), dir: '/store/session-b' }, identity, null, null);
+mixed.set(keyA1, familyAll, { body: 'a1' });
+mixed.set(keyA2, familyAll, { body: 'a2' });
+check('growth in one family did not disturb the other family', mixed.size, 1);
+mixed.set(keySlice, familySlice, { body: 's3' });
+mixed.set(keyOther, trajectoryCacheFamily('/store/session-b', null), { body: 'b1' });
+check('two sessions and two slices coexist', mixed.size, 3);
+assert('the unfiltered session kept its newest body', mixed.get(keyA2)?.body === 'a2');
+assert('the slice kept its own body', mixed.get(keySlice)?.body === 's3');
+assert('the other session kept its own body', mixed.get(keyOther)?.body === 'b1');
+
+/* =====================================================================
+ * 4 — the entry bound still applies across families
+ * ===================================================================== */
+
+const bounded = createTrajectoryCache(LIMIT);
+const families = [];
+for (let i = 0; i < LIMIT + 3; i += 1) {
+  const dir = `/store/session-${i}`;
+  const fam = trajectoryCacheFamily(dir, null);
+  families.push(fam);
+  bounded.set(trajectoryCacheKey({ dir, sizeBytes: 100, lastActiveAt: 1 }, identity, null, null), fam, { body: `b${i}` });
+}
+assert('more sessions than the bound still respect it', bounded.size === LIMIT);
+assert('the oldest session was the one evicted', bounded.get(trajectoryCacheKey(
+  { dir: '/store/session-0', sizeBytes: 100, lastActiveAt: 1 }, identity, null, null,
+)) === null);
+
+// Reading has to refresh recency, or a family the reader keeps asking for is evicted by
+// insertion order while a colder one survives.
+//
+// Three families are needed, not two: storing a fourth member of an existing family frees its own
+// slot first, so with two families the bound never has to evict anything and the assertion passes
+// whether or not recency is refreshed. That is the shape of a tautological test.
+const hot = createTrajectoryCache(2);
+const keyOf = (name) => trajectoryCacheKey(
+  { dir: `/store/${name}`, sizeBytes: 1, lastActiveAt: 1 }, identity, null, null,
+);
+hot.set(keyOf('wanted'), trajectoryCacheFamily('/store/wanted', null), { body: 'wanted' });
+hot.set(keyOf('other'), trajectoryCacheFamily('/store/other', null), { body: 'other' });
+// Touched, so recency order becomes [other, wanted] rather than [wanted, other].
+hot.get(keyOf('wanted'));
+hot.set(keyOf('newcomer'), trajectoryCacheFamily('/store/newcomer', null), { body: 'newcomer' });
+assert('a family that was read again survives the next eviction', hot.get(keyOf('wanted'))?.body === 'wanted');
+assert('the family that was NOT touched is the one evicted', hot.get(keyOf('other')) === null);
+
+/* =====================================================================
+ * 5 — structure: the cache is per-runtime, and the route names the family
+ * ===================================================================== */
+
+const startAt = SERVER.indexOf('export async function start(');
+const startBody = SERVER.slice(startAt);
+assert('start() exists', startAt > 0);
+assert('the cache is created inside start(), not at module level',
+  startBody.includes('const trajectoryCache = createTrajectoryCache(TRAJECTORY_CACHE_ENTRIES);')
+  && !/\nconst trajectoryCache = createTrajectoryCache\(/.test(SERVER.slice(0, startAt)));
+assert('the route names the family from the entry and the requested slice',
+  startBody.includes('trajectoryCache.set(cacheKey, trajectoryCacheFamily(entry.dir, filter)'));
+assert('the route no longer evicts by insertion order itself',
+  !/while \(trajectoryCache\.size > TRAJECTORY_CACHE_ENTRIES\)/.test(startBody));
+assert('the family helper is exported so the key and the cache cannot drift apart',
+  SERVER.includes('export function trajectoryCacheFamily(dir, filter)'));
+assert('the key is built from the same helper, so the prefix is one expression',
+  SERVER.includes('`${trajectoryCacheFamily(entry.dir, filter)}${lineage}|'));
+assert('the route still releases both caches on dispose',
+  /trajectoryCache\.clear\(\);/.test(startBody) && /parsedRows\.clear\(\);/.test(startBody));
+
+if (failures.length) {
+  console.error(`\n[trajectory-cache] ${failures.length} FAILED, ${pass} passed`);
+  for (const f of failures) console.error('  - ' + f);
+  process.exit(1);
+}
+console.log(`\n[trajectory-cache] ${pass} assertions passed`);

From 890c1786d7f008f26bfc170f72b896b186fa423d Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Wed, 14 Oct 2026 20:08:30 +0800
Subject: [PATCH 04/36] Let the parsed-row assertions measure what they were
 measuring

verify-parsed-rows.mjs built its stand-in session as
`{ session: {...}, sizeBytes: 0, truncated: false }`, then spread it into the
per-file result with `...other` AFTER the loop had computed both numbers. The
guard replaced its own measurements with two constants one line before comparing
them: every assertion about total size and the truncated flag was asserting the
literal back at itself.

Those are exactly the two quantities the route derives by walking the store --
how many bytes the generation actually holds, and whether the cap cut it. The
guard was therefore free to disagree with the route about either without any
assertion noticing.

The stand-in now carries `session` and nothing else. Nothing else needed to
change: the computed values survive to be compared, which is the point.

53 assertions and all 12 mutations behave the same as before, so what the guard
was actually pinning is unchanged -- it just stops pinning a constant.

Found while measuring what parsed rows are worth to hold in memory: the row
cache's value was being judged partly by a guard that could not disagree with
itself.
---
 .../avatasia/mmc-trajectory/tests/verify-parsed-rows.mjs    | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-parsed-rows.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-parsed-rows.mjs
index 2c8cabb..ac23e8c 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-parsed-rows.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-parsed-rows.mjs
@@ -75,7 +75,11 @@ const jsonl = [
 // 6 parseable rows, 2 skipped (one unparseable, one not an object). Counted by hand.
 const EXPECTED_SKIPPED = 2;
 
-const other = { session: { id: 'sess-b', createdAtMs: 1791617886000 }, sizeBytes: 0, truncated: false };
+// A stand-in session, so a key built for one conversation cannot be served another's. It carries a
+// session and nothing else: `sizeBytes` and `truncated` are spread BELOW this, so any value added
+// here would silently replace what the loop just computed — and the body-equality comparison would
+// then be asserting a constant instead of what was actually read.
+const other = { session: { id: 'sess-b', createdAtMs: 1791617886000 } };
 
 /** Build the body the way the route does, from a set of per-file results. */
 async function buildBody(files, filter) {

From 369475b5eaeb8477df24ca83b61028d6aa23116d Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Wed, 14 Oct 2026 20:32:28 +0800
Subject: [PATCH 05/36] =?UTF-8?q?Stop=20holding=20a=20session's=20parsed?=
 =?UTF-8?q?=20rows=20open=20just=20to=20answer=20=E5=8E=9F=E6=96=87?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The body was already serialized by the time /raw was asked for, and the entry kept the whole
parsed object graph behind it so that one record could be handed back. Measured on this
machine's own store: 377 MB of heap held while one 71.8 MB session was open, against 304 MB
once the rows were not retained -- and on a session with a 20.5 MB source, 31 MB against 11.
Polling does not change either way: 304 of 304 answered 304, at 1.6 ms each.

The parsed-rows cache could not have been the fix, because it was never a cache for the file
that mattered. Its key is path+size+mtime, and handleTrajectory only reaches the parse after
the trajectory key -- carrying that same size and mtime -- has already missed. Every store was
followed by a miss. Sealed generations are the opposite case and stay cached, because for
those the stat really is constant.

So the active generation is parsed every time and retained never, and what the entry keeps
instead is, per record: the file, the byte range of its line, and a SHA-256 of that line.
36,527 locators cost 5 MB against the object graph's 73. `parseMessagesJsonl` reads the bytes
`readHead` already has and reports where each line sits, which also stops a 68 MB JSONL being
decoded into a 135 MB JS string before it is parsed at all.

/raw seeks to the range, refuses anything whose length or digest does not match, and answers
409 raw_stale rather than a plausible message from the wrong line. That case is narrow -- the
entry is keyed on size and mtime, so only a rewrite preserving both reaches it, and no sealed
generation on this store has ever been rewritten -- but nothing above the file level can see
it, and a wrong message under the right record's name is worse than a hint. The page puts the
validator in its own raw cache key for the same reason: a record index is a position within
one version of one body, and a body that has moved on would otherwise keep its old messages.

The cost is on re-parses only, and it scales with record count rather than file size: 574
records cost 25 ms, 36,527 cost 342 ms. 304s are unaffected.

Reads now answer one line at a time out of a file rather than out of memory, and a record the
page has already opened is kept decoded for the entry, 32 at a time.

verify-raw-locators.mjs: 57 assertions, over the three things the seam can get wrong -- the
positions being byte offsets rather than character indices (the fixture carries a CJK line,
where the two part company at the line's end and agree at its start), the digest meaning
something under a same-length rewrite, and the route actually keeping locators instead of
rows. mutate-raw-locators.py: 20 mutations.

Four existing mutation controls had anchors this change invalidated, and the anchors moved
rather than the mutations: two named the old cache-entry line, one named a comment that was
re-wrapped, two named `empty` and the inline-parse call site. mutate-review16's own anchor
had to move with them, which is the third time a re-wrap has cost a detector its anchor.

Also verified, and it is the part worth keeping: no sealed generation on this store has ever
been rewritten (52 of them, checked against their own catalog's byteLength and mtime), and
the lineage at a session root is the active file alone -- rotated generations live under
snapshots/ rather than beside messages.jsonl, so the retention this removes was the active
file's and nothing else.

Suite 69/69.
---
 .../mmc-trajectory/miniapp/client/index.html  |  11 +-
 .../mmc-trajectory/miniapp/node/server.mjs    | 354 ++++++++++++++----
 .../tests/mutate-parsed-rows.py               |   6 +-
 .../mmc-trajectory/tests/mutate-raw-lazy.py   |   4 +-
 .../tests/mutate-raw-locators.py              | 244 ++++++++++++
 .../mmc-trajectory/tests/mutate-review16.py   |   4 +-
 .../tests/mutate-trajectory-cache.py          |   4 +-
 .../tests/verify-parsed-rows.mjs              |  10 +-
 .../mmc-trajectory/tests/verify-raw-lazy.mjs  |  17 +-
 .../tests/verify-raw-locators.mjs             | 271 ++++++++++++++
 10 files changed, 828 insertions(+), 97 deletions(-)
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/mutate-raw-locators.py
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/verify-raw-locators.mjs

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
index 2846831..b0753c6 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
+++ b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
@@ -7953,7 +7953,11 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         var session = payload && payload.session ? payload.session : null;
         var sid = session && typeof session.id === 'string' ? session.id : '';
         var gen = state.generation === null ? 'all' : String(state.generation);
-        return sid + '#' + gen + '#' + index;
+        // The validator belongs in this key. A record index is only a position within one version
+        // of one body: the same index in the next version of the session is a different message.
+        // Without the tag, a body that changed since the raw was read kept being served from here
+        // forever, and the page had no way to notice. Pinned by tests/verify-raw-lazy.mjs.
+        return sid + '#' + gen + '#' + (state.etag || '') + '#' + index;
       }
 
       function requestRaw(index) {
@@ -7978,6 +7982,11 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
        * before giving up; without the retry the tab would be permanently broken after any
        * restart, and without the retry cap it would loop.
        *
+       * A 409 `raw_stale` is deliberately NOT on that path. It means the file a record was read
+       * from has been rewritten, which is not something a reload retries its way out of on a
+       * timer — and the reader is told so by the same 原文读取失败 line every other raw failure
+       * uses. A stale record is a hint, not an unavailable session.
+       *
        * @param {Record<string, any>} record
        * @param {boolean} [retried]
        */
diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
index 2241fc4..abde241 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
@@ -69,14 +69,17 @@ const TRAJECTORY_CACHE_ENTRIES = 4;
 /**
  * Upper bound on the parsed generation rows kept resident, in bytes.
  *
- * The whole-session cache above stores serialized bodies; this one stores parsed object
- * graphs, which cost several times their source text. Measured on this machine: JSON.parse
- * retains 1.36x the text of the emitted payload, and that is a floor — the payload has
- * already had its message bodies stripped by splitRawRecords, so the rows graph is larger.
- * A 95 MB lineage lands somewhere in 130-290 MB.
- *
- * The trade is deliberate: it converts roughly 350 MB of allocation every 2.5 s into one
- * resident cost. Pinned by tests/verify-parsed-rows.mjs.
+ * This budget no longer covers the file that matters. A cache keyed on path+size+mtime for a file
+ * that is being appended to has no hit rate to speak of: `handleTrajectory` only reaches the parse
+ * after the trajectory key — which carries the same size and mtime — has already missed, so every
+ * store here is followed by a miss and the entry is dead weight that still costs its rows'
+ * memory. Measured on this machine, retaining it was the largest single cost in the process: 378 MB
+ * of heap after one session and 304 polls, against 145 MB once it is not retained.
+ *
+ * What is left is the sealed generations, whose stat never changes and which are therefore the
+ * only parses a second request can genuinely reuse. Those files are rare at a session root — the
+ * store keeps rotated generations under `snapshots/`, not beside `messages.jsonl` — so the budget
+ * is now generous rather than tuned. Pinned by tests/verify-parsed-rows.mjs.
  */
 const PARSED_ROWS_CACHE_BYTES = 256 * 1024 * 1024;
 /**
@@ -93,6 +96,15 @@ const PARSED_ROWS_CACHE_BYTES = 256 * 1024 * 1024;
  * re-parsed them on the next poll. The budget is only as good as this number.
  */
 const PARSED_ROWS_HEAP_PER_SOURCE_BYTE = 2;
+/**
+ * How many decoded messages one trajectory entry keeps for `/raw`, per open session.
+ *
+ * Bounded by count rather than bytes because the thing being kept is one message, and a 64 KB cap
+ * is already what decides whether a message is too big to show. The point is not to be a cache —
+ * it is so that paging back and forth in the inspector does not re-read the file each time — and a
+ * reader who opens more than this many at once is served correctly either way.
+ */
+const RAW_DECODE_CACHE_ENTRIES = 32;
 const SESSION_STORE_TOKEN = '<session-store>';
 const JSON_HEADERS = { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' };
 /**
@@ -188,33 +200,71 @@ export function createRedactor(secrets) {
 }
 
 /**
- * @param {string} text
- * @returns {{ rows: Array<Record<string, any>>, skipped: number }}
+ * One generation file's rows, plus where each row's line sits in the bytes they were read from.
+ *
+ * The positions are the second half of what this returns, and they are not a convenience: they
+ * are the only thing `/raw` has left once the parsed rows are released, which is what stops a
+ * 68 MB session from costing hundreds of megabytes of resident object graph. A line's bytes are
+ * found again by seeking to `start` and taking `end - start` of them, and the digest is what says
+ * they are still the same bytes.
+ *
+ * Offsets are byte offsets into `source`. For the route that source is a file read from offset 0,
+ * so they are byte offsets into the file; the guards that pass text get offsets into that text's
+ * UTF-8 encoding, which is the same relation.
+ *
+ * @param {string | Buffer} source
+ * @returns {{ rows: Array<Record<string, any>>, skipped: number, spans: Array<[number, number]> }}
  */
-export function parseMessagesJsonl(text) {
+export function parseMessagesJsonl(source) {
+  // One code path, two inputs. The route hands over the bytes it already read, which costs
+  // nothing; a caller holding text pays one encode here. Scanning the bytes rather than the string
+  // is also what makes the offsets free — a UTF-16 index is not a byte offset.
+  const bytes = typeof source === 'string' ? Buffer.from(source, 'utf8') : source;
   /** @type {Array<Record<string, any>>} */
   const rows = [];
+  /** @type {Array<[number, number]>} */
+  const spans = [];
   let skipped = 0;
   let start = 0;
-  while (start <= text.length) {
-    let end = text.indexOf('\n', start);
-    if (end === -1) end = text.length;
-    const line = text.slice(start, end);
-    start = end + 1;
-    if (line.trim() === '') {
-      if (end >= text.length) break;
-      continue;
-    }
-    try {
-      const parsed = JSON.parse(line);
-      if (parsed && typeof parsed === 'object') rows.push(parsed);
-      else skipped += 1;
-    } catch {
-      skipped += 1;
+  while (start < bytes.length) {
+    const newline = bytes.indexOf(0x0a, start);
+    const end = newline === -1 ? bytes.length : newline;
+    const line = bytes.subarray(start, end).toString('utf8');
+    if (line.trim() !== '') {
+      try {
+        const parsed = JSON.parse(line);
+        if (parsed && typeof parsed === 'object') {
+          rows.push(parsed);
+          spans.push([start, end]);
+        } else skipped += 1;
+      } catch {
+        skipped += 1;
+      }
     }
-    if (end >= text.length) break;
+    if (newline === -1) break;
+    start = newline + 1;
   }
-  return { rows, skipped };
+  return { rows, skipped, spans };
+}
+
+/**
+ * How much of a line's SHA-256 is kept.
+ *
+ * Sixteen hex characters is 64 bits, which is chosen against the thing it has to survive: two
+ * different lines of the same length producing the same digest. Not a collision an adversary
+ * would have to find — nothing here is attacker-controlled — but the 32-bit FNV that was
+ * considered first, where a 68 MB session makes birthday-range collisions a matter of how many
+ * lines you are willing to hash. A full digest would cost the same to compare and twice the memory
+ * per row.
+ */
+const LINE_DIGEST_CHARS = 16;
+
+/**
+ * @param {Buffer} bytes
+ * @returns {string}
+ */
+export function lineDigest(bytes) {
+  return createHash('sha256').update(bytes).digest('hex').slice(0, LINE_DIGEST_CHARS);
 }
 
 /**
@@ -329,9 +379,20 @@ export function truncatedByCap(size, limit) {
 }
 
 /**
+ * Read at most `limit` bytes from the start of a file, cut back to the last complete line.
+ *
+ * The read always starts at offset 0 and never moves, so an index into `buffer` is also the byte
+ * offset of the same place in the file. That is what lets `/raw` go back to one line later without
+ * the parsed rows still being in memory, and it is the reason `buffer` is the primary result:
+ * decoding the whole thing into a JS string is what this function used to return, and a 68 MB
+ * JSONL read as UTF-16 is up to 136 MB of heap for the duration of the parse.
+ *
+ * `text` is derived from those bytes on demand for the callers that want a string, and cached
+ * because the fixtures read it more than once.
+ *
  * @param {string} filePath
  * @param {number} limit
- * @returns {Promise<{ text: string, size: number, read: number }>}
+ * @returns {Promise<{ buffer: Buffer, text: string, size: number, read: number }>}
  */
 export async function readHead(filePath, limit) {
   const handle = await open(filePath, 'r');
@@ -349,12 +410,61 @@ export async function readHead(filePath, limit) {
     const view = buffer.subarray(0, filled);
     const lastNewline = view.lastIndexOf(0x0a);
     const usable = lastNewline === -1 ? filled : lastNewline;
-    return { text: view.subarray(0, usable).toString('utf8'), size, read: filled };
+    const usableBytes = view.subarray(0, usable);
+    /** @type {string | null} */
+    let decoded = null;
+    return {
+      buffer: usableBytes,
+      size,
+      read: filled,
+      get text() {
+        if (decoded === null) decoded = usableBytes.toString('utf8');
+        return decoded;
+      },
+    };
   } finally {
     await handle.close();
   }
 }
 
+/**
+ * Read exactly `[start, end)` out of a file, for one line.
+ *
+ * Used only by `/raw`, and only after the line's position was recorded during the parse. The
+ * length check is not decoration: a file that shrank since then would otherwise answer with
+ * whatever now sits at that offset.
+ *
+ * @param {string} filePath
+ * @param {number} start
+ * @param {number} end
+ * @returns {Promise<Buffer | null>} null when the file no longer reaches `end`
+ */
+export async function readRange(filePath, start, end) {
+  if (!Number.isInteger(start) || !Number.isInteger(end) || start < 0 || end <= start) return null;
+  let handle;
+  try {
+    handle = await open(filePath, 'r');
+  } catch {
+    return null;
+  }
+  try {
+    const stat = await handle.stat();
+    if (stat.size < end) return null;
+    const buffer = Buffer.allocUnsafe(end - start);
+    let filled = 0;
+    while (filled < buffer.length) {
+      const { bytesRead } = await handle.read(buffer, filled, buffer.length - filled, start + filled);
+      if (bytesRead <= 0) return null;
+      filled += bytesRead;
+    }
+    return buffer;
+  } catch {
+    return null;
+  } finally {
+    await handle.close().catch(() => undefined);
+  }
+}
+
 /**
  * @param {string} dir
  */
@@ -1844,7 +1954,14 @@ export function buildDeltaPayload(payload, since) {
 }
 
 /**
- * @typedef {{ rows: Array<Record<string, any>>, skipped: number, size: number, read: number, empty: boolean, truncated: boolean }} ParsedRows
+ * One generation file, parsed once.
+ *
+ * `locators` is parallel to `rows` and is what makes releasing `rows` safe: each entry says which
+ * file the line came from, where in it, and what it hashed to, which is everything `/raw` needs to
+ * fetch that one line again.
+ *
+ * @typedef {{ filePath: string, start: number, end: number, digest: string }} LineLocator
+ * @typedef {{ rows: Array<Record<string, any>>, locators: Array<LineLocator>, skipped: number, size: number, read: number, empty: boolean, truncated: boolean }} ParsedRows
  */
 
 /**
@@ -1929,21 +2046,6 @@ export function createParsedRowsCache(budget) {
   };
 }
 
-/**
- * One generation file's rows, from the cache when the filesystem still agrees with the key.
- *
- * Extracted from the route so a test can run the real step twice and compare: a cache hit
- * that is even slightly different from a cold read is the one failure this cache may not
- * have, and it is invisible to any test that does not run this function.
- *
- * Throws whatever readHead throws; the caller owns the error response, because the route
- * needs to answer 500 and the test needs the throw.
- *
- * @param {ReturnType<typeof createParsedRowsCache>} cache
- * @param {string} filePath
- * @param {number} limit
- * @returns {Promise<ParsedRows>}
- */
 /**
  * LRU over rendered trajectory bodies, bounded by entries.
  *
@@ -2006,7 +2108,30 @@ export function createTrajectoryCache(limit) {
   };
 }
 
-export async function loadParsedRows(cache, filePath, limit) {
+/**
+ * One generation file, parsed once, from the cache when the caller says the file can be reused.
+ *
+ * `cacheable` is the whole of what step 2 changed, and it is not a tuning knob: a cache entry
+ * keyed on path+size+mtime for a file that grows between polls cannot be hit, because the caller
+ * only gets here after a key carrying that same size and mtime already missed. The active file is
+ * therefore parsed every time and retained never, and `/raw` finds its lines from the locators
+ * instead. Sealed generations still go in, because for those the stat really is constant.
+ *
+ * Extracted from the route so a test can run the real step twice and compare: a cache hit
+ * that is even slightly different from a cold read is the one failure this cache may not
+ * have, and it is invisible to any test that does not run this function.
+ *
+ * Throws whatever readHead throws; the caller owns the error response, because the route
+ * needs to answer 500 and the test needs the throw.
+ *
+ * @param {ReturnType<typeof createParsedRowsCache>} cache
+ * @param {string} filePath
+ * @param {number} limit
+ * @param {{ cacheable?: boolean }} [options]
+ * @returns {Promise<ParsedRows>}
+ */
+export async function loadParsedRows(cache, filePath, limit, options) {
+  const cacheable = options === undefined || options.cacheable !== false;
   // Stat for the key rather than trusting the catalog, for the same reason the read limit is
   // not taken from it: the active file grows past its recorded size between polls. If the file
   // changes between this stat and readHead the entry ends up keyed on a size it does not
@@ -2015,21 +2140,33 @@ export async function loadParsedRows(cache, filePath, limit) {
   // different key.
   const current = await stat(filePath);
   const key = parsedRowsKey(filePath, current.size, current.mtimeMs, limit);
-  const hit = cache.get(key);
-  if (hit !== null) return hit;
+  if (cacheable) {
+    const hit = cache.get(key);
+    if (hit !== null) return hit;
+  }
 
   const head = await readHead(filePath, limit);
-  const parsed = parseMessagesJsonl(head.text);
+  const parsed = parseMessagesJsonl(head.buffer);
+  // Built complete rather than completed by the caller: one locator per row is 36,527 objects on a
+  // session this size, and spreading each of them into a second object to add a field the parse
+  // already had in hand cost more than the digests do.
+  const locators = parsed.spans.map(([start, end]) => ({
+    filePath,
+    start,
+    end,
+    digest: lineDigest(head.buffer.subarray(start, end)),
+  }));
   const value = {
     rows: parsed.rows,
+    locators,
     skipped: parsed.skipped,
     size: head.size,
     read: head.read,
-    empty: head.text === '',
+    empty: head.buffer.length === 0,
     // Truncated means our cap cut the read, nothing else.
     truncated: truncatedByCap(head.size, limit),
   };
-  cache.set(key, value, Math.ceil(head.size * PARSED_ROWS_HEAP_PER_SOURCE_BYTE));
+  if (cacheable) cache.set(key, value, Math.ceil(head.size * PARSED_ROWS_HEAP_PER_SOURCE_BYTE));
   return value;
 }
 
@@ -2101,9 +2238,11 @@ export async function start(context) {
    */
   const trajectoryCache = createTrajectoryCache(TRAJECTORY_CACHE_ENTRIES);
   /**
-   * Parsed generation rows, keyed by path+size+mtime+limit. Beside trajectoryCache, not
-   * inside it: a whole-session hit still short-circuits before this is touched at all, so
-   * the two caches never answer for each other. Pinned by tests/verify-parsed-rows.mjs.
+   * Parsed generation rows, keyed by path+size+mtime+limit, and now holding sealed generations
+   * only — `loadParsedRows` is called with `cacheable: false` for the file being appended to.
+   * Beside trajectoryCache, not inside it: a whole-session hit still short-circuits before this is
+   * touched at all, so the two caches never answer for each other.
+   * Pinned by tests/verify-parsed-rows.mjs.
    */
   const parsedRows = createParsedRowsCache(PARSED_ROWS_CACHE_BYTES);
 
@@ -2462,8 +2601,8 @@ export async function start(context) {
       // cursor carries the validator it was taken against, so a request that reaches this
       // line with a cursor means the session changed — which is the branch below. Cutting
       // a tail out of a cached payload would also mean holding that payload in memory, and
-      // this cache deliberately does not: it holds the serialized bytes and the rows /raw
-      // needs, not the object graph the bytes came from.
+      // this cache deliberately does not: it holds the serialized bytes and the locators
+      // /raw needs, not the object graph the bytes came from.
       sendJsonBody(response, 200, cached.body, { etag, revalidate: true });
       return;
     }
@@ -2524,6 +2663,11 @@ export async function start(context) {
     // Concatenate oldest → newest, which is the order the conversation actually happened in.
     /** @type {Array<Record<string, any>>} */
     const rows = [];
+    // Parallel to `rows`, and the reason `rows` is allowed to be a local. One entry per row,
+    // holding where that row's line was read from and what it hashed to — enough for `/raw` to go
+    // back to one line without any of the parsed rows still being alive.
+    /** @type {Array<LineLocator>} */
+    const rowLocators = [];
     let skippedTotal = 0;
     let truncated = false;
     let readBytes = 0;
@@ -2545,7 +2689,7 @@ export async function start(context) {
       /** @type {ParsedRows} */
       let parsedFile;
       try {
-        parsedFile = await loadParsedRows(parsedRows, filePath, limit);
+        parsedFile = await loadParsedRows(parsedRows, filePath, limit, { cacheable: link.fileName !== activeFileName });
       } catch (error) {
         context.logger.error('miniapp.trajectory.read_error', { reason: 'messages_unreadable', code: errorCode(error) });
         sendError(response, 500, 'trajectory_unreadable', '会话数据暂时无法读取');
@@ -2560,13 +2704,16 @@ export async function start(context) {
       readBytes += parsedFile.read;
       skippedTotal += parsedFile.skipped;
       const keep = filter === null || filter === link.generation;
-      // The rows are shared with the cache and with every other request that read this file.
-      // Stamping the generation is the only write to them, and one filePath always maps to one
-      // generation, so it is idempotent. Pinned by tests/verify-parsed-rows.mjs.
-      for (const row of parsedFile.rows) {
+      // A sealed file's rows are shared with every other request that read it; the active file's
+      // are this request's alone and are released below. Either way stamping the generation is the
+      // only write, and one filePath always maps to one generation, so it is idempotent.
+      // Pinned by tests/verify-parsed-rows.mjs.
+      for (let index = 0; index < parsedFile.rows.length; index += 1) {
         if (keep) {
+          const row = parsedFile.rows[index];
           row[ROW_GENERATION] = link.generation;
           rows.push(row);
+          rowLocators.push(parsedFile.locators[index]);
         }
       }
     }
@@ -2606,11 +2753,15 @@ export async function start(context) {
 
     // Last thing before serializing, and the only place `raw` is ever touched: from here on
     // the body carries no message bodies at all.
-    // The locator map plus the rows it points into. Both are references: the rows are the
-    // same objects the parsed-rows cache holds, so this adds a map of numbers and an array of
-    // pointers rather than a second copy of the session. Keeping the array here also means
-    // /raw still answers after the parsed-rows cache has evicted the file.
-    const raws = splitRawRecords(payload.turns);
+    // The record -> locator map. Locators, not row references: the parsed rows behind them are
+    // about to stop existing, and this entry is what has to outlive them for `/raw` to still work.
+    const rowIndexByRecord = splitRawRecords(payload.turns);
+    /** @type {Map<number, LineLocator>} */
+    const raws = new Map();
+    for (const [recordIndex, rowIndex] of rowIndexByRecord) {
+      const locator = rowLocators[rowIndex];
+      if (locator !== undefined) raws.set(recordIndex, locator);
+    }
 
     let body;
     try {
@@ -2622,7 +2773,14 @@ export async function start(context) {
     // The family is the session plus the requested slice: the parts of the answer that stay the
     // same while it goes stale. Everything that decides whether the answer changed stays in the
     // key, so a newer version of one family replaces its predecessor instead of stacking beside it.
-    trajectoryCache.set(cacheKey, trajectoryCacheFamily(entry.dir, filter), { at: Date.now(), etag, body, raws, rows });
+    // `decoded` is filled in by /raw, at most RAW_DECODE_CACHE_ENTRIES lines' worth.
+    trajectoryCache.set(cacheKey, trajectoryCacheFamily(entry.dir, filter), { at: Date.now(), etag, body, raws, decoded: new Map() });
+    // Nothing below reads `rows` or `rowLocators`, and `payload` holds its own projections rather
+    // than the rows, so this is where the object graph stops being reachable. A sealed generation's
+    // rows are still held by the parsed-rows cache — that is the point of that cache — but the
+    // active file's are now only held by this array.
+    rows.length = 0;
+    rowLocators.length = 0;
     // `?since=` asks for the tail. The whole body is serialized either way — the cache
     // entry and /raw both need it — so this saves the transfer and the page's JSON.parse,
     // and not the server's work. Any reading of "41 MB → a few KB, so polling got faster"
@@ -2635,10 +2793,18 @@ export async function start(context) {
   /**
    * One record's untouched message, fetched only when something actually reads it.
    *
-   * Served out of the same cache entry as the bulk body, so opening the inspector's raw
-   * tab costs one record rather than a session. A miss means this process restarted
-   * between the two calls; saying so is more honest than silently showing the normalized
-   * record in a panel labelled 原文.
+   * The body no longer has the parsed rows behind it, so the line is read back out of the file it
+   * came from. That is a seek and a digest over one line, against the alternative of holding every
+   * session's object graph in memory for the life of the page — measured at 233 MB of the 378 MB
+   * this process held while one session was open.
+   *
+   * The digest is what makes that safe to do. Between building the body and answering this request
+   * the file can be rewritten; the trajectory entry is keyed on the file's size and mtime, so a
+   * rewrite that preserved both would otherwise be served the wrong message under the right
+   * record's name. Answering `raw_stale` says the session moved instead.
+   *
+   * A missing entry means this process restarted between the two calls; saying so is more honest
+   * than silently showing the normalized record in a panel labelled 原文.
    */
   const handleRaw = async (response, url) => {
     const ctx = await resolveTrajectoryRequest(url);
@@ -2656,9 +2822,34 @@ export async function start(context) {
       sendError(response, 503, 'trajectory_not_cached', '会话数据已释放，请重新加载');
       return;
     }
-    const rowIndex = cached.raws.get(wanted);
-    const row = rowIndex === undefined ? undefined : cached.rows[rowIndex];
-    if (rowIndex === undefined || !row || typeof row !== 'object') {
+    // Re-reading a record the reader has already opened is the common case, and a decoded message
+    // is far smaller than a session, so the entry keeps the ones it has already paid for.
+    const alreadyDecoded = cached.decoded.get(wanted);
+    if (alreadyDecoded !== undefined) {
+      sendJson(response, 200, { index: wanted, raw: alreadyDecoded.value, omitted: alreadyDecoded.omitted });
+      return;
+    }
+    const locator = cached.raws.get(wanted);
+    if (locator === undefined || typeof locator.filePath !== 'string') {
+      sendError(response, 404, 'record_not_found', '找不到该记录');
+      return;
+    }
+    const bytes = await readRange(locator.filePath, locator.start, locator.end);
+    if (bytes === null || lineDigest(bytes) !== locator.digest) {
+      context.logger.warn('miniapp.trajectory.read_error', { reason: 'raw_stale' });
+      sendError(response, 409, 'raw_stale', '该记录所在的文件已变化，请重新加载会话');
+      return;
+    }
+    /** @type {any} */
+    let row;
+    try {
+      row = JSON.parse(bytes.toString('utf8'));
+    } catch {
+      context.logger.warn('miniapp.trajectory.read_error', { reason: 'raw_unparseable' });
+      sendError(response, 409, 'raw_stale', '该记录所在的文件已变化，请重新加载会话');
+      return;
+    }
+    if (!row || typeof row !== 'object') {
       sendError(response, 404, 'record_not_found', '找不到该记录');
       return;
     }
@@ -2666,6 +2857,12 @@ export async function start(context) {
     // size verdict travels with it because the page has to be able to say "omitted" rather
     // than silently show something else — see tests/verify-raw-lazy.mjs.
     const built = buildRawPayload(row.message, redact);
+    cached.decoded.set(wanted, built);
+    while (cached.decoded.size > RAW_DECODE_CACHE_ENTRIES) {
+      const oldest = cached.decoded.keys().next();
+      if (oldest.done) break;
+      cached.decoded.delete(oldest.value);
+    }
     sendJson(response, 200, { index: wanted, raw: built.value, omitted: built.omitted });
   };
 
@@ -2764,10 +2961,9 @@ export async function start(context) {
     sessionsBody = { material: '', body: null };
     descriptorCache.clear();
     trajectoryCache.clear();
-    // The parsed-row cache is the largest of the three and was the only one not released here, so a
-    // disposed runtime kept a whole session's parsed rows alive — measured at roughly 43MB of heap
-    // still held for a 39MB session after dispose. It has the same clear() as the others and was
-    // simply missed; the line is here so the next cache added cannot repeat the omission quietly.
+    // The parsed-row cache only ever holds sealed generations now, but it is still a cache that
+    // has to be released here: a disposed runtime that kept it would still hold a rotated
+    // generation's rows. The line is here so the next cache added cannot repeat the omission.
     parsedRows.clear();
     clientEntry = null;
     disposal = close(server).then(() => undefined);
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-parsed-rows.py b/plugins/avatasia/mmc-trajectory/tests/mutate-parsed-rows.py
index ef3b6b9..1d49ae0 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-parsed-rows.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-parsed-rows.py
@@ -49,7 +49,7 @@
     (
         "server: `empty` is not carried on the cached value, so a hit stops reporting it",
         SERVER,
-        "    empty: head.text === '',\n",
+        "    empty: head.buffer.length === 0,\n",
         "    empty: false,\n",
     ),
     (
@@ -109,8 +109,8 @@
     (
         "the route parses the file inline again instead of going through the cache",
         SERVER,
-        "        parsedFile = await loadParsedRows(parsedRows, filePath, limit);",
-        "        parsedFile = await (async () => { const h = await readHead(filePath, limit); const p = parseMessagesJsonl(h.text); return { rows: p.rows, skipped: p.skipped, size: h.size, read: h.read, empty: h.text === '', truncated: truncatedByCap(h.size, limit) }; })();",
+        "        parsedFile = await loadParsedRows(parsedRows, filePath, limit, { cacheable: link.fileName !== activeFileName });",
+        "        parsedFile = await (async () => { const h = await readHead(filePath, limit); const p = parseMessagesJsonl(h.buffer); return { rows: p.rows, locators: p.spans.map(([s, e]) => ({ start: s, end: e, digest: lineDigest(h.buffer.subarray(s, e)) })), skipped: p.skipped, size: h.size, read: h.read, empty: h.buffer.length === 0, truncated: truncatedByCap(h.size, limit) }; })();",
     ),
 ]
 
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-raw-lazy.py b/plugins/avatasia/mmc-trajectory/tests/mutate-raw-lazy.py
index 8895b25..7bdf1bf 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-raw-lazy.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-raw-lazy.py
@@ -67,8 +67,8 @@
     (
         "server: /raw keeps the rows out of the cache entry, so it cannot resolve a locator",
         SERVER,
-        "trajectoryCache.set(cacheKey, trajectoryCacheFamily(entry.dir, filter), { at: Date.now(), etag, body, raws, rows });",
-        "trajectoryCache.set(cacheKey, trajectoryCacheFamily(entry.dir, filter), { at: Date.now(), etag, body, raws });",
+        "body, raws, decoded: new Map() });",
+        "body, decoded: new Map() });",
     ),
     # ---- the cap must still hold, wherever it now lives ----------------------
     (
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-raw-locators.py b/plugins/avatasia/mmc-trajectory/tests/mutate-raw-locators.py
new file mode 100644
index 0000000..7485770
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-raw-locators.py
@@ -0,0 +1,244 @@
+"""Mutation control for verify-raw-locators.mjs.
+
+Each mutation reintroduces exactly one bug the guard is supposed to catch, and the guard must FAIL
+every time. A mutation the guard still passes means the assertion was tautological; a mutation whose
+anchor no longer exists means the assertion went dead, which is worse — the runner reports both as
+misses, and they look the same from outside.
+
+The two that matter most are here in the middle, and they are deliberately near-neighbours:
+
+  * a span recorded as a character offset rather than a byte offset, and
+  * a digest taken over the wrong slice.
+
+Both leave /raw answering 200 with a plausible message. Neither throws, neither logs, and neither
+changes a number any surface reports. The only thing standing between them and a wrong answer is
+the guard, which is why they get one each rather than being folded together.
+"""
+import subprocess
+import sys
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parent
+SERVER = ROOT / "miniapp" / "node" / "server.mjs"
+CLIENT = ROOT / "miniapp" / "client" / "index.html"
+PROBE = HERE / "verify-raw-locators.mjs"
+
+MUTATIONS = [
+    # ---- the positions ---------------------------------------------------------------
+    (
+        "server: a span is off by one byte, so it reads the tail of the previous line",
+        SERVER,
+        "          spans.push([start, end]);",
+        "          spans.push([start + 1, end]);",
+    ),
+    (
+        "server: the span runs to the start of the next line instead of the end of this one",
+        SERVER,
+        "    const end = newline === -1 ? bytes.length : newline;",
+        "    const end = newline === -1 ? bytes.length : newline + 1;",
+    ),
+    (
+        "server: the locator's digest is taken over the whole file rather than the line",
+        SERVER,
+        "    digest: lineDigest(head.buffer.subarray(start, end)),",
+        "    digest: lineDigest(head.buffer),",
+    ),
+    (
+        "server: the digest swallows the line's newline, so the line and the line plus its terminator agree on nothing",
+        SERVER,
+        "    digest: lineDigest(head.buffer.subarray(start, end)),",
+        "    digest: lineDigest(head.buffer.subarray(start, end + 1)),",
+    ),
+    (
+        "server: the digest is truncated to 32 bits, where a session's worth of lines can collide",
+        SERVER,
+        "  return createHash('sha256').update(bytes).digest('hex').slice(0, LINE_DIGEST_CHARS);",
+        "  return createHash('sha256').update(bytes).digest('hex').slice(0, 8);",
+    ),
+    # ---- readRange --------------------------------------------------------------------
+    (
+        "server: a locator forgets which file it came from, so /raw has nowhere to read from",
+        SERVER,
+        """  const locators = parsed.spans.map(([start, end]) => ({
+    filePath,
+    start,""",
+        """  const locators = parsed.spans.map(([start, end]) => ({
+    start,""",
+    ),    (
+        "server: readRange hands back whatever it managed to read instead of refusing it",
+        SERVER,
+        """    const stat = await handle.stat();
+    if (stat.size < end) return null;
+    const buffer = Buffer.allocUnsafe(end - start);
+    let filled = 0;
+    while (filled < buffer.length) {
+      const { bytesRead } = await handle.read(buffer, filled, buffer.length - filled, start + filled);
+      if (bytesRead <= 0) return null;
+      filled += bytesRead;
+    }
+""",
+        """    const buffer = Buffer.allocUnsafe(end - start);
+    let filled = 0;
+    while (filled < buffer.length) {
+      const { bytesRead } = await handle.read(buffer, filled, buffer.length - filled, start + filled);
+      if (bytesRead <= 0) break;
+      filled += bytesRead;
+    }
+""",
+    ),
+    (
+        "server: readRange clamps a backwards range instead of refusing it",
+        SERVER,
+        "  if (!Number.isInteger(start) || !Number.isInteger(end) || start < 0 || end <= start) return null;",
+        "  if (!Number.isInteger(start) || !Number.isInteger(end) || start < 0) return null;\n  if (end <= start) end = start + 1;",
+    ),
+    (
+        "server: a missing file throws out of readRange instead of answering null",
+        SERVER,
+        "  let handle;\n  try {\n    handle = await open(filePath, 'r');\n  } catch {\n    return null;\n  }",
+        "  const handle = await open(filePath, 'r');",
+    ),
+    # ---- what is retained --------------------------------------------------------------
+    (
+        "server: the active file is cached again, which is the 233 MB this change removed",
+        SERVER,
+        "loadParsedRows(parsedRows, filePath, limit, { cacheable: link.fileName !== activeFileName })",
+        "loadParsedRows(parsedRows, filePath, limit)",
+    ),
+    (
+        "server: cacheable:false stores anyway, so the rows come back",
+        SERVER,
+        "  if (cacheable) cache.set(key, value, Math.ceil(head.size * PARSED_ROWS_HEAP_PER_SOURCE_BYTE));",
+        "  cache.set(key, value, Math.ceil(head.size * PARSED_ROWS_HEAP_PER_SOURCE_BYTE));",
+    ),
+    (
+        "server: cacheable:false still reads through the cache, so a stale sealed parse is served",
+        SERVER,
+        "  if (cacheable) {\n    const hit = cache.get(key);\n    if (hit !== null) return hit;\n  }",
+        "  const hit = cache.get(key);\n  if (hit !== null) return hit;",
+    ),
+    (
+        "server: the active file is decided by being the last one read rather than by name",
+        SERVER,
+        "cacheable: link.fileName !== activeFileName",
+        "cacheable: link.generation !== generations[generations.length - 1].generation",
+    ),
+    (
+        "server: the rows are put back into the cache entry, so the object graph stays resident",
+        SERVER,
+        "body, raws, decoded: new Map() });",
+        "body, raws, decoded: new Map(), rows });",
+    ),
+    (
+        "server: the rows are never released, so the request holds them until it returns",
+        SERVER,
+        "    rows.length = 0;\n    rowLocators.length = 0;",
+        "    rowLocators.length = 0;",
+    ),
+    (
+        "server: the decode cache is unbounded",
+        SERVER,
+        "    while (cached.decoded.size > RAW_DECODE_CACHE_ENTRIES) {",
+        "    while (false) {",
+    ),
+    # ---- what /raw does with what it found --------------------------------------------
+    (
+        "server: /raw serves the line without checking it is still the line the record describes",
+        SERVER,
+        "if (bytes === null || lineDigest(bytes) !== locator.digest) {",
+        "if (bytes === null) {",
+    ),
+    (
+        "server: /raw ignores where the line actually starts",
+        SERVER,
+        "const bytes = await readRange(locator.filePath, locator.start, locator.end);",
+        "const bytes = await readRange(locator.filePath, locator.start, locator.end + 1);",
+    ),
+    # ---- the page's own copy -----------------------------------------------------------
+    (
+        "client: the page's raw cache key drops the validator, so a moved-on session keeps its old messages",
+        CLIENT,
+        "        return sid + '#' + gen + '#' + (state.etag || '') + '#' + index;",
+        "        return sid + '#' + gen + '#' + index;",
+    ),
+    (
+        "client: a refused raw is reloaded and retried, turning a hint into a reload the reader never asked for",
+        CLIENT,
+        "if (!retried && err && err.code === 'trajectory_not_cached') {",
+        "if (!retried && err && (err.code === 'trajectory_not_cached' || err.code === 'raw_stale')) {",
+    ),
+]
+
+
+def read_exact(path):
+    """Normalise to LF for matching, and report the file's own newline so it can be put back."""
+    data = path.read_bytes()
+    text = data.decode("utf-8").replace("\r\n", "\n")
+    return text, ("\r\n" if b"\r\n" in data else "\n")
+
+
+def write_exact(path, text, newline):
+    if newline == "\r\n":
+        text = text.replace("\n", "\r\n")
+    path.write_bytes(text.encode("utf-8"))
+
+
+def run_probe():
+    proc = subprocess.run(
+        ["node", str(PROBE)],
+        cwd=str(ROOT),
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+    )
+    return proc.returncode, (proc.stdout or "") + (proc.stderr or "")
+
+
+def main():
+    code, output = run_probe()
+    if code != 0:
+        print("baseline probe does not pass; fix that first")
+        print(output)
+        return 1
+    print("baseline clean")
+
+    originals = {path: path.read_bytes() for path in {m[1] for m in MUTATIONS}}
+    missed = []
+    for label, path, old, new in MUTATIONS:
+        text, newline = read_exact(path)
+        if old not in text:
+            print(f"SKIP  {label}: anchor not found in {path.name}")
+            missed.append(label)
+            continue
+        write_exact(path, text.replace(old, new, 1), newline)
+        try:
+            code, output = run_probe()
+        finally:
+            path.write_bytes(originals[path])
+        if code == 0:
+            print(f"MISSED {label}: the probe still passed")
+            missed.append(label)
+        else:
+            first = next(
+                (line.strip() for line in output.splitlines() if line.strip().startswith("- ")),
+                "(no detail)",
+            )
+            print(f"caught {label}\n         -> {first}")
+
+    for path, data in originals.items():
+        if path.read_bytes() != data:
+            print(f"NOT RESTORED {path}")
+            return 1
+    print("all files restored byte-for-byte")
+
+    if missed:
+        print(f"\n{len(missed)} mutation(s) got through")
+        return 1
+    print(f"\nall {len(MUTATIONS)} mutations caught")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py b/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py
index 4408c5c..58e92de 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py
@@ -144,8 +144,8 @@
      "nothing still points at a docs/ file that does not ship"),
 
     ("the server source points at the document that left the package",
-     "// generation, so it is idempotent. Pinned by",
-     "// generation, so it is idempotent — see docs/LAYERS.md D10.",
+     "// only write, and one filePath always maps to one generation, so it is idempotent.",
+     "// only write, and one filePath always maps to one generation, so it is idempotent. See docs/LAYERS.md §5.",
      "nothing still points at a docs/ file that does not ship"),
 
     # And the reason an audit of server.mjs under-reported it by two thirds: one NUL byte, in a string
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-cache.py b/plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-cache.py
index 9fcc10d..4f31a03 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-cache.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-cache.py
@@ -47,8 +47,8 @@
     (
         "the route names the whole key as the family, so every version is its own family",
         SERVER,
-        "trajectoryCache.set(cacheKey, trajectoryCacheFamily(entry.dir, filter), { at: Date.now(), etag, body, raws, rows });",
-        "trajectoryCache.set(cacheKey, cacheKey, { at: Date.now(), etag, body, raws, rows });",
+        "trajectoryCache.set(cacheKey, trajectoryCacheFamily(entry.dir, filter), { at: Date.now(), etag, body, raws, decoded: new Map() });",
+        "trajectoryCache.set(cacheKey, cacheKey, { at: Date.now(), etag, body, raws, decoded: new Map() });",
     ),
     (
         "the family stops naming the slice, so one session's generations evict each other",
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-parsed-rows.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-parsed-rows.mjs
index ac23e8c..06cbd63 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-parsed-rows.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-parsed-rows.mjs
@@ -13,6 +13,12 @@
  * through the cache — build the payload both ways, and require the serialized bodies to be
  * identical. Not "looks the same", identical.
  *
+ * What the cache now covers is narrower than it was: only sealed generations are retained, because
+ * for the file being appended to the key cannot hit by construction. That narrower job is pinned in
+ * tests/verify-raw-locators.mjs, along with what replaced the rows for `/raw`. What is left here is
+ * the cache's own correctness — that a hit is identical to a cold read, that its key names
+ * everything it must name, and that it cannot serve one session's rows to another.
+ *
  * The key's three components are each tested by the failure they exist to prevent:
  * a path, because every session has a `messages.jsonl` and a basename key lets two of them
  * collide; a size, because the active file grows; a limit, because readHead truncates at it.
@@ -322,9 +328,11 @@ assert('the cache is created inside start(), not at module level',
   && !/\nconst parsedRows = createParsedRowsCache\(/.test(SERVER.slice(0, startAt)));
 
 assert('the route reaches the file through loadParsedRows()',
-  startBody.includes('await loadParsedRows(parsedRows, filePath, limit)'));
+  startBody.includes('await loadParsedRows(parsedRows, filePath, limit, { cacheable: link.fileName !== activeFileName })'));
 assert('the route no longer parses messages inline',
   !startBody.includes('parseMessagesJsonl(head.text)'));
+assert('the bytes readHead returns are what gets parsed, not a decoded string',
+  SERVER.includes('parseMessagesJsonl(head.buffer)'));
 assert('the key is built from a stat of the file, not from the catalog',
   /const current = await stat\(filePath\);/.test(SERVER)
   && !/parsedRowsKey\(filePath, entry\.sizeBytes/.test(SERVER)
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-raw-lazy.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-raw-lazy.mjs
index ef01cbf..3b8fda6 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-raw-lazy.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-raw-lazy.mjs
@@ -147,15 +147,18 @@ assert('handleRaw exists', handleRawAt > 0);
 const handleRawBody = SERVER.slice(handleRawAt, SERVER.indexOf('};', handleRawAt));
 assert('it calls buildRawPayload, i.e. it builds rather than looks up a stored message',
   handleRawBody.includes('buildRawPayload(row.message, redact)'));
-assert('it follows the locator back to a row', handleRawBody.includes('cached.rows[rowIndex]'));
+assert('it follows the locator back into the file the record came from',
+  handleRawBody.includes('readRange(locator.filePath, locator.start, locator.end)'));
 assert('it reports the verdict alongside the message', /omitted: built\.omitted/.test(handleRawBody));
 assert('a missing row is still a 404, not an empty message', handleRawBody.includes("'record_not_found'"));
-// The entry shape lives in createTrajectoryCache now, so this asserts the thing the two
-// assertions above jointly depend on: the route stores `rows` into the entry, and /raw reads
-// `cached.rows` back out of it. Anchoring on the old JSDoc type comment instead would have made
-// the assertion a check on where a type was written rather than on what the route does.
-assert('the cache entry keeps the rows the locators point into',
-  SERVER.includes('trajectoryCache.set(cacheKey, trajectoryCacheFamily(entry.dir, filter), { at: Date.now(), etag, body, raws, rows })'));
+// The entry shape lives in createTrajectoryCache now, so this asserts the thing the assertions
+// above jointly depend on: the route stores the record->locator map into the entry, and /raw reads
+// `cached.raws` back out of it. It used to store `rows` and read `cached.rows`, which is the thing
+// that was costing 233 MB; anchoring on the JSDoc type comment instead would have made this a
+// check on where a type was written rather than on what the route does.
+assert('the cache entry keeps the locators /raw follows, keyed by record',
+  SERVER.includes('raws, decoded: new Map() })')
+  && handleRawBody.includes('cached.raws.get(wanted)'));
 
 /* =====================================================================
  * 4 — each of the five readers, by name
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-raw-locators.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-raw-locators.mjs
new file mode 100644
index 0000000..b60012a
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-raw-locators.mjs
@@ -0,0 +1,271 @@
+/**
+ * `/raw` must still answer after the parsed rows it used to point into are gone.
+ *
+ * The rows are released on purpose. Retaining a session's parsed object graph was the largest
+ * single cost in this process: 378 MB of heap held while one 68 MB session was open, against
+ * 145 MB once the active generation's rows are not kept. What is kept instead is, per record, the
+ * file it came from, the byte range of its line, and a digest of that line — about 40 bytes a
+ * record instead of the megabytes the rows cost.
+ *
+ * So this guard is about the seam that replacement creates, in three parts:
+ *
+ *   1. The positions are real. A span must be a byte range into the file, read from offset 0, so
+ *      that `readRange(file, start, end)` gives back exactly the line that was parsed. Getting
+ *      this wrong is silent: JSON.parse of the wrong bytes either throws or, worse, succeeds on a
+ *      neighbouring line.
+ *   2. The digest means something. Same length, same offset, different content must be caught —
+ *      that is the whole case the digest exists for, because the trajectory entry is keyed on size
+ *      and mtime and so cannot see a rewrite that preserved both.
+ *   3. The route actually uses it. These are structural assertions on the source, because the
+ *      property they describe ("the entry holds locators, not rows") is not observable from any
+ *      exported function.
+ *
+ * Read-only: imports the pure helpers and reads files it wrote itself, never starts the runtime
+ * and never touches a real session store. mutate-raw-locators.py breaks each of these in the
+ * shipped file.
+ */
+import { mkdtemp, writeFile, rm, utimes } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { readFileSync } from 'node:fs';
+import {
+  createParsedRowsCache,
+  lineDigest,
+  loadParsedRows,
+  parseMessagesJsonl,
+  readHead,
+  readRange,
+} from '../miniapp/node/server.mjs';
+
+const SERVER = readFileSync(new URL('../miniapp/node/server.mjs', import.meta.url), 'utf8');
+const CLIENT = readFileSync(new URL('../miniapp/client/index.html', import.meta.url), 'utf8');
+
+let pass = 0;
+const failures = [];
+function check(name, actual, expected) {
+  if (JSON.stringify(actual) === JSON.stringify(expected)) pass += 1;
+  else failures.push(`${name}: got ${JSON.stringify(actual)}, want ${JSON.stringify(expected)}`);
+}
+function assert(name, cond) {
+  if (cond) pass += 1;
+  else failures.push(name);
+}
+
+const LIMIT = 64 * 1024 * 1024;
+const root = await mkdtemp(join(tmpdir(), 'raw-locators-'));
+
+/* =====================================================================
+ * 1 — spans are byte ranges into the file, not into the decoded string
+ * ===================================================================== */
+
+const ROWS = [
+  { message_id: 'm1', turn_id: 't1', message: { role: 'user', content: 'first', timestamp: 1791617886000 } },
+  { message_id: 'm2', turn_id: 't1', message: { role: 'assistant', content: [{ type: 'text', text: 'ok' }], timestamp: 1791617891000 } },
+  { message_id: 'm3', turn_id: 't2', message: { role: 'user', content: '中文内容', timestamp: 1791617895000 } },
+  { message_id: 'm4', turn_id: 't2', message: { role: 'toolResult', content: 'done', timestamp: 1791617897000 } },
+];
+// Multi-byte content on purpose: a UTF-16 index and a byte offset stop agreeing the moment a line
+// leaves ASCII, so a guard written only in ASCII would pass on the bug this pins.
+const jsonl = ROWS.map((r) => JSON.stringify(r)).join('\n') + '\n';
+
+const file = join(root, 'messages.jsonl');
+await writeFile(file, jsonl);
+
+const head = await readHead(file, LIMIT);
+const parse = parseMessagesJsonl(head.buffer);
+check('one span per parsed row', parse.spans.length, ROWS.length);
+check('one row per span', parse.rows.length, ROWS.length);
+assert('the fixture really does contain a multi-byte line', Buffer.byteLength(jsonl) > jsonl.length);
+
+let spansExact = true;
+for (let i = 0; i < ROWS.length; i += 1) {
+  const [start, end] = parse.spans[i];
+  const line = head.buffer.subarray(start, end).toString('utf8');
+  if (JSON.parse(line).message_id !== ROWS[i].message_id) spansExact = false;
+}
+assert('every span reads back as exactly the line it produced the row from', spansExact);
+
+const thirdLine = JSON.stringify(ROWS[2]);
+check('the multi-byte row is found by the byte span', head.buffer.subarray(parse.spans[2][0], parse.spans[2][1]).toString('utf8'), thirdLine);
+// The character index of the same line, which is what the old string-based parse produced. The
+// two agree on where the line STARTS — everything before it is ASCII — and part company at its
+// end, which is why the guard has to compare the end and not the start.
+const charIndex = jsonl.indexOf(thirdLine);
+check('the start is the same either way, because everything before it is ASCII', charIndex, parse.spans[2][0]);
+assert('but the byte end and the character end are different numbers',
+  parse.spans[2][1] !== charIndex + thirdLine.length);
+assert('and the byte end is larger, because the CJK characters are 3 bytes each',
+  parse.spans[2][1] > charIndex + thirdLine.length);
+check('by exactly the extra bytes those characters take',
+  parse.spans[2][1] - (charIndex + thirdLine.length),
+  Buffer.byteLength(thirdLine) - thirdLine.length);
+
+// readHead must start at offset 0 or none of this means anything.
+assert('readHead reads from the start of the file', /handle\.read\(buffer, filled, wanted - filled, filled\)/.test(SERVER));
+check('so the first span starts at byte 0', parse.spans[0][0], 0);
+
+/* =====================================================================
+ * 2 — the locators a parse carries
+ * ===================================================================== */
+
+const sealedCache = createParsedRowsCache(64 * 1024 * 1024);
+const sealed = await loadParsedRows(sealedCache, file, LIMIT);
+check('one locator per row', sealed.locators.length, sealed.rows.length);
+assert('every locator carries a start, an end and a digest',
+  sealed.locators.every((l) => Number.isInteger(l.start) && Number.isInteger(l.end)
+    && l.end > l.start && typeof l.digest === 'string' && l.digest.length > 0));
+// The file is part of the locator rather than something the route adds on the way past. It used to
+// be, which meant a spread per row — 36,527 of them on a session this size — and a cached entry
+// whose locators were unusable until a caller remembered to complete them.
+assert('every locator names the file it was read from, complete',
+  sealed.locators.every((l) => l.filePath === file));
+assert('the digest is 64 bits of hex', sealed.locators.every((l) => /^[0-9a-f]{16}$/.test(l.digest)));
+
+let digestsMatch = true;
+let locatorAgrees = true;
+for (let i = 0; i < sealed.locators.length; i += 1) {
+  const { start, end, digest } = sealed.locators[i];
+  if (lineDigest(head.buffer.subarray(start, end)) !== digest) digestsMatch = false;
+  if (start !== parse.spans[i][0] || end !== parse.spans[i][1]) locatorAgrees = false;
+}
+assert('each digest is taken over exactly the bytes its locator names', digestsMatch);
+assert('and the locator and the parse agree on every position', locatorAgrees);
+
+const roundTrip = await readRange(file, sealed.locators[2].start, sealed.locators[2].end);
+assert('readRange returns exactly the line the locator names',
+  roundTrip !== null && roundTrip.toString('utf8') === thirdLine);
+check('and its digest is the one recorded', lineDigest(roundTrip), sealed.locators[2].digest);
+
+/* =====================================================================
+ * 3 — readRange refuses rather than returning whatever is there
+ * ===================================================================== */
+
+check('a range that starts after it ends is refused', await readRange(file, 10, 10), null);
+check('a backwards range is refused', await readRange(file, 20, 10), null);
+check('a negative start is refused', await readRange(file, -1, 10), null);
+check('a non-integer start is refused', await readRange(file, 1.5, 10), null);
+check('a range past the end of the file is refused', await readRange(file, 0, Buffer.byteLength(jsonl) + 1), null);
+check('but one that ends exactly at the end is not', (await readRange(file, 0, Buffer.byteLength(jsonl)))?.length, Buffer.byteLength(jsonl));
+// A file that cannot be opened has to answer, not throw: this runs inside a request handler, and
+// an exception here is a 500 for the reader rather than the 409 they should get.
+let missingThrew = false;
+let missingAnswer = null;
+try {
+  missingAnswer = await readRange(join(root, 'no-such-file.jsonl'), 0, 10);
+} catch {
+  missingThrew = true;
+}
+assert('a missing file is refused, not thrown', !missingThrew && missingAnswer === null);
+
+/* =====================================================================
+ * 4 — the case the digest exists for
+ *
+ * Same path, same length, same mtime, different content. Nothing above the file level can see it:
+ * the trajectory entry is keyed on size and mtime, so it stays valid and the record still names
+ * its index. Without the digest this line would be served under the wrong record's name.
+ * ===================================================================== */
+
+const rewritten = join(root, 'rewritten.jsonl');
+await writeFile(rewritten, jsonl);
+const beforeRewrite = await loadParsedRows(createParsedRowsCache(1024), rewritten, LIMIT, { cacheable: false });
+const swap = jsonl.replace('"first"', '"firsx"');
+assert('the rewrite is the same byte length, which is the point', Buffer.byteLength(swap) === Buffer.byteLength(jsonl));
+await writeFile(rewritten, swap);
+const frozen = new Date(1791617886000);
+await utimes(rewritten, frozen, frozen);
+const locatorBefore = beforeRewrite.locators[0];
+const bytesAfter = await readRange(rewritten, locatorBefore.start, locatorBefore.end);
+assert('the bytes at the recorded position did change', bytesAfter.toString('utf8') !== jsonl.slice(0, locatorBefore.end - locatorBefore.start));
+assert('equal length is not mistaken for equal content', bytesAfter.length === locatorBefore.end - locatorBefore.start);
+assert('and the digest is what says so',
+  lineDigest(bytesAfter) !== locatorBefore.digest);
+
+/* =====================================================================
+ * 5 — the active file is parsed every time and retained never
+ * ===================================================================== */
+
+const activeCache = createParsedRowsCache(64 * 1024 * 1024);
+const firstPass = await loadParsedRows(activeCache, file, LIMIT, { cacheable: false });
+const secondPass = await loadParsedRows(activeCache, file, LIMIT, { cacheable: false });
+check('cacheable:false stores nothing', activeCache.size, 0);
+assert('so every call really parses', firstPass !== secondPass);
+assert('while still returning equal content',
+  JSON.stringify(firstPass.rows) === JSON.stringify(secondPass.rows));
+
+const mixedCache = createParsedRowsCache(64 * 1024 * 1024);
+await loadParsedRows(mixedCache, file, LIMIT, { cacheable: false });
+check('an uncacheable call stores nothing even in an empty cache', mixedCache.size, 0);
+const kept = await loadParsedRows(mixedCache, file, LIMIT);
+check('a cacheable call does store', mixedCache.size, 1);
+await loadParsedRows(mixedCache, file, LIMIT, { cacheable: false });
+check('and an uncacheable one does not disturb what is there', mixedCache.size, 1);
+// Two halves, and both matter. Reading through the cache when told not to is the dangerous one:
+// it hands back a parse of whatever the file held when it was stored, which for the file being
+// appended to is exactly the stale answer this change exists to stop serving.
+assert('a cacheable call does hit the cache', (await loadParsedRows(mixedCache, file, LIMIT)) === kept);
+const despite = await loadParsedRows(mixedCache, file, LIMIT, { cacheable: false });
+assert('an uncacheable call parses anyway, even with that file sitting in the cache', despite !== kept);
+assert('and still returns equal content', JSON.stringify(despite.rows) === JSON.stringify(kept.rows));
+
+/* =====================================================================
+ * 6 — structure: the route keeps locators, not rows
+ * ===================================================================== */
+
+const startAt = SERVER.indexOf('export async function start(');
+assert('start() exists', startAt > 0);
+const startBody = SERVER.slice(startAt);
+
+assert('the route asks not to cache the file being appended to',
+  startBody.includes('loadParsedRows(parsedRows, filePath, limit, { cacheable: link.fileName !== activeFileName })'));
+assert('and that test names the active file rather than whatever it read last',
+  startBody.includes('const activeFileName = lineage.chain[lineage.chain.length - 1].fileName;'));
+assert('the entry keeps a locator map and a decode cache',
+  /trajectoryCache\.set\(cacheKey,[\s\S]{0,200}?raws[\s\S]{0,200}?decoded: new Map\(\)/.test(startBody));
+assert('and not the rows it used to keep',
+  !/trajectoryCache\.set\(cacheKey,[\s\S]{0,200}?\{[^}]*\brows\b[^}]*\}\)/.test(startBody));
+assert('the rows array is emptied once nothing else can reach it', startBody.includes('rows.length = 0;'));
+assert('and the locator array goes with it', startBody.includes('rowLocators.length = 0;'));
+
+// The route must not reach into rows for /raw any more; it seeks.
+const handleRawAt = startBody.indexOf('const handleRaw = async');
+assert('handleRaw exists', handleRawAt > 0);
+const rawBody = startBody.slice(handleRawAt, startBody.indexOf('const handleDashboard'));
+assert('handleRaw does not read the rows the entry used to keep', !rawBody.includes('cached.rows'));
+assert('it reads the line back through readRange', rawBody.includes('readRange(locator.filePath, locator.start, locator.end)'));
+assert('and refuses the answer when the digest disagrees',
+  rawBody.includes('lineDigest(bytes) !== locator.digest') && rawBody.includes("'raw_stale'"));
+assert('the decode cache is bounded rather than grown',
+  rawBody.includes('cached.decoded.size > RAW_DECODE_CACHE_ENTRIES'));
+assert('RAW_DECODE_CACHE_ENTRIES is a real bound, not a comment',
+  /const RAW_DECODE_CACHE_ENTRIES = \d+;/.test(SERVER));
+assert('the decode cache is per entry, so a new body starts empty',
+  /trajectoryCache\.set\([\s\S]{0,200}?decoded: new Map\(\)/.test(startBody));
+
+/* =====================================================================
+ * 7 — structure: the page keys its own raw cache on the version
+ *
+ * The server binding the message to the body it was built from does not cover the browser's copy.
+ * A record index is a position within one version of one body, so without the validator in the
+ * key the page keeps showing the previous version's message for the same record.
+ * ===================================================================== */
+
+const rawCacheKeyAt = CLIENT.indexOf('function rawCacheKey(index)');
+assert('rawCacheKey exists', rawCacheKeyAt > 0);
+const keyBody = CLIENT.slice(rawCacheKeyAt, rawCacheKeyAt + 900);
+assert("the page's raw cache key includes the validator", /state\.etag/.test(keyBody));
+assert('and still the session and the index', keyBody.includes("sid + '#' + gen + '#'"));
+// A raw the server refuses is a hint, not a broken tab, so there is deliberately no second chance
+// for it: `raw_stale` stays out of the reload-and-retry path and lands on the same line every
+// other raw failure uses. What must not happen is the opposite — a stale answer being kept.
+assert('a refused raw is reported, not retried into a loop',
+  !/err\.code === 'raw_stale'/.test(CLIENT)
+  && CLIENT.includes("err.code === 'trajectory_not_cached'"));
+
+await rm(root, { recursive: true, force: true });
+
+if (failures.length) {
+  console.error(`\n[raw-locators] ${failures.length} FAILED, ${pass} passed`);
+  for (const f of failures) console.error('  - ' + f);
+  process.exit(1);
+}
+console.log(`\n[raw-locators] ${pass} assertions passed`);

From 99674b5bfa810921043e178cbaf086af0bdfbacd Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 01:47:04 +0800
Subject: [PATCH 06/36] Merge stored copies into one message, and decide a
 turn's opener over the lineage
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A message can be stored more than once across a lineage: the active file may
re-record one a sealed snapshot already holds, and sealing a generation can
rewrite old tool results in place. Neither is a row that can simply be
dropped — one is a second copy of one version, the other a second version of
one message — so the route now merges them and keeps both.

  buildMessageIdentity() folds every occurrence into one identity and records
  the content versions it was written in; selectIdentityView() then picks the
  rows one request projects. The whole lineage shows each message once, at its
  first version; a generation shows that generation's own stored context. A
  row with no usable id is never keyed together with another.

Two readings of "the same message" disagreed about one field.
contentFingerprint() dropped history_artifact, because the newer generation's
opener carries it while nothing about the message changed; equalOutsideContent()
counted it, so whether a rewrite read as a declared trim depended on which row
happened to carry the generation's annotation. It now ignores it too. Checked
against the session store on this machine, the two comparisons disagree about
none of the pairs compared — the change is behaviour-preserving on the data
that exists, and it stops depending on annotation placement in future data.

A turn's opener is decided over the whole lineage rather than the projected
slice. Deciding it from the slice is what let a real steer become the first
visible prompt of its own turn whenever the opener's generation was filtered
away: it counted as dialogue instead of a redirect, and its turn was filed as
neither prompted nor closed. Turns now report openerInView / openerOutOfView
so those two facts stay apart — a view can hold a turn's steer without holding
the row that opened it.

stats.messagesAll counts logical messages over the reachable lineage instead of
summing the per-file counts the catalog recorded, so a message stored twice is
one message and a generation slice no longer shrinks the session total. The
physical count moves to stats.messageRowsAll, and each generation reports the
messages it stores as logicalMessageCount. The picker reads that, and the
generation banner now says which generation is still growing — the picker can
pin the live one, which the previous wording promised would never change.
---
 .../mmc-trajectory/miniapp/client/index.html  |  16 +-
 .../mmc-trajectory/miniapp/node/server.mjs    | 462 ++++++++++++++++--
 2 files changed, 443 insertions(+), 35 deletions(-)

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
index b0753c6..f7b3689 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
+++ b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
@@ -3080,12 +3080,16 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
           .map(function (entry) {
             var active = entry.generation === activeGeneration || entry.active === true;
             var label = '第 ' + formatInt(entry.generation) + ' 代';
+            // The count is how many logical messages THAT generation stores, which is not the
+            // catalog's per-file row count: one message recorded twice is one message, and a
+            // message sealed in an earlier generation and re-recorded here counts in both.
+            var stored = isCount(entry.logicalMessageCount) ? entry.logicalMessageCount : null;
             if (active) label += '（当前）';
-            else if (isCount(entry.messageCount)) label += '（' + formatInt(entry.messageCount) + ' 条）';
+            else if (isCount(stored)) label += '（' + formatInt(stored) + ' 条）';
             return {
               generation: entry.generation,
               active: active,
-              messageCount: isCount(entry.messageCount) ? entry.messageCount : null,
+              messageCount: stored,
               label: label
             };
           });
@@ -8351,9 +8355,13 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         var shown = session && isCount(session.generation) ? session.generation : state.generation;
         dom.generationHint.hidden = !pinned;
         if (pinned) {
+          // Whether this generation is still growing is the difference between a promise and a
+          // description, and the picker can pin the live one. The old wording promised a sealed
+          // snapshot never changes while being shown for whichever generation was picked.
+          var live = !session || !isCount(session.activeGeneration) || session.activeGeneration === shown;
           dom.generationHint.textContent = '正在查看第 ' + formatInt(shown) +
-            ' 代上下文 —— 这是压缩前的历史快照，不会随后续对话更新。全部上下文共 ' +
-            formatInt(statsAll()) + ' 条消息。';
+            ' 代存储的上下文' + (live ? '，它仍在随后续对话更新' : '，这是当时封存的快照，不会随后续对话更新') +
+            '。全部上下文共 ' + formatInt(statsAll()) + ' 条消息。';
         }
       }
 
diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
index abde241..dce72f7 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
@@ -1104,6 +1104,346 @@ export function splitRawRecords(turns) {
   return raws;
 }
 
+/**
+ * The runtime's marker for a tool result it dropped while compacting the context.
+ *
+ * Measured across the whole session store: 141 occurrences, and every one of them the same
+ * wording. This is what separates "the runtime rewrote this message" from "something else
+ * changed it" — and that distinction decides whether a repeated message_id is a second COPY of
+ * one message or a second VERSION of it.
+ */
+const TOOL_RESULT_REMOVED = /\[Tool result removed by context compaction\.\]/;
+
+/**
+ * Two rows are the same message with its content taken out — the comparison that tells a declared
+ * trim apart from a rewrite nobody claimed.
+ *
+ * Only `message.content` is removed, because only it is supposed to change: a trim replaces the
+ * result text and leaves the tool name, the call id, the error flag and the turn alone. Anything
+ * else moving means this is not the transformation we recognise.
+ *
+ * `history_artifact` is removed too, for the same reason `contentFingerprint()` removes it. It is
+ * the declaring generation's provenance about itself, not a property of the message, and the store
+ * attaches it to a generation's own opener row rather than to the message it rewrote. Counting it
+ * here made whether a trim was recognised depend on which row happened to carry the annotation —
+ * so a correct rewrite sitting on an annotated row read as an unexplained difference, and the two
+ * functions disagreed about the same field for opposite reasons.
+ *
+ * @param {any} a
+ * @param {any} b
+ * @returns {boolean}
+ */
+function equalOutsideContent(a, b) {
+  if (a === null || b === null || typeof a !== 'object' || typeof b !== 'object') return false;
+  const am = a.message;
+  const bm = b.message;
+  if (am === null || bm === null || typeof am !== 'object' || typeof bm !== 'object') return false;
+  const { history_artifact: _omittedFromA, ...restA } = a;
+  const { history_artifact: _omittedFromB, ...restB } = b;
+  const left = JSON.stringify({ ...restA, message: { ...am, content: null } });
+  const right = JSON.stringify({ ...restB, message: { ...bm, content: null } });
+  return left === right;
+}
+
+/**
+ * What makes two occurrences the same CONTENT VERSION of a message.
+ *
+ * Not the raw line. The newer generation's own opener carries `history_artifact`, so its bytes
+ * differ from the identical row in the sealed snapshot while nothing about the message changed —
+ * that row is the same version with provenance attached, not a second version. So the fingerprint
+ * drops `history_artifact` and nothing else; `message.content` stays in, because that is exactly
+ * what a version difference is.
+ *
+ * @param {any} row
+ * @returns {string}
+ */
+function contentFingerprint(row) {
+  if (row === null || typeof row !== 'object') return '';
+  const { history_artifact: _omitted, ...rest } = row;
+  return JSON.stringify(rest);
+}
+
+/**
+ * Is this row one the runtime trimmed?
+ *
+ * All four have to hold, and each one on its own is not enough. The marker describes a
+ * GENERATION, not every change inside it; the placeholder wording on its own is just a string that
+ * happens to appear. What is not stated anywhere is assumed not to have happened.
+ *
+ * @param {any} olderRow
+ * @param {any} newerRow
+ * @param {Set<number>} trimmedGenerations generations that declare `producedBy: 'tool_trim'`
+ * @param {number|null} newerGeneration
+ * @returns {boolean}
+ */
+function isDeclaredTrim(olderRow, newerRow, trimmedGenerations, newerGeneration) {
+  if (olderRow?.message?.role !== 'toolResult' || newerRow?.message?.role !== 'toolResult') return false;
+  if (!equalOutsideContent(olderRow, newerRow)) return false;
+  const text = contentToPlainText(newerRow.message.content) ?? '';
+  if (!TOOL_RESULT_REMOVED.test(text)) return false;
+  return newerGeneration !== null && trimmedGenerations.has(newerGeneration);
+}
+
+/**
+ * One logical message, and every content version it was stored in.
+ *
+ * @typedef {object} MessageVersion
+ * @property {string|null} digest
+ * @property {number|null} generation
+ * @property {any} locator
+ * @property {any} row
+ * @property {number} occurrences how many times this exact version turned up
+ * @property {'only'|'trimmed'|'unclassified'} relation how it differs from the first version
+ */
+
+/**
+ * Merge every occurrence of a message across the whole lineage into one identity.
+ *
+ * A message can be stored more than once: the active file may re-record a message a sealed
+ * snapshot already holds (the same bytes, so it is a second copy of one version), and sealing a
+ * generation can rewrite old tool results in place (different bytes, so it is a second version).
+ * Treating either as "delete the later row" loses a message or loses a version, so neither is
+ * what this does: it keeps both and says which kind it is.
+ *
+ * Rows with no usable id are NOT keyed together. The builder accepts a non-string id and maps it
+ * to null, and a shared `null` key would delete real rows or reject the request outright, so
+ * those rows pass straight through in `unkeyed`.
+ *
+ * @param {Array<{ row: any, generation: number|null, locator: any }>} occurrences in lineage order, oldest first
+ * @returns {{
+ *   identities: Map<string, { id: string, turnId: string|null, role: string|null, versions: MessageVersion[], openers: string[] }>,
+ *   unkeyed: Array<{ row: any, generation: number|null, locator: any }>,
+ *   openers: Map<string, string>,
+ *   openerOccurrence: Map<string, { row: any, generation: number|null, locator: any }>,
+ *   conflicts: Array<{ id: string, reason: string, expected: any, found: any }>,
+ *   unclassified: Array<{ id: string, olderGeneration: number|null, newerGeneration: number|null }>,
+ *   trimmedGenerations: Set<number>,
+ *   stats: { occurrences: number, identities: number, identical: number, trimmed: number, unclassified: number, conflicts: number, unkeyed: number },
+ * }}
+ */
+export function buildMessageIdentity(occurrences) {
+  const identities = new Map();
+  const unkeyed = [];
+  const conflicts = [];
+  const unclassified = [];
+  const trimmedGenerations = new Set();
+  const openers = new Map();
+  // Which OCCURRENCE opened each turn, not just which id. A view can contain a message without
+  // containing the copy of it that opened the turn, and "is this row the opener" has to be
+  // answerable by comparing rows rather than by comparing ids.
+  const openerOccurrence = new Map();
+  let identical = 0;
+  let total = 0;
+
+  for (const occ of occurrences) {
+    const row = occ.row;
+    const artifact = row?.history_artifact;
+    if (artifact && artifact.producedBy === 'tool_trim' && Number.isInteger(artifact.generation)) {
+      trimmedGenerations.add(artifact.generation);
+    }
+    const id = typeof row?.message_id === 'string' && row.message_id !== '' ? row.message_id : null;
+    if (id === null) { unkeyed.push(occ); continue; }
+    total += 1;
+
+    const role = typeof row?.message?.role === 'string' ? row.message.role : null;
+    const turnId = typeof row?.turn_id === 'string' ? row.turn_id : null;
+    let entry = identities.get(id);
+    if (entry === undefined) {
+      entry = { id, turnId, role, versions: [], byFingerprint: new Map() };
+      identities.set(id, entry);
+    } else if (turnId !== entry.turnId) {
+      conflicts.push({ id, reason: 'turn_id', expected: entry.turnId, found: turnId });
+    } else if (role !== entry.role) {
+      conflicts.push({ id, reason: 'role', expected: entry.role, found: role });
+    }
+
+    const digest = typeof occ.locator?.digest === 'string' ? occ.locator.digest : null;
+    const fingerprint = contentFingerprint(row);
+    const occurrence = { row, generation: occ.generation ?? null, locator: occ.locator ?? null };
+    const seen = entry.byFingerprint.get(fingerprint);
+    if (seen !== undefined) {
+      // Same content version showing up again. Which generation it belongs to is a property of
+      // the OCCURRENCE, not of the version: a sealed snapshot and the active file can both hold
+      // it, and a generation view has to be able to find the copy that file actually stores.
+      seen.occurrences.push(occurrence);
+      identical += 1;
+      continue;
+    }
+    const version = {
+      fingerprint,
+      digest,
+      generation: occurrence.generation,
+      locator: occurrence.locator,
+      row,
+      occurrences: [occurrence],
+      relation: 'only',
+    };
+    entry.versions.push(version);
+    entry.byFingerprint.set(fingerprint, version);
+  }
+
+  let trimmed = 0;
+  for (const entry of identities.values()) {
+    const first = entry.versions[0];
+    for (let v = 1; v < entry.versions.length; v += 1) {
+      const other = entry.versions[v];
+      if (isDeclaredTrim(first.row, other.row, trimmedGenerations, other.generation)) {
+        other.relation = 'trimmed';
+        trimmed += 1;
+      } else {
+        other.relation = 'unclassified';
+        unclassified.push({ id: entry.id, olderGeneration: first.generation, newerGeneration: other.generation });
+      }
+    }
+  }
+
+  // The turn opener, decided over the whole lineage rather than over whatever a request kept.
+  // Deciding it from the projected slice is what would let a real steer become the first visible
+  // prompt of its turn and be counted as dialogue.
+  for (const entry of identities.values()) {
+    if (entry.role !== 'user' || entry.turnId === null) continue;
+    const message = entry.versions[0].row?.message;
+    const plain = contentToPlainText(message?.content) ?? (typeof message?.text === 'string' ? message.text : null);
+    if (splitUserMessage(message ?? {}, plain).prompt === null) continue;
+    if (!openers.has(entry.turnId)) {
+      openers.set(entry.turnId, entry.id);
+      openerOccurrence.set(entry.turnId, entry.versions[0].occurrences[0]);
+    }
+  }
+
+  return {
+    identities,
+    unkeyed,
+    openers,
+    openerOccurrence,
+    conflicts,
+    unclassified,
+    trimmedGenerations,
+    stats: {
+      occurrences: total,
+      identities: identities.size,
+      identical,
+      trimmed,
+      unclassified: unclassified.length,
+      conflicts: conflicts.length,
+      unkeyed: unkeyed.length,
+    },
+  };
+}
+
+/**
+ * Where each turn's opener stands relative to one projected view.
+ *
+ * A turn has an entry here whenever the WHOLE lineage has an opener for it, and `row` is that
+ * opener only when this view actually contains it. The two facts are kept apart on purpose: a
+ * generation slice that does not hold the opener still has to classify the prompt it does show
+ * as a steer, and still has to call the turn a prompted turn — it just has no opener row to point
+ * at. Collapsing them into "the opener is this row, else there is no opener" is what let a real
+ * steer become the first visible prompt of its own turn.
+ *
+ * @param {ReturnType<typeof buildMessageIdentity>} identity
+ * @param {Array<{ row: any, generation: number|null, locator: any }>} occurrences the projected rows
+ * @returns {Map<string, { row: any | null }>} turn id -> its lineage opener, row null when out of view
+ */
+export function openerRowsForView(identity, occurrences) {
+  // Compared by the ROW, not by the occurrence wrapper. `buildMessageIdentity` wraps every
+  // occurrence in a fresh object of its own, so a caller's own array never contains the same
+  // wrapper the identity table holds — comparing wrappers made every turn look like its opener was
+  // missing, and every prompt in it a steer. Each stored copy is a distinct row object, so the row
+  // is the thing that actually says "this is the copy the view contains".
+  const rows = new Set(occurrences.map((occurrence) => occurrence.row));
+  /** @type {Map<string, { row: any | null }>} */
+  const byTurn = new Map();
+  for (const [turnId, occurrence] of identity.openerOccurrence) {
+    byTurn.set(turnId, { row: rows.has(occurrence.row) ? occurrence.row : null });
+  }
+  return byTurn;
+}
+
+/**
+ * How many logical messages each generation's stored context holds.
+ *
+ * A generation's count is the number of identities with at least one occurrence in it, plus its
+ * own unkeyed rows. The counts OVERLAP and their sum is not the conversation: a message sealed
+ * into generation 0 and re-recorded in generation 1 is in both, which is what a stored context
+ * is. That is also why this cannot be derived from the catalog's per-file `messageCount` — that
+ * counts stored rows, so a message recorded twice in one file, and one written three times across
+ * a lineage, are both invisible to it.
+ *
+ * @param {ReturnType<typeof buildMessageIdentity>} identity
+ * @returns {Map<number, number>}
+ */
+export function logicalCountByGeneration(identity) {
+  /** @type {Map<number, number>} */
+  const counts = new Map();
+  const bump = (generation) => {
+    if (generation === null || generation === undefined) return;
+    counts.set(generation, (counts.get(generation) ?? 0) + 1);
+  };
+  for (const entry of identity.identities.values()) {
+    // One tick per generation the message appears in, however many copies that generation holds
+    // of it — a sealed snapshot and the active file can both store the same version.
+    const generations = new Set();
+    for (const version of entry.versions) {
+      for (const occurrence of version.occurrences) generations.add(occurrence.generation);
+    }
+    for (const generation of generations) bump(generation);
+  }
+  for (const occurrence of identity.unkeyed) bump(occurrence.generation);
+  return counts;
+}
+
+/**
+ * The rows one request should project, given the identity table and the generation it asked for.
+ *
+ * `null` generation is the whole lineage: every logical message appears once, at its first
+ * version, because the reader wants the original. A generation number is that generation's own
+ * stored context: every message that appears in it, at ITS version, including the trimmed
+ * placeholder. Those are different views of one message, not different messages — a generation can
+ * therefore hold a message the whole-lineage view already counted, which is why the generation
+ * counts are overlapping sets and their sum need not equal the lineage total.
+ *
+ * @param {ReturnType<typeof buildMessageIdentity>} identity
+ * @param {number|null} generation `null` for the whole lineage
+ * @returns {{ rows: Array<any>, occurrences: Array<{ row: any, generation: number|null, locator: any }>, versionOf: Map<string, number>, openerByTurn: Map<string, { row: any | null }> }}
+ */
+export function selectIdentityView(identity, generation) {
+  const occurrences = [];
+  /** logical id -> index into `versions` of the one being shown */
+  const versionOf = new Map();
+  for (const entry of identity.identities.values()) {
+    if (generation === null) {
+      const first = entry.versions[0];
+      occurrences.push(first.occurrences[0]);
+      versionOf.set(entry.id, 0);
+      continue;
+    }
+    // A generation view is that generation's own stored context: pick the version that file
+    // actually holds, and among its occurrences the one from that file — the rows of one version
+    // differ only in `history_artifact`, which is provenance about the generation.
+    let picked = null;
+    let pickedIndex = -1;
+    for (let v = 0; v < entry.versions.length && picked === null; v += 1) {
+      const version = entry.versions[v];
+      const hit = version.occurrences.find((o) => o.generation === generation);
+      if (hit !== undefined) { picked = hit; pickedIndex = v; }
+    }
+    if (picked === null) continue;
+    occurrences.push(picked);
+    versionOf.set(entry.id, pickedIndex);
+  }
+  // Rows with no usable id were never merged, so they pass through filtered like anything else.
+  for (const occ of identity.unkeyed) {
+    if (generation === null || (occ.generation ?? null) === generation) occurrences.push(occ);
+  }
+  return {
+    rows: occurrences.map((o) => o.row),
+    occurrences,
+    versionOf,
+    openerByTurn: openerRowsForView(identity, occurrences),
+  };
+}
+
 /**
  * A record the runtime keeps for itself: written to the session, never shown, never sent.
  *
@@ -1131,6 +1471,19 @@ export function isHostOnlyMessage(message) {
 export function buildTrajectoryPayload(input) {
   const { session, rows, sizeBytes = 0, truncated = false } = input;
   const redact = input.redact ?? ((value) => value);
+  // The identity table the route already built over the whole lineage, so that a turn's opener is
+  // known even when the opener's own row falls outside the generation being projected. A caller
+  // that only holds a slice derives one from the rows it was given — the same function, so
+  // "how many messages is this" has one definition rather than one per caller.
+  const sliceOccurrences = input.identity
+    ? null
+    : rows.map((row) => ({
+      row,
+      generation: typeof row[ROW_GENERATION] === 'number' ? row[ROW_GENERATION] : null,
+      locator: null,
+    }));
+  const identity = input.identity ?? buildMessageIdentity(sliceOccurrences);
+  const openerByTurn = input.openerByTurn ?? openerRowsForView(identity, sliceOccurrences);
   /** @type {Array<Record<string, any>>} */
   const records = [];
   /** @type {Array<Record<string, any>>} */
@@ -1446,14 +1799,20 @@ export function buildTrajectoryPayload(input) {
         // The first prompt of a turn is what opened it. Anything later arrived while the
         // turn was still running — a steer, redirecting work already under way.
         //
-        // Nothing in the session file marks this. Compared field by field, a steer is
-        // byte-identical to a typed prompt in role, stopReason, api, model, provider, tokens,
-        // producedBy, turnId and everything else; only id, timestamp and index differ. The
-        // signal available is position: measured across every turn that has one, its prompt
-        // sits at record 1 or 2 and never further in, so a user record past that point can
-        // only have been written mid-turn. That is an inference from ordering, not a fact
-        // the file asserts, and it is recorded as `steered` so the detail panel can say so.
-        const steered = turn.records.some((r) => r.kind === 'user');
+        // Nothing in the session file marks this, so it is decided from the lineage: the turn's
+        // opener is its earliest prompt across every generation, and this row is a steer exactly
+        // when it is not that row. Deciding it from the projected slice instead is what let a real
+        // steer become the first visible prompt of its own turn whenever the opener's generation
+        // was filtered away — and it counted as a new turn rather than as a redirect.
+        //
+        // The older fallback, kept for a turn the lineage says nothing about: position within the
+        // records seen so far. A steer is byte-identical to a typed prompt in role, stopReason,
+        // api, model, provider, tokens, producedBy, turnId and everything else; only id, timestamp
+        // and index differ, so position was the only signal available before the lineage was read.
+        const opener = openerByTurn.get(turnKey);
+        const steered = opener === undefined
+          ? turn.records.some((r) => r.kind === 'user')
+          : opener.row !== row;
         if (steered) stats.steers += 1; else stats.userMessages += 1;
         if (label === null) label = singleLine(redact(split.prompt), MAX_LABEL_CHARS);
         const promptField = clipField(redact(split.prompt), MAX_FIELD_CHARS);
@@ -1580,6 +1939,13 @@ export function buildTrajectoryPayload(input) {
       if (record.kind === 'toolCall' && typeof record.toolName === 'string'
         && USER_INPUT_TOOLS.has(record.toolName)) askedReader = true;
     }
+    // A turn somebody opened, and whether this view can show the row that opened it. The two are
+    // separate because a generation slice routinely holds a turn's steer without holding its
+    // opener: reading "no opener row" as "no opener" is what filed that turn as 其他 and lost it
+    // from the 对话 count while the reader was looking at a prompted turn.
+    const opener = turn.id === null ? undefined : openerByTurn.get(turn.id);
+    turn.openerInView = opener !== undefined && opener.row !== null;
+    turn.openerOutOfView = opener !== undefined && opener.row === null;
     turn.askedReader = askedReader;
     turn.closed = closed;
     // A turn that *contains* a checkpoint is still judged on what it did. A checkpoint used to be
@@ -1587,7 +1953,9 @@ export function buildTrajectoryPayload(input) {
     // rejoins the turn it interrupted, that would relabel every turn the runtime ever compacted
     // as a checkpoint and drop all of them out of the prompted count. Only a turn that holds
     // nothing but its checkpoint is one.
-    if (hasPrompt) {
+    // `hasPrompt` already covers the opener being in view — a prompt row in the records is what sets
+    // it — so only the out-of-view case adds anything here.
+    if (hasPrompt || turn.openerOutOfView) {
       turn.turnClass = 'prompt';
       turnsWithPrompt += 1;
       if (!closed) openTurns += 1;
@@ -1620,14 +1988,24 @@ export function buildTrajectoryPayload(input) {
   // to nothing. Both are fixed by reporting the chain rather than the catalog — the rejected ones
   // are still disclosed through `orphans`.
   const orphanFiles = new Set(orphans.map((orphan) => orphan.fileName));
+  const logicalPerGeneration = logicalCountByGeneration(identity);
+  // A copy per entry rather than the caller's objects: the count is ours to attach, and the
+  // catalog entries are read by other callers.
   const generations = (Array.isArray(input.generations) ? input.generations : [])
-    .filter((entry) => !orphanFiles.has(entry.fileName));
-  // `messages` counts what is on screen. When the whole lineage is stitched that already
-  // spans every generation; when the reader filtered to one, `messagesAll` keeps the
-  // session-wide number from silently shrinking to a single slice.
-  const messagesAll = generations.length > 1
-    ? generations.reduce((sum, entry) => sum + (Number.isInteger(entry.messageCount) ? entry.messageCount : 0), 0)
-    : rows.length;
+    .filter((entry) => !orphanFiles.has(entry.fileName))
+    .map((entry) => ({ ...entry, logicalMessageCount: logicalPerGeneration.get(entry.generation) ?? 0 }));
+  // `messages` counts what is on screen. `messagesAll` counts the conversation: one entry per
+  // LOGICAL message over the whole reachable lineage, so a message the store wrote into two
+  // generations is one message and a message the runtime trimmed into a new content version is
+  // still one message. It is therefore not a function of the generation the reader picked, which
+  // is the whole reason it exists — the previous definition summed the per-file counts the
+  // catalog recorded, so it counted the stored copies rather than the conversation, and a forked
+  // snapshot the lineage walk had already rejected still reached the total.
+  //
+  // `messageRowsAll` is the physical counterpart, kept because the two answer different questions
+  // and only one of them is "how many messages did this conversation have".
+  const messagesAll = identity.stats.identities + identity.stats.unkeyed;
+  const messageRowsAll = identity.stats.occurrences + identity.stats.unkeyed;
 
   return {
     session: {
@@ -1646,7 +2024,7 @@ export function buildTrajectoryPayload(input) {
       generations,
       orphans,
     },
-    stats: { ...stats, messagesAll },
+    stats: { ...stats, messagesAll, messageRowsAll },
     turns: turns.map((turn) => ({
       id: turn.id,
       index: turn.index,
@@ -1663,6 +2041,12 @@ export function buildTrajectoryPayload(input) {
       // turn count and the reply count.
       askedReader: turn.askedReader === true,
       closed: turn.closed === true,
+      // The turn's opener over the whole lineage: whether this view holds the row that opened it,
+      // and whether the lineage says the turn was opened at all while the row is somewhere else.
+      // `openerOutOfView` is why a `steer` record can be the only prompt a turn shows and the turn
+      // is still 对话 rather than 其他.
+      openerInView: turn.openerInView === true,
+      openerOutOfView: turn.openerOutOfView === true,
       records: turn.records,
     })),
   };
@@ -2661,13 +3045,14 @@ export async function start(context) {
     const activeArtifact = activeArtifactFor(activeFileName);
 
     // Concatenate oldest → newest, which is the order the conversation actually happened in.
-    /** @type {Array<Record<string, any>>} */
-    const rows = [];
-    // Parallel to `rows`, and the reason `rows` is allowed to be a local. One entry per row,
-    // holding where that row's line was read from and what it hashed to — enough for `/raw` to go
-    // back to one line without any of the parsed rows still being alive.
-    /** @type {Array<LineLocator>} */
-    const rowLocators = [];
+    //
+    // Every generation's rows are collected even when the reader filtered to one. They have to
+    // be: a turn's opener is its earliest prompt across the WHOLE lineage, so filtering first
+    // would leave the reader looking at a steer that looks like the first prompt of its turn. The
+    // cost is a list of references, not a second copy of any row — each `row` is the same object
+    // `parsedFile` holds, and the view below drops the ones this request does not project.
+    /** @type {Array<{ row: Record<string, any>, generation: number | null, locator: LineLocator }>} */
+    const occurrences = [];
     let skippedTotal = 0;
     let truncated = false;
     let readBytes = 0;
@@ -2703,24 +3088,37 @@ export async function start(context) {
       if (parsedFile.truncated) truncated = true;
       readBytes += parsedFile.read;
       skippedTotal += parsedFile.skipped;
-      const keep = filter === null || filter === link.generation;
       // A sealed file's rows are shared with every other request that read it; the active file's
       // are this request's alone and are released below. Either way stamping the generation is the
       // only write, and one filePath always maps to one generation, so it is idempotent.
       // Pinned by tests/verify-parsed-rows.mjs.
       for (let index = 0; index < parsedFile.rows.length; index += 1) {
-        if (keep) {
-          const row = parsedFile.rows[index];
-          row[ROW_GENERATION] = link.generation;
-          rows.push(row);
-          rowLocators.push(parsedFile.locators[index]);
-        }
+        const row = parsedFile.rows[index];
+        row[ROW_GENERATION] = link.generation;
+        // One entry per row, holding where that row's line was read from and what it hashed to —
+        // enough for `/raw` to go back to one line without any of the parsed rows still being
+        // alive, which is what lets the rows be released once the payload is serialized.
+        occurrences.push({ row, generation: link.generation, locator: parsedFile.locators[index] });
       }
     }
     if (skippedTotal > 0) {
       context.logger.warn('miniapp.trajectory.parse_warn', { skipped: skippedTotal });
     }
 
+    // One logical message per id, every stored copy of it folded in, and the versions it was
+    // written in kept rather than dropped. `filter === null` shows every message once at its
+    // first version; a generation number shows that generation's own stored context.
+    const identityTable = buildMessageIdentity(occurrences);
+    const view = selectIdentityView(identityTable, filter);
+    const rows = view.rows;
+    const rowLocators = view.occurrences.map((occurrence) => occurrence.locator);
+    if (identityTable.conflicts.length > 0) {
+      context.logger.warn('miniapp.trajectory.parse_warn', { identity_conflicts: identityTable.conflicts.length });
+    }
+    if (identityTable.stats.unclassified > 0) {
+      context.logger.warn('miniapp.trajectory.parse_warn', { identity_unclassified: identityTable.stats.unclassified });
+    }
+
     const shown = filter === null ? lineage.chain : lineage.chain.filter((link) => link.generation === filter);
     const payload = buildTrajectoryPayload({
       session: { id: identity.id, createdAtMs: entry.lastActiveAt },
@@ -2731,6 +3129,8 @@ export async function start(context) {
       generations,
       generation: shown.length === 1 ? shown[0].generation : null,
       orphans: lineage.orphans,
+      identity: identityTable,
+      openerByTurn: view.openerByTurn,
     });
     payload.session.lastActiveAt = entry.lastActiveAt;
     payload.session.activeGeneration = activeArtifact === null ? null : activeArtifact.generation;

From 20441a7539aea44648fd69aff62a58c8fb1b2553 Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 01:47:05 +0800
Subject: [PATCH 07/36] Pin the identity rules with assertions and mutations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

verify-message-identity.mjs covers the merge, the two views, the four declared-
trim predicates, the turn opener, and the three numbers the payload derives
from them; mutate-message-identity.py breaks each one at a time.

The declared-trim section hangs the generation's declaration on that
generation's own opener row, which is where the store puts it. With it on the
changed row instead, every negative case failed at the "equal outside content"
predicate for a reason unrelated to the case under test — so two of the four
predicates could be deleted and the section still passed. A positive control in
the same shape keeps that from recurring.

One mutation anchor did not do what its label says, which is worth recording:
it replaced a precondition inside a comparison function with `if (false) return
false;`. A never-taken branch does not disable the work below it, so the
mutation was never observed and read as a live miss. Anchors belong on the line
that decides the answer.

mutate-steer.py gains the two ways a steer can come back: deciding the opener
from the projected slice, and treating an opener the view does not hold as no
opener at all.

The generation picker's count and the banner sentence are new behaviour, so
mutate-generation-counts.py breaks each: reading the catalog's per-file row
count again, printing a count the option carries but the label omits, taking
the whole-context number from the slice, and describing the live generation as
a sealed snapshot.

Three existing anchors are re-pointed rather than repaired, because the shipped
lines they matched moved: the steer rule, the orphan filter that now attaches a
per-generation count, and the orphan-matching line it sits next to.
---
 .../mmc-trajectory/tests/client-check.mjs     |  39 ++-
 .../tests/mutate-generation-counts.py         | 104 +++++++
 .../tests/mutate-message-identity.py          | 208 +++++++++++++
 .../mmc-trajectory/tests/mutate-pr15-fixes.py |  12 +-
 .../mmc-trajectory/tests/mutate-steer.py      |  30 +-
 .../tests/verify-generations.mjs              |  75 ++++-
 .../tests/verify-message-identity.mjs         | 280 ++++++++++++++++++
 .../tests/verify-pr15-fixes.mjs               |  13 +-
 8 files changed, 738 insertions(+), 23 deletions(-)
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/mutate-generation-counts.py
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/mutate-message-identity.py
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/verify-message-identity.mjs

diff --git a/plugins/avatasia/mmc-trajectory/tests/client-check.mjs b/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
index 7340cd2..25f61e8 100644
--- a/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
@@ -102,11 +102,13 @@ check('kindLabel ignores title', sandbox.kindLabel({ kind: 'system', title: 'com
 check('every kind has a label', sandbox.KIND_ORDER.every((k) => typeof sandbox.KIND_LABELS[k] === 'string' && sandbox.KIND_LABELS[k].length > 0), true);
 check('every label has a kind', Object.keys(sandbox.KIND_LABELS).every((k) => sandbox.KIND_ORDER.indexOf(k) >= 0), true);
 
-/* generation selector — one generation is not a choice, and the newest comes first */
+/* generation selector — one generation is not a choice, and the newest comes first.
+   `logicalMessageCount` is how many logical messages that generation stores; the catalog's
+   `messageCount` counts stored rows, and a message the store wrote twice is one message. */
 const gens = [
-  { generation: 0, kind: 'snapshot', messageCount: 676, active: false },
-  { generation: 1, kind: 'snapshot', messageCount: 548, active: false },
-  { generation: 2, kind: 'active', messageCount: 186, active: true }
+  { generation: 0, kind: 'snapshot', messageCount: 676, logicalMessageCount: 610, active: false },
+  { generation: 1, kind: 'snapshot', messageCount: 548, logicalMessageCount: 494, active: false },
+  { generation: 2, kind: 'active', messageCount: 186, logicalMessageCount: 180, active: true }
 ];
 check('generationOptions empty for one', sandbox.generationOptions([{ generation: 0 }], 0), []);
 check('generationOptions empty for none', sandbox.generationOptions([], null), []);
@@ -119,7 +121,16 @@ check('generationOptions all is never marked active', opts[0].active, false);
 check('generationOptions newest generation first', opts[1].generation, 2);
 check('generationOptions active marked', opts[1].active, true);
 check('generationOptions active label', opts[1].label, '第 2 代（当前）');
-check('generationOptions archived label carries count', opts[2].label, '第 1 代（548 条）');
+check('generationOptions archived label carries the stored count', opts[2].label, '第 1 代（494 条）');
+check('generationOptions exposes that count to the option', opts[2].messageCount, 494);
+check(
+  'generationOptions prefers the stored count over the catalog row count',
+  sandbox.generationOptions([
+    { generation: 0, messageCount: 676, logicalMessageCount: 610 },
+    { generation: 1, messageCount: 548, logicalMessageCount: 494 }
+  ], 1)[2].label,
+  '第 0 代（610 条）'
+);
 check('generationOptions last option', opts[3].generation, 0);
 check(
   'generationOptions drops entries without a generation',
@@ -129,7 +140,7 @@ check(
 check('generationOptions falls back to the active flag', sandbox.generationOptions(gens, null)[1].active, true);
 check(
   'generationOptions missing count drops the suffix',
-  sandbox.generationOptions([{ generation: 0, messageCount: null }, { generation: 1, messageCount: 5, active: true }], 1)[2].label,
+  sandbox.generationOptions([{ generation: 0, logicalMessageCount: null }, { generation: 1, messageCount: 5, logicalMessageCount: 5, active: true }], 1)[2].label,
   '第 0 代'
 );
 
@@ -284,6 +295,22 @@ for (const selector of ['.tbtn', '.tbtn-icon', '.overview-plot', '.ov-span', '.w
   assert('css rule survives comment stripping: ' + selector, styleNoComments.includes(selector + ' {') || styleNoComments.includes(selector + ','));
 }
 
+// The generation banner describes a context the reader chose out of a lineage. Whether that
+// generation is still growing is the difference between a promise and a description, and the
+// picker can pin the LIVE one — so promising immutability for whichever generation was picked is
+// the wrong sentence half the time. The wording is only reachable through the DOM, so it is
+// checked here against the delivered file rather than through the sandbox.
+assert('the generation banner names both states, not just the sealed one',
+  html.includes('当时封存的快照') && html.includes('仍在随后续对话更新'));
+assert('...and reads which one applies from the active generation',
+  /var live = [^;]*session\.activeGeneration === shown;/.test(html));
+
+// 「全部上下文共 N 条」 is the comparison the reader is there for. Taking it from the generation
+// on screen leaves the sentence true and useless, so it has to read the session total — which is
+// the logical message count, not the rows the catalog counted per file.
+const statsAllBody = fnSource('function statsAll()') || '';
+assert('the whole-context count reads the session total', statsAllBody.includes('stats.messagesAll'));
+
 // turnContext builds its string from turnContextParts, and turnContextSuffix calls
 // turnContext, so a check that wants to RUN any of them has to lift all three, in dependency
 // order. Lifting by regex is acceptable here because these are leaf functions ending in a
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-generation-counts.py b/plugins/avatasia/mmc-trajectory/tests/mutate-generation-counts.py
new file mode 100644
index 0000000..13f394a
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-generation-counts.py
@@ -0,0 +1,104 @@
+"""Mutation control for what the page says about a CONTEXT GENERATION.
+
+Two numbers and one sentence, all of which the server hands over and the page renders:
+
+  1. The picker's per-generation count. It used to be the catalog's `messageCount` — how many
+     rows that file holds — which counts one message twice when the store recorded it twice and
+     says nothing about how many messages the conversation has. It is now `logicalMessageCount`:
+     how many logical messages THAT generation stores.
+  2. The count beside the pinned generation. It is `stats.messagesAll`, the whole conversation,
+     and it is deliberately not re-scoped to the generation on screen.
+  3. The banner sentence. Promising a sealed snapshot "will not change with later turns" is true
+     for a sealed generation and false for the live one, which the picker can also pin.
+
+Anchors are multi-line and index.html is LF, so they are written with bare \\n and the file is
+read and written with newline='' — matching on normalised text while preserving the file's own
+endings.
+"""
+import io
+import os
+import subprocess
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+ROOT = os.path.dirname(HERE)
+CLIENT = os.path.join(ROOT, "miniapp", "client", "index.html")
+PROBE = os.path.join(HERE, "client-check.mjs")
+
+PICKER_COUNT = "            var stored = isCount(entry.logicalMessageCount) ? entry.logicalMessageCount : null;"
+PICKER_LABEL = "            else if (isCount(stored)) label += '（' + formatInt(stored) + ' 条）';"
+WHOLE_COUNT = "        return stats && isCount(stats.messagesAll) ? stats.messagesAll : 0;"
+LIVE_TEST = "          var live = !session || !isCount(session.activeGeneration) || session.activeGeneration === shown;"
+
+MUTATIONS = [
+    # The catalog row count back in the picker: a generation whose messages were recorded twice
+    # reads as more messages than the conversation has.
+    ("the picker counts stored rows again",
+     PICKER_COUNT,
+     "            var stored = isCount(entry.messageCount) ? entry.messageCount : null;",
+     "generationOptions prefers the stored count over the catalog row count"),
+    # ...or the label stops printing it at all, which is a quieter version of the same drift:
+    # the option carries a count nobody is shown.
+    ("the picker stops printing the count it carries",
+     PICKER_LABEL,
+     "            else if (false) label += '（' + formatInt(stored) + ' 条）';",
+     "generationOptions archived label carries the stored count"),
+    # The session-wide number re-scoped to the generation on screen leaves 「全部上下文共 N 条」
+    # with nothing to compare against.
+    ("the whole-context count is taken from the slice instead",
+     WHOLE_COUNT,
+     "        return stats && isCount(stats.messages) ? stats.messages : 0;",
+     "the whole-context count reads the session total"),
+    # The live generation described as a sealed snapshot: the promise is exactly wrong for the
+    # generation still being written to.
+    ("the banner calls the live generation a sealed snapshot",
+     LIVE_TEST,
+     "          var live = false;",
+     "...and reads which one applies from the active generation"),
+    # ...and the other direction, a sealed snapshot described as still growing.
+    ("the banner calls a sealed snapshot live",
+     LIVE_TEST,
+     "          var live = true;",
+     "...and reads which one applies from the active generation"),
+]
+
+
+def run():
+    proc = subprocess.run(["node", PROBE], cwd=HERE, capture_output=True, text=True,
+                          encoding="utf-8", errors="replace")
+    return proc.stdout + proc.stderr
+
+
+ok = True
+baseline = run()
+base_ok = "0 failed" in baseline
+print(("ok   " if base_ok else "FAIL ") + "baseline green")
+ok = ok and base_ok
+
+caught_all = []
+for title, old, new, expect in MUTATIONS:
+    with io.open(CLIENT, encoding="utf-8", newline="") as handle:
+        original = handle.read()
+    if original.count(old) != 1:
+        raise SystemExit("FAIL  anchor for %r matched %d times" % (title, original.count(old)))
+    try:
+        io.open(CLIENT, "w", encoding="utf-8", newline="").write(original.replace(old, new, 1))
+        during = run()
+        named = expect in during
+        failed = "0 failed" not in during
+        print(("ok   " if (named and failed) else "FAIL ") + "guard catches: " + title)
+        if not named:
+            for line in during.splitlines()[-6:]:
+                print("       " + line.strip())
+        caught_all.append(named and failed)
+    finally:
+        io.open(CLIENT, "w", encoding="utf-8", newline="").write(original)
+
+with io.open(CLIENT, encoding="utf-8", newline="") as handle:
+    restored = handle.read() == original
+print(("ok   " if restored else "FAIL ") + "client restored byte for byte")
+after = run()
+after_ok = "0 failed" in after
+print(("ok   " if after_ok else "FAIL ") + "green again after restore")
+
+sys.exit(0 if (ok and all(caught_all) and restored and after_ok) else 1)
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-message-identity.py b/plugins/avatasia/mmc-trajectory/tests/mutate-message-identity.py
new file mode 100644
index 0000000..9275f63
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-message-identity.py
@@ -0,0 +1,208 @@
+"""Mutation control for verify-message-identity.mjs.
+
+Each mutation reintroduces exactly one bug the guard is supposed to catch. The guard must FAIL
+every time, and the file must come back byte-for-byte identical afterwards. A mutation the guard
+still passes means the assertion was tautological; a mutation whose anchor no longer exists means
+the assertion went dead, which is worse -- the runner reports those as misses too.
+
+The four declared-trim predicates are broken one at a time. Collapsing any two of them would let
+one wrong assertion stand in for another, and then we would not learn which one mattered.
+
+Three of these anchors did not do what their label says, which is the second way this file lies.
+`if (false) return false;` drops a BLOCKING guard -- the branch never runs, so nothing is rejected.
+Replacing a PRECONDITION inside a function that carries on with real work does not disable that
+work: `if (a === null) return false;` becomes a no-op and the comparison below still runs, so the
+mutation is never observed and the anchor is reported as a live miss rather than as the mistake it
+is. Anchor on the line that decides the answer, not on a line near it.
+"""
+import subprocess
+import sys
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parent
+SERVER = ROOT / "miniapp" / "node" / "server.mjs"
+PROBE = HERE / "verify-message-identity.mjs"
+
+MUTATIONS = [
+    # ---- rows with no usable id must not be keyed together -------------------------
+    (
+        "a row with no id is keyed as null, so every unkeyed row collides with the rest",
+        SERVER,
+        "const id = typeof row?.message_id === 'string' && row.message_id !== '' ? row.message_id : null;",
+        "const id = row?.message_id ?? null;",
+    ),
+    (
+        "an empty-string id is treated as an identity, so two empty ids merge",
+        SERVER,
+        "const id = typeof row?.message_id === 'string' && row.message_id !== '' ? row.message_id : null;",
+        "const id = typeof row?.message_id === 'string' ? row.message_id : null;",
+    ),
+    # ---- what makes a version a version -------------------------------------------
+    (
+        "the version fingerprint stops dropping history_artifact, so an annotated copy looks trimmed",
+        SERVER,
+        "  const { history_artifact: _omitted, ...rest } = row;\n  return JSON.stringify(rest);",
+        "  return JSON.stringify(row);",
+    ),
+    (
+        "the fingerprint drops message.content too, so a trim stops being a second version",
+        SERVER,
+        "  const { history_artifact: _omitted, ...rest } = row;\n  return JSON.stringify(rest);",
+        "  const { history_artifact: _a, message: _b, ...rest } = row;\n  return JSON.stringify(rest);",
+    ),
+    # ---- the four declared-trim predicates, one at a time -------------------------
+    (
+        "predicate 1 is dropped: a role change stops being blocked",
+        SERVER,
+        "  if (olderRow?.message?.role !== 'toolResult' || newerRow?.message?.role !== 'toolResult') return false;",
+        "  if (false) return false;",
+    ),
+    (
+        "predicate 2 is dropped: any content change counts as a declared trim",
+        SERVER,
+        "  return left === right;",
+        "  return true;",
+    ),
+    (
+        "predicate 3 is dropped: any changed content passes as the runtime's placeholder",
+        SERVER,
+        "  if (!TOOL_RESULT_REMOVED.test(text)) return false;",
+        "  if (false) return false;",
+    ),
+    (
+        "predicate 4 is dropped: a rewrite nobody declared is still called a declared trim",
+        SERVER,
+        "  return newerGeneration !== null && trimmedGenerations.has(newerGeneration);",
+        "  return true;",
+    ),
+    # ---- the two views -----------------------------------------------------------
+    (
+        "the whole-lineage view shows the newest version, so a trimmed result replaces the original",
+        SERVER,
+        "      const first = entry.versions[0];\n      occurrences.push(first.occurrences[0]);",
+        "      const first = entry.versions[entry.versions.length - 1];\n      occurrences.push(first.occurrences[0]);",
+    ),
+    (
+        "a generation view stops filtering by generation, so it shows another generation's version",
+        SERVER,
+        "      const hit = version.occurrences.find((o) => o.generation === generation);",
+        "      const hit = version.occurrences[0];",
+    ),
+    # ---- the turn opener ---------------------------------------------------------
+    (
+        "the last prompt of a turn wins the opener, so a steer is filed as the turn's dialogue",
+        SERVER,
+        "    if (!openers.has(entry.turnId)) {\n      openers.set(entry.turnId, entry.id);\n      openerOccurrence.set(entry.turnId, entry.versions[0].occurrences[0]);\n    }",
+        "    openers.set(entry.turnId, entry.id);\n    openerOccurrence.set(entry.turnId, entry.versions[0].occurrences[0]);",
+    ),
+    (
+        "the opener is matched by occurrence wrapper, so no view is ever found to hold it",
+        SERVER,
+        "  const rows = new Set(occurrences.map((occurrence) => occurrence.row));",
+        "  const rows = new Set(occurrences);",
+    ),
+    # ---- the numbers the payload promises ------------------------------------------
+    (
+        "a generation counts one message once per stored copy of it",
+        SERVER,
+        "    const generations = new Set();\n    for (const version of entry.versions) {\n      for (const occurrence of version.occurrences) generations.add(occurrence.generation);\n    }\n    for (const generation of generations) bump(generation);",
+        "    for (const version of entry.versions) {\n      for (const occurrence of version.occurrences) bump(occurrence.generation);\n    }",
+    ),
+    (
+        "messagesAll counts stored rows again, so one message stored twice counts twice",
+        SERVER,
+        "  const messagesAll = identity.stats.identities + identity.stats.unkeyed;",
+        "  const messagesAll = identity.stats.occurrences + identity.stats.unkeyed;",
+    ),
+    (
+        "the physical row count is reported as the logical one",
+        SERVER,
+        "  const messageRowsAll = identity.stats.occurrences + identity.stats.unkeyed;",
+        "  const messageRowsAll = identity.stats.identities + identity.stats.unkeyed;",
+    ),
+    (
+        "the picker goes back to the catalog's per-file row count",
+        SERVER,
+        "    .map((entry) => ({ ...entry, logicalMessageCount: logicalPerGeneration.get(entry.generation) ?? 0 }));",
+        "    .map((entry) => ({ ...entry, logicalMessageCount: Number.isInteger(entry.messageCount) ? entry.messageCount : null }));",
+    ),
+]
+
+
+def read_exact(path):
+    """Normalise to LF for matching, and report the file's own newline so it can be put back."""
+    data = path.read_bytes()
+    text = data.decode("utf-8").replace("\r\n", "\n")
+    return text, ("\r\n" if b"\r\n" in data else "\n")
+
+
+def write_exact(path, text, newline):
+    if newline == "\r\n":
+        text = text.replace("\n", "\r\n")
+    path.write_bytes(text.encode("utf-8"))
+
+
+def run_probe():
+    proc = subprocess.run(
+        ["node", str(PROBE)],
+        cwd=str(ROOT),
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+    )
+    return proc.returncode, (proc.stdout or "") + (proc.stderr or "")
+
+
+def main():
+    code, output = run_probe()
+    if code != 0:
+        print("baseline guard does not pass; fix that first")
+        print(output)
+        return 1
+    print("baseline clean")
+
+    originals = {path: path.read_bytes() for path in {m[1] for m in MUTATIONS}}
+    missed = []
+    for label, path, old, new in MUTATIONS:
+        text, newline = read_exact(path)
+        if old not in text:
+            print(f"SKIP  {label}: anchor not found in {path.name}")
+            missed.append(label)
+            continue
+        write_exact(path, text.replace(old, new, 1), newline)
+        try:
+            code, output = run_probe()
+        finally:
+            path.write_bytes(originals[path])
+        if code == 0:
+            print(f"MISSED {label}: the guard still passed")
+            missed.append(label)
+        else:
+            first = next(
+                (line.strip() for line in output.splitlines() if line.strip().startswith("FAIL")),
+                None,
+            )
+            if first is None:
+                # The guard died rather than reporting an assertion. Still a catch, but saying so
+                # plainly matters: "(no detail)" reads like "not really verified".
+                tail = [line.strip() for line in output.splitlines() if line.strip()]
+                first = f"(the guard threw, no assertion failed) {tail[-1] if tail else '(no output)'}"
+            print(f"caught {label}\n         -> {first}")
+
+    for path, data in originals.items():
+        if path.read_bytes() != data:
+            print(f"NOT RESTORED {path}")
+            return 1
+    print("all files restored byte-for-byte")
+
+    if missed:
+        print(f"\n{len(missed)} mutation(s) got through")
+        return 1
+    print(f"\nall {len(MUTATIONS)} mutations caught")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-pr15-fixes.py b/plugins/avatasia/mmc-trajectory/tests/mutate-pr15-fixes.py
index 62e3aac..3e5b3c7 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-pr15-fixes.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-pr15-fixes.py
@@ -16,11 +16,17 @@
 
 MUTATIONS = [
     (
-        "server: list the whole catalog again (orphan counted + offered)",
+        # Only the "offered" half of the original label is still observable. The count is built
+        # from the identity table over the lineage and no longer reads the catalog at all, so a
+        # catalog entry cannot reach it — that is pinned by its own assertion in
+        # verify-generations.mjs, not by this one.
+        "server: offer the whole catalog again, orphan pick included",
         SERVER,
         "  const generations = (Array.isArray(input.generations) ? input.generations : [])\n"
-        "    .filter((entry) => !orphanFiles.has(entry.fileName));",
-        "  const generations = Array.isArray(input.generations) ? input.generations : [];",
+        "    .filter((entry) => !orphanFiles.has(entry.fileName))\n"
+        "    .map((entry) => ({ ...entry, logicalMessageCount: logicalPerGeneration.get(entry.generation) ?? 0 }));",
+        "  const generations = (Array.isArray(input.generations) ? input.generations : [])\n"
+        "    .map((entry) => ({ ...entry, logicalMessageCount: logicalPerGeneration.get(entry.generation) ?? 0 }));",
     ),
     (
         "server: match orphans by generation number instead of file name",
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-steer.py b/plugins/avatasia/mmc-trajectory/tests/mutate-steer.py
index 15ad23c..9ba0fe1 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-steer.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-steer.py
@@ -1,14 +1,17 @@
 """Mutation controls for the steer split and the turn classification.
 
-Two mistakes worth being able to catch automatically:
+Three mistakes worth being able to catch automatically:
 
   1. Filing every prompt in a turn as `user`. The count then reads as conversations but is
      really messages, and a turn can show three of them — the exact mismatch that sent
      someone looking for a mechanism.
   2. Filing 问答 as the turn *after* the question again, which puts the label on a turn while
      the reader still has not answered.
+  3. Deciding the opener from the projected slice instead of the lineage. A steer whose turn
+     opened in an earlier generation is then the only prompt the slice shows, so it reads as
+     that turn's first prompt: counted as dialogue, and its turn filed 其他 instead of 对话.
 
-Both are one-line edits, which is exactly why they need a guard that has been seen to fail.
+All are one-line edits, which is exactly why they need a guard that has been seen to fail.
 """
 import io
 import os
@@ -20,9 +23,9 @@
 SERVER = os.path.join(ROOT, "miniapp", "node", "server.mjs")
 PROBE = os.path.join(HERE, "verify-generations.mjs")
 
-# server.mjs is CRLF. A multi-line anchor written with bare \n never matches it, which reads as
-# "the anchor drifted" and sends you off to re-find a rule that never moved. Build every anchor
-# in the file's own line ending.
+# server.mjs is LF (pinned by .gitattributes). Build every multi-line anchor in the file's own
+# line ending anyway: this script once read a CRLF working copy, and an anchor written with the
+# other ending reads as "the rule drifted" and sends you off to re-find a rule that never moved.
 original = io.open(SERVER, encoding="utf-8", newline="").read()
 NL = "\r\n" if "\r\n" in original else "\n"
 
@@ -31,7 +34,10 @@ def anchored(*lines):
     return NL.join(lines)
 
 
-OLD_STEER = "        const steered = turn.records.some((r) => r.kind === 'user');"
+OLD_STEER = anchored("        const opener = openerByTurn.get(turnKey);",
+                     "        const steered = opener === undefined",
+                     "          ? turn.records.some((r) => r.kind === 'user')",
+                     "          : opener.row !== row;")
 OLD_CONT = anchored("    } else if (closed) {",
                     "      turn.turnClass = 'continuation';",
                     "      continuationTurns += 1;")
@@ -45,6 +51,18 @@ def anchored(*lines):
      OLD_STEER,
      "        const steered = true;",
      "the prompt that opened the turn is the only one counted as dialogue"),
+    ("the opener is decided from the slice, not the lineage",
+     OLD_STEER,
+     anchored("        const opener = openerByTurn.get(turnKey);",
+              "        const steered = turn.records.some((r) => r.kind === 'user');"),
+     "the prompt alone in the slice is still a steer"),
+    ("an opener outside the view counts as no opener at all",
+     OLD_STEER,
+     anchored("        const opener = openerByTurn.get(turnKey);",
+              "        const steered = opener === undefined || opener.row === null",
+              "          ? turn.records.some((r) => r.kind === 'user')",
+              "          : opener.row !== row;"),
+     "the prompt alone in the slice is still a steer"),
     ("Q and A goes back to the turn after the question",
      OLD_CONT,
      "    } else if (closed) {\n"
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-generations.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-generations.mjs
index 2af031f..89e78e8 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-generations.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-generations.mjs
@@ -11,6 +11,8 @@ import {
   readGenerationMarker,
   walkLineage,
   ROW_GENERATION,
+  buildMessageIdentity,
+  selectIdentityView,
 } from '../miniapp/node/server.mjs';
 
 let pass = 0;
@@ -148,7 +150,11 @@ const payload = buildTrajectoryPayload({
   generation: 2,
 });
 check('messages counts this generation only', payload.stats.messages, 2);
-check('messagesAll spans every generation', payload.stats.messagesAll, 676 + 548 + 186);
+// What it used to assert — the session-wide number must not shrink to one generation — is now
+// carried by the identity path below, where it is actually true. What it asserts here is the
+// definition: logical messages, not the rows the catalog recorded per file.
+check('messagesAll counts logical messages, not catalog rows', payload.stats.messagesAll, 2);
+check('...and the physical row count is reported separately', payload.stats.messageRowsAll, 2);
 check('compactions counted', payload.stats.compactions, 1);
 check('generation echoed on the session', payload.session.generation, 2);
 check('generation list passed through', payload.session.generations.length, 3);
@@ -288,12 +294,75 @@ const stitchedPayload = buildTrajectoryPayload({
   orphans: [{ generation: 5, fileName: 'orphan.jsonl' }],
 });
 const allRecords = stitchedPayload.turns.flatMap((t) => t.records);
+const generationsLogical = (payload) => payload.session.generations
+  .slice()
+  .sort((a, b) => a.generation - b.generation)
+  .map((g) => g.logicalMessageCount);
 check('every record carries a generation', allRecords.every((r) => Number.isInteger(r.generation)), true);
 check('generations appear in stitch order', [...new Set(allRecords.map((r) => r.generation))], [0, 1, 2]);
 check('the symbol never reaches the body', JSON.stringify(stitchedPayload).includes('rowGeneration'), false);
 check('orphans are reported on the session', stitchedPayload.session.orphans.map((o) => o.generation), [5]);
-check('the fixture catalog counts match the stitched rows', stitchedPayload.stats.messagesAll, 30);
-check('a stitched view still reports the session-wide total', stitchedPayload.stats.messagesAll >= stitchedPayload.stats.messages, true);
+// Five stored rows, three of them the same `msg-a1` re-recorded in each generation. The catalog
+// claims thirty; the conversation has three.
+check('the stitched rows collapse into logical messages, not stored rows', stitchedPayload.stats.messagesAll, 3);
+check('the physical row count stays available separately', stitchedPayload.stats.messageRowsAll, 5);
+
+/* The session-wide number has to survive being read one generation at a time, which is the
+   property the catalog sum used to supply. The route builds the identity table over the whole
+   lineage and projects afterwards, so the slice carries the lineage's count with it. */
+const stitchedIdentity = buildMessageIdentity(stitched.map((row) => ({
+  row,
+  generation: /** @type {number} */ (row[ROW_GENERATION]),
+  locator: null,
+})));
+check('the identity table merges the three copies of one message', stitchedIdentity.stats.identities, 3);
+const slice = selectIdentityView(stitchedIdentity, 1);
+const slicePayload = buildTrajectoryPayload({
+  session: { id: 'mvs_9s', createdAtMs: 1 },
+  rows: slice.rows,
+  generations: fixtureCatalog([[0,'g0.jsonl'],[1,'g1.jsonl'],[2,'messages.jsonl']]).generations,
+  identity: stitchedIdentity,
+  openerByTurn: slice.openerByTurn,
+});
+check('a single-generation slice shows only that generation', slicePayload.stats.messages, 2);
+check('...while still reporting the whole conversation', slicePayload.stats.messagesAll, 3);
+// Per-generation counts overlap by construction: msg-a1 is stored in all three.
+check('each generation reports the messages IT stores', generationsLogical(stitchedPayload), [1, 2, 2]);
+
+/* ---- a steer whose opener is stored in an earlier generation ----
+   Deciding the opener from the projected slice is what made this prompt look like the first
+   prompt of its own turn, which counted it as a conversation instead of a redirect and dropped
+   the turn out of the 对话 total while the reader was looking straight at it. */
+const crossGen = [
+  { row: { message_id: 'c-1', turn_id: 'tx', message: { role: 'user', content: [{ type: 'text', text: 'start it' }], timestamp: 10 } }, generation: 0, locator: null },
+  { row: { message_id: 'c-2', turn_id: 'tx', message: { role: 'assistant', content: [{ type: 'text', text: 'on it' }], timestamp: 11 } }, generation: 0, locator: null },
+  { row: { message_id: 'c-3', turn_id: 'tx', message: { role: 'user', content: [{ type: 'text', text: 'no, the other one' }], timestamp: 20 } }, generation: 1, locator: null },
+];
+const crossIdentity = buildMessageIdentity(crossGen);
+check('the opener is the first prompt of the turn, from generation 0', crossIdentity.openers.get('tx'), 'c-1');
+const crossSlice = selectIdentityView(crossIdentity, 1);
+const crossPayload = buildTrajectoryPayload({
+  session: { id: 'mvs_x', createdAtMs: 10 },
+  rows: crossSlice.rows,
+  identity: crossIdentity,
+  openerByTurn: crossSlice.openerByTurn,
+});
+const crossKinds = crossPayload.turns.flatMap((t) => t.records).map((r) => r.kind);
+check('the prompt alone in the slice is still a steer', crossKinds, ['steer']);
+check('...so it is not counted as a conversation prompt', [crossPayload.stats.userMessages, crossPayload.stats.steers], [0, 1]);
+check('...and the turn is still a prompted turn', [crossPayload.stats.turnsWithPrompt, crossPayload.turns[0].turnClass], [1, 'prompt']);
+check('...and it says the opener is elsewhere', [crossPayload.turns[0].openerInView, crossPayload.turns[0].openerOutOfView], [false, true]);
+
+const crossWhole = selectIdentityView(crossIdentity, null);
+const crossWholePayload = buildTrajectoryPayload({
+  session: { id: 'mvs_x', createdAtMs: 10 },
+  rows: crossWhole.rows,
+  identity: crossIdentity,
+  openerByTurn: crossWhole.openerByTurn,
+});
+check('the whole lineage files the opener as dialogue and the rest as a steer',
+  crossWholePayload.turns.flatMap((t) => t.records).map((r) => r.kind), ['user', 'narration', 'steer']);
+check('...and both are inside the view', [crossWholePayload.turns[0].openerInView, crossWholePayload.turns[0].openerOutOfView], [true, false]);
 
 /* ---- a turn total is only readable if it says what it is made of ---- */
 const turnRows = [];
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-message-identity.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-message-identity.mjs
new file mode 100644
index 0000000..d01cf8e
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-message-identity.mjs
@@ -0,0 +1,280 @@
+/**
+ * Message identity across a lineage: one logical message, several stored copies, and several
+ * content versions of it.
+ *
+ * The route used to hand every stored row to the projector, so a message the runtime wrote into
+ * both a sealed snapshot and the active file appeared twice, and a message whose old tool result
+ * the runtime trimmed on compaction appeared twice with different text. Neither is a row that can
+ * simply be dropped — one is a second copy of one version, the other is a second version of one
+ * message — so this covers the merge, not the deletion.
+ *
+ * Every fixture here is SYNTHETIC. The session store is read-only input, and a real trim case costs
+ * megabytes to reproduce, which is not something a committed fixture should be.
+ */
+import { buildMessageIdentity, selectIdentityView, openerRowsForView, logicalCountByGeneration, buildTrajectoryPayload } from '../miniapp/node/server.mjs';
+
+let pass = 0;
+const failures = [];
+function check(label, actual, expected) {
+  const a = JSON.stringify(actual);
+  const e = JSON.stringify(expected);
+  if (a === e) pass += 1;
+  else failures.push(`${label}\n     expected ${e}\n     actual   ${a}`);
+}
+function assert(label, cond) {
+  if (cond) pass += 1;
+  else failures.push(label);
+}
+
+const REMOVED = '[Tool result removed by context compaction.]';
+
+/** A row the way the store holds one. */
+function row(id, turn, message, extra) {
+  return { message_id: id, turn_id: turn, message, ...(extra ?? {}) };
+}
+function toolResult(text) {
+  return { role: 'toolResult', toolCallId: 'call_1', toolName: 'bash', content: [{ type: 'text', text }], isError: false };
+}
+function user(text) {
+  return { role: 'user', content: [{ type: 'text', text }] };
+}
+/** The route reads one occurrence per row, with the locator digest alongside. */
+const occ = (rowValue, generation, digest) => ({ row: rowValue, generation, locator: { digest } });
+
+const TRIM_DECLARATION = { schemaVersion: 1, generation: 1, producedBy: 'tool_trim', parentSnapshot: { generation: 0, compactionId: 'ctx_1' } };
+
+/* ---------- 1. a second copy of the same content is one version, not two ---------- */
+{
+  const occurrences = [
+    occ(row('m1', 't1', toolResult('exit 0')), 0, 'dA'),
+    occ(row('m1', 't1', toolResult('exit 0')), 1, 'dA'),
+  ];
+  const id = buildMessageIdentity(occurrences);
+  check('an identical re-record is one version', id.identities.get('m1').versions.length, 1);
+  check('...seen twice', id.identities.get('m1').versions[0].occurrences.length, 2);
+  check('...counted as identical, not trimmed', id.stats.identical, 1);
+  check('...and the lineage view keeps one row', selectIdentityView(id, null).rows.length, 1);
+}
+
+/* ---------- 2. the generation's own annotation is provenance, not a new version ---------- */
+{
+  const base = row('m2', 't1', toolResult('exit 0'));
+  const annotated = row('m2', 't1', toolResult('exit 0'), { history_artifact: TRIM_DECLARATION });
+  const id = buildMessageIdentity([occ(base, 0, 'dB'), occ(annotated, 1, 'dC')]);
+  check('history_artifact alone does not make a version', id.identities.get('m2').versions.length, 1);
+  check('...and is not reported as a difference', id.stats.unclassified, 0);
+  check('...while the generation is still recognised as trimmed', [...id.trimmedGenerations], [1]);
+}
+
+/* ---------- 3. a declared trim is a second version, not a copy ---------- */
+{
+  const id = buildMessageIdentity([
+    occ(row('m3', 't1', toolResult('exit 0')), 0, 'dD'),
+    occ(row('m3', 't1', toolResult(REMOVED)), 1, 'dE'),
+    occ(row('m3', 't1', toolResult(REMOVED), { history_artifact: TRIM_DECLARATION }), 1, 'dF'),
+  ]);
+  const versions = id.identities.get('m3').versions;
+  check('a trimmed result is a second version', versions.length, 2);
+  check('...marked as the runtime trimming it', versions[1].relation, 'trimmed');
+  check('...and counted as trimmed', id.stats.trimmed, 1);
+  check('...not as an unexplained difference', id.stats.unclassified, 0);
+}
+
+/* ---------- 4. drop any one predicate and it stops being a declared trim ---------- */
+{
+  // The declaration goes on the declaring generation's OWN opener row, which is where the store
+  // puts it — the rows the runtime rewrote carry no annotation. Hanging it on the changed row
+  // instead made every case below fail at predicate 2 for a reason that had nothing to do with the
+  // case, so predicates 1 and 3 could both be removed and this section still passed.
+  const mk = (label, expected, opts = {}) => {
+    const older = row('m4', 't1', toolResult('exit 0'));
+    const newer = row('m4', 't1', toolResult(REMOVED));
+    (opts.mutate ?? (() => {}))(older, newer);
+    const occurrences = [occ(older, 0, 'dG'), occ(newer, 1, 'dH')];
+    if (opts.declare !== false) {
+      occurrences.push(occ(row('op', 't0', user('carry on'), { history_artifact: TRIM_DECLARATION }), 1, 'dI'));
+    }
+    const id = buildMessageIdentity(occurrences);
+    check(label, id.stats.trimmed, expected);
+    return id;
+  };
+
+  // Without this the whole section could pass with the fixture shape itself broken.
+  mk('a declared trim is recognised in the shape the store actually writes', 1);
+
+  // Only predicate 1 can catch this one: the roles are equal to each other, so "everything but the
+  // content is the same" holds. A role that was never a tool result is not something a trim makes.
+  mk('a role that was never a tool result is never a trim, however else the two rows match', 0, {
+    mutate: (older, newer) => { older.message.role = 'user'; newer.message.role = 'user'; },
+  });
+  mk('a role change is never a trim', 0, {
+    mutate: (older, newer) => { newer.message.role = 'assistant'; },
+  });
+  mk('a change outside the content is never a trim', 0, {
+    mutate: (older, newer) => { newer.message.toolName = 'grep'; },
+  });
+  mk('changed content that is not the placeholder is never a trim', 0, {
+    mutate: (older, newer) => { newer.message.content = [{ type: 'text', text: 'something else entirely' }]; },
+  });
+  const noDeclaration = mk('a rewrite no generation declared is never a trim', 0, { declare: false });
+  check('...and it is reported rather than thrown away', noDeclaration.stats.unclassified, 1);
+  check('...which is a difference, not a failure', noDeclaration.stats.conflicts, 0);
+}
+
+/* ---------- 5. rows with no usable id are never keyed together ---------- */
+{
+  const noId = { message: toolResult('x'), turn_id: 't9' };
+  const emptyId = { message_id: '', turn_id: 't9', message: toolResult('x') };
+  const numericId = { message_id: 7, turn_id: 't9', message: toolResult('x') };
+  const id = buildMessageIdentity([occ(noId, 0, 'z1'), occ(emptyId, 0, 'z2'), occ(numericId, 0, 'z3')]);
+  check('no usable id means no identity at all', id.identities.size, 0);
+  check('...and all three pass through', id.stats.unkeyed, 3);
+  check('...into the view', selectIdentityView(id, null).rows.length, 3);
+}
+
+/* ---------- 6. turn and role decide which projection a message belongs to ---------- */
+{
+  const id = buildMessageIdentity([
+    occ(row('m5', 't1', user('do it')), 0, 'e1'),
+    occ(row('m5', 't2', user('do it')), 1, 'e2'),
+  ]);
+  check('a turn_id conflict is reported', id.conflicts.map((c) => c.reason), ['turn_id']);
+  const role = buildMessageIdentity([
+    occ(row('m6', 't1', user('do it')), 0, 'e3'),
+    occ(row('m6', 't1', toolResult('done')), 1, 'e4'),
+  ]);
+  check('a role conflict is reported too', role.conflicts.map((c) => c.reason), ['role']);
+}
+
+/* ---------- 7. the two views show different versions of the same message ---------- */
+{
+  const shared = buildMessageIdentity([
+    occ(row('k1', 't1', toolResult('exit 0')), 0, 'f1'),
+    occ(row('k1', 't1', toolResult('exit 0')), 1, 'f2'),
+    occ(row('k2', 't1', user('go')), 0, 'f3'),
+    occ(row('k2', 't1', user('go')), 1, 'f4'),
+    occ(row('k3', 't1', toolResult('boom')), 0, 'f5'),
+    occ(row('k3', 't1', toolResult(REMOVED), { history_artifact: TRIM_DECLARATION }), 1, 'f6'),
+  ]);
+  const all = selectIdentityView(shared, null);
+  check('the whole lineage shows one row per message', all.rows.length, 3);
+  check('...and it shows the original, never the placeholder',
+    all.rows.filter((r) => JSON.stringify(r.message.content).includes('Tool result removed')).length, 0);
+  check('...keeping the full result', all.rows.some((r) => JSON.stringify(r.message.content).includes('exit 0')), true);
+
+  const g0 = selectIdentityView(shared, 0);
+  const g1 = selectIdentityView(shared, 1);
+  check('generation 0 holds all three', g0.rows.length, 3);
+  check('generation 1 holds all three', g1.rows.length, 3);
+  check('...where generation 1 stores the placeholder',
+    g1.rows.filter((r) => JSON.stringify(r.message.content).includes('Tool result removed')).length, 1);
+  check('...and generation 0 does not',
+    g0.rows.filter((r) => JSON.stringify(r.message.content).includes('Tool result removed')).length, 0);
+  // 3 + 3 - 3 shared = 3: the generation counts are overlapping sets, and their sum is 6.
+  assert('generation counts overlap, so their sum is not the lineage count',
+    g0.rows.length + g1.rows.length !== all.rows.length);
+}
+
+/* ---------- 8. a message only in one generation is absent from the other ---------- */
+{
+  const id = buildMessageIdentity([
+    occ(row('o1', 't1', user('old')), 0, 'g1'),
+    occ(row('o2', 't1', user('new')), 1, 'g2'),
+  ]);
+  check('generation 0 sees only its own', selectIdentityView(id, 0).rows.length, 1);
+  check('generation 1 sees only its own', selectIdentityView(id, 1).rows.length, 1);
+  check('the lineage sees both', selectIdentityView(id, null).rows.length, 2);
+}
+
+/* ---------- 9. the turn opener is decided over the lineage, not over the slice ---------- */
+{
+  // A steer whose turn opened in generation 0. Projecting generation 1 alone must not turn it into
+  // the turn's first visible prompt, because the opener is known from the whole lineage.
+  const id = buildMessageIdentity([
+    occ(row('p1', 't7', user('start the work')), 0, 'h1'),
+    occ(row('p2', 't7', user('no, the other one')), 1, 'h2'),
+  ]);
+  check('the opener is the first prompt of the turn', id.openers.get('t7'), 'p1');
+
+  // The point of computing this over the lineage: the opener's own row may be outside the slice
+  // being projected, and the classification still has to name it.
+  const split = buildMessageIdentity([
+    occ(row('s1', 'tA', user('open it')), 0, 'h3'),
+    occ(row('s2', 'tA', user('steer it')), 1, 'h4'),
+  ]);
+  check('the opener is known from another generation', split.openers.get('tA'), 's1');
+  const laterOnly = selectIdentityView(split, 1);
+  assert('the opener is not a row in the generation-1 slice',
+    laterOnly.rows.length === 1 && laterOnly.rows[0].message_id === 's2');
+  assert('yet the opener map still names it, so this prompt is not the turn opener',
+    laterOnly.rows[0].message_id !== split.openers.get('tA'));
+
+  const injected = buildMessageIdentity([occ(row('r1', 't9', user('<system-reminder>noise</system-reminder>')), 0, 'h5')]);
+  assert('an injected block does not open a turn', injected.openers.has('t9') === false);
+}
+
+/* ---------- 10. the numbers the payload promises are identity numbers ---------- */
+{
+  // Four stored rows, two logical messages. `g1` is sealed in generation 0 and re-recorded in
+  // generation 1 — once with the same bytes, once with the placeholder the runtime wrote when it
+  // trimmed the old tool result. `g2` is a prompt that only ever lived in generation 1.
+  const gen = (id, generation, message, extra) => ({ row: row(id, 't1', message, extra), generation, locator: { digest: id + '@' + generation } });
+  const table = buildMessageIdentity([
+    gen('g1', 0, toolResult('exit 0')),
+    gen('g2', 1, user('go')),
+    gen('g1', 1, toolResult('exit 0')),
+    gen('g1', 1, toolResult(REMOVED), { history_artifact: TRIM_DECLARATION }),
+  ]);
+  check('a message stored three times is one message', table.stats.identities, 2);
+  check('...of which one copy is byte-identical', table.stats.identical, 1);
+  check('...and one is a trimmed second version', table.stats.trimmed, 1);
+
+  const counts = [...logicalCountByGeneration(table)].sort((a, b) => a[0] - b[0]);
+  check('each generation reports the messages it stores, once each', counts, [[0, 1], [1, 2]]);
+  assert('the per-generation counts overlap rather than summing to the conversation',
+    counts.reduce((sum, [, n]) => sum + n, 0) !== table.stats.identities);
+
+  const all = selectIdentityView(table, null);
+  const payload = buildTrajectoryPayload({
+    session: { id: 'mvs_i' },
+    rows: all.rows,
+    generations: [{ generation: 0, messageCount: 900, active: false }, { generation: 1, messageCount: 800, active: true }],
+    identity: table,
+    openerByTurn: all.openerByTurn,
+  });
+  check('messagesAll is the logical message count, not the catalog rows', payload.stats.messagesAll, 2);
+  check('the physical row count is reported beside it', payload.stats.messageRowsAll, 4);
+  check('...and what is on screen agrees in the whole-lineage view', payload.stats.messages, 2);
+  check('the generations carry their own stored counts',
+    payload.session.generations.map((g) => g.logicalMessageCount), [1, 2]);
+
+  const slice = selectIdentityView(table, 0);
+  const slicePayload = buildTrajectoryPayload({
+    session: { id: 'mvs_i' },
+    rows: slice.rows,
+    generations: [{ generation: 0, messageCount: 900, active: false }, { generation: 1, messageCount: 800, active: true }],
+    identity: table,
+    openerByTurn: slice.openerByTurn,
+  });
+  check('a slice shows only its own messages', slicePayload.stats.messages, 1);
+  check('...while the session-wide count does not follow it down', slicePayload.stats.messagesAll, 2);
+
+  // The opener a view reports has to be the very row that view projects. Matching on the
+  // occurrence wrapper instead of the row finds nothing, because the identity table wraps every
+  // occurrence in an object of its own — and then every turn looks like its opener is missing.
+  assert('the opener is found by row identity inside the view that holds it',
+    all.openerByTurn.get('t1').row === all.rows.find((r) => r.message_id === 'g2'));
+  assert('...and the direct helper agrees with the view it came from',
+    openerRowsForView(table, all.occurrences).get('t1').row === all.openerByTurn.get('t1').row);
+  check('...while a view without the opener reports it as absent, not as unknown',
+    slice.openerByTurn.get('t1').row, null);
+}
+
+/* ---------- report ---------- */
+console.log(`[1] message identity: ${pass} assertions, ${failures.length} failed`);
+if (failures.length) {
+  for (const f of failures) console.log(`  FAIL ${f}`);
+  console.log('verify-message-identity');
+  process.exit(1);
+}
+console.log('verify-message-identity');
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-pr15-fixes.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-pr15-fixes.mjs
index b9d23e8..10bd252 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-pr15-fixes.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-pr15-fixes.mjs
@@ -53,7 +53,10 @@ const baseInput = {
 };
 
 const withFork = buildTrajectoryPayload(baseInput);
-check('messagesAll leaves the forked generation out', withFork.stats.messagesAll, 676 + 548 + 186);
+// The count is built from the identity table over the lineage, so a catalog entry has no way into
+// it at all — which is a stronger statement than the sum-and-filter this replaced, and the
+// counter-example below is what keeps it honest.
+check('messagesAll counts the conversation, not the catalog', withFork.stats.messagesAll, 2);
 check(
   'the picker never offers the forked generation',
   withFork.session.generations.map((g) => g.generation),
@@ -61,11 +64,11 @@ check(
 );
 check('the fork is still disclosed as an orphan', withFork.session.orphans.map((o) => o.generation), [7]);
 
-// Counter-example: the identical catalog with nothing marked as an orphan. This is what
-// the page got before the fix, and it is what proves the filter is what moved the number
-// rather than the sum itself being wrong.
+// Counter-example: the identical catalog with nothing marked as an orphan. Before the fix the sum
+// walked the catalog and this extra entry moved the total; the count no longer reads the catalog,
+// so the entry cannot reach it even unmarked. Asserting the number is UNCHANGED is the whole claim.
 const noOrphans = buildTrajectoryPayload({ ...baseInput, orphans: [] });
-check('counter-example: an unmarked extra generation is still counted', noOrphans.stats.messagesAll, 676 + 548 + 186 + 999);
+check('counter-example: an unmarked extra generation cannot move the count', noOrphans.stats.messagesAll, 2);
 check(
   'counter-example: an unmarked extra generation is still listed',
   noOrphans.session.generations.map((g) => g.generation),

From c8fe23fb9ca9a0cd87d310a7e0d7ee5f74fb605a Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 07:59:18 +0800
Subject: [PATCH 08/36] Follow a session's active generation, and key rows and
 time spans by record
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two record-addressing defects, both visible on stored sessions that keep more
than one generation of the same conversation.

An unmarked activity file was skipped

A session's cross-generation information lives in exactly one place: its
history-catalog.json, whose activeGeneration names the generation still taking
writes. The lineage walk instead decided the active generation from the file
alone, so an active file carrying no generation marker was read as generation 0
and the whole rest of the chain was dropped. One session in 139 catalogued
sessions is affected: its chain resolved to a single file, and every earlier
turn of that conversation was invisible. With the fallback in place the same
chain resolves to generations 0 and 1 — 752 rows become 383 unique messages,
228 identical copies and 141 copies whose tool results were trimmed by the
runtime, and 39 turn openers.

The fallback only applies where it has to. A file that declares its generation
is still taken at its word, so a catalog entry that disagrees with a file is
still resolved in the file's favour, and a file that declares a generation other
than the one sought is still refused. The catalog names which files to look at;
it does not become the authority on what they contain.

Rows and time spans were keyed by message, not by record

The first column renders a record's index, and index is what a row means when it
is scrolled to, pinned to, or brushed on the overview. Those three all went
through the message-level id instead. A message split across records by a
tool-result trim therefore resolved to whichever record happened to be first,
so the scroll anchor, the overview selection and the time brush disagreed with
each other and with the row the reader was looking at. Measured on that session,
228 messages have more than one record, so this is not a corner case.

The overview now keys each span by the record it was built from, and its hit
test returns the span rather than an id. That is what lets a click keep its
message-level meaning — the same message's records highlight together, which is
what selection is for — while hover and time brushing stay on the single record
under the pointer. Selection is unchanged on purpose.
---
 .../mmc-trajectory/miniapp/client/index.html  | 68 +++++++++++++++----
 .../mmc-trajectory/miniapp/node/server.mjs    | 36 ++++++++--
 2 files changed, 84 insertions(+), 20 deletions(-)

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
index f7b3689..f744133 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
+++ b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
@@ -3067,6 +3067,27 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         return typeof value === 'number' && isFinite(value);
       }
 
+      /**
+       * The key that identifies ONE row.
+       *
+       * `record.id` is the message's id, and one message can expand into several rows — a
+       * thought, a sentence and six tool calls all share it. So it answers "which message", and
+       * using it as a row key collapses those rows onto one entry: the scroll anchor lands back
+       * on the first of them, and the overview resolves a hover or a time brush against the last.
+       * `record.index` is dense from 1 and already the public `/raw?index=` key, so it is the one
+       * that says "which row".
+       *
+       * Selection is the exception and stays on `record.id` on purpose — picking a row highlights
+       * the whole message it belongs to, and that grouping is the feature.
+       *
+       * @param {{ id?: any, index?: any }} record
+       * @returns {string}
+       */
+      function recordKey(record) {
+        if (record && isCount(record.index)) return String(record.index);
+        return record && record.id ? String(record.id) : '';
+      }
+
       // The runtime rotates a compacted session into generations: the previous messages.jsonl
       // becomes a snapshot and a fresh active file takes its place. A session can therefore
       // hold more than one generation, and the ledger can be narrowed to any one of them.
@@ -4792,7 +4813,10 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
           if (!isCount(timestamp)) continue;
           var range = timedRange(record, prevTimestamp, timestamp);
           timed.push({
-            id: record.id,
+            // The span's key is the ROW's, not the message's: one span is one record, and the
+            // hover hairline, the tooltip and the time brush all have to find the span the
+            // reader is pointing at rather than the last one its message expanded into.
+            id: recordKey(record),
             record: record,
             start: range.start,
             end: range.end,
@@ -4873,7 +4897,7 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
 
       function recordInSelection(record, selection, spansById) {
         if (!selection) return true;
-        var span = spansById.get(record.id);
+        var span = spansById.get(recordKey(record));
         // A record with no span has no position on the strip, so a range cannot claim
         // to contain it. Leaving it out is the honest answer; putting it in would let
         // a time brush silently match records it never saw.
@@ -5131,10 +5155,23 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         return view.start + fraction * view.duration;
       }
 
+      /**
+       * The span under a point, or null.
+       *
+       * The SPAN rather than its key, because the two callers want different halves of it: a
+       * hover needs the span's own key to mark one row, and a click needs the record's message id
+       * because selection is per message. Returning the key forced both to use one number, and
+       * picking for the hover is what broke selection.
+       *
+       * @returns {any|null}
+       */
       function spanAt(clientX, clientY) {
         var node = document.elementFromPoint(clientX, clientY);
         while (node && node !== dom.overviewTrack) {
-          if (node.classList && node.classList.contains('ov-span')) return node.getAttribute('data-record-id');
+          if (node.classList && node.classList.contains('ov-span')) {
+            var key = node.getAttribute('data-record-id');
+            return key === null ? null : (overviewSpansById.get(key) || null);
+          }
           node = node.parentNode;
         }
         return null;
@@ -5252,7 +5289,8 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
 
         // Idle: a hairline marks the pointer, and a span shows its detail only after
         // the reader has held still long enough to mean it.
-        var id = spanAt(event.clientX, event.clientY);
+        var hovered = spanAt(event.clientX, event.clientY);
+        var id = hovered ? hovered.id : null;
         dom.overviewHover.hidden = false;
         dom.overviewHover.style.setProperty('--ov-hover-left', (fraction * 100).toFixed(3) + '%');
         if (overviewHoverTimer !== null) window.clearTimeout(overviewHoverTimer);
@@ -5329,13 +5367,13 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         }
 
         if (!drag.moved) {
-          var id = spanAt(event.clientX, event.clientY);
-          if (id) {
+          var span = spanAt(event.clientX, event.clientY);
+          if (span) {
             clearOverviewSelection();
-            selectRecord(id);
+            selectRecord(span.record.id);
           } else {
             var nearest = nearestSpanAt(overviewTimeAt(overviewFractionAt(event.clientX)));
-            if (nearest) selectRecord(nearest);
+            if (nearest) selectRecord(nearest.record.id);
           }
           return;
         }
@@ -5355,6 +5393,7 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         renderLedger();
       }
 
+      /** The span nearest a point in time, or null. The span, for the reason spanAt() gives. */
       function nearestSpanAt(time) {
         var model = overviewCache.model;
         if (!model) return null;
@@ -5364,12 +5403,12 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
           var span = model.spans[i];
           if (span.end < time) {
             var after = span.end - time;
-            if (after < bestDistance) { bestDistance = after; best = span.id; }
+            if (after < bestDistance) { bestDistance = after; best = span; }
           } else if (span.start > time) {
             var before = time - span.start;
-            if (before < bestDistance) { bestDistance = before; best = span.id; }
+            if (before < bestDistance) { bestDistance = before; best = span; }
           } else {
-            return span.id;
+            return span;
           }
         }
         return best;
@@ -5677,7 +5716,10 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         var record = entry.record;
         var row = el('button', 'row');
         row.type = 'button';
-        row.setAttribute('data-row-id', record.id || String(record.index));
+        // The scroll anchor reads this back with querySelector, which returns the FIRST match.
+        // Keyed by the message id it would resolve to the first row of the message, so a reader
+        // whose topmost row was the seventh of eight came back at the first. One row, one key.
+        row.setAttribute('data-row-id', recordKey(record));
         if (record.id === state.selectedId) row.setAttribute('aria-current', 'true');
         else row.removeAttribute('aria-current');
         var failed = !!(record.isError || record.error);
@@ -5748,7 +5790,7 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         var record = entry.record;
         var band = el('button', 'compaction-band');
         band.type = 'button';
-        band.setAttribute('data-row-id', record.id || String(record.index));
+        band.setAttribute('data-row-id', recordKey(record));
         if (record.id === state.selectedId) band.setAttribute('aria-current', 'true');
         else band.removeAttribute('aria-current');
 
diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
index dce72f7..f138f09 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
@@ -630,11 +630,13 @@ export function readGenerationMarker(headText) {
  * take the generation it declares, then step back one generation at a time through the
  * parent each file names.
  *
- * The catalog is used only to find candidate files. Every candidate still has to open and
- * declare the generation it was reached for, so a catalog that lists a file belonging to a
- * different lineage cannot smuggle it in, and a file whose parent generation is not exactly
- * one lower ends the chain instead of being stitched on. Snapshots never reached are orphans
- * — a fork leaves them behind — and are reported rather than shown.
+ * The catalog is used only to find candidate files, with one exception: a file that opens with
+ * no marker is taken at the generation the catalog reached it for, because a file that declares
+ * nothing offers nothing to check it against. Every file that DOES declare a generation still
+ * has to declare the one it was reached for, so a catalog that lists a file belonging to a
+ * different lineage cannot smuggle it in, and a file whose parent generation is not exactly one
+ * lower ends the chain instead of being stitched on. Snapshots never reached are orphans — a
+ * fork leaves them behind — and are reported rather than shown.
  *
  * @param {{ generations: Array<{ generation: number, kind: string, fileName: string, byteLength: number | null, messageCount: number | null, revision: string | null, active: boolean }> }} catalog
  * @param {(generation: number | null) => Promise<{ fileName: string, marker: { generation: number, parentGeneration: number | null } | null } | null>} probe `null` asks for the active file
@@ -648,7 +650,21 @@ export async function walkLineage(catalog, probe) {
   const activeProbe = await probe(null);
   if (activeProbe === null) return { chain: [], orphans: [] };
 
-  const activeGeneration = activeProbe.marker ? activeProbe.marker.generation : 0;
+  // A file that opens with a marker says which generation it is, and the file wins: it is the
+  // thing the rest of this function is about verifying. Not every active file opens with one
+  // though — the marker rides on the checkpoint row that ROTATED the generation, so a session
+  // whose active file was rewritten in place has none. Read from the head of an active file and
+  // find nothing, and the walk used to start at generation 0: it reached no parent, so every
+  // sealed generation it actually had was reported as an orphan and never shown.
+  //
+  // The catalog names the same generation, and where both exist they agree — measured over every
+  // session on this machine with a catalog: 5 of 5 agree, none contradicts. So the catalog is
+  // used for exactly the value the file does not carry, and a file that does carry one still
+  // overrides it. That keeps the rule this function already states: the catalog finds candidate
+  // files, and each file still has to declare the generation it is reached for.
+  const activeGeneration = activeProbe.marker
+    ? activeProbe.marker.generation
+    : activeCatalogGeneration(null, catalog.generations) ?? 0;
   const chain = [{ generation: activeGeneration, fileName: activeProbe.fileName }];
   const reached = new Set([activeGeneration]);
 
@@ -658,7 +674,13 @@ export async function walkLineage(catalog, probe) {
     if (!byGeneration.has(want)) break;
     const parent = await probe(want);
     if (parent === null) break;
-    const declared = parent.marker ? parent.marker.generation : 0;
+    // A file that opens with no marker declares nothing, so there is nothing to check it
+    // against — and refusing it would drop a sealed generation the session really has. The
+    // first snapshot of a session that never compacted is exactly this shape: the marker rides
+    // on the checkpoint row that rotated the generation, and there was never one. Taken at the
+    // generation the catalog reached it for. A file that DOES declare a different generation is
+    // still refused, which is what keeps a fork's snapshot out.
+    const declared = parent.marker ? parent.marker.generation : want;
     if (declared !== want) break;
     if (parent.marker && parent.marker.parentGeneration !== null && parent.marker.parentGeneration !== want - 1) break;
     if (reached.has(declared)) break;

From c00eeb1c20602104d4da26b02842a50e3880133c Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 07:59:22 +0800
Subject: [PATCH 09/36] Pin the generation fallback and the record-level keys
 with assertions and mutations

A fallback that is never exercised resolves nothing, so both fixes ship with the
evidence that they are load-bearing.

verify-generations.mjs grows by 5 assertion groups covering the cases the
fallback has to distinguish: an unmarked active file resolves to the
catalogued generation, an unmarked sealed snapshot resolves to the generation it
was sought at, a file that declares its generation still overrides the catalog,
a fork still pointing at a generation other than the one sought is still
refused, and a catalog with no active entry still emits the chain. 129
assertions, all passing.

verify-message-identity.mjs already carries 16 mutations and client-check.mjs
grows by 9: the compaction band and the row both key by record, the overview
model pushes a record-keyed id, selection reads spans by record, and the hit test
hands back a span so the click and the hover read different fields off it. The
old assertion on the compaction band pinned an expression rather than the
behaviour and is updated to pin the key. 186 assertions, all passing.

mutate-generation-counts.py grows from 5 to 11 mutations and mutate-steer.py
from 5 to 8, so both fixes are broken and caught by name: dropping the
catalogued-generation fallback, letting a declaration override the catalog in the
wrong direction, accepting a fork, and reverting each of the record-level keys
back to the message-level id.

All 72 guards pass.
---
 .../mmc-trajectory/tests/client-check.mjs     | 38 ++++++++++++-
 .../tests/mutate-generation-counts.py         | 50 ++++++++++++++++-
 .../mmc-trajectory/tests/mutate-steer.py      | 21 +++++++
 .../tests/verify-generations.mjs              | 56 +++++++++++++++++++
 4 files changed, 161 insertions(+), 4 deletions(-)

diff --git a/plugins/avatasia/mmc-trajectory/tests/client-check.mjs b/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
index 25f61e8..ab1534e 100644
--- a/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
@@ -311,6 +311,38 @@ assert('...and reads which one applies from the active generation',
 const statsAllBody = fnSource('function statsAll()') || '';
 assert('the whole-context count reads the session total', statsAllBody.includes('stats.messagesAll'));
 
+/* ---------- the row key, and the one place selection is per message ---------- */
+// One message can expand into several rows. Anything that has to name ONE row has to use the
+// row's own key; selection is the deliberate exception, and that exception is the feature.
+const keySrc = fnSource('function recordKey(record)') || '';
+assert('the row key prefers the row index over the message id',
+  /isCount\(record\.index\)\)\s*return String\(record\.index\)/.test(keySrc));
+const rowSrc = fnSource('function buildRow(entry, rail)') || '';
+assert('a ledger row is keyed by its own row, not by its message',
+  /setAttribute\('data-row-id', recordKey\(record\)\)/.test(rowSrc));
+assert('...while clicking a row still selects the message it belongs to',
+  /selectRecord\(record\.id\)/.test(rowSrc) && /aria-current/.test(rowSrc));
+assert('the scroll anchor reads that key back out of the DOM',
+  /querySelector\('\[data-row-id="'/.test(html));
+
+// The overview had one id doing two jobs. A hover needs the row's key to mark one span; a click
+// needs the message's id. Returning the key forced both onto one number.
+const spanSrc = fnSource('function overviewModel(entries)') || '';
+assert('an overview span is keyed by its row, not by its message', /id: recordKey\(record\)/.test(spanSrc));
+const selSrc = fnSource('function recordInSelection(record, selection, spansById)') || '';
+assert('the time brush looks a span up by the row key too',
+  /spansById\.get\(recordKey\(record\)\)/.test(selSrc));
+const spanAtSrc = fnSource('function spanAt(clientX, clientY)') || '';
+assert('the hit test returns the span, so click and hover stop sharing one number',
+  /overviewSpansById\.get\(key\)/.test(spanAtSrc));
+const nearestSrc = fnSource('function nearestSpanAt(time)') || '';
+assert('...and so does the nearest-span lookup', /best = span;/.test(nearestSrc) && !/best = span\.id;/.test(nearestSrc));
+const pointerUp = fnSource('function onOverviewPointerUp(event)') || '';
+assert('clicking a span selects the message, not the row',
+  /selectRecord\(span\.record\.id\)/.test(pointerUp) && /selectRecord\(nearest\.record\.id\)/.test(pointerUp));
+assert('hovering a span marks only that span',
+  /var id = hovered \? hovered\.id : null;/.test(html));
+
 // turnContext builds its string from turnContextParts, and turnContextSuffix calls
 // turnContext, so a check that wants to RUN any of them has to lift all three, in dependency
 // order. Lifting by regex is acceptable here because these are leaf functions ending in a
@@ -749,11 +781,13 @@ const checks = [
     && /item\.appendChild\(buildCompactionBand\(group\.entries\[j\]\)\)/.test(loop);
 })()],
   // The band is a real control: it carries the same data-row-id the inspector looks up, so
-  // clicking it opens the checkpoint's details rather than doing nothing.
+  // clicking it opens the checkpoint's details rather than doing nothing. The two halves are
+  // deliberately different units — the DOM key has to name ONE row for the scroll anchor, and
+  // the selection stays on the message — so both are matched.
   ['the compaction band is selectable and states what it is', (() => {
   const src = fnSource('function buildCompactionBand(entry)');
   if (!src) return false;
-  return /setAttribute\('data-row-id', record\.id \|\| String\(record\.index\)\)/.test(src)
+  return /setAttribute\('data-row-id', recordKey\(record\)\)/.test(src)
     && /selectRecord\(record\.id\)/.test(src)
     // The point of the band is that it says what changed, so the generation and the moment both
     // have to be in it. Neither is decoration. The condition is matched whole: a mutation that
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-generation-counts.py b/plugins/avatasia/mmc-trajectory/tests/mutate-generation-counts.py
index 13f394a..b6b5086 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-generation-counts.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-generation-counts.py
@@ -1,6 +1,7 @@
-"""Mutation control for what the page says about a CONTEXT GENERATION.
+"""Mutation control for what the page says about a CONTEXT GENERATION, and for the two places a
+row has to be named rather than its message.
 
-Two numbers and one sentence, all of which the server hands over and the page renders:
+Three numbers and one sentence, all of which the server hands over and the page renders:
 
   1. The picker's per-generation count. It used to be the catalog's `messageCount` — how many
      rows that file holds — which counts one message twice when the store recorded it twice and
@@ -11,6 +12,11 @@
   3. The banner sentence. Promising a sealed snapshot "will not change with later turns" is true
      for a sealed generation and false for the live one, which the picker can also pin.
 
+Plus the record key. `record.id` is the MESSAGE's id and one message expands into several rows —
+a thought, a sentence and six tool calls share it. Anything that has to name ONE row (the scroll
+anchor, the overview span, the time brush) has to use `record.index` instead; selection is the
+deliberate exception, and two mutations below pin that from both sides.
+
 Anchors are multi-line and index.html is LF, so they are written with bare \\n and the file is
 read and written with newline='' — matching on normalised text while preserving the file's own
 endings.
@@ -30,7 +36,47 @@
 WHOLE_COUNT = "        return stats && isCount(stats.messagesAll) ? stats.messagesAll : 0;"
 LIVE_TEST = "          var live = !session || !isCount(session.activeGeneration) || session.activeGeneration === shown;"
 
+# The row key. `record.id` is the MESSAGE's id and one message expands into several rows, so
+# anything that has to name one row has to use `record.index`. Selection is the deliberate
+# exception — the last two mutations below are the guard saying so from both sides.
+ROW_KEY = "  if (record && isCount(record.index)) return String(record.index);"
+SPAN_KEY = "            id: recordKey(record),"
+BRUSH_LOOKUP = "        var span = spansById.get(recordKey(record));"
+HIT_TEST = "            return key === null ? null : (overviewSpansById.get(key) || null);"
+CLICK_SELECT = "            selectRecord(span.record.id);"
+
 MUTATIONS = [
+    # The row key falls back to the message id again. This is the scroll anchor defect: the key
+    # is read back with querySelector, which returns the first match, so a reader whose topmost
+    # row was the seventh of eight comes back at the first.
+    ("the row key falls back to the message id",
+     ROW_KEY,
+     "  if (record) return String(record.id);",
+     "the row key prefers the row index over the message id"),
+    ("the ledger row is keyed by its message again",
+     "        row.setAttribute('data-row-id', recordKey(record));",
+     "        row.setAttribute('data-row-id', record.id || String(record.index));",
+     "a ledger row is keyed by its own row, not by its message"),
+    # The span key. Same reason: the hover hairline, the tooltip and the time brush all have to
+    # find the span the reader is pointing at, not the last one its message expanded into.
+    ("an overview span is keyed by its message again",
+     SPAN_KEY,
+     "            id: record.id,",
+     "an overview span is keyed by its row, not by its message"),
+    ("the time brush looks a span up by the message id again",
+     BRUSH_LOOKUP,
+     "        var span = spansById.get(record.id);",
+     "the time brush looks a span up by the row key too"),
+    # And the split itself: one number cannot serve both, which is why the hit test hands back the
+    # span rather than its key.
+    ("the hit test returns the key again, so click and hover share one number",
+     HIT_TEST,
+     "            return key;",
+     "the hit test returns the span, so click and hover stop sharing one number"),
+    ("clicking a span selects the row rather than the message",
+     CLICK_SELECT,
+     "            selectRecord(span.id);",
+     "clicking a span selects the message, not the row"),
     # The catalog row count back in the picker: a generation whose messages were recorded twice
     # reads as more messages than the conversation has.
     ("the picker counts stored rows again",
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-steer.py b/plugins/avatasia/mmc-trajectory/tests/mutate-steer.py
index 9ba0fe1..51b66d5 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-steer.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-steer.py
@@ -70,6 +70,27 @@ def anchored(*lines):
      "      continuationTurns += 1;\n"
      "      qaTurns += 1;",
      "the turn after it is a continuation, not a Q&A"),
+    # A file that declares nothing used to be read as generation 0, which ended the walk and
+    # turned every sealed generation the session had into an orphan.
+    ("an active file with no marker starts the walk at generation 0 again",
+     "  const activeGeneration = activeProbe.marker\n"
+     "    ? activeProbe.marker.generation\n"
+     "    : activeCatalogGeneration(null, catalog.generations) ?? 0;",
+     "  const activeGeneration = activeProbe.marker ? activeProbe.marker.generation : 0;",
+     "an active file with no marker still starts at the generation the catalog names"),
+    ("a sealed file with no marker is refused again",
+     "    const declared = parent.marker ? parent.marker.generation : want;",
+     "    const declared = parent.marker ? parent.marker.generation : 0;",
+     "a sealed snapshot reached at a generation it does not declare is still stitched"),
+    # ...and the counter-example must keep passing, or the fix has quietly turned the catalog
+    # into the authority: a file that DOES declare its generation still overrides it.
+    ("the catalog overrides a file that declares its own generation",
+     "  const activeGeneration = activeProbe.marker\n"
+     "    ? activeProbe.marker.generation\n"
+     "    : activeCatalogGeneration(null, catalog.generations) ?? 0;",
+     "  const activeGeneration = activeCatalogGeneration(null, catalog.generations)\n"
+     "    ?? (activeProbe.marker ? activeProbe.marker.generation : 0);",
+     "a file that declares its own generation still wins over the catalog"),
 ]
 
 
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-generations.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-generations.mjs
index 89e78e8..c15e576 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-generations.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-generations.mjs
@@ -249,6 +249,62 @@ check('no orphans on a clean chain', full.orphans, []);
 const single = await walkLineage(fixtureCatalog([[0,'messages.jsonl']]), probeFrom({ ...FILES, gen1: 'g1.jsonl', 'messages.jsonl': plainRow }));
 check('an uncompacted session is one generation', single.chain.map((l) => l.generation), [0]);
 
+/* An active file that opens with no marker. The marker rides on the checkpoint row that rotated
+   the generation, so a session whose active file was rewritten in place has none — and reading
+   nothing off its head used to start the walk at generation 0, which reached no parent and
+   turned every sealed generation it actually had into an orphan. Measured over the store: one
+   session in 139, and it is the only one the runtime ever rewrote tool results in. */
+{
+  const noMarker = await walkLineage(
+    fixtureCatalog([[0,'g0.jsonl'],[1,'g1.jsonl'],[2,'messages.jsonl']]),
+    probeFrom({ ...FILES, gen0: 'g0.jsonl', gen1: 'g1.jsonl', 'messages.jsonl': plainRow }),
+  );
+  check('an active file with no marker still starts at the generation the catalog names',
+    noMarker.chain.map((l) => l.generation), [0, 1, 2]);
+  check('...so its sealed generations are reached, not orphaned', noMarker.orphans, []);
+
+  // The shape the store actually has: a session that compacted once and whose files declare
+  // nothing at all, because the marker rides on a checkpoint row that is not there. Both the
+  // active file and its one sealed snapshot are marker-less, and the snapshot is reached at
+  // generation 1 — where reading "no marker" as generation 0 used to refuse it.
+  const noMarkersAtAll = await walkLineage(
+    fixtureCatalog([[1,'g1.jsonl'],[2,'messages.jsonl']]),
+    probeFrom({ 'g1.jsonl': plainRow, gen1: 'g1.jsonl', 'messages.jsonl': plainRow }),
+  );
+  check('a sealed snapshot reached at a generation it does not declare is still stitched',
+    noMarkersAtAll.chain.map((l) => l.generation), [1, 2]);
+  check('...and nothing is left as an orphan', noMarkersAtAll.orphans, []);
+
+  // The counter-example, and the reason this is a fallback rather than a new source of truth: a
+  // file that DOES declare its generation still overrides the catalog, so this cannot become a
+  // way for a hand-edited catalog to place a file in a lineage.
+  const lying = await walkLineage(
+    fixtureCatalog([[0,'g0.jsonl'],[1,'g1.jsonl'],[2,'messages.jsonl']]),
+    probeFrom({ ...FILES, gen0: 'g0.jsonl', gen1: 'g1.jsonl', 'messages.jsonl': markerRow(7, 6) }),
+  );
+  check('a file that declares its own generation still wins over the catalog',
+    lying.chain.map((l) => l.generation), [7]);
+  check('...and everything the walk cannot reach stays orphaned', lying.orphans.map((o) => o.generation), [0, 1]);
+
+  // And the fork case is unchanged: a sealed file that names a generation other than the one it
+  // was reached for is still refused, marker or no marker.
+  const forkedOnPurpose = await walkLineage(
+    fixtureCatalog([[0,'g0.jsonl'],[1,'g1.jsonl'],[2,'messages.jsonl']]),
+    probeFrom({ ...FILES, gen0: 'g0.jsonl', gen1: 'g1.jsonl', 'g1.jsonl': markerRow(7, 6), 'messages.jsonl': markerRow(2, 1) + plainRow }),
+  );
+  check('a sealed file declaring the wrong generation is still refused',
+    forkedOnPurpose.chain.map((l) => l.generation), [2]);
+  check('...and is reported as an orphan', forkedOnPurpose.orphans.map((o) => o.generation), [0, 1]);
+
+  // A catalog that names no active entry at all leaves nothing to fall back to, and the walk
+  // still starts rather than throwing.
+  const nameless = await walkLineage(
+    { generations: [{ generation: 4, kind: 'snapshot', fileName: 'g0.jsonl', byteLength: 1, messageCount: 1, revision: null, active: false }] },
+    probeFrom({ 'g0.jsonl': plainRow, 'messages.jsonl': plainRow }),
+  );
+  assert('a catalog with no active entry still yields a chain', nameless.chain.length >= 1);
+}
+
 /* a snapshot whose parent generation is not exactly one lower is not part of this lineage */
 const skipped = await walkLineage(fixtureCatalog([[0,'g0.jsonl'],[1,'g1.jsonl'],[2,'messages.jsonl']]), probeFrom({
   ...FILES, gen0: 'g0.jsonl', gen1: 'g1.jsonl',

From 78250a0fce748fc4e712e07985f40b76aeaf1c03 Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 08:39:38 +0800
Subject: [PATCH 10/36] Describe the ledger twice: once as an index on disk,
 once as searchable text
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two derived artifacts under the runtime's data dir, each with its own guard, neither wired to the
route yet. They are here because the next change is going to need them, and because building them
first is how their shapes get argued against real numbers instead of against an intention.

The index: what a session's ledger looks like, laid out so reading a window or counting a kind
costs a lookup rather than a re-parse of every generation the session has stored.

The primary key is the record's own index, which is already dense and sorted on disk (measured
gapless 1..36527 on a 44-generation session), so the file IS the sorted array a binary search wants.
Four structures are built on load: message id to its records, generation to its records, kind to its
count, and — the one that costs a sort — a side array of timestamps in time order. That last one is
not optional: timestamps along the ledger are nearly but not quite monotonic (32 adjacent inversions
in 25,428 rows on a real session, the largest a 141.8 s step backwards against a 98.9 h span), so
bisecting the primary order would silently drop whatever fell in a gap. The guard holds a fixture with
constructed inversions and shows, as a control, that bisecting the primary order on that same data
loses records and the side array loses none.

What a record does not carry is the bulk: the projected text fields are left out and read back from
the source line on demand, which is the same move the existing lazy raw read already makes. The
denylist is a denylist rather than an allowlist on purpose — a hand-copied allowlist lost eleven
fields the page actually reads before it was measured, and a field this file forgot is a row that
renders blank with nothing to say why. Two of them survive as booleans: whether there was error
text, and the byte range of the line a record came from, which is what a search hit in a sealed
generation is mapped back through.

Nothing in either artifact is a machine path. A record names its file by an index into the
manifest's own file table, and the resolved path is stripped before the manifest is written.

Both are published with the manifest written last, so an interrupted write leaves a directory that
reads as "no artifact" rather than as half of one. Neither is consumed unless its bytes match the
digest the manifest was written with, its schema and projection versions are the ones this build
speaks, and the source it was built from is still the source on disk.

The search segment: the five fields a reader can search, stored once per sealed generation.

Those five fields are measured at 36.7 MB for the worst session, against 8.6 MB for the index, so
they are kept apart: the ordinary read never opens the search surface, and a search never pays for
the index's own metadata twice. A sealed generation cannot change, which is what makes its segment
something written once; the active generation is being appended to and is therefore never stored.

The surface is the page's own search text under one stated normalisation — runs of whitespace
become a single space, ends trimmed — applied to the surface and to the needle alike, so what the
reader typed cannot decide the answer. One record is one line, which is not a formatting choice:
the page joins the five fields with a newline, and a surface that kept that separator produced five
lines per record, so a scan's line number stopped being the record ordinal its locators were numbered
by and a hit resolved to whichever record happened to sit at that line. The guard pins that with an
assertion on the ordinal rather than on the string, because string equality cannot see it — both
sides shift together.

And a scan may not cross a record boundary. One needle tested against each line alone; the guard
constructs a needle that belongs to neither of two records and shows the joined blob would have
matched it.

All 76 guards pass: 84 assertions and 17 mutations on the index, 92 assertions and 17 mutations on
the segments.
---
 .../miniapp/node/search-segments.mjs          | 340 +++++++++++
 .../miniapp/node/trajectory-index.mjs         | 564 ++++++++++++++++++
 .../tests/mutate-search-segments.py           | 196 ++++++
 .../tests/mutate-trajectory-index.py          | 181 ++++++
 plugins/avatasia/mmc-trajectory/tests/run.mjs |   2 +
 .../mmc-trajectory/tests/verify-review16.mjs  |   2 +
 .../tests/verify-search-segments.mjs          | 407 +++++++++++++
 .../tests/verify-trajectory-index.mjs         | 538 +++++++++++++++++
 8 files changed, 2230 insertions(+)
 create mode 100644 plugins/avatasia/mmc-trajectory/miniapp/node/search-segments.mjs
 create mode 100644 plugins/avatasia/mmc-trajectory/miniapp/node/trajectory-index.mjs
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/mutate-search-segments.py
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-index.py
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/verify-trajectory-index.mjs

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/search-segments.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/search-segments.mjs
new file mode 100644
index 0000000..27cf8fd
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/search-segments.mjs
@@ -0,0 +1,340 @@
+// @ts-check
+
+// Immutable search segments: the text a session can be searched for, stored once per sealed
+// generation so that asking the question again does not cost a re-read of 198 MB.
+//
+// WHY A SEGMENT AND NOT A FIELD ON THE INDEX. The search surface is five fields per record
+// (summary, text, result, thinking, toolName) — measured at 36.7 MB for a 44-generation session,
+// against 8.6 MB for the index. Folding it in would make every read of the index pay for search, on
+// a page that reads the index every eight seconds and searches when someone types. Kept apart, the
+// ordinary read never opens the surface and a search never opens the index's own metadata twice.
+//
+// WHY PER GENERATION AND NOT PER SESSION. A sealed generation's records cannot change, so its
+// surface cannot either — that is what makes the segment a thing that is written once. The active
+// generation is being appended to right now and is therefore never stored: it is searched from the
+// rows the request already read. A session-level file would have to be rewritten on every append,
+// which is the exact cost the split exists to avoid.
+//
+// THE SCAN MAY NOT CROSS A RECORD BOUNDARY. One record's surface is one line, and the scan tests
+// each line on its own. Joining the surfaces into one blob first would let a needle that starts at
+// the end of one record and finishes at the start of the next report a match that exists in neither.
+// That is not a theoretical difference: it is the one thing this file has to get right, so it is an
+// invariant with a fixture rather than a comment.
+//
+// FOUR QUESTIONS.
+//
+// 归层 — server only. A segment is a derived artifact under the runtime's data dir; the page never
+// sees one, it sees the records a scan returned. No client state is written from here.
+//
+// 关联 — subordinate to the projection that produced the records, and parallel to the index: both
+// describe the same records and both are invalidated by the same source identity. A search hit is
+// resolved back to the current ledger THROUGH the index, so a hit in a sealed generation and a hit
+// in the live one answer in the same shape.
+//
+// 布局 — no new surface. A new read on the route that already exists; the search box is the same
+// control, and this is the only thing that changes about it.
+//
+// 口径 — the searched text has to be the text the page was searching. `searchSurfaceOf` is the
+// page's own `recordSearchText` with the five fields in the page's order, folded once at build time;
+// verify-search-segments.mjs holds them equal field for field, because a segment that dropped a
+// field would quietly narrow what a reader can find.
+
+import { createHash } from 'node:crypto';
+import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+
+/** Bumped when the on-disk shape changes in a way an older reader cannot survive. */
+export const SEGMENT_SCHEMA_VERSION = 1;
+
+/**
+ * The fields a search reads, in the page's order.
+ *
+ * This is the page's `recordSearchText` field list, and the order is load-bearing for the equality
+ * check: two field lists that differ only in order produce different surfaces, so a reader searching
+ * for a phrase that spans two of them would hit in one build and miss in another.
+ */
+export const SEARCH_FIELDS = ['summary', 'text', 'result', 'thinking', 'toolName'];
+
+/** @typedef {{ ordinal: number, fileIdx: number, byteStart: number, byteEnd: number }} SegmentLocator */
+
+/** @typedef {{ schemaVersion: number, generation: number | null, view: string, recordCount: number, surfaceBytes: number, locatorBytes: number, surfaceDigest: string, locatorDigest: string, source: Array<{ fileName: string, generation: number | null, size: number, revision: string | null }> }} SegmentManifest */
+
+/**
+ * One record's searchable text.
+ *
+ * ONE NORMALISATION, stated once and applied to both sides. The page's own `recordSearchText` reads
+ * the same five fields in the same order, joins them with a newline and folds to lower case. Here
+ * every run of whitespace becomes a single space and the ends are trimmed — which is what makes a
+ * record one line, and what `foldNeedle` does to the needle before the scan.
+ *
+ * Why one rule and not two. The first draft skipped empty fields AND flattened newlines, which are
+ * two separate differences from the page and read as one. Worse, the first draft's separator
+ * difference was invisible: with the page's newline between the five fields a record became five
+ * lines, so a scan's line number stopped being the record ordinal its locators were numbered by,
+ * and a hit resolved to whichever record sat at that line. `verify-search-segments.mjs` holds this
+ * function equal to the page's under exactly this normalisation, field for field, plus the ordinal
+ * that string equality cannot see.
+ *
+ * @param {Record<string, any>} record a projected record
+ * @returns {string}
+ */
+export function searchSurfaceOf(record) {
+  const parts = [];
+  for (const field of SEARCH_FIELDS) {
+    const value = record === null || record === undefined ? null : record[field];
+    parts.push(typeof value === 'string'
+      ? value
+      : value !== null && value !== undefined && typeof value === 'object'
+        ? (typeof value.text === 'string' ? value.text : '')
+        : '');
+  }
+  return normaliseWhitespace(parts.join('\n')).toLowerCase();
+}
+
+/**
+ * Every run of whitespace becomes one space, and the ends are trimmed.
+ *
+ * Applied to a record's surface AND to the needle, so what the reader typed cannot decide whether a
+ * record matches on how the page happened to lay the five fields out.
+ *
+ * @param {string} value
+ */
+export function normaliseWhitespace(value) {
+  return String(value).replace(/\s+/g, ' ').trim();
+}
+
+/**
+ * Builds one generation's pair: the surface and the locators that name where each of its records
+ * came from.
+ *
+ * @param {{ records: Array<Record<string, any>> }} input records of ONE generation, in ledger order
+ * @returns {{ surface: string, locators: string }}
+ */
+export function buildSegment(input) {
+  const surfaceLines = [];
+  const locatorLines = [];
+  for (let i = 0; i < input.records.length; i += 1) {
+    const record = input.records[i];
+    surfaceLines.push(searchSurfaceOf(record));
+    /** @type {SegmentLocator} */
+    const locator = {
+      ordinal: i,
+      fileIdx: typeof record.fileIdx === 'number' ? record.fileIdx : -1,
+      byteStart: typeof record.byteStart === 'number' ? record.byteStart : -1,
+      byteEnd: typeof record.byteEnd === 'number' ? record.byteEnd : -1,
+    };
+    locatorLines.push(JSON.stringify(locator));
+  }
+  return { surface: surfaceLines.join('\n'), locators: locatorLines.join('\n') };
+}
+
+/**
+ * Every record ordinal whose own surface contains the needle.
+ *
+ * Per line, on purpose: this is the boundary. A needle cannot be answered from anything but one
+ * record's own five fields, because a match spanning two records describes no record.
+ *
+ * @param {string} surface
+ * @param {string} needle already folded, by {@link foldNeedle}
+ * @returns {number[]}
+ */
+export function scanSegment(surface, needle) {
+  if (needle === '') return [];
+  const hits = [];
+  let start = 0;
+  let ordinal = 0;
+  while (start <= surface.length) {
+    const nl = surface.indexOf('\n', start);
+    const end = nl === -1 ? surface.length : nl;
+    const line = surface.slice(start, end);
+    if (line.includes(needle)) hits.push(ordinal);
+    ordinal += 1;
+    if (nl === -1) break;
+    start = nl + 1;
+  }
+  return hits;
+}
+
+/**
+ * The needle in the form the surface was stored in: normalised the same way a surface is, then
+ * folded. Folding the needle rather than the surface at query time is what keeps the scan a plain
+ * substring test — `String.prototype.includes` is case-sensitive.
+ *
+ * @param {string} needle
+ * @returns {string}
+ */
+export function foldNeedle(needle) {
+  return normaliseWhitespace(typeof needle === 'string' ? needle : '').toLowerCase();
+}
+
+/**
+ * A needle long enough to be worth scanning for. Measured against the page's own minimum: a shorter
+ * one matches almost every record, and a search that returns the whole ledger is not an answer.
+ * @param {string} needle
+ */
+export function needleIsUsable(needle) {
+  return foldNeedle(needle).trim().length >= MIN_NEEDLE_CHARS;
+}
+
+/** Characters. Two is the floor, not a preference: one character matched most records measured. */
+export const MIN_NEEDLE_CHARS = 2;
+
+/**
+ * How many hits a single search reports before it stops counting.
+ *
+ * A bound rather than a page size: the count is real and continues past it, and what the reader sees
+ * is the first N. The alternative — returning every hit in a session where a two-character needle
+ * matches ten thousand — is a response nobody can use.
+ *
+ * @param {number[]} hits
+ * @param {number} [limit]
+ * @returns {{ ordinals: number[], total: number, truncated: boolean }}
+ */
+export function capHits(hits, limit = MAX_HITS) {
+  if (hits.length <= limit) return { ordinals: hits, total: hits.length, truncated: false };
+  return { ordinals: hits.slice(0, limit), total: hits.length, truncated: true };
+}
+
+/** The most hits one search response carries. */
+export const MAX_HITS = 500;
+
+/**
+ * @param {string} text
+ */
+export function digestOf(text) {
+  return createHash('sha256').update(text).digest('hex');
+}
+
+/**
+ * The store. Under the runtime's data dir and nowhere else: the session history is read-only input,
+ * and the plugin package installs onto every reader's machine.
+ *
+ * @param {string} root
+ */
+export function createSegmentStore(root) {
+  const safe = (part) => String(part).replace(/[^A-Za-z0-9._-]/g, '_').slice(0, 120) || '_';
+
+  /** @param {string} sessionKey @param {string} view @param {string} generationKey */
+  const dirOf = (sessionKey, view, generationKey) =>
+    join(root, safe(sessionKey), safe(view), safe(generationKey));
+
+  return {
+    dirOf,
+
+    /**
+     * Publishes one generation's pair. The surface lands, then the locators, then the manifest that
+     * makes the pair readable — so a run interrupted anywhere leaves a directory that reads as "no
+     * segment" rather than as half of one.
+     *
+     * @param {string} sessionKey
+     * @param {string} view
+     * @param {string} generationKey
+     * @param {{ surface: string, locators: string }} segment
+     * @param {{ generation: number | null, source: SegmentManifest['source'] }} meta
+     */
+    async write(sessionKey, view, generationKey, segment, meta) {
+      const dir = dirOf(sessionKey, view, generationKey);
+      await mkdir(dir, { recursive: true });
+      await writeFile(`${join(dir, 'surface.txt')}.tmp`, segment.surface, 'utf8');
+      await rename(`${join(dir, 'surface.txt')}.tmp`, join(dir, 'surface.txt'));
+      await writeFile(`${join(dir, 'locators.jsonl')}.tmp`, segment.locators, 'utf8');
+      await rename(`${join(dir, 'locators.jsonl')}.tmp`, join(dir, 'locators.jsonl'));
+      /** @type {SegmentManifest} */
+      const manifest = {
+        schemaVersion: SEGMENT_SCHEMA_VERSION,
+        generation: meta.generation,
+        view,
+        recordCount: segment.locators === '' ? 0 : segment.locators.split('\n').length,
+        surfaceBytes: Buffer.byteLength(segment.surface),
+        locatorBytes: Buffer.byteLength(segment.locators),
+        surfaceDigest: digestOf(segment.surface),
+        locatorDigest: digestOf(segment.locators),
+        source: meta.source,
+      };
+      await writeFile(`${join(dir, 'manifest.json')}.tmp`, `${JSON.stringify(manifest)}\n`, 'utf8');
+      await rename(`${join(dir, 'manifest.json')}.tmp`, join(dir, 'manifest.json'));
+      return manifest;
+    },
+
+    /**
+     * Reads one generation's pair, or answers `null` for every reason it cannot be trusted: no
+     * manifest, a manifest from another schema or another view, a source that moved, or bytes that
+     * do not match the digests the manifest was written with.
+     *
+     * @param {string} sessionKey
+     * @param {string} view
+     * @param {string} generationKey
+     * @param {SegmentManifest['source']} source
+     */
+    async read(sessionKey, view, generationKey, source) {
+      const dir = dirOf(sessionKey, view, generationKey);
+      /** @type {any} */
+      let manifest;
+      try {
+        manifest = JSON.parse(await readFile(join(dir, 'manifest.json'), 'utf8'));
+      } catch {
+        return null;
+      }
+      if (!manifest || typeof manifest !== 'object') return null;
+      if (manifest.schemaVersion !== SEGMENT_SCHEMA_VERSION) return null;
+      if (manifest.view !== view) return null;
+      if (!sameSource(manifest.source, source)) return null;
+      let surface;
+      let locators;
+      try {
+        surface = await readFile(join(dir, 'surface.txt'), 'utf8');
+        locators = await readFile(join(dir, 'locators.jsonl'), 'utf8');
+      } catch {
+        return null;
+      }
+      if (digestOf(surface) !== manifest.surfaceDigest) return null;
+      if (digestOf(locators) !== manifest.locatorDigest) return null;
+      const lines = locators === '' ? [] : locators.split('\n');
+      if (lines.length !== manifest.recordCount) return null;
+      return { manifest, surface, locators: lines };
+    },
+
+    /** @param {string} sessionKey @param {string} view @param {string} generationKey */
+    async discard(sessionKey, view, generationKey) {
+      await rm(dirOf(sessionKey, view, generationKey), { recursive: true, force: true });
+    },
+  };
+}
+
+/**
+ * Whether the generation a segment was built from is still the generation on disk.
+ *
+ * Identity, not mtime: a sealed file is not written to, and a reader that treated a touch as a
+ * change would rebuild correct bytes on every poll.
+ *
+ * @param {SegmentManifest['source']} stored
+ * @param {SegmentManifest['source']} live
+ */
+export function sameSource(stored, live) {
+  if (!Array.isArray(stored) || !Array.isArray(live)) return false;
+  if (stored.length === 0 || stored.length !== live.length) return false;
+  for (let i = 0; i < stored.length; i += 1) {
+    const a = stored[i];
+    const b = live[i];
+    if (!a || !b) return false;
+    if (a.fileName !== b.fileName) return false;
+    if (a.generation !== b.generation) return false;
+    if (a.size !== b.size) return false;
+    if (typeof a.revision === 'string' && a.revision.length > 0
+      && typeof b.revision === 'string' && b.revision.length > 0 && a.revision !== b.revision) {
+      return false;
+    }
+  }
+  return true;
+}
+
+/**
+ * The key a generation's segment is stored under. The generation number, not the file name: two
+ * sessions may store the same file name, and a segment that answered for another session's
+ * generation would return records that do not exist here.
+ *
+ * @param {number | null} generation
+ */
+export function generationKey(generation) {
+  return generation === null || generation === undefined ? 'active' : `g${generation}`;
+}
diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/trajectory-index.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/trajectory-index.mjs
new file mode 100644
index 0000000..713fe9d
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/trajectory-index.mjs
@@ -0,0 +1,564 @@
+// @ts-check
+
+// The record-level index: what a session's ledger looks like, laid out so that reading a window,
+// counting a kind, or brushing a time range costs a lookup instead of a re-parse of every
+// generation the session has ever stored.
+//
+// WHY IT EXISTS. Reading a session today has exactly two shapes — all of it, or all of it with the
+// tail cut off — and both have to build every row of every generation first. That is why the
+// server keeps parsed rows resident (measured 231 MB for a 44-generation session) and keeps the
+// serialized response (135 MB for the same session). This file is the third shape: a durable,
+// cheap-to-load description of the ledger, so "give me records 3,100 through 3,300" and "how many
+// tool calls are there" stop being a reason to read 198 MB.
+//
+// FOUR QUESTIONS, because a change like this is not allowed to skip them.
+//
+// 归层 — server only. Everything here is derived from the projection the identity layer already
+// produced, and none of it is shipped to the page as a second answer: the window endpoint answers
+// out of this, and the full payload keeps its existing shape. The index never writes client state.
+//
+// 关联 — subordinate to the projection, parallel to the two caches it exists to replace. It is
+// built FROM the corrected records, so it inherits the identity merge rather than re-deciding it;
+// a view it does not cover (a single generation) falls back to the full build rather than being
+// answered from a stale approximation.
+//
+// 布局 — no new surface. Two files under the runtime's data dir, and query parameters on the route
+// that already exists. Nothing here is a panel, a section, or a page.
+//
+// 口径 — the answer must be the same answer. `verify-trajectory-index.mjs` holds every window, KPI
+// and brush it serves against the full payload field by field, so switching a read onto this file
+// cannot move a number the page already shows.
+//
+// STORAGE. Two files per (session, view): records.jsonl, then manifest.json. The manifest is
+// written LAST and only after the records are in place under their final name, so a run that dies
+// half way leaves a manifest that does not describe the bytes next to it — and a missing or
+// mismatched manifest means "no index", never "half an index". Absolute paths are deliberately
+// absent: a record names a file by its index into the manifest's own file table, so the artifact
+// carries no machine path and is meaningless outside the session it was built for.
+//
+// The records are JSONL rather than a b-tree because the primary key is already dense and sorted
+// (measured gapless 1..36527 on a 44-generation session), which makes the file on disk the sorted
+// array a binary search wants. The one thing that must not be searched that way is the timestamp —
+// see `buildSecondary`.
+
+import { createHash } from 'node:crypto';
+import { mkdir, open, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+
+/**
+ * Bumped when the on-disk shape changes in a way an older reader cannot survive. A file written
+ * under a different version is rebuilt, never migrated: the source it describes is still there.
+ */
+export const INDEX_SCHEMA_VERSION = 1;
+
+/**
+ * Bumped when `buildTrajectoryPayload` changes what a record CONTAINS, independently of the file
+ * layout above. A projection that starts emitting a new field, or stops clipping at a different
+ * length, makes every stored index describe a ledger that no longer exists — and the check that
+ * catches it has to be about the projection, not about the bytes.
+ */
+export const PROJECTION_VERSION = 1;
+
+/**
+ * The record fields the index does NOT carry.
+ *
+ * A denylist, not an allowlist, and the reason is that a field this file forgot would be a field
+ * the page renders as blank with nothing to say why. The projected text fields are the whole of
+ * what is left out: they are the bulk of the payload, and the ledger draws them from one record at
+ * a time, so they are read back from the source line the locator names — the same move `/raw`
+ * already makes. Everything else, however small, is carried verbatim.
+ *
+ * `rawRow` is dropped for a different reason: it is an index into an array that is gone by the time
+ * anything reads this file, and the locator beside it is the durable form of the same fact.
+ */
+export const EXCLUDED_RECORD_FIELDS = new Set([
+  'text',
+  'thinking',
+  'arguments',
+  'result',
+  'error',
+  'rawRow',
+]);
+
+/**
+ * Turn-level fields, kept apart because a window has to reproduce a turn header without the rows
+ * that header was summed from. Sums, not derivations: `toolCalls` / `errors` / `tokens` are read
+ * off the built turn rather than recomputed, so a window's header matches the full build's header.
+ */
+export const INDEX_TURN_FIELDS = [
+  'id',
+  'index',
+  'startedAt',
+  'endedAt',
+  'durationMs',
+  'toolCalls',
+  'errors',
+  'tokens',
+  'turnClass',
+  'askedReader',
+  'closed',
+  'openerInView',
+  'openerOutOfView',
+];
+
+/**
+ * One source file, as the index knows it.
+ *
+ * `filePath` is here because a locator names a file by its path and the record has to be matched
+ * to a file exactly, not by basename — but it is stripped before the manifest is written, so no
+ * machine path reaches the artifact. That is also why it is not compared by `sameSources`: it is
+ * not identity, it is where the identity happens to live this time.
+ *
+ * @typedef {{ fileName: string, generation: number | null, size: number, mtimeMs: number, revision: string | null, filePath?: string }} IndexFile
+ */
+
+/** @typedef {{ schemaVersion: number, projectionVersion: number, view: string, files: IndexFile[], recordCount: number, turnCount: number, recordsBytes: number, recordsDigest: string, projectionDigest: string }} IndexManifest */
+
+/**
+ * One ledger record as the index stores it.
+ * @typedef {Record<string, any>} IndexRecord
+ */
+
+/**
+ * Turns a built payload's turns into the two line-per-item shapes the file is made of.
+ *
+ * `raws` is the record -> locator map the route already builds for `/raw`; it is read here and
+ * then forgotten, because a locator's `filePath` is a machine path and the file must not carry one.
+ * A record with no locator becomes `fileIdx: -1`, which is a real state (a projection built by a
+ * caller that had no locators) and is not silently repaired to 0 — that would point the record at
+ * whichever file happens to be first.
+ *
+ * There is deliberately no `ordinalInLine`. One source line expands into several records, but they
+ * all answer with the same message, so `/raw` locates per line and not per segment — a segment
+ * number here would be a field nothing could act on.
+ *
+ * @param {{ turns: Array<any>, stats: Record<string, any>, session: Record<string, any> }} payload
+ * @param {Map<number, { filePath: string, start: number, end: number, digest: string }>} raws
+ * @param {IndexFile[]} files
+ * @returns {{ turns: Array<Record<string, any>>, records: IndexRecord[] }}
+ */
+export function indexRowsFromPayload(payload, raws, files) {
+  const pathToFileIdx = new Map();
+  files.forEach((file, i) => {
+    // Matched on the full path, not the file name: two generations can each hold a file the catalog
+    // names the same way, and a basename match would file one generation's records under the other.
+    // First writer wins, because a path can only be in the table once for one session.
+    if (typeof file.filePath === 'string' && !pathToFileIdx.has(file.filePath)) {
+      pathToFileIdx.set(file.filePath, i);
+    }
+  });
+  /** @type {IndexRecord[]} */
+  const records = [];
+  /** @type {Array<Record<string, any>>} */
+  const turns = [];
+  for (const turn of payload.turns) {
+    /** @type {Record<string, any>} */
+    const header = {};
+    for (const field of INDEX_TURN_FIELDS) header[field] = turn[field] ?? null;
+    header.firstRecord = 0;
+    header.lastRecord = -1;
+    for (const record of turn.records) {
+      const locator = raws.get(record.index);
+      const fileIdx = locator === undefined ? -1 : (pathToFileIdx.get(locator.filePath) ?? -1);
+      /** @type {IndexRecord} */
+      const line = {};
+      for (const [key, value] of Object.entries(record)) {
+        if (EXCLUDED_RECORD_FIELDS.has(key)) continue;
+        if (value === undefined) continue;
+        line[key] = value;
+      }
+      line.fileIdx = fileIdx;
+      // Where the line that produced this record sat in its file. `ordinalInLine` — which segment of
+      // a line this record is — is deliberately absent: every record out of one line answers with the
+      // same message, so /raw locates per line. These two are different: they name the LINE, and they
+      // are what a search hit in a sealed generation is mapped back through, because a sealed
+      // generation's records are searched long after the row objects that gave them their ordinals
+      // have stopped existing. `-1` is "no location", and stays distinguishable from a byte 0.
+      line.byteStart = locator === undefined ? -1 : locator.start;
+      line.byteEnd = locator === undefined ? -1 : locator.end;
+      // Whether `error` had text, not the text: the flag is what a row is styled by, and carrying
+      // the string would put the bulk back into the file this exists to keep small.
+      line.hasErrorText = typeof record.error === 'string' && record.error.length > 0;
+      if (header.lastRecord < 0) header.firstRecord = records.length;
+      header.lastRecord = records.length;
+      records.push(line);
+    }
+    turns.push(header);
+  }
+  return { turns, records };
+}
+
+/**
+ * Serializes turns and records into the two byte ranges of one file, in that order.
+ *
+ * Turns first so that a reader can learn the turn table without touching a record line, and so a
+ * file whose record half is truncated still has a describable header.
+ *
+ * @param {{ turns: Array<Record<string, any>>, records: IndexRecord[] }} rows
+ * @returns {string}
+ */
+export function serializeIndex(rows) {
+  const parts = [];
+  // No separator between the two blocks: the manifest's `turnCount` is the boundary, and a blank
+  // line would be a second thing that has to agree with it.
+  for (const turn of rows.turns) parts.push(JSON.stringify(turn));
+  for (const record of rows.records) parts.push(JSON.stringify(record));
+  return parts.join('\n');
+}
+
+/**
+ * @param {string} text
+ * @param {IndexManifest} manifest
+ * @returns {{ turns: Array<Record<string, any>>, records: IndexRecord[] } | null}
+ */
+export function parseIndex(text, manifest) {
+  if (manifest.recordsDigest !== digestOf(text)) return null;
+  const lines = text.split('\n');
+  if (lines.length < 1) return null;
+  const turns = [];
+  for (let i = 0; i < manifest.turnCount; i += 1) {
+    const line = lines[i];
+    if (line === undefined || line === '') return null;
+    let parsed;
+    try { parsed = JSON.parse(line); } catch { return null; }
+    if (!parsed || typeof parsed !== 'object') return null;
+    turns.push(parsed);
+  }
+  // Exactly as many lines as the manifest claims, and no more: a file with an extra line is one
+  // whose writer was interrupted, and reading the prefix of it would answer with half an index.
+  if (lines.length !== manifest.turnCount + manifest.recordCount) return null;
+  const records = [];
+  for (let i = manifest.turnCount; i < manifest.turnCount + manifest.recordCount; i += 1) {
+    const line = lines[i];
+    if (line === undefined || line === '') return null;
+    let parsed;
+    try { parsed = JSON.parse(line); } catch { return null; }
+    if (!parsed || typeof parsed !== 'object') return null;
+    records.push(parsed);
+  }
+  return { turns, records };
+}
+
+/**
+ * The identity half of a source file, with the path taken off.
+ *
+ * This is what the manifest stores and what `sameSources` compares, so it is also what decides
+ * whether a stored index may be reused: a machine path is not part of that question.
+ *
+ * @param {IndexFile} file
+ */
+export function stripPath(file) {
+  return {
+    fileName: file.fileName,
+    generation: file.generation,
+    size: file.size,
+    mtimeMs: file.mtimeMs,
+    revision: file.revision,
+  };
+}
+
+/** @param {string} text */
+export function digestOf(text) {
+  return createHash('sha256').update(text).digest('hex');
+}
+
+/**
+ * The five secondary structures, built once per load.
+ *
+ * `index` is the primary key and needs no structure: the array is already in index order, and the
+ * file is written that way. `timestamp` is the one that costs a sort, and it is the one that may
+ * NOT be searched in index order — a session's timestamps are nearly but not quite monotonic
+ * (measured 32 adjacent inversions in 25,428 rows, the largest a 141.8 s step backwards, against a
+ * 98.9 h span), so bisecting the primary order would silently drop whatever fell in a gap. The
+ * ordering is therefore a side array, and nothing is allowed to reach for `records[]` order when
+ * answering a time range.
+ *
+ * @param {IndexRecord[]} records
+ */
+export function buildSecondary(records) {
+  /** @type {Map<string, number[]>} */
+  const byMessageId = new Map();
+  /** @type {Map<number, number[]>} */
+  const byGeneration = new Map();
+  /** @type {Map<string, number>} */
+  const kindCounts = new Map();
+  /** @type {number[]} */
+  const timedPositions = [];
+  for (let i = 0; i < records.length; i += 1) {
+    const record = records[i];
+    // `id` IS the logical message id: it is the field the page groups by and the field the
+    // identity layer keys on. A record without one is unkeyed and joins no group — it is not
+    // filed under a shared empty key, which would merge every unkeyed record into one message.
+    if (typeof record.id === 'string' && record.id.length > 0) {
+      const existing = byMessageId.get(record.id);
+      if (existing === undefined) byMessageId.set(record.id, [i]);
+      else existing.push(i);
+    }
+    if (typeof record.generation === 'number') {
+      const existing = byGeneration.get(record.generation);
+      if (existing === undefined) byGeneration.set(record.generation, [i]);
+      else existing.push(i);
+    }
+    if (typeof record.kind === 'string') {
+      kindCounts.set(record.kind, (kindCounts.get(record.kind) ?? 0) + 1);
+    }
+    if (typeof record.timestamp === 'number') timedPositions.push(i);
+  }
+  // Stable so that two records sharing a timestamp keep index order among themselves: a time
+  // brush that lists them back in ledger order is the order the reader is looking at.
+  timedPositions.sort((a, b) => {
+    const delta = records[a].timestamp - records[b].timestamp;
+    return delta === 0 ? a - b : delta;
+  });
+  const timeValues = new Float64Array(timedPositions.length);
+  for (let i = 0; i < timedPositions.length; i += 1) timeValues[i] = records[timedPositions[i]].timestamp;
+  return {
+    recordCount: records.length,
+    /** @type {Map<string, number[]>} */
+    byMessageId,
+    /** @type {Map<number, number[]>} */
+    byGeneration,
+    /** @type {Map<string, number>} */
+    kindCounts,
+    /** @type {Float64Array} */
+    timeValues,
+    /** @type {Int32Array} */
+    timeRows: Int32Array.from(timedPositions),
+    untimedCount: records.length - timedPositions.length,
+  };
+}
+
+/**
+ * The half-open record range a window request names, clamped to what exists.
+ *
+ * `limit` is bounded here rather than at the route so that every caller gets the same ceiling and
+ * the guard can pin one number.
+ *
+ * @param {{ recordCount: number }} secondary
+ * @param {{ from?: number | null, limit?: number | null, tail?: number | null }} request
+ */
+export function resolveWindow(secondary, request) {
+  const total = secondary.recordCount;
+  if (total === 0) return { from: 1, to: 0, limit: 0, total: 0 };
+  const tail = typeof request.tail === 'number' && request.tail > 0 ? Math.min(request.tail, MAX_WINDOW_RECORDS) : null;
+  const from = typeof request.from === 'number' && request.from > 0 ? request.from : 1;
+  if (tail !== null) {
+    const start = Math.max(1, total - tail + 1);
+    return { from: start, to: total, limit: tail, total };
+  }
+  const limit = Math.min(
+    typeof request.limit === 'number' && request.limit > 0 ? request.limit : MAX_WINDOW_RECORDS,
+    MAX_WINDOW_RECORDS,
+  );
+  const start = Math.min(from, total);
+  const end = Math.min(start + limit - 1, total);
+  return { from: start, to: end, limit: end - start + 1, total };
+}
+
+/**
+ * One window's worth of records: the range plus every turn that touches it.
+ *
+ * The extra turns are not padding. A group header carries the turn's token and error totals, so a
+ * window that cut a turn in half would print a header describing rows the reader cannot see. The
+ * turn table knows each turn's record span, which is why it is indexed separately.
+ *
+ * @param {{ turns: Array<Record<string, any>> }} index
+ * @param {{ from: number, to: number, total: number }} range
+ */
+export function windowTurns(index, range) {
+  const out = [];
+  for (let i = 0; i < index.turns.length; i += 1) {
+    const turn = index.turns[i];
+    const first = typeof turn.firstRecord === 'number' ? turn.firstRecord : null;
+    const last = typeof turn.lastRecord === 'number' ? turn.lastRecord : null;
+    // A turn with no records still has a header the full payload emitted, so it is kept.
+    if (first === null || last === null || last < first) {
+      out.push({ turn, records: [] });
+      continue;
+    }
+    const start = first + 1;
+    const end = last + 1;
+    if (end < range.from || start > range.to) continue;
+    out.push({ turn, records: [Math.max(start, range.from), Math.min(end, range.to)] });
+  }
+  return out;
+}
+
+/**
+ * Every record whose timestamp falls in a range, in ledger order.
+ *
+ * Bisected on the sorted side array and then sorted back into index order, because the answer a
+ * brush highlights is a set of ledger rows and the page addresses them by record.
+ *
+ * @param {ReturnType<typeof buildSecondary>} secondary
+ * @param {number} from inclusive
+ * @param {number} to inclusive
+ * @returns {number[]} record indexes
+ */
+export function recordsInTimeRange(secondary, from, to) {
+  if (to < from || secondary.timeValues.length === 0) return [];
+  const values = secondary.timeValues;
+  let lo = 0;
+  let hi = values.length;
+  while (lo < hi) {
+    const mid = (lo + hi) >> 1;
+    if (values[mid] < from) lo = mid + 1;
+    else hi = mid;
+  }
+  const hits = [];
+  for (let i = lo; i < values.length && values[i] <= to; i += 1) hits.push(secondary.timeRows[i]);
+  hits.sort((a, b) => a - b);
+  return hits;
+}
+
+/** The most records one window response may carry, whatever the request asked for. */
+export const MAX_WINDOW_RECORDS = 2000;
+
+/**
+ * A derived-artifact store under the runtime's data dir. Never beside the session history and never
+ * inside the plugin package: the session store is read-only input, and the package installs onto
+ * every reader's machine.
+ *
+ * @param {string} root
+ */
+export function createIndexStore(root) {
+  const safe = (part) => String(part).replace(/[^A-Za-z0-9._-]/g, '_').slice(0, 120) || '_';
+
+  /**
+   * @param {string} sessionKey
+   * @param {string} view
+   */
+  const dirOf = (sessionKey, view) => join(root, safe(sessionKey), safe(view));
+
+  return {
+    /**
+     * Publishes one view. The records land under their final name first; the manifest, which is
+     * what makes the pair readable, lands last.
+     *
+     * @param {string} sessionKey
+     * @param {string} view
+     * @param {{ turns: Array<Record<string, any>>, records: IndexRecord[] }} rows
+     * @param {{ files: IndexFile[], projectionDigest: string }} meta
+     */
+    async write(sessionKey, view, rows, meta) {
+      const dir = dirOf(sessionKey, view);
+      await mkdir(dir, { recursive: true });
+      const text = serializeIndex(rows);
+      const recordPath = join(dir, 'records.jsonl');
+      const manifestPath = join(dir, 'manifest.json');
+      await writeFile(`${recordPath}.tmp`, text, 'utf8');
+      await rename(`${recordPath}.tmp`, recordPath);
+      /** @type {IndexManifest} */
+      const manifest = {
+        schemaVersion: INDEX_SCHEMA_VERSION,
+        projectionVersion: PROJECTION_VERSION,
+        view,
+        files: meta.files.map(stripPath),
+        recordCount: rows.records.length,
+        turnCount: rows.turns.length,
+        turnsStart: 0,
+        recordsBytes: Buffer.byteLength(text),
+        recordsDigest: digestOf(text),
+        projectionDigest: meta.projectionDigest,
+      };
+      await writeFile(`${manifestPath}.tmp`, `${JSON.stringify(manifest)}\n`, 'utf8');
+      await rename(`${manifestPath}.tmp`, manifestPath);
+      return manifest;
+    },
+
+    /**
+     * Reads one view, or answers `null` for every reason it cannot be trusted: no manifest, a
+     * manifest from another schema or another projection, a source file that moved, or records
+     * whose bytes do not match the digest the manifest was written with.
+     *
+     * @param {string} sessionKey
+     * @param {string} view
+     * @param {IndexFile[]} sourceFiles the files the caller just stat()ed
+     */
+    async read(sessionKey, view, sourceFiles) {
+      const dir = dirOf(sessionKey, view);
+      let manifest;
+      try {
+        manifest = JSON.parse(await readFile(join(dir, 'manifest.json'), 'utf8'));
+      } catch {
+        return null;
+      }
+      if (!manifest || typeof manifest !== 'object') return null;
+      if (manifest.schemaVersion !== INDEX_SCHEMA_VERSION) return null;
+      if (manifest.projectionVersion !== PROJECTION_VERSION) return null;
+      if (manifest.view !== view) return null;
+      if (!sameSources(manifest.files, sourceFiles)) return null;
+      let text;
+      try {
+        text = await readFile(join(dir, 'records.jsonl'), 'utf8');
+      } catch {
+        return null;
+      }
+      const rows = parseIndex(text, manifest);
+      if (rows === null) return null;
+      return { manifest, ...rows };
+    },
+
+    /**
+     * @param {string} sessionKey
+     * @param {string} view
+     */
+    async discard(sessionKey, view) {
+      await rm(dirOf(sessionKey, view), { recursive: true, force: true });
+    },
+
+    dirOf,
+  };
+}
+
+/**
+ * Whether the source a stored index was built from is still the source on disk.
+ *
+ * Identity is per file: the same names, in the same order, each with the same generation and the
+ * same byte length. `revision` is the runtime's own sha256 when the catalog carries one, and it is
+ * compared when both sides have it — that catches a rewrite which happened to preserve the length,
+ * which a length check alone cannot. Mtime is deliberately NOT compared: it moves when the file is
+ * touched without being written, and a reader that treated that as a change would rebuild a
+ * correct index for nothing on every poll.
+ *
+ * @param {IndexFile[]} stored
+ * @param {IndexFile[]} live
+ */
+export function sameSources(stored, live) {
+  if (!Array.isArray(stored) || !Array.isArray(live)) return false;
+  if (stored.length !== live.length) return false;
+  for (let i = 0; i < stored.length; i += 1) {
+    const a = stored[i];
+    const b = live[i];
+    if (!a || !b) return false;
+    if (a.fileName !== b.fileName) return false;
+    if (a.generation !== b.generation) return false;
+    if (a.size !== b.size) return false;
+    if (typeof a.revision === 'string' && a.revision.length > 0
+      && typeof b.revision === 'string' && b.revision.length > 0 && a.revision !== b.revision) {
+      return false;
+    }
+  }
+  return true;
+}
+
+/**
+ * What every served answer has to reproduce, reduced to one comparable value.
+ *
+ * The index is allowed to be a different shape from the payload — that is the point of it. It is
+ * not allowed to be a different ANSWER, and this is how that is checked rather than asserted.
+ *
+ * @param {{ stats: Record<string, any>, session: Record<string, any> }} payload
+ * @returns {string}
+ */
+export function projectionDigestOf(payload) {
+  return digestOf(JSON.stringify({
+    stats: payload.stats,
+    session: {
+      messageCount: payload.session.messageCount,
+      turnCount: payload.session.turnCount,
+      startedAt: payload.session.startedAt,
+      generation: payload.session.generation,
+    },
+  }));
+}
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-search-segments.py b/plugins/avatasia/mmc-trajectory/tests/mutate-search-segments.py
new file mode 100644
index 0000000..b02ac02
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-search-segments.py
@@ -0,0 +1,196 @@
+"""Mutation control for verify-search-segments.mjs.
+
+Each mutation reintroduces exactly one bug the probe is supposed to catch. The probe must FAIL every
+time, by NAME — a crash with no rule named is a weaker outcome, and this project treats it as one —
+and the file must come back byte-for-byte identical afterwards.
+
+The first six are the ones that matter: together they are the ways a segment can quietly stop being
+"the text the page was searching". A dropped field, a reordered field, a different separator, no
+folding and no whitespace rule each narrow what a reader can find, and none of them throws.
+"""
+import subprocess
+import sys
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parent
+MODULE = ROOT / "miniapp" / "node" / "search-segments.mjs"
+PROBE = HERE / "verify-search-segments.mjs"
+
+FIELDS = "export const SEARCH_FIELDS = ['summary', 'text', 'result', 'thinking', 'toolName'];"
+
+MUTATIONS = [
+    # ---- the surface has to be what the page searched -------------------------------------
+    (
+        "the thinking field is dropped from the search surface",
+        FIELDS,
+        "export const SEARCH_FIELDS = ['summary', 'text', 'result', 'toolName'];",
+    ),
+    (
+        "the fields are read in a different order",
+        FIELDS,
+        "export const SEARCH_FIELDS = ['summary', 'result', 'text', 'thinking', 'toolName'];",
+    ),
+    (
+        "the fields are joined with nothing instead of a separator",
+        "  return normaliseWhitespace(parts.join('\\n')).toLowerCase();",
+        "  return normaliseWhitespace(parts.join('')).toLowerCase();",
+    ),
+    (
+        "whitespace is not normalised, so the surface is five lines per record again",
+        "  return String(value).replace(/\\s+/g, ' ').trim();",
+        "  return String(value);",
+    ),
+    (
+        "the surface is not folded, so an upper-case needle finds nothing",
+        "  return normaliseWhitespace(parts.join('\\n')).toLowerCase();",
+        "  return normaliseWhitespace(parts.join('\\n'));",
+    ),
+    (
+        "the needle is folded but not normalised, so what the reader typed decides the answer",
+        "  return normaliseWhitespace(typeof needle === 'string' ? needle : '').toLowerCase();",
+        "  return (typeof needle === 'string' ? needle : '').toLowerCase();",
+    ),
+    # ---- the boundary, and the ordinal it is only correct because of ----------------------
+    (
+        "the scan joins every line into one blob, so a needle can cross a record boundary",
+        "  const hits = [];\n  let start = 0;\n  let ordinal = 0;",
+        "  const hits = [];\n  const flat = surface.replace(/\\n/g, ' ');\n  if (flat.includes(needle)) hits.push(0);\n  let start = 0;\n  let ordinal = 0;",
+    ),
+    (
+        "the scan counts only non-empty lines, so every ordinal after an empty record is one short",
+        "    if (line.includes(needle)) hits.push(ordinal);\n    ordinal += 1;",
+        "    if (line.includes(needle)) hits.push(ordinal);\n    if (line !== '') ordinal += 1;",
+    ),
+    (
+        "the locators are numbered from one while the scan numbers from zero",
+        "      ordinal: i,",
+        "      ordinal: i + 1,",
+    ),
+    (
+        "a locator of a record with no position claims file 0",
+        "      fileIdx: typeof record.fileIdx === 'number' ? record.fileIdx : -1,",
+        "      fileIdx: typeof record.fileIdx === 'number' ? record.fileIdx : 0,",
+    ),
+    # ---- the artifact ---------------------------------------------------------------------
+    (
+        "the manifest is published before the surface it describes",
+        "      await rename(`${join(dir, 'surface.txt')}.tmp`, join(dir, 'surface.txt'));",
+        "      await rename(`${join(dir, 'manifest.json')}.tmp`, join(dir, 'manifest.json'));",
+    ),
+    (
+        "a manifest from another schema version is served anyway",
+        "    if (manifest.schemaVersion !== SEGMENT_SCHEMA_VERSION) return null;",
+        "",
+    ),
+    (
+        "a surface with a line the locators do not account for is accepted",
+        "  if (lines.length !== manifest.recordCount) return null;",
+        "",
+    ),
+    (
+        "the runtime's own revision stops being compared, so a rewrite that kept the length is reused",
+        "    if (typeof a.revision === 'string' && a.revision.length > 0\n      && typeof b.revision === 'string' && b.revision.length > 0 && a.revision !== b.revision) {\n      return false;\n    }\n",
+        "",
+    ),
+    # ---- the rest of the contract ---------------------------------------------------------
+    (
+        "the needle floor is dropped, so one character is a search",
+        "  return foldNeedle(needle).trim().length >= MIN_NEEDLE_CHARS;",
+        "  return foldNeedle(needle).length >= 0;",
+    ),
+    (
+        "the hit cap is dropped, so a two-character needle returns the whole ledger",
+        "  return { ordinals: hits.slice(0, limit), total: hits.length, truncated: true };",
+        "  return { ordinals: hits, total: hits.length, truncated: true };",
+    ),
+    (
+        "the active generation's segment is stored under a sealed generation's key",
+        "  return generation === null || generation === undefined ? 'active' : `g${generation}`;",
+        "  return generation === null || generation === undefined ? 'g0' : `g${generation}`;",
+    ),
+]
+
+
+def read_exact(path):
+    """Normalise to LF for matching, and report the file's own newline so it can be put back."""
+    data = path.read_bytes()
+    text = data.decode("utf-8").replace("\r\n", "\n")
+    return text, ("\r\n" if b"\r\n" in data else "\n")
+
+
+def write_exact(path, text, newline):
+    if newline == "\r\n":
+        text = text.replace("\n", "\r\n")
+    path.write_bytes(text.encode("utf-8"))
+
+
+def run_probe():
+    proc = subprocess.run(
+        ["node", str(PROBE)],
+        cwd=str(ROOT),
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+    )
+    return proc.returncode, (proc.stdout or "") + (proc.stderr or "")
+
+
+def main():
+    code, output = run_probe()
+    if code != 0:
+        print("baseline probe does not pass; fix that first")
+        print(output)
+        return 1
+    print("baseline clean")
+
+    original = MODULE.read_bytes()
+    missed = []
+    unnamed = []
+    for label, old, new in MUTATIONS:
+        text, newline = read_exact(MODULE)
+        if old not in text:
+            print(f"SKIP  {label}: anchor not found")
+            missed.append(label)
+            continue
+        if old == new:
+            print(f"SKIP  {label}: the mutation changes nothing")
+            missed.append(label)
+            continue
+        write_exact(MODULE, text.replace(old, new, 1), newline)
+        try:
+            code, output = run_probe()
+        finally:
+            MODULE.write_bytes(original)
+        if code == 0:
+            print(f"MISSED {label}: the probe still passed")
+            missed.append(label)
+            continue
+        first = next(
+            (line.strip() for line in output.splitlines() if line.strip().startswith("- ")),
+            None,
+        )
+        if first is None:
+            print(f"UNNAMED {label}: the probe failed without naming a rule")
+            unnamed.append(label)
+        else:
+            print(f"caught {label}\n         -> {first}")
+
+    if MODULE.read_bytes() != original:
+        print(f"NOT RESTORED {MODULE}")
+        return 1
+    print("file restored byte-for-byte")
+
+    if missed or unnamed:
+        if missed:
+            print(f"\n{len(missed)} mutation(s) got through")
+        if unnamed:
+            print(f"{len(unnamed)} mutation(s) failed without naming a rule")
+        return 1
+    print(f"\nall {len(MUTATIONS)} mutations caught, each by name")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-index.py b/plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-index.py
new file mode 100644
index 0000000..fc7b1d2
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-index.py
@@ -0,0 +1,181 @@
+"""Mutation control for verify-trajectory-index.mjs.
+
+Each mutation reintroduces exactly one bug the probe is supposed to catch. The probe must FAIL
+every time, and the file must come back byte-for-byte identical afterwards. A mutation that the
+probe still passes means the assertion was tautological; a mutation whose anchor no longer exists
+means the assertion went dead, which is worse — the runner reports those as misses too.
+
+The groups are ordered by what they protect: a wrong ANSWER first, a half-written artifact second,
+and the ways the index would quietly stop being equivalent to the payload last.
+"""
+import subprocess
+import sys
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parent
+MODULE = ROOT / "miniapp" / "node" / "trajectory-index.mjs"
+PROBE = HERE / "verify-trajectory-index.mjs"
+
+MUTATIONS = [
+    # ---- the answer has to be the payload's answer -------------------------------------
+    (
+        "a record is matched to its file by name instead of by path, so every record loses its file",
+        "    if (typeof file.filePath === 'string' && !pathToFileIdx.has(file.filePath)) {\n      pathToFileIdx.set(file.filePath, i);\n    }",
+        "    if (typeof file.fileName === 'string' && !pathToFileIdx.has(file.fileName)) {\n      pathToFileIdx.set(file.fileName, i);\n    }",
+    ),
+    (
+        "a missing locator is repaired to file 0 instead of admitting it has none",
+        "      const fileIdx = locator === undefined ? -1 : (pathToFileIdx.get(locator.filePath) ?? -1);",
+        "      const fileIdx = locator === undefined ? 0 : (pathToFileIdx.get(locator.filePath) ?? -1);",
+    ),
+    (
+        "a missing locator is given the line's start instead of admitting it has none",
+        "      line.byteStart = locator === undefined ? -1 : locator.start;",
+        "      line.byteStart = locator === undefined ? 0 : locator.start;",
+    ),
+    (
+        "the projected text fields are carried after all, putting the bulk back into the file",
+        "        if (EXCLUDED_RECORD_FIELDS.has(key)) continue;\n",
+        "",
+    ),
+    (
+        "a turn is served whole even when the window holds only part of it",
+        "    out.push({ turn, records: [Math.max(start, range.from), Math.min(end, range.to)] });",
+        "    out.push({ turn, records: [start, end] });",
+    ),
+    (
+        "a turn the window only touches is dropped, so its header goes with it",
+        "    if (end < range.from || start > range.to) continue;",
+        "    if (end < range.from || start > range.to || true) continue;",
+    ),
+    (
+        "the window ceiling is dropped, so one request can ask for the whole lineage",
+        "  const limit = Math.min(\n    typeof request.limit === 'number' && request.limit > 0 ? request.limit : MAX_WINDOW_RECORDS,\n    MAX_WINDOW_RECORDS,\n  );",
+        "  const limit = typeof request.limit === 'number' && request.limit > 0 ? request.limit : MAX_WINDOW_RECORDS;",
+    ),
+    (
+        "the timestamp side array is replaced by the records' own order, so a range bisects the primary key",
+        "  timedPositions.sort((a, b) => {\n    const delta = records[a].timestamp - records[b].timestamp;\n    return delta === 0 ? a - b : delta;\n  });",
+        "  timedPositions.sort((a, b) => a - b);",
+    ),
+    (
+        "a record with no id joins the shared empty group",
+        "    if (typeof record.id === 'string' && record.id.length > 0) {\n      const existing = byMessageId.get(record.id);\n      if (existing === undefined) byMessageId.set(record.id, [i]);\n      else existing.push(i);\n    }",
+        "    const groupKey = typeof record.id === 'string' ? record.id : 'unkeyed';\n    {\n      const existing = byMessageId.get(groupKey);\n      if (existing === undefined) byMessageId.set(groupKey, [i]);\n      else existing.push(i);\n    }",
+    ),
+    # ---- a half-written artifact is never consumed --------------------------------------
+    (
+        "the manifest is published before the records it describes",
+        "      await rename(`${recordPath}.tmp`, recordPath);",
+        "      await rename(`${manifestPath}.tmp`, manifestPath);",
+    ),
+    (
+        "the manifest keeps the machine path it was handed",
+        "        files: meta.files.map(stripPath),",
+        "        files: meta.files,",
+    ),
+    (
+        "the records are accepted at whatever length they happen to be",
+        "  if (lines.length !== manifest.turnCount + manifest.recordCount) return null;",
+        "",
+    ),
+    (
+        "a manifest from another schema version is served anyway",
+        "    if (manifest.schemaVersion !== INDEX_SCHEMA_VERSION) return null;",
+        "",
+    ),
+    (
+        "a manifest from another projection version is served anyway",
+        "    if (manifest.projectionVersion !== PROJECTION_VERSION) return null;",
+        "",
+    ),
+    # ---- the source identity that decides reuse -----------------------------------------
+    (
+        "the runtime's own revision stops being compared, so a rewrite that kept the length is reused",
+        "    if (typeof a.revision === 'string' && a.revision.length > 0\n      && typeof b.revision === 'string' && b.revision.length > 0 && a.revision !== b.revision) {\n      return false;\n    }\n",
+        "",
+    ),
+    (
+        "the file name stops being compared, so a replaced source answers from the old index",
+        "    if (a.fileName !== b.fileName) return false;",
+        "",
+    ),
+    (
+        "a touched-but-unchanged source invalidates the index on every poll",
+        "    if (a.size !== b.size) return false;",
+        "    if (a.size !== b.size) return false;\n    if (a.mtimeMs !== b.mtimeMs) return false;",
+    ),
+]
+
+
+def read_exact(path):
+    """Normalise to LF for matching, and report the file's own newline so it can be put back."""
+    data = path.read_bytes()
+    text = data.decode("utf-8").replace("\r\n", "\n")
+    return text, ("\r\n" if b"\r\n" in data else "\n")
+
+
+def write_exact(path, text, newline):
+    if newline == "\r\n":
+        text = text.replace("\n", "\r\n")
+    path.write_bytes(text.encode("utf-8"))
+
+
+def run_probe():
+    proc = subprocess.run(
+        ["node", str(PROBE)],
+        cwd=str(ROOT),
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+    )
+    return proc.returncode, (proc.stdout or "") + (proc.stderr or "")
+
+
+def main():
+    code, output = run_probe()
+    if code != 0:
+        print("baseline probe does not pass; fix that first")
+        print(output)
+        return 1
+    print("baseline clean")
+
+    original = MODULE.read_bytes()
+    missed = []
+    for label, old, new in MUTATIONS:
+        text, newline = read_exact(MODULE)
+        if old not in text:
+            print(f"SKIP  {label}: anchor not found")
+            missed.append(label)
+            continue
+        write_exact(MODULE, text.replace(old, new, 1), newline)
+        try:
+            code, output = run_probe()
+        finally:
+            MODULE.write_bytes(original)
+        if code == 0:
+            print(f"MISSED {label}: the probe still passed")
+            missed.append(label)
+        else:
+            first = next(
+                (line.strip() for line in output.splitlines() if line.strip().startswith("- ")),
+                "(no detail)",
+            )
+            print(f"caught {label}\n         -> {first}")
+
+    if MODULE.read_bytes() != original:
+        print(f"NOT RESTORED {MODULE}")
+        return 1
+    print("file restored byte-for-byte")
+
+    if missed:
+        print(f"\n{len(missed)} mutation(s) got through")
+        return 1
+    print(f"\nall {len(MUTATIONS)} mutations caught")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/plugins/avatasia/mmc-trajectory/tests/run.mjs b/plugins/avatasia/mmc-trajectory/tests/run.mjs
index d042d72..b66cd53 100644
--- a/plugins/avatasia/mmc-trajectory/tests/run.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/run.mjs
@@ -44,6 +44,8 @@ const filter = args.find((a) => !a.startsWith('--')) ?? '';
 const SHIPPED = [
   'miniapp/client/index.html',
   'miniapp/node/server.mjs',
+  'miniapp/node/trajectory-index.mjs',
+  'miniapp/node/search-segments.mjs',
   'tests/make-fixtures.mjs',
   'tests/client-check.mjs',
   'README.md',
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs
index af8e7d5..6958fb0 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs
@@ -51,6 +51,8 @@ const SHIPPED_TEXT = {
   'README.zh-CN.md': readmeZh,
   'miniapp/client/index.html': clientHtml,
   'miniapp/node/server.mjs': serverJs,
+  'miniapp/node/trajectory-index.mjs': read('miniapp/node/trajectory-index.mjs'),
+  'miniapp/node/search-segments.mjs': read('miniapp/node/search-segments.mjs'),
   'tests/make-fixtures.mjs': read('tests/make-fixtures.mjs'),
   'tests/client-check.mjs': read('tests/client-check.mjs'),
   '.minimax-plugin/plugin.json': read('.minimax-plugin/plugin.json'),
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs
new file mode 100644
index 0000000..e19ad38
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs
@@ -0,0 +1,407 @@
+/**
+ * A search segment has to search what the page was searching, and only whole records.
+ *
+ * The page searches five fields per record (`recordSearchText`, client/index.html). This module
+ * stores those five fields once per sealed generation so the question does not have to be re-asked
+ * of 198 MB. Two things follow, and both are pinned here rather than asserted in a comment:
+ *
+ *  1. **The surface is the page's function, not a paraphrase of it.** The field list and its ORDER
+ *     are load-bearing — two lists differing only in order produce different surfaces, so a phrase
+ *     spanning two of them hits in one build and misses in another. The page's own implementation is
+ *     reproduced below and compared field for field.
+ *
+ *  2. **A scan may not cross a record boundary.** One record's surface is one line and the scan
+ *     tests each line alone. Joining the surfaces into one blob would let a needle starting at the
+ *     end of one record and finishing at the start of the next report a match belonging to neither —
+ *     and a measurement that found zero such false hits on real data is luck, not a property. So the
+ *     fixture below CONSTRUCTS one and the scan has to refuse it.
+ *
+ * Plus the artifact rules: a half-published segment is never consumed, the locators map a hit back to
+ * the line it came from, and nothing in the segment carries a machine path.
+ *
+ * Read-only: imports the pure helpers and writes only under a temp dir it makes itself.
+ * mutate-search-segments.py breaks each of these in the shipped module.
+ */
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { readFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import {
+  MAX_HITS,
+  MIN_NEEDLE_CHARS,
+  SEARCH_FIELDS,
+  buildSegment,
+  capHits,
+  createSegmentStore,
+  digestOf,
+  foldNeedle,
+  generationKey,
+  needleIsUsable,
+  normaliseWhitespace,
+  sameSource,
+  scanSegment,
+  searchSurfaceOf,
+} from '../miniapp/node/search-segments.mjs';
+
+const SEGMENT_PATH = new URL('../miniapp/node/search-segments.mjs', import.meta.url);
+
+let pass = 0;
+const failures = [];
+function check(name, actual, expected) {
+  if (JSON.stringify(actual) === JSON.stringify(expected)) pass += 1;
+  else failures.push(`${name}: got ${JSON.stringify(actual)}, want ${JSON.stringify(expected)}`);
+}
+function assert(name, cond) {
+  if (cond) pass += 1;
+  else failures.push(name);
+}
+
+/* =====================================================================
+ * 1 — the surface is the page's own function
+ * ===================================================================== */
+
+// Transcribed from client/index.html `recordSearchText` and `safeText`. Deliberately a COPY: the
+// point of the comparison is that the two implementations agree, and importing the page's would
+// make the check true by construction.
+function safeText(value) {
+  if (value === null || value === undefined) return '';
+  if (typeof value === 'string') return value;
+  if (typeof value === 'object' && value.text !== undefined) return safeText(value.text);
+  return '';
+}
+function pageRecordSearchText(record) {
+  if (!record || typeof record !== 'object') return '';
+  const thinking = record.thinking;
+  const thinkingText = thinking && typeof thinking === 'object'
+    ? safeText(thinking.text !== undefined ? thinking.text : thinking)
+    : safeText(thinking);
+  return [record.summary, record.text, safeText(record.result), thinkingText, record.toolName]
+    .map((part) => safeText(part))
+    .join('\n')
+    .toLowerCase();
+}
+
+const RECORDS = [
+  { summary: 'the first answer', text: 'a longer Body of the reply', result: null, thinking: null, toolName: null },
+  { summary: 'Reading a file', text: null, result: 'file contents here', thinking: null, toolName: 'read' },
+  { summary: 'Thinking it over', text: null, result: null, thinking: { text: 'weighing the options' }, toolName: null },
+  { summary: '', text: null, result: null, thinking: null, toolName: 'grep' },
+  { summary: 'No text at all', text: null, result: null, thinking: null, toolName: null },
+  // A record whose five fields are all empty. It searches as nothing, but it still OCCUPIES its
+  // ordinal — a scan that counted only non-empty lines would number everything after it one short,
+  // and every later hit would resolve to the record before the one that matched.
+  { summary: '', text: '', result: '', thinking: null, toolName: '' },
+  { summary: 'A summary with\nan embedded newline', text: 'line one\nline two', result: null, thinking: null, toolName: null },
+  { summary: null, text: null, result: null, thinking: null, toolName: null },
+];
+
+check('the field list is the page\'s, in the page\'s order',
+  SEARCH_FIELDS, ['summary', 'text', 'result', 'thinking', 'toolName']);
+// The field list is only the page's if the page still says it is. Read out of the shipped client
+// rather than out of this file's own copy of it, or the check would be true by construction.
+const CLIENT = readFileSync(new URL('../miniapp/client/index.html', import.meta.url), 'utf8');
+assert('the page still searches exactly these five fields, in this order',
+  /\[record\.summary, record\.text, safeText\(record\.result\), thinkingText, record\.toolName\]/.test(CLIENT));
+
+// The page's surface under the ONE normalisation the module states: runs of whitespace become one
+// space, ends trimmed. Anything else — a field dropped, a field reordered, a field read in the
+// wrong shape — shows up here as a string that differs.
+const pageSurface = (record) => normaliseWhitespace(pageRecordSearchText(record));
+for (let i = 0; i < RECORDS.length; i += 1) {
+  check(`record ${i} searches as the page searched it, under the stated normalisation`,
+    searchSurfaceOf(RECORDS[i]), pageSurface(RECORDS[i]));
+}
+
+// And the property that string equality alone cannot see: the same needle finds the same RECORDS.
+const NEEDLES = new Set(['', 'the', 'answer', 'grep', 'file', 'weighing', 'newline', 'answer a longer']);
+for (const record of RECORDS) {
+  const words = pageSurface(record).split(' ').filter(Boolean);
+  for (let i = 0; i + 2 < words.length; i += 1) NEEDLES.add(words.slice(i, i + 3).join(' '));
+  for (const word of words) NEEDLES.add(word);
+}
+let mismatch = [];
+const builtSurface = buildSegment({ records: RECORDS }).surface;
+for (const needle of NEEDLES) {
+  const folded = foldNeedle(needle);
+  if (folded === '') continue;
+  const onSurface = scanSegment(builtSurface, folded);
+  const onPage = RECORDS
+    .map((r, i) => ({ r, i }))
+    .filter(({ r }) => pageSurface(r).includes(folded))
+    .map(({ i }) => i);
+  if (JSON.stringify(onSurface) !== JSON.stringify(onPage)) mismatch.push(`${needle}: ${onSurface} vs ${onPage}`);
+}
+check(`the surface finds exactly what the page found, over ${NEEDLES.size} needles`, mismatch, []);
+// And the needle's own whitespace cannot change the answer.
+check('a needle with odd whitespace finds what the tidy one finds',
+  scanSegment(builtSurface, foldNeedle('  the   first  ')), scanSegment(builtSurface, foldNeedle('the first')));
+check('the page would NOT have matched a needle spanning its field separator, and that is stated',
+  pageRecordSearchText(RECORDS[0]).includes('answer a longer'), false);
+
+check('a record with no fields searches as empty', searchSurfaceOf(null), '');
+check('a record whose summary is empty searches as empty', searchSurfaceOf({}), '');
+assert('the surface is folded once, at build time',
+  searchSurfaceOf({ summary: 'MiXeD Case' }) === 'mixed case');
+// One line per record is what makes a scan's line number the record ordinal. The first draft joined
+// the five fields with the page's newline and produced five lines per record, so `scanSegment`
+// answered with line numbers while the locators were numbered by record — and every hit resolved to
+// whichever record sat at that line.
+assert('a record with five fields is still one line',
+  !searchSurfaceOf({ summary: 'a', text: 'b', result: 'c', thinking: { text: 'd' }, toolName: 'e' }).includes('\n'));
+check('its five fields are all still searchable',
+  scanSegment(buildSegment({
+    records: [{ summary: 'alpha', text: 'beta', result: 'gamma', thinking: { text: 'delta' }, toolName: 'epsilon' }],
+  }).surface, 'beta'), [0]);
+check('and it is still one line in the built surface',
+  buildSegment({
+    records: [{ summary: 'alpha', text: 'beta', result: 'gamma', thinking: { text: 'delta' }, toolName: 'epsilon' }],
+  }).surface.split('\n').length, 1);
+// Located by content, not by index: this fixture has grown records and an assertion pinned to a
+// position would then be checking a different record while still reading as if it were the same one.
+const newlineRecord = RECORDS.findIndex((r) => String(r.summary).includes('\n'));
+assert('the fixture really does carry a record with an embedded newline', newlineRecord >= 0);
+assert('and that record is one line on the surface',
+  !searchSurfaceOf(RECORDS[newlineRecord]).includes('\n'));
+check('and its two halves are still searchable together',
+  scanSegment(builtSurface, foldNeedle('with an embedded newline')), [newlineRecord]);
+check('and a needle spanning two fields of one record is found, which is the point of the space',
+  scanSegment(builtSurface, foldNeedle('answer a longer')), [0]);
+
+check('a record with no fields searches as empty', searchSurfaceOf(null), '');
+check('a record whose summary is empty searches as empty', searchSurfaceOf({}), '');
+assert('the surface is folded once, at build time',
+  searchSurfaceOf({ summary: 'MiXeD Case' }) === 'mixed case');
+assert('a record with five fields is still one line',
+  !searchSurfaceOf({ summary: 'a', text: 'b', result: 'c', thinking: { text: 'd' }, toolName: 'e' }).includes('\n'));
+check('all five of those fields are still on that one line',
+  searchSurfaceOf({ summary: 'a', text: 'b', result: 'c', thinking: { text: 'd' }, toolName: 'e' }),
+  'a b c d e');
+
+/* =====================================================================
+ * 2 — a scan cannot answer with a record that does not exist
+ * ===================================================================== */
+
+const segment = buildSegment({ records: RECORDS });
+check('one surface line per record', segment.surface.split('\n').length, RECORDS.length);
+check('one locator per record', segment.locators.split('\n').length, RECORDS.length);
+
+// The direct statement of the line-number bug, as an assertion: for every record, that record's own
+// surface finds that record, AT THAT RECORD'S ORDINAL. A surface that kept the page's newline
+// separator between its five fields produced one line per FIELD, so the scan answered with field
+// ordinals while the locators were numbered by record — and a hit resolved to whichever record
+// happened to sit at that line. The per-needle equivalence above cannot see it, because both sides
+// shift together; only the ordinal can.
+let wrongOrdinal = [];
+for (let i = 0; i < RECORDS.length; i += 1) {
+  const own = searchSurfaceOf(RECORDS[i]);
+  if (own === '') continue;
+  const hits = scanSegment(segment.surface, foldNeedle(own));
+  if (!hits.includes(i)) wrongOrdinal.push(`${i}: ${JSON.stringify(hits)}`);
+}
+check("each record's own surface finds that record, at its own ordinal", wrongOrdinal, []);
+
+check('a word in a summary is found', scanSegment(segment.surface, foldNeedle('answer')), [0]);
+check('a word in the body text is found', scanSegment(segment.surface, foldNeedle('longer body')), [0]);
+check('a word in a tool result is found', scanSegment(segment.surface, foldNeedle('contents here')), [1]);
+check('a word in a thinking block is found', scanSegment(segment.surface, foldNeedle('weighing')), [2]);
+check('a tool name is found', scanSegment(segment.surface, foldNeedle('grep')), [3]);
+check('the needle is folded the same way the surface was',
+  scanSegment(segment.surface, foldNeedle('ANSWER')), [0]);
+
+// The boundary, constructed rather than observed: one record ends with `record` and the next begins
+// with `the first`. The needle belongs to neither. The control is the implementation this is here to
+// prevent — flatten every newline in the surface to a space, then read it as one string — which
+// reports a match that exists in no record.
+const boundarySegment = buildSegment({
+  records: [{ summary: 'the last word of one record' }, { summary: 'the first word of the next' }],
+});
+const joinedAsOneBlob = boundarySegment.surface.replace(/\n/g, ' ');
+check('a needle spanning two records matches nothing', scanSegment(boundarySegment.surface, foldNeedle('record the first')), []);
+check('and does not match either side', scanSegment(boundarySegment.surface, foldNeedle('last word of one')), [0]);
+assert('the joined blob WOULD have matched, which is what the boundary is for',
+  joinedAsOneBlob.includes(foldNeedle('record the first')));
+
+check('an empty needle matches nothing', scanSegment(segment.surface, ''), []);
+check('a single line scan still finds the last record',
+  scanSegment(buildSegment({ records: [{ summary: 'a' }, { summary: 'z' }] }).surface, 'z'), [1]);
+check('one record is one hit, not one per occurrence',
+  scanSegment(buildSegment({ records: [{ summary: 'x x x' }] }).surface, 'x'), [0]);
+check('an empty generation scans to nothing', scanSegment('', 'x'), []);
+
+// The usable-needle floor: measured, not guessed. A one-character needle on this surface matches
+// every record that carries a letter, so the floor is what keeps a search an answer.
+assert('a one-character needle is refused', !needleIsUsable('x'));
+assert('a two-character needle is accepted', needleIsUsable('xy'));
+check('the floor is the number the guard reads', MIN_NEEDLE_CHARS, 2);
+check('whitespace does not count toward the floor', needleIsUsable('  '), false);
+assert('a needle longer than the floor passes', needleIsUsable('  real words  '));
+
+/* =====================================================================
+ * 3 — a hit maps back to the line it came from
+ * ===================================================================== */
+
+const withLocators = buildSegment({
+  records: RECORDS.map((r, i) => ({ ...r, fileIdx: i < 4 ? 0 : 1, byteStart: i * 100, byteEnd: i * 100 + 40 })),
+});
+const locatorList = withLocators.locators.split('\n').map((line) => JSON.parse(line));
+check('locator ordinals are the record order', locatorList.map((l) => l.ordinal), RECORDS.map((_, i) => i));
+check('locators carry which file', locatorList.map((l) => l.fileIdx), RECORDS.map((_, i) => (i < 4 ? 0 : 1)));
+check('locators carry where the line sat', locatorList.map((l) => l.byteStart), RECORDS.map((_, i) => i * 100));
+check('a locator of a record with no position says -1',
+  JSON.parse(buildSegment({ records: [{ summary: 'x' }] }).locators),
+  { ordinal: 0, fileIdx: -1, byteStart: -1, byteEnd: -1 });
+
+const hit = scanSegment(withLocators.surface, foldNeedle('grep'))[0];
+// Read through `?.` so a build whose surfaces no longer line up with their records FAILS HERE BY
+// NAME rather than throwing on an undefined locator — a crash names no rule, and the reader is left
+// with a stack trace instead of the thing that moved.
+check('a hit resolves to a locator', locatorList[hit]?.ordinal ?? null, hit ?? null);
+check('and that locator names the line the hit came from', locatorList[hit]?.byteStart ?? null, hit === undefined ? null : hit * 100);
+
+/* =====================================================================
+ * 4 — a half-published segment is never consumed
+ * ===================================================================== */
+
+const SOURCE = [{ fileName: 'g0.jsonl', generation: 0, size: 100, revision: 'sha256:' + 'a'.repeat(64) }];
+const root = await mkdtemp(join(tmpdir(), 'mmc-seg-'));
+const store = createSegmentStore(root);
+const storeFailures = [];
+
+try {
+  assert('nothing stored yet reads as no segment',
+    (await store.read('s', 'all', 'g0', SOURCE)) === null);
+
+  const written = await store.write('s', 'all', 'g0', segment, { generation: 0, source: SOURCE });
+  check('the manifest counts the records', written.recordCount, RECORDS.length);
+  const good = await store.read('s', 'all', 'g0', SOURCE);
+  assert('a complete pair reads back', good !== null);
+  if (good !== null) {
+    check('the surface is the one written', good.surface, segment.surface);
+    check('every locator is readable', good.locators.length, RECORDS.length);
+  }
+
+  const dir = store.dirOf('s', 'all', 'g0');
+
+  await writeFile(join(dir, 'surface.txt'), '', 'utf8');
+  assert('a surface that does not match its manifest is refused',
+    (await store.read('s', 'all', 'g0', SOURCE)) === null);
+  await writeFile(join(dir, 'surface.txt'), `${segment.surface}\nextra`, 'utf8');
+  assert('a surface with a line the locators do not account for is refused',
+    (await store.read('s', 'all', 'g0', SOURCE)) === null);
+
+  // The locator count, isolated from the checksums. Every other refusal above is caught by a digest
+  // first, which means "the file holds exactly what the manifest claims" was never actually on
+  // trial. Here the locator file gains a line AND the manifest's digest for it is re-taken, so both
+  // bytes check out and only the count disagrees.
+  const baseManifest = JSON.parse(await readFile(join(dir, 'manifest.json'), 'utf8'));
+  // Put the surface back first: the case above deliberately left a grown one on disk, and this
+  // control is about the LOCATOR count, not about two files being wrong at once.
+  await writeFile(join(dir, 'surface.txt'), segment.surface, 'utf8');
+  const grownLocators = `${segment.locators}\n${JSON.stringify({ ordinal: RECORDS.length, fileIdx: 0, byteStart: 0, byteEnd: 1 })}`;
+  await writeFile(join(dir, 'locators.jsonl'), grownLocators, 'utf8');
+  await writeFile(join(dir, 'manifest.json'),
+    JSON.stringify({ ...baseManifest, locatorDigest: digestOf(grownLocators), locatorBytes: Buffer.byteLength(grownLocators) }), 'utf8');
+  assert('locators the manifest does not count are refused',
+    (await store.read('s', 'all', 'g0', SOURCE)) === null);
+  // And the positive control, because a check that refuses everything would pass the line above:
+  // the same file with a manifest that counts it IS read.
+  await writeFile(join(dir, 'manifest.json'),
+    JSON.stringify({ ...baseManifest, locatorDigest: digestOf(grownLocators), locatorBytes: Buffer.byteLength(grownLocators), recordCount: RECORDS.length + 1 }), 'utf8');
+  const counted = await store.read('s', 'all', 'g0', SOURCE);
+  assert('and is read once the manifest counts it', counted !== null);
+  if (counted !== null) check('with every locator present', counted.locators.length, RECORDS.length + 1);
+  await store.write('s', 'all', 'g0', segment, { generation: 0, source: SOURCE });
+
+  await rm(join(dir, 'manifest.json'), { force: true });
+  assert('a pair with no manifest is refused',
+    (await store.read('s', 'all', 'g0', SOURCE)) === null);
+
+  await store.write('s', 'all', 'g0', segment, { generation: 0, source: SOURCE });
+  const manifestPath = join(dir, 'manifest.json');
+  const original = JSON.parse(await readFile(manifestPath, 'utf8'));
+  for (const [patch, label] of [
+    [{ schemaVersion: 99 }, 'another schema version'],
+    [{ view: 'g3' }, 'another view'],
+  ]) {
+    await writeFile(manifestPath, JSON.stringify({ ...original, ...patch }), 'utf8');
+    assert(`a manifest from ${label} is refused`, (await store.read('s', 'all', 'g0', SOURCE)) === null);
+  }
+  await writeFile(manifestPath, 'not json', 'utf8');
+  assert('an unreadable manifest is refused', (await store.read('s', 'all', 'g0', SOURCE)) === null);
+  await writeFile(manifestPath, JSON.stringify(original), 'utf8');
+  assert('the restored manifest reads again', (await store.read('s', 'all', 'g0', SOURCE)) !== null);
+
+  // The source identity that decides reuse.
+  assert('a source that grew refuses the segment',
+    (await store.read('s', 'all', 'g0', [{ ...SOURCE[0], size: 101 }])) === null);
+  assert('a source whose revision changed refuses the segment',
+    (await store.read('s', 'all', 'g0', [{ ...SOURCE[0], revision: 'sha256:' + 'f'.repeat(64) }])) === null);
+  assert('a renamed source refuses the segment',
+    (await store.read('s', 'all', 'g0', [{ ...SOURCE[0], fileName: 'x.jsonl' }])) === null);
+  assert('a source that went away refuses the segment',
+    (await store.read('s', 'all', 'g0', [])) === null);
+  assert('a touched-but-unchanged source keeps the segment, on purpose',
+    (await store.read('s', 'all', 'g0', [{ ...SOURCE[0], revision: SOURCE[0].revision }])) !== null);
+
+  // Two generations are two segments: one never answers for the other.
+  await store.write('s', 'all', 'g1', segment, { generation: 1, source: [{ ...SOURCE[0], generation: 1 }] });
+  const g0 = await store.read('s', 'all', 'g0', SOURCE);
+  const g1 = await store.read('s', 'all', 'g1', [{ ...SOURCE[0], generation: 1 }]);
+  check('two generations read back the same bytes', g0?.surface, g1?.surface);
+  assert('and each is keyed by its own generation',
+    store.dirOf('s', 'all', 'g0') !== store.dirOf('s', 'all', 'g1'));
+  assert('another session does not answer', (await store.read('other', 'all', 'g0', SOURCE)) === null);
+} catch (error) {
+  storeFailures.push(`the segment store could not be exercised: ${error instanceof Error ? error.message : String(error)}`);
+} finally {
+  await rm(root, { recursive: true, force: true });
+}
+for (const line of storeFailures) failures.push(line);
+
+/* =====================================================================
+ * 5 — the rest of the contract
+ * ===================================================================== */
+
+check('the active generation has a key of its own', generationKey(null), 'active');
+check('a sealed generation keys on its number', generationKey(3), 'g3');
+check('two sessions cannot collide on a generation key', generationKey(0) !== generationKey(1), true);
+
+const many = Array.from({ length: MAX_HITS + 40 }, (_, i) => ({ summary: `hit ${i}` }));
+const manyHits = scanSegment(buildSegment({ records: many }).surface, 'hit');
+const capped = capHits(manyHits);
+check('hits are capped', capped.ordinals.length, MAX_HITS);
+check('the real total is still reported', capped.total, MAX_HITS + 40);
+check('and the cap says so', capped.truncated, true);
+const underCap = capHits([1, 2, 3]);
+check('a short answer is not marked truncated', [underCap.truncated, underCap.total], [false, 3]);
+
+check('sameSource is order sensitive', sameSource(SOURCE, [{ ...SOURCE[0] }]), true);
+check('sameSource rejects an empty stored source', sameSource([], SOURCE), false);
+check('sameSource rejects a longer live source',
+  sameSource(SOURCE, [SOURCE[0], { ...SOURCE[0], generation: 1 }]), false);
+
+const source = await readFile(SEGMENT_PATH, 'utf8');
+assert('the segment is written under the runtime data dir and nowhere else',
+  !/join\([^)]*sessions/i.test(source));
+// The publish order is only observable in the source: a correct writer and one that publishes the
+// manifest first leave the same directory behind. Read the two rename TARGETS rather than the word
+// "manifest", which appears in the reader too.
+const publishSurface = source.indexOf(`join(dir, 'surface.txt'))`);
+const publishManifest = source.indexOf(`join(dir, 'manifest.json'))`);
+assert('the manifest is published last',
+  publishSurface >= 0 && publishManifest > publishSurface);
+assert('nothing here spawns a thread; the route owns that',
+  !/worker_threads/.test(source));
+assert('the scan is a per-line test, not a joined blob',
+  /line\.includes\(needle\)/.test(source) && !/\+ .*surface.*\+/.test(source.split('export function scanSegment')[1].split('export function')[0]));
+
+/* --------------------------------------------------------------------- */
+
+if (failures.length) {
+  console.log(`\n  [search-segments] ${failures.length} failure(s):`);
+  for (const line of failures) console.log(`    - ${line}`);
+  console.log('');
+  process.exitCode = 1;
+} else {
+  console.log(`[search-segments] ${pass} assertions passed`);
+}
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-trajectory-index.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-trajectory-index.mjs
new file mode 100644
index 0000000..a05547a
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-trajectory-index.mjs
@@ -0,0 +1,538 @@
+/**
+ * The index has to be the same answer as the payload it was built from, or it is a second opinion.
+ *
+ * `trajectory-index.mjs` exists so that reading a window, counting a kind or brushing a time range
+ * stops costing a re-parse of every generation a session has stored. It can only be allowed to do
+ * that if what it serves is what the full build would have served — so most of this file builds a
+ * real payload through `buildTrajectoryPayload`, indexes it, and compares the two field by field.
+ *
+ * The cases that are easy to get wrong, and are therefore pinned here:
+ *
+ *  1. A record's every carried field survives the round trip, and the six excluded ones are the six
+ *     that were meant to go. A field quietly dropped is a row that renders blank.
+ *  2. A window at EVERY boundary equals the corresponding slice of the full payload, including the
+ *     turns that the range only partly covers — a cut turn would print a header about rows the
+ *     reader cannot see.
+ *  3. Timestamps are not monotonic, so a time range is answered from the side array and equals a
+ *     brute-force filter. The control group is the point: it shows that bisecting the primary key
+ *     order would have MISSED rows, which is why the side array exists at all.
+ *  4. A half-written pair of files is never consumed: no manifest, a digest that disagrees, a
+ *     schema from another version, a source that moved — each answers "no index", not "some index".
+ *  5. No machine path is written into the artifact, so the file is meaningless outside its session
+ *     rather than a pointer into somebody's home directory.
+ *
+ * Read-only: imports the pure helpers and writes only under a temp dir it makes itself.
+ * mutate-trajectory-index.py breaks each of these in the shipped module.
+ */
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { buildTrajectoryPayload, ROW_GENERATION } from '../miniapp/node/server.mjs';
+import {
+  MAX_WINDOW_RECORDS,
+  buildSecondary,
+  createIndexStore,
+  digestOf,
+  indexRowsFromPayload,
+  parseIndex,
+  projectionDigestOf,
+  recordsInTimeRange,
+  resolveWindow,
+  sameSources,
+  serializeIndex,
+  windowTurns,
+} from '../miniapp/node/trajectory-index.mjs';
+
+const INDEX_PATH = new URL('../miniapp/node/trajectory-index.mjs', import.meta.url);
+
+let pass = 0;
+const failures = [];
+function check(name, actual, expected) {
+  if (JSON.stringify(actual) === JSON.stringify(expected)) pass += 1;
+  else failures.push(`${name}: got ${JSON.stringify(actual)}, want ${JSON.stringify(expected)}`);
+}
+function assert(name, cond) {
+  if (cond) pass += 1;
+  else failures.push(name);
+}
+
+/* =====================================================================
+ * A payload built the way the route builds one, from rows that exercise the shapes
+ * ===================================================================== */
+
+/** @param {string} id */
+const message = (id, role, extra) => ({ message_id: id, role, ...extra });
+
+const rawRows = [
+  { message_id: 'u1', turn_id: 't1', message: message('u1', 'user', { content: 'first question', timestamp: 1000 }) },
+  {
+    message_id: 'a1',
+    turn_id: 't1',
+    message: message('a1', 'assistant', {
+      timestamp: 1100,
+      stopReason: 'stop',
+      model: 'm',
+      provider: 'p',
+      api: 'a',
+      content: [
+        { type: 'thinking', thinking: 'weighing it' },
+        { type: 'text', text: 'the answer' },
+        { type: 'toolCall', id: 'c1', name: 'read', arguments: { path: 'x' } },
+        { type: 'toolCall', id: 'c2', name: 'grep', arguments: { q: 'y' } },
+      ],
+    }),
+  },
+  { message_id: 'tr1', turn_id: 't1', message: message('tr1', 'toolResult', { timestamp: 1200, toolCallId: 'c1', toolName: 'read', content: 'file body' }) },
+  // A second prompt in the same turn: a steer, decided over the lineage.
+  { message_id: 'u2', turn_id: 't1', message: message('u2', 'user', { content: 'actually do this instead', timestamp: 1300 }) },
+  { message_id: 'u3', turn_id: 't2', message: message('u3', 'user', { content: 'second question', timestamp: 2000 }) },
+  { message_id: 'a2', turn_id: 't2', message: message('a2', 'assistant', { timestamp: 2100, stopReason: 'toolUse', content: [{ type: 'text', text: 'on it' }] }) },
+  // A message with no usable id at all: unkeyed, and it must not join any group. Two of them, so
+  // that "does not join a group" is a statement about the pair and not about a lone record that
+  // happened to be alone.
+  { message_id: null, turn_id: 't2', message: message('', 'assistant', { timestamp: 2200, stopReason: 'stop', content: [{ type: 'text', text: 'unkeyed tail' }] }) },
+  { message_id: null, turn_id: 't2', message: message('', 'assistant', { timestamp: 2300, stopReason: 'stop', content: [{ type: 'text', text: 'second unkeyed tail' }] }) },
+];
+
+const generations = [{ generation: 0, fileName: 'g0.jsonl', byteLength: 10 }, { generation: 1, fileName: 'g1.jsonl', byteLength: 10 }];
+const rowsForBuild = rawRows.map((row, i) => {
+  const copy = { ...row, [ROW_GENERATION]: i < 4 ? 0 : 1 };
+  return copy;
+});
+
+const payload = buildTrajectoryPayload({
+  session: { id: 's1', createdAtMs: 2200 },
+  rows: rowsForBuild,
+  sizeBytes: 999,
+  generations,
+  generation: null,
+});
+
+/** One locator per record, in the shape the route builds for `/raw`. */
+const FILES = [
+  { fileName: 'g0.jsonl', generation: 0, size: 100, mtimeMs: 5, revision: 'sha256:' + 'a'.repeat(64), filePath: '/store/session-a/g0.jsonl' },
+  { fileName: 'g1.jsonl', generation: 1, size: 100, mtimeMs: 5, revision: 'sha256:' + 'b'.repeat(64), filePath: '/store/session-a/g1.jsonl' },
+];
+const raws = new Map();
+let byteCursor = 0;
+for (const turn of payload.turns) {
+  for (const record of turn.records) {
+    const fileIdx = record.generation === 0 ? 0 : 1;
+    raws.set(record.index, {
+      filePath: `/store/session-a/${FILES[fileIdx].fileName}`,
+      start: byteCursor,
+      end: byteCursor + 40,
+      digest: 'd' + String(record.index).padStart(3, '0'),
+    });
+    byteCursor += 40;
+  }
+}
+
+const EXCLUDED = ['text', 'thinking', 'arguments', 'result', 'error', 'rawRow'];
+const flatRecords = payload.turns.flatMap((turn) => turn.records);
+
+/* =====================================================================
+ * 1 — every carried field survives the round trip, and only the excluded ones go
+ * ===================================================================== */
+
+const rows = indexRowsFromPayload(payload, raws, FILES);
+const text = serializeIndex(rows);
+const manifest = {
+  schemaVersion: 1,
+  projectionVersion: 1,
+  view: 'all',
+  files: FILES,
+  recordCount: rows.records.length,
+  turnCount: rows.turns.length,
+  recordsBytes: Buffer.byteLength(text),
+  recordsDigest: digestOf(text),
+  projectionDigest: projectionDigestOf(payload),
+};
+const back = parseIndex(text, manifest);
+
+assert('the index round-trips', back !== null);
+check('the record count survives', back.records.length, flatRecords.length);
+check('the turn count survives', back.turns.length, payload.turns.length);
+
+// A file that holds more lines than its manifest claims. The digest is re-taken over the longer
+// text so this is NOT caught by the checksum: it isolates the rule that the file must hold exactly
+// what the manifest says, which is what makes a manifest from a different write unusable.
+const overlong = `${text}\n{"index":99999}`;
+const overlongManifest = { ...manifest, recordsDigest: digestOf(overlong) };
+assert('a file with a line the manifest does not claim is refused',
+  parseIndex(overlong, overlongManifest) === null);
+const truncated = text.split('\n').slice(0, -1).join('\n');
+assert('a file that is short a line is refused',
+  parseIndex(truncated, { ...manifest, recordsDigest: digestOf(truncated) }) === null);
+
+let mismatched = [];
+for (let i = 0; i < flatRecords.length; i += 1) {
+  const original = flatRecords[i];
+  const stored = back.records[i];
+  for (const key of Object.keys(original)) {
+    if (EXCLUDED.includes(key)) continue;
+    if (JSON.stringify(stored[key]) !== JSON.stringify(original[key])) {
+      mismatched.push(`${original.index}.${key}`);
+    }
+  }
+}
+check('every carried field is identical', mismatched, []);
+
+let leaked = [];
+for (const [key] of Object.entries(back.records[0])) {
+  if (EXCLUDED.includes(key)) leaked.push(key);
+}
+check('no excluded field is carried', leaked, []);
+
+let leakedHeavy = 0;
+for (const record of back.records) {
+  for (const key of ['text', 'thinking', 'arguments', 'result', 'error']) {
+    if (record[key] !== undefined) leakedHeavy += 1;
+  }
+}
+check('no heavy text field is carried anywhere', leakedHeavy, 0);
+
+// `error` becomes a flag, because a row is styled by whether there was error text.
+const withErrorFlag = back.records.filter((r) => r.hasErrorText === true);
+check('the error-text flag is a boolean', withErrorFlag.every((r) => typeof r.hasErrorText === 'boolean'), true);
+
+check('a record knows which file it came from',
+  back.records.every((r) => r.fileIdx === 0 || r.fileIdx === 1), true);
+// The line position is what a search hit in a sealed generation is mapped back through, and `-1` has
+// to stay distinguishable from byte 0 — a record at the very start of a file is not "no location".
+check('a located record carries where its line sat',
+  back.records.map((r) => r.byteStart), flatRecords.map((r) => raws.get(r.index).start));
+check('a located record carries where its line ended',
+  back.records.map((r) => r.byteEnd), flatRecords.map((r) => raws.get(r.index).end));
+check('the fixture really does start a record at byte 0, so -1 is distinguishable',
+  back.records[0].byteStart, 0);
+// A record whose line was never located says so. Repairing it to 0 would point it at whichever
+// file happens to be first, and /raw would then answer with a different generation's message.
+const partialRaws = new Map(raws);
+partialRaws.delete(flatRecords[3].index);
+const partial = indexRowsFromPayload(payload, partialRaws, FILES);
+check('a record with no locator says file -1', partial.records[3].fileIdx, -1);
+check('and its neighbours keep theirs', partial.records[2].fileIdx, back.records[2].fileIdx);
+check('no record silently became file 0',
+  partial.records.filter((r) => r.fileIdx === -1).length, 1);
+check('a record with no locator has no line position either',
+  [partial.records[3].byteStart, partial.records[3].byteEnd], [-1, -1]);
+
+assert('the file carries no absolute path', !/[A-Za-z]:\\|\/(?:store|home|Users)\//.test(text));
+assert('the file carries no store path from the locator', !text.includes('/store/session-a'));
+
+/* =====================================================================
+ * 2 — a window at every boundary equals the slice of the full payload
+ * ===================================================================== */
+
+const secondary = buildSecondary(back.records);
+const total = flatRecords.length;
+
+const rangeOf = (from, limit) => resolveWindow(secondary, { from, limit });
+
+check('a window at the very start is the full width asked for',
+  [rangeOf(1, 3).from, rangeOf(1, 3).to], [1, 3]);
+check('a window in the middle is the same width',
+  [rangeOf(5, 3).from, rangeOf(5, 3).to], [5, 7]);
+check('a window past the end is clamped to the last record',
+  [rangeOf(total + 50, 3).from, rangeOf(total + 50, 3).to], [total, total]);
+check('a window that starts past the end still returns one record',
+  rangeOf(total + 50, 3).limit, 1);
+check('a window wider than the session stops at the session',
+  rangeOf(1, 10_000).limit, total);
+const bigSession = buildSecondary(Array.from({ length: MAX_WINDOW_RECORDS * 3 }, (_, i) => ({ timestamp: i })));
+check('a window wider than the ceiling is capped on a session large enough to show it',
+  resolveWindow(bigSession, { from: 1, limit: MAX_WINDOW_RECORDS + 500 }).limit, MAX_WINDOW_RECORDS);
+check('an explicit tail wider than the ceiling is capped too',
+  resolveWindow(bigSession, { tail: MAX_WINDOW_RECORDS + 500 }).limit, MAX_WINDOW_RECORDS);
+check('a tail window is the last n records',
+  [rangeOf(null, null) && resolveWindow(secondary, { tail: 4 }).from, resolveWindow(secondary, { tail: 4 }).to],
+  [total - 3, total]);
+check('a tail wider than the session is the whole session',
+  resolveWindow(secondary, { tail: 10_000 }).from, 1);
+check('an empty index has no window', resolveWindow(buildSecondary([]), { from: 1, limit: 5 }), { from: 1, to: 0, limit: 0, total: 0 });
+
+// The real comparison: every boundary, one record at a time.
+let windowBad = [];
+for (let from = 1; from <= total; from += 1) {
+  const range = resolveWindow(secondary, { from, limit: 3 });
+  const expected = flatRecords.slice(range.from - 1, range.to).map((r) => r.index);
+  const served = [];
+  for (const { records } of windowTurns(back, range)) {
+    for (let i = records[0]; i <= records[1]; i += 1) served.push(i);
+  }
+  served.sort((a, b) => a - b);
+  if (JSON.stringify(served) !== JSON.stringify(expected)) windowBad.push(`from ${from}: ${served} vs ${expected}`);
+}
+check('every window boundary serves exactly the full payload slice', windowBad, []);
+
+// A range that straddles the boundary between the two turns: every turn the range touches has to
+// appear, because a turn header carries token and error totals that a window cannot recompute.
+const cutRange = resolveWindow(secondary, { from: 7, limit: 2 });
+const cutTurns = windowTurns(back, cutRange);
+check('a window straddling two turns shows both', cutTurns.map((t) => t.turn.id), ['t1', 't2']);
+check('each turn is served only its overlap with the window',
+  cutTurns.map((t) => t.records), [[7, 7], [8, 8]]);
+// A window sitting wholly inside one turn still shows that turn, header and all: the turn's own
+// span is wider than the window, so dropping it would print a range with no group above it.
+const innerRange = resolveWindow(secondary, { from: 3, limit: 3 });
+const innerTurns = windowTurns(back, innerRange);
+check('a window inside a turn still shows the turn', innerTurns.map((t) => t.turn.id), ['t1']);
+check('the inside window is served in full', innerTurns[0]?.records ?? null, [3, 5]);
+check('a cut turn keeps its own header',
+  cutTurns[0]?.turn.tokens ?? null, payload.turns.find((t) => t.id === 't1').tokens);
+check('a turn narrower than the window is never stretched',
+  windowTurns(back, { from: 1, to: total, total })[1]?.records ?? null, [8, total]);
+
+const allTurns = windowTurns(back, { from: 1, to: total, total });
+check('the whole range shows every turn', allTurns.length, payload.turns.length);
+let headerBad = [];
+for (let i = 0; i < payload.turns.length; i += 1) {
+  const served = allTurns[i];
+  if (served === undefined) {
+    headerBad.push(`${payload.turns[i].id}.<missing>`);
+    continue;
+  }
+  for (const key of ['id', 'index', 'startedAt', 'endedAt', 'toolCalls', 'errors', 'turnClass', 'askedReader', 'closed', 'openerInView', 'openerOutOfView']) {
+    if (JSON.stringify(served.turn[key]) !== JSON.stringify(payload.turns[i][key])) {
+      headerBad.push(`${payload.turns[i].id}.${key}`);
+    }
+  }
+}
+check('every turn header is identical to the full build', headerBad, []);
+
+/* =====================================================================
+ * 3 — a time range is answered from the side array, and the control shows why
+ * ===================================================================== */
+
+// Timestamps on a real session are nearly, but not quite, monotonic. Reproduced here by pulling two
+// records' timestamps back below the one before them, so the fixture has the inversions the side
+// array exists for — a value BELOW its predecessor, not merely an equal or a smaller-than-later one.
+const staggered = back.records.map((r, i) => ({ ...r, timestamp: i === 3 ? 5 : i === 6 ? 15 : (i + 1) * 10 }));
+const inversions = staggered.reduce((n, r, i) => (i > 0 && r.timestamp < staggered[i - 1].timestamp ? n + 1 : n), 0);
+assert('the fixture really does go backwards in time', inversions >= 2);
+
+const staggeredSecondary = buildSecondary(staggered);
+const brute = (from, to) => staggered
+  .map((r, i) => ({ r, i }))
+  .filter(({ r }) => typeof r.timestamp === 'number' && r.timestamp >= from && r.timestamp <= to)
+  .map(({ i }) => i);
+
+let rangeBad = [];
+for (const [from, to] of [[0, 45], [0, 55], [55, 65], [70, 75], [100, 100], [0, 10_000], [500, 600]]) {
+  const got = recordsInTimeRange(staggeredSecondary, from, to);
+  if (JSON.stringify(got) !== JSON.stringify(brute(from, to))) rangeBad.push(`${from}..${to}: ${got} vs ${brute(from, to)}`);
+}
+check('a time range equals a brute-force filter on non-monotonic timestamps', rangeBad, []);
+check('a time range answers in ledger order', JSON.stringify(recordsInTimeRange(staggeredSecondary, 0, 10_000)), JSON.stringify(brute(0, 10_000).sort((a, b) => a - b)));
+
+// The control: bisecting the PRIMARY order on this same data loses rows, which is the whole reason
+// the timestamp side array is a separate structure rather than an assumption about the rows. The
+// range is bounded on purpose — a range covering every row would be answered correctly even by the
+// wrong implementation, which is exactly how a broken shortcut survives.
+const bisectOnIndexOrder = (records, from, to) => {
+  const at = (i) => records[i].timestamp;
+  let lo = 0;
+  let hi = records.length;
+  while (lo < hi) {
+    const mid = (lo + hi) >> 1;
+    if (at(mid) < from) lo = mid + 1;
+    else hi = mid;
+  }
+  const hits = [];
+  for (let i = lo; i < records.length && at(i) <= to; i += 1) hits.push(i);
+  return hits;
+};
+const lostRows = brute(0, 45).filter((i) => !bisectOnIndexOrder(staggered, 0, 45).includes(i));
+assert('bisecting the primary key order on this data would lose rows', lostRows.length > 0);
+check('and the side array loses none',
+  recordsInTimeRange(staggeredSecondary, 0, 45).length, brute(0, 45).length);
+
+check('a record with no timestamp joins no time range',
+  buildSecondary([{ timestamp: null }, { timestamp: 5 }]).timeValues.length, 1);
+check('the count of untimed records is reported',
+  buildSecondary([{ timestamp: null }, { timestamp: 5 }]).untimedCount, 1);
+check('an empty range answers nothing', recordsInTimeRange(staggeredSecondary, 900, 100), []);
+check('an inverted range answers nothing', recordsInTimeRange(staggeredSecondary, 500, 100), []);
+
+/* =====================================================================
+ * 4 — the secondary structures answer what they claim to
+ * ===================================================================== */
+
+const kinds = new Map();
+for (const record of back.records) kinds.set(record.kind, (kinds.get(record.kind) ?? 0) + 1);
+check('kind counts match the records',
+  [...secondary.kindCounts.entries()].sort(), [...kinds.entries()].sort());
+check('every record is counted under some kind',
+  [...secondary.kindCounts.values()].reduce((a, b) => a + b, 0), back.records.length);
+
+const grouped = new Map();
+for (let i = 0; i < back.records.length; i += 1) {
+  const id = back.records[i].id;
+  if (typeof id !== 'string' || id.length === 0) continue;
+  if (!grouped.has(id)) grouped.set(id, []);
+  grouped.get(id).push(i);
+}
+check('message grouping matches the records',
+  [...secondary.byMessageId.entries()].sort(), [...grouped.entries()].sort());
+assert('a message expanded into several records groups under one key',
+  (secondary.byMessageId.get('a1') ?? []).length > 1);
+// The form of that rule: every record filed under a key must carry that key. A group holding a
+// record that does not belong to it is a merge of two messages that never shared an id — which is
+// what filing every unkeyed record under one placeholder would do.
+const mismatchedGroup = [];
+for (const [key, list] of secondary.byMessageId) {
+  for (const i of list) if (back.records[i].id !== key) mismatchedGroup.push(`${key}<-${back.records[i].id}@${i}`);
+}
+check('no group holds a record whose id is not that group', mismatchedGroup, []);
+const unkeyedCount = back.records.filter((r) => typeof r.id !== 'string' || r.id.length === 0).length;
+assert('the fixture really does carry unkeyed records', unkeyedCount >= 2);
+check('no unkeyed record is in any group',
+  [...secondary.byMessageId.values()].flat().filter((i) => !byMessageIdOwns(back.records[i])).length, 0);
+function byMessageIdOwns(record) {
+  return typeof record.id === 'string' && record.id.length > 0;
+}
+
+const byGen = new Map();
+for (let i = 0; i < back.records.length; i += 1) {
+  const g = back.records[i].generation;
+  if (!byGen.has(g)) byGen.set(g, []);
+  byGen.get(g).push(i);
+}
+check('generation grouping matches the records',
+  [...secondary.byGeneration.entries()].sort(), [...byGen.entries()].sort());
+check('generations partition the records',
+  [...secondary.byGeneration.values()].flat().length, back.records.length);
+
+/* =====================================================================
+ * 5 — the shape the file is written in, read before anything is written with it
+ * ===================================================================== */
+
+// Checked before the store is exercised, and deliberately a reading of the source rather than of a
+// behaviour: the publish ORDER is only observable in the source, since a correct writer and a writer
+// that publishes the manifest first produce the same directory afterwards. Doing it here also means
+// a build that gets the order wrong is named rather than crashing inside the write below.
+const source = await readFile(INDEX_PATH, 'utf8');
+assert('the module names its five secondary structures',
+  ['byMessageId', 'byGeneration', 'kindCounts', 'timeValues', 'timeRows'].every((n) => source.includes(n)));
+assert('the primary key needs no structure of its own: the rows are already in order',
+  /records\[a\]\.timestamp - records\[b\]\.timestamp/.test(source));
+assert('the timestamp side array is built, not assumed',
+  source.includes('Float64Array') && source.includes('Int32Array'));
+assert('a time range bisects the side array',
+  /values\[mid\] < from/.test(source));
+const publishRecords = source.indexOf('recordPath}.tmp`, recordPath)');
+const publishManifest = source.indexOf('manifestPath}.tmp`, manifestPath)');
+assert('the records are published before the manifest',
+  publishRecords >= 0 && publishManifest > publishRecords);
+assert('the manifest strips the machine path',
+  /files: meta\.files\.map\(stripPath\)/.test(source));
+assert('nothing is ever read from the session history directory',
+  !/join\([^)]*sessions/i.test(source));
+
+/* =====================================================================
+ * 6 — a half-written pair of files is never consumed
+ * ===================================================================== */
+
+const root = await mkdtemp(join(tmpdir(), 'mmc-index-'));
+const store = createIndexStore(root);
+const sourceFiles = FILES.map((f) => ({ ...f }));
+
+/**
+ * The store is exercised inside a catch, and every read is checked for `null` rather than
+ * dereferenced. A guard that crashes reports a stack trace and no rule, which is a weaker outcome
+ * than failing by name: the reader cannot tell which invariant moved. Here a store that cannot be
+ * written at all is itself the finding, and the summary still prints the assertions around it.
+ */
+const storeFailures = [];
+try {
+  const written = await store.read('session-a', 'all', sourceFiles);
+  assert('nothing stored yet reads as no index', written === null);
+
+  const manifestWritten = await store.write('session-a', 'all', rows, { files: FILES, projectionDigest: manifest.projectionDigest });
+  const good = await store.read('session-a', 'all', sourceFiles);
+  assert('a complete pair reads back', good !== null);
+  if (good !== null && manifestWritten !== undefined) {
+    check('the manifest records what it holds', manifestWritten.recordCount, rows.records.length);
+    check('the read-back is the same records', good.records.length, rows.records.length);
+  }
+
+  const dir = store.dirOf('session-a', 'all');
+
+  // Manifest written, records not: the state a crash between the two renames leaves.
+  await writeFile(join(dir, 'records.jsonl'), '', 'utf8');
+  assert('records that do not match the manifest are refused',
+    (await store.read('session-a', 'all', sourceFiles)) === null);
+
+  // Records written, manifest not yet: the other order, and the one the write order prevents.
+  await rm(join(dir, 'manifest.json'), { force: true });
+  assert('records with no manifest are refused',
+    (await store.read('session-a', 'all', sourceFiles)) === null);
+
+  await store.write('session-a', 'all', rows, { files: FILES, projectionDigest: manifest.projectionDigest });
+  assert('a rebuilt pair reads again',
+    (await store.read('session-a', 'all', sourceFiles)) !== null);
+
+  // A manifest that describes a schema or a projection this build does not speak.
+  const manifestPath = join(dir, 'manifest.json');
+  const original = JSON.parse(await readFile(manifestPath, 'utf8'));
+  await writeFile(manifestPath, JSON.stringify({ ...original, schemaVersion: 99 }), 'utf8');
+  assert('a manifest from another schema version is refused',
+    (await store.read('session-a', 'all', sourceFiles)) === null);
+  await writeFile(manifestPath, JSON.stringify({ ...original, projectionVersion: 99 }), 'utf8');
+  assert('a manifest from another projection version is refused',
+    (await store.read('session-a', 'all', sourceFiles)) === null);
+  await writeFile(manifestPath, JSON.stringify({ ...original, view: 'g3' }), 'utf8');
+  assert('a manifest for another view is refused',
+    (await store.read('session-a', 'all', sourceFiles)) === null);
+  await writeFile(manifestPath, JSON.stringify({ ...original, recordCount: original.recordCount + 1 }), 'utf8');
+  assert('a manifest that overstates the record count is refused',
+    (await store.read('session-a', 'all', sourceFiles)) === null);
+  await writeFile(manifestPath, 'not json at all', 'utf8');
+  assert('an unreadable manifest is refused',
+    (await store.read('session-a', 'all', sourceFiles)) === null);
+  await writeFile(manifestPath, JSON.stringify(original), 'utf8');
+  assert('the restored manifest reads again',
+    (await store.read('session-a', 'all', sourceFiles)) !== null);
+
+  // The source it was built from is the identity that decides reuse.
+  const grown = sourceFiles.map((f, i) => (i === 0 ? { ...f, size: f.size + 1 } : f));
+  assert('a source that grew refuses the stored index',
+    (await store.read('session-a', 'all', grown)) === null);
+  const rewritten = sourceFiles.map((f, i) => (i === 0 ? { ...f, revision: 'sha256:' + 'f'.repeat(64) } : f));
+  assert('a source whose revision changed refuses the stored index',
+    (await store.read('session-a', 'all', rewritten)) === null);
+  const renamed = sourceFiles.map((f, i) => (i === 0 ? { ...f, fileName: 'other.jsonl' } : f));
+  assert('a renamed source refuses the stored index',
+    (await store.read('session-a', 'all', renamed)) === null);
+  const dropped = sourceFiles.slice(1);
+  assert('a source that went away refuses the stored index',
+    (await store.read('session-a', 'all', dropped)) === null);
+  const touched = sourceFiles.map((f, i) => (i === 0 ? { ...f, mtimeMs: f.mtimeMs + 999 } : f));
+  assert('a touched-but-unchanged source keeps the stored index, on purpose',
+    (await store.read('session-a', 'all', touched)) !== null);
+
+  // Two sessions, two sets of bytes.
+  await store.write('session-b', 'all', { turns: [], records: [] }, { files: FILES, projectionDigest: 'x' });
+  assert('one session does not answer for another',
+    (await store.read('session-b', 'all', [])) === null);
+
+  check('sameSources is order sensitive', sameSources(FILES, [...FILES].reverse()), false);
+  check('sameSources rejects a length mismatch', sameSources(FILES, FILES.slice(0, 1)), false);
+} catch (error) {
+  storeFailures.push(`the store could not be exercised: ${error instanceof Error ? error.message : String(error)}`);
+} finally {
+  await rm(root, { recursive: true, force: true });
+}
+for (const line of storeFailures) failures.push(line);
+
+/* --------------------------------------------------------------------- */
+
+if (failures.length) {
+  console.log(`\n  [trajectory-index] ${failures.length} failure(s):`);
+  for (const line of failures) console.log(`    - ${line}`);
+  console.log('');
+  process.exitCode = 1;
+} else {
+  console.log(`[trajectory-index] ${pass} assertions passed`);
+}

From 0dbd8eafb4e43ac96a2dab6beb57cf5c78095fd5 Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 10:12:44 +0800
Subject: [PATCH 11/36] Search the whole lineage instead of the loaded window
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The page decided 「does this record contain the needle」 by scanning five fields of
the payload it happened to be holding. So 「只搜已加载部分」 was the contract rather
than a choice, and it missed everything the window did not hold. Search now asks
the server, which scans the same projection the payload was built from, and the
page asks a set.

Server

  - /api/trajectory/search?session=&q=&generation= walks the lineage through the
    one walk handleTrajectory uses, so both endpoints see the same records
  - a hit is the record being displayed: hits resolve through the identity layer
    and the view's version choice, never through stored lines, so a hit can never
    name a row the ledger is not drawing
  - the cap bounds what is sent, not what is counted: a thousand hits is a
    thousand hits
  - a needle shorter than two characters is a 400, not an empty answer
  - indexes and one search segment per sealed generation are published after the
    response, best-effort; the active generation is never published, because it is
    still being written

Client

  - recordSearchText is gone; matchesQuery asks the server's hit set
  - an unanswered needle filters nothing and the count line says 正在搜索. Four
    states are now distinguishable: 命中 N 条 / 未找到 / 搜索中 / 搜索失败.
    「没搜到」 and 「没搜成」 used to be the same empty table
  - one AbortController plus a sequence gate, so only the newest request writes
  - a changed payload re-asks, because the answer names indexes of the payload
    that was there before
  - clearing the filters drops the answer with the needle

The overview strip now follows the answer instead of holding a predicate of its
own, and can reach a per-turn rule. Both are pinned, each by a mutation: the
strip previously kept its own copy of the whole decision, and it drifted the moment
the search moved to the server.

verify-raw-locators' release assertion was accepting a substring of the new
handler's `view.rows.length = 0;`. It now looks inside handleTrajectory and pins
that the `rows` being released is `view.rows`.

Tests: `node tests/run.mjs` on this tree -> 80/80 guards passed. New: verify-search-
endpoint 62 assertions, mutate-overview 2 mutations.
---
 .../mmc-trajectory/miniapp/client/index.html  | 201 +++++++-
 .../mmc-trajectory/miniapp/node/server.mjs    | 450 +++++++++++++++---
 .../mmc-trajectory/tests/client-check.mjs     |  96 +++-
 .../mmc-trajectory/tests/mutate-anomaly.py    |  13 +-
 .../mmc-trajectory/tests/mutate-overview.py   | 143 ++++++
 .../tests/mutate-search-client.py             | 166 +++++++
 .../tests/mutate-search-endpoint.py           | 195 ++++++++
 .../mmc-trajectory/tests/mutate-selection.py  |   4 +-
 .../tests/mutate-turn-breakdown.py            |   8 +-
 .../mmc-trajectory/tests/verify-anomaly.mjs   |  24 +-
 .../mmc-trajectory/tests/verify-overview.mjs  |  60 ++-
 .../tests/verify-raw-locators.mjs             |  16 +-
 .../tests/verify-search-endpoint.mjs          | 338 +++++++++++++
 .../tests/verify-search-segments.mjs          |  17 +-
 14 files changed, 1599 insertions(+), 132 deletions(-)
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/mutate-overview.py
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/mutate-search-client.py
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/mutate-search-endpoint.py
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
index f744133..81d2090 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
+++ b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
@@ -3416,23 +3416,70 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         );
       }
 
-      /** Record fields the search box scans, flattened to one lowercase string. */
-      function recordSearchText(record) {
-        if (!record || typeof record !== 'object') return '';
-        var thinking = record.thinking;
-        var thinkingText =
-          thinking && typeof thinking === 'object' ? safeText(thinking.text !== undefined ? thinking.text : thinking) : safeText(thinking);
-        return [record.summary, record.text, safeText(record.result), thinkingText, record.toolName]
-          .map(function (part) {
-            return safeText(part);
-          })
-          .join('\n')
-          .toLowerCase();
+      /**
+       * The record indexes a search answered with, as a set the filter can ask in constant time.
+       *
+       * `null` is the answer "this page has no search result in force", which is NOT the same as an
+       * empty set: an empty set means the needle matched nothing, and a page that rendered them the
+       * same way would show a full table in one case and a blank one in the other with nothing on
+       * screen to say which had happened.
+       *
+       * @param {Array<{index: number}> | null} hits
+       * @returns {Set<number> | null}
+       */
+      function searchHitSet(hits) {
+        if (!Array.isArray(hits)) return null;
+        var set = new Set();
+        for (var i = 0; i < hits.length; i += 1) {
+          var entry = hits[i];
+          var index = entry && typeof entry.index === 'number' ? entry.index : NaN;
+          if (Number.isInteger(index)) set.add(index);
+        }
+        return set;
       }
 
-      function matchesQuery(record, needle) {
+      /**
+       * Whether a record survives the text filter.
+       *
+       * The needle is no longer scanned here. It used to be, over the record's own summary, text,
+       * result, thinking and tool name — which is the whole bulk of the payload, and searching the
+       * page meant the page had to be holding the bulk. The server answers which records match, from
+       * the same projection this payload was built from, so the page asks a set.
+       *
+       * `hitSet === null` means the needle has not been answered yet. The record passes, and the
+       * count line says 正在搜索 — an unapplied filter that says so beats an applied one that lies.
+       *
+       * @param {any} record
+       * @param {string} needle
+       * @param {Set<number> | null} hitSet
+       */
+      function matchesQuery(record, needle, hitSet) {
         if (!needle) return true;
-        return recordSearchText(record).indexOf(String(needle).toLowerCase()) >= 0;
+        if (hitSet === null || hitSet === undefined) return true;
+        return !!(record && hitSet.has(record.index));
+      }
+
+      /**
+       * What the text filter is doing, in the one place that can say it.
+       *
+       * Four states, and the reason there are four rather than two is that the answer now comes
+       * from somewhere else. 「没搜到」 and 「没搜成」 used to be the same table — an empty one — and
+       * they are not the same thing: one is the server saying there is no such record, the other is
+       * the page not knowing yet. A needle answered with nothing reads as 「未找到」, a needle still
+       * out reads as 「搜索中」, and a needle that failed says so rather than showing an empty table
+       * that reads as an answer.
+       *
+       * Takes the state as an argument so the four can be tested without a page.
+       *
+       * @param {any} searchState
+       */
+      function searchStatusLabel(searchState) {
+        if (!searchState || !searchState.query) return '';
+        if (searchState.searchError) return '搜索失败，以下为上次结果';
+        if (searchState.searchPending) return '搜索中';
+        if (searchState.searchHits !== null && searchState.searchTotal === 0) return '未找到';
+        if (searchState.searchTruncated) return '命中 ' + formatInt(searchState.searchTotal) + ' 条（已截断）';
+        return '命中 ' + formatInt(searchState.searchTotal) + ' 条';
       }
 
       function hasKind(record, kinds) {
@@ -3778,6 +3825,21 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
           last: null
         },
         query: '',
+        // Which records the last ANSWERED search matched, as a set. `null` is "no answer in force",
+        // which is different from an empty set and is never rendered as one — see searchHitSet.
+        searchHits: null,
+        // Whether a search is in flight. The table keeps showing the previous answer meanwhile,
+        // because a filter that empties and refills on every keystroke is worse than one that lags
+        // visibly; `searchPending` is what makes the lag visible.
+        searchPending: false,
+        // What the server said, as distinct from what the page can count. `total` is every match,
+        // `truncated` says the response carried only the first N of them — so the count line can
+        // report a number that is not the number of rows on screen.
+        searchTotal: 0,
+        searchTruncated: false,
+        // Why the last search could not be answered, or null. 「没搜到」 and 「没搜成」 are
+        // different states and the count line has to be able to tell them apart.
+        searchError: null,
         // Time range, in milliseconds since the session started — the same zero the ledger's
         // `+893 分 21 秒` column counts from. `null` on either side means that end is open,
         // and both null is the default: no range, whole session.
@@ -3844,6 +3906,11 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
       var sessionPollTimer = null;
       var trajectoryPollTimer = null;
       var searchTimer = null;
+      // The in-flight search and the sequence that decides which of several is allowed to answer.
+      // Both are needed only because the answer comes from somewhere else now: when the page
+      // scanned its own records there was nothing to wait for and nothing to arrive out of order.
+      var searchController = null;
+      var searchSeq = 0;
       var rangeTimer = null;
       var refreshSeq = 0;
 
@@ -4098,6 +4165,83 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
           });
       }
 
+      /**
+       * Asks the server which records a needle matches, and puts the answer in force.
+       *
+       * Three things this has to get right, and each of them used to be free when the page scanned
+       * its own records:
+       *
+       *  - **A late answer must not win.** Every request carries a sequence number, and only the
+       *    newest one is allowed to write. Typing "abc" then "abcd" must not leave "abc" on screen
+       *    because its slower answer arrived second.
+       *  - **A needle of one character is not a question.** The server refuses it, and the page
+       *    does not ask: a needle that short matches nearly every record, and the answer would be
+       *    the whole ledger arriving to be discarded.
+       *  - **A changed session invalidates the answer.** The hit set names record indexes of a
+       *    projection that has since been replaced, so a poll that changed the payload re-runs the
+       *    search rather than filtering the new table by the old answer. That is one writer —
+       *    applyPayload — because two callers deciding when to re-search is two chances to forget.
+       *
+       * @param {string} needle
+       */
+      function runSearch(needle) {
+        if (searchController) searchController.abort();
+        var asked = String(needle == null ? '' : needle).trim();
+        if (asked === '') {
+          state.searchHits = null;
+          state.searchPending = false;
+          state.searchTotal = 0;
+          state.searchTruncated = false;
+          searchSeq += 1;
+          return;
+        }
+        var controller = new AbortController();
+        searchController = controller;
+        var seq = (searchSeq += 1);
+        state.searchPending = true;
+        var session = sessionParam();
+        var url = '/api/trajectory/search?session=' + session
+          + '&q=' + encodeURIComponent(asked)
+          + (state.generation === null ? '' : '&generation=' + encodeURIComponent(String(state.generation)));
+
+        fetch(url, { signal: controller.signal, headers: { Accept: 'application/json' } })
+          .then(function (response) {
+            return response
+              .json()
+              .catch(function () { return null; })
+              .then(function (body) {
+                if (!response.ok || !body || typeof body !== 'object') {
+                  var error = new Error('api');
+                  error.status = response.status;
+                  error.code = body && body.error ? body.error : 'unknown';
+                  throw error;
+                }
+                return body;
+              });
+          })
+          .then(function (body) {
+            if (seq !== searchSeq) return;
+            searchController = null;
+            state.searchPending = false;
+            state.searchHits = searchHitSet(body.hits);
+            state.searchTotal = Number.isInteger(body.total) ? body.total : 0;
+            state.searchTruncated = body.truncated === true;
+            resetWindowMode();
+            renderLedger();
+          })
+          .catch(function (error) {
+            if (seq !== searchSeq) return;
+            searchController = null;
+            state.searchPending = false;
+            if (error && error.name === 'AbortError') return;
+            // A search that could not be answered leaves the previous answer standing rather than
+            // emptying the table: 「没搜到」 and 「没搜成」 are different, and only one of them is
+            // true. The count line carries the reason.
+            state.searchError = error && error.code ? String(error.code) : 'search_failed';
+            renderLedger();
+          });
+      }
+
       /**
        * The highest record index in a payload, which is the cursor the next poll sends.
        *
@@ -4244,6 +4388,12 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         // table shows goes through; answering the question here as well would give the field two
         // writers, and the poll path is the one that used to leave it stale.
         if (changed) rePinWindow();
+        // The hit set names record indexes of the payload that was on screen a moment ago. A
+        // payload that just changed is a different set of indexes, so filtering the new table by
+        // the old answer would show the reader rows that never matched. Re-running it here is the
+        // whole of the rule; doing it at the reader would leave the poll path stale, which is the
+        // same mistake the window pinning above used to make.
+        if (changed && state.query) runSearch(state.query);
         render();
         if (manual) announce('已刷新，正在显示最新数据。');
       }
@@ -4487,9 +4637,14 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
        * how many records are not loaded, which is the question it actually answers.
        */
       function turnRangeLabel(firstTurn, lastTurn) {
-        if (!isCount(firstTurn) || !isCount(lastTurn)) return DASH;
-        if (firstTurn === lastTurn) return '第 ' + formatInt(firstTurn) + ' 轮';
-        return '第 ' + formatInt(firstTurn) + '–' + formatInt(lastTurn) + ' 轮';
+        var range = DASH;
+        if (isCount(firstTurn) && isCount(lastTurn)) {
+          range = firstTurn === lastTurn
+            ? '第 ' + formatInt(firstTurn) + ' 轮'
+            : '第 ' + formatInt(firstTurn) + '–' + formatInt(lastTurn) + ' 轮';
+        }
+        var status = searchStatusLabel(state);
+        return status ? range + ' · ' + status : range;
       }
 
       /**
@@ -5502,7 +5657,7 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
           return passesAnomaly(record, { turn: turn || null, liveTurn: liveTurn() }, state.anomaly.rules);
         }
         if (!hasKind(record, state.kinds)) return false;
-        if (state.query && !matchesQuery(record, state.query)) return false;
+        if (state.query && !matchesQuery(record, state.query, state.searchHits)) return false;
         // The overview brush is a further filter, applied after kind and text so that
         // clearing it never silently changes what the other two meant.
         if (selection && !recordInSelection(record, selection, overviewSpansById)) return false;
@@ -8683,6 +8838,11 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
       function resetBaseFilters() {
         state.kinds = KIND_ORDER.slice();
         state.query = '';
+        state.searchHits = null;
+        state.searchPending = false;
+        state.searchTotal = 0;
+        state.searchTruncated = false;
+        state.searchError = null;
         dropOverviewSelection();
         clearTimeRange();
         if (dom.searchInput) dom.searchInput.value = '';
@@ -8913,8 +9073,11 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
           searchTimer = window.setTimeout(function () {
             searchTimer = null;
             state.query = dom.searchInput.value.trim();
+            state.searchError = null;
             resetWindowMode();
-            renderLedger();
+            // The table does not move until the answer arrives; runSearch is what puts the answer
+            // in force, and the count line says 正在搜索 while it is out.
+            runSearch(state.query);
           }, SEARCH_DEBOUNCE);
         });
 
diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
index f138f09..a2da7f9 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
@@ -6,6 +6,29 @@ import { createServer } from 'node:http';
 import { basename, join, resolve, sep } from 'node:path';
 import { homedir } from 'node:os';
 import { createHash } from 'node:crypto';
+import {
+  MAX_WINDOW_RECORDS,
+  buildSecondary,
+  createIndexStore,
+  indexRowsFromPayload,
+  projectionDigestOf,
+  recordsInTimeRange,
+  resolveWindow,
+  stripPath,
+  windowTurns,
+} from './trajectory-index.mjs';
+import {
+  MAX_HITS,
+  SEARCH_FIELDS,
+  buildSegment,
+  createSegmentStore,
+  foldNeedle,
+  generationKey,
+  needleIsUsable,
+  normaliseWhitespace,
+  scanSegment,
+  searchSurfaceOf,
+} from './search-segments.mjs';
 
 /** @typedef {import('./miniapp-api.js').MiniAppContext} MiniAppContext */
 /** @typedef {import('./miniapp-api.js').MiniAppLifecycle} MiniAppLifecycle */
@@ -66,6 +89,12 @@ const LIST_CACHE_TTL_MS = 3000;
 const SESSION_CACHE_TTL_MS = 5000;
 const SESSION_CACHE_ENTRIES = 80;
 const TRAJECTORY_CACHE_ENTRIES = 4;
+/**
+ * The most hits one search response carries. The count is still reported in full — a needle that
+ * matches ten thousand records is a real answer — so this is a transport bound and not a claim
+ * about how many there were.
+ */
+const MAX_SEARCH_HITS = MAX_HITS;
 /**
  * Upper bound on the parsed generation rows kept resident, in bytes.
  *
@@ -1126,6 +1155,54 @@ export function splitRawRecords(turns) {
   return raws;
 }
 
+/**
+ * Every record of a built payload whose own search text contains the needle.
+ *
+ * The whole of the search's answer, and a pure function of what is already in hand, so the rule can
+ * be pinned without a runtime: it runs over the PROJECTED view rather than over the stored rows, so
+ * a version the identity layer suppressed cannot be reported as a row in the ledger, and it tests
+ * one record at a time, so a needle cannot be answered by a phrase that spans two of them.
+ *
+ * `limit` bounds what is RETURNED and never what is COUNTED. A needle that matches ten thousand
+ * records is a real answer, and saying so is more useful than a silent truncation.
+ *
+ * @param {{ turns: Array<any> }} payload
+ * @param {string} needle already normalised and folded
+ * @param {number} limit
+ * @returns {{ hits: Array<{ index: number, turnIndex: number, kind: string, summary: string, generation: number | null }>, total: number }}
+ */
+export function collectSearchHits(payload, needle, limit) {
+  /** @type {Array<{ index: number, turnIndex: number, kind: string, summary: string, generation: number | null }>} */
+  const hits = [];
+  let total = 0;
+  const turns = payload && Array.isArray(payload.turns) ? payload.turns : [];
+  for (const turn of turns) {
+    const records = Array.isArray(turn.records) ? turn.records : [];
+    for (const record of records) {
+      if (!searchSurfaceOf(record).includes(needle)) continue;
+      total += 1;
+      if (hits.length >= limit) continue;
+      hits.push({
+        index: record.index,
+        turnIndex: turn.index,
+        kind: record.kind,
+        // Already projected and already redacted. Sending it is how the reader sees WHAT matched
+        // without opening every row the needle found.
+        summary: typeof record.summary === 'string' ? record.summary : '',
+        generation: typeof record.generation === 'number' ? record.generation : null,
+      });
+    }
+  }
+  return { hits, total };
+}
+
+/**
+ * The five fields a search reads, in the page's order, normalised and folded exactly as the stored
+ * surfaces are. Re-exported so a guard can compare the page's own `recordSearchText` against this
+ * without reaching into a private module.
+ */
+export { SEARCH_FIELDS, normaliseWhitespace, searchSurfaceOf, scanSegment, foldNeedle, needleIsUsable };
+
 /**
  * The runtime's marker for a tool result it dropped while compacting the context.
  *
@@ -2652,6 +2729,34 @@ export async function start(context) {
    */
   const parsedRows = createParsedRowsCache(PARSED_ROWS_CACHE_BYTES);
 
+  // Derived artifacts, under the runtime's own data dir and nowhere else. The session history is
+  // read-only input and the plugin package installs onto every reader's machine, so neither is a
+  // place to write. Held per runtime instance rather than as module state, so two runtimes in one
+  // process cannot share a root.
+  const artifactRoot = join(context.dataDir, 'trajectory-artifacts');
+  const indexStore = createIndexStore(join(artifactRoot, 'index'));
+  const segmentStore = createSegmentStore(join(artifactRoot, 'search'));
+
+  /**
+   * A name for one session's artifacts, derived rather than quoted.
+   *
+   * Hashed because the key becomes a DIRECTORY NAME: a session id is not something to scatter across
+   * a filesystem, and two stores on one machine can hold the same id for different sessions, so the
+   * store's own path has to be part of it. The two are joined by a newline CHARACTER at runtime,
+   * written here as an escape rather than as the byte — a literal NUL here made this file binary to
+   * every text tool reading it, and the guard that says so is the one that caught it.
+   *
+   * @param {string} dir
+   * @param {string} sessionId
+   */
+  const searchSessionKey = (dir, sessionId) =>
+    createHash('sha256').update(`${dir}\n${sessionId}`).digest('hex').slice(0, 32);
+
+  /**
+   * @param {number | null} filter
+   */
+  const searchViewKey = (filter) => (filter === null || filter === undefined ? 'all' : `g${filter}`);
+
   const loadClientEntry = async () => {
     if (clientEntry) return clientEntry;
     const buffer = await readFile(join(context.pluginRoot, 'miniapp', 'client', 'index.html'));
@@ -2986,42 +3091,33 @@ export async function start(context) {
     return { ok: true, entry, binding, identity, generations, filter, cacheKey: trajectoryCacheKey(entry, identity, binding, filter) };
   };
 
-  const handleTrajectory = async (response, url) => {
-    const ctx = await resolveTrajectoryRequest(url);
-    if (!ctx.ok) {
-      sendError(response, ctx.status, ctx.code, ctx.message);
-      return;
-    }
-    const { entry, binding, identity, generations, filter, cacheKey } = ctx;
-    const etag = weakETag(cacheKey);
-    const requestEtag = response.req && response.req.headers ? response.req.headers['if-none-match'] : null;
-    const cached = trajectoryCache.get(cacheKey);
-    if (cached) {
-      if (etagMatches(requestEtag, etag)) {
-        sendJsonBody(response, 304, '', { etag, revalidate: true });
-        return;
-      }
-      // No validator from the page (first load, or a fresh tab): reuse the body we already
-      // built instead of re-reading and re-parsing the files to rebuild the same bytes.
-      // No `?since=` handling here, and that is not an oversight. A page that carries a
-      // cursor carries the validator it was taken against, so a request that reaches this
-      // line with a cursor means the session changed — which is the branch below. Cutting
-      // a tail out of a cached payload would also mean holding that payload in memory, and
-      // this cache deliberately does not: it holds the serialized bytes and the locators
-      // /raw needs, not the object graph the bytes came from.
-      sendJsonBody(response, 200, cached.body, { etag, revalidate: true });
-      return;
-    }
-
-    // Walk the lineage from the active file outward. A small head of each candidate is enough
-    // to learn which generation it claims to be, so only the files that actually belong to the
-    // chain get parsed in full.
+  /**
+   * One session's lineage, and every stored row of every generation that belongs to it.
+   *
+   * The ONE place the lineage is walked. Two readers need it and they must not be allowed to walk it
+   * separately: the payload answers from the whole chain, and a search answers from the same chain
+   * with the active generation read fresh. A second walk would be a second answer to "which files
+   * are this session made of", and the two could disagree about a generation that rotated between
+   * two requests.
+   *
+   * `files` is the same chain as a table the index and the search segments address: one entry per
+   * generation, carrying the identity that decides whether a stored artifact may be reused. It holds
+   * the resolved path so a record can be matched to its file exactly; the index strips it before
+   * anything is written.
+   *
+   * Throws rather than answering: an unreadable lineage is reported by the caller, which is the only
+   * place that knows how to phrase it.
+   *
+   * @param {{ dir: string }} entry
+   * @param {Array<any>} generations
+   */
+  const collectLineage = async (entry, generations) => {
     const artifactByFile = new Map(generations.map((candidate) => [candidate.fileName, candidate]));
     // history-catalog.json is written by the runtime when it rotates generations, so a session
     // that has never compacted does not have one and its `generations` list is empty. The active
     // file is real regardless, and `probe` below already synthesises an artifact for it; reuse
     // that same shape here instead of rejecting the whole session with artifact_path_rejected.
-    const activeArtifactFor = (fileName) => artifactByFile.get(fileName)
+    const artifactFor = (fileName) => artifactByFile.get(fileName)
       ?? (fileName === 'messages.jsonl'
         ? {
           fileName: 'messages.jsonl',
@@ -3037,7 +3133,7 @@ export async function start(context) {
     const probed = new Map();
     const probe = async (generation) => {
       const artifact = generation === null
-        ? { fileName: 'messages.jsonl', active: true, byteLength: identity.catalogBytes }
+        ? { fileName: 'messages.jsonl', active: true, byteLength: null }
         : generations.find((candidate) => candidate.generation === generation) ?? null;
       if (artifact === null) return null;
       if (generation !== null && artifact.active) return null;
@@ -3050,42 +3146,21 @@ export async function start(context) {
       return result;
     };
 
-    /** @type {{ chain: Array<{ generation: number, fileName: string }>, orphans: Array<{ generation: number, fileName: string }> }} */
-    let lineage;
-    try {
-      lineage = await walkLineage({ generations }, probe);
-    } catch (error) {
-      context.logger.error('miniapp.trajectory.read_error', { reason: 'lineage_unreadable', code: errorCode(error) });
-      sendError(response, 500, 'trajectory_unreadable', '会话数据暂时无法读取');
-      return;
-    }
-    if (lineage.chain.length === 0) {
-      sendError(response, 500, 'trajectory_unreadable', '会话数据暂时无法读取');
-      return;
-    }
+    const lineage = await walkLineage({ generations }, probe);
+    if (lineage.chain.length === 0) throw new Error('lineage_empty');
     const activeFileName = lineage.chain[lineage.chain.length - 1].fileName;
-    const activeArtifact = activeArtifactFor(activeFileName);
-
-    // Concatenate oldest → newest, which is the order the conversation actually happened in.
-    //
-    // Every generation's rows are collected even when the reader filtered to one. They have to
-    // be: a turn's opener is its earliest prompt across the WHOLE lineage, so filtering first
-    // would leave the reader looking at a steer that looks like the first prompt of its turn. The
-    // cost is a list of references, not a second copy of any row — each `row` is the same object
-    // `parsedFile` holds, and the view below drops the ones this request does not project.
-    /** @type {Array<{ row: Record<string, any>, generation: number | null, locator: LineLocator }>} */
+
+    /** @type {Array<{ row: Record<string, any>, generation: number | null, locator: any }>} */
     const occurrences = [];
+    /** @type {Array<any>} */
+    const files = [];
     let skippedTotal = 0;
     let truncated = false;
     let readBytes = 0;
     for (const link of lineage.chain) {
-      const artifact = activeArtifactFor(link.fileName);
+      const artifact = artifactFor(link.fileName);
       const filePath = artifact === null ? null : resolveArtifactPath(entry.dir, artifact);
-      if (filePath === null) {
-        context.logger.error('miniapp.trajectory.read_error', { reason: 'artifact_path_rejected', code: errorCode(null) });
-        sendError(response, 500, 'trajectory_unreadable', '会话数据暂时无法读取');
-        return;
-      }
+      if (filePath === null) throw new Error('artifact_path_rejected');
       // Bound the read by our own cap only. The catalog's recorded sizes are a snapshot and the
       // active messages.jsonl keeps being appended to after the catalog was written, so using
       // them as a read limit both dropped records that were really on disk and — because the read
@@ -3097,10 +3172,8 @@ export async function start(context) {
       let parsedFile;
       try {
         parsedFile = await loadParsedRows(parsedRows, filePath, limit, { cacheable: link.fileName !== activeFileName });
-      } catch (error) {
-        context.logger.error('miniapp.trajectory.read_error', { reason: 'messages_unreadable', code: errorCode(error) });
-        sendError(response, 500, 'trajectory_unreadable', '会话数据暂时无法读取');
-        return;
+      } catch {
+        throw new Error('messages_unreadable');
       }
       // Kept as a flag on the cached value rather than a log line at the read site: a file that
       // parsed empty once will parse empty every time, and a hit must still say so.
@@ -3110,6 +3183,26 @@ export async function start(context) {
       if (parsedFile.truncated) truncated = true;
       readBytes += parsedFile.read;
       skippedTotal += parsedFile.skipped;
+      // The identity a stored index or search segment is reused under. Read before the rows so a
+      // file that cannot be stat()ed is a missing entry rather than a wrong one — a file that
+      // cannot be stat()ed was not read either.
+      let size = 0;
+      let mtimeMs = 0;
+      try {
+        const fileStat = await stat(filePath);
+        size = fileStat.size;
+        mtimeMs = fileStat.mtimeMs;
+      } catch {
+        throw new Error('messages_unreadable');
+      }
+      files.push({
+        fileName: link.fileName,
+        generation: link.generation,
+        size,
+        mtimeMs,
+        revision: typeof artifact.revision === 'string' ? artifact.revision : null,
+        filePath,
+      });
       // A sealed file's rows are shared with every other request that read it; the active file's
       // are this request's alone and are released below. Either way stamping the generation is the
       // only write, and one filePath always maps to one generation, so it is idempotent.
@@ -3123,10 +3216,84 @@ export async function start(context) {
         occurrences.push({ row, generation: link.generation, locator: parsedFile.locators[index] });
       }
     }
-    if (skippedTotal > 0) {
-      context.logger.warn('miniapp.trajectory.parse_warn', { skipped: skippedTotal });
+    return {
+      lineage,
+      occurrences,
+      files,
+      skippedTotal,
+      truncated,
+      readBytes,
+      activeFileName,
+      activeArtifact: artifactFor(activeFileName),
+      artifactFor,
+    };
+  };
+
+  /**
+   * Why a lineage could not be collected. Named here so the caller reports the same reason the
+   * walk used to, from one table instead of two blocks of inline sends.
+   * @param {unknown} error
+   */
+  const lineageFailure = (error) => {
+    const reason = error instanceof Error ? error.message : String(error);
+    if (reason === 'lineage_unreadable') {
+      context.logger.error('miniapp.trajectory.read_error', { reason: 'lineage_unreadable' });
+      return '会话数据暂时无法读取';
+    }
+    if (reason === 'artifact_path_rejected') {
+      context.logger.error('miniapp.trajectory.read_error', { reason: 'artifact_path_rejected', code: errorCode(null) });
+      return '会话数据暂时无法读取';
+    }
+    if (reason === 'messages_unreadable') {
+      context.logger.error('miniapp.trajectory.read_error', { reason: 'messages_unreadable', code: errorCode(error) });
+      return '会话数据暂时无法读取';
+    }
+    // `lineage_empty` and anything unforeseen both land here, and both are the same answer to the
+    // reader: there is nothing to show. The reason is kept for the log, never for the page.
+    context.logger.error('miniapp.trajectory.read_error', { reason: `lineage_${reason}` });
+    return '会话数据暂时无法读取';
+  };
+
+  const handleTrajectory = async (response, url) => {
+    const ctx = await resolveTrajectoryRequest(url);
+    if (!ctx.ok) {
+      sendError(response, ctx.status, ctx.code, ctx.message);
+      return;
+    }
+    const { entry, binding, identity, generations, filter, cacheKey } = ctx;
+    const etag = weakETag(cacheKey);
+    const requestEtag = response.req && response.req.headers ? response.req.headers['if-none-match'] : null;
+    const cached = trajectoryCache.get(cacheKey);
+    if (cached) {
+      if (etagMatches(requestEtag, etag)) {
+        sendJsonBody(response, 304, '', { etag, revalidate: true });
+        return;
+      }
+      // No validator from the page (first load, or a fresh tab): reuse the body we already
+      // built instead of re-reading and re-parsing the files to rebuild the same bytes.
+      // No `?since=` handling here, and that is not an oversight. A page that carries a
+      // cursor carries the validator it was taken against, so a request that reaches this
+      // line with a cursor means the session changed — which is the branch below. Cutting
+      // a tail out of a cached payload would also mean holding that payload in memory, and
+      // this cache deliberately does not: it holds the serialized bytes and the locators
+      // /raw needs, not the object graph the bytes came from.
+      sendJsonBody(response, 200, cached.body, { etag, revalidate: true });
+      return;
     }
 
+    // The lineage is walked in ONE place (`collectLineage`), because two readers need it and a
+    // second walk would be a second answer to "which files is this session made of".
+    let walked;
+    try {
+      walked = await collectLineage(entry, generations);
+    } catch (error) {
+      sendError(response, 500, 'trajectory_unreadable', lineageFailure(error));
+      return;
+    }
+    const { lineage, occurrences, files, truncated, readBytes, activeFileName, activeArtifact } = walked;
+    if (walked.skippedTotal > 0) {
+      context.logger.warn('miniapp.trajectory.parse_warn', { skipped: walked.skippedTotal });
+    }
     // One logical message per id, every stored copy of it folded in, and the versions it was
     // written in kept rather than dropped. `filter === null` shows every message once at its
     // first version; a generation number shows that generation's own stored context.
@@ -3212,6 +3379,148 @@ export async function start(context) {
     sendJsonBody(response, 200, delta === null ? body : JSON.stringify(delta), { etag, revalidate: true });
   };
 
+/**
+ * One needle against one session, answered from the same projection the payload is built from.
+   *
+   * WHY IT IS A READ AND NOT A SCAN OF WHAT THE PAGE ALREADY HAS. The page searches five fields per
+   * record, and those five fields are the bulk of the payload — so a search the page can do itself
+   * requires the page to hold the bulk, which is the thing being removed. A search that is answered
+   * here does not have to be shipped to it.
+   *
+   * WHY IT REBUILDS FOR NOW. This walks the lineage and projects it exactly as `/api/trajectory`
+   * does, so the records it searches are the records that payload would carry — which is what makes
+   * a hit a row the reader can actually be sent to. Segments are written as a side effect here, so a
+   * later pass can answer a search without the rebuild; until then this is the correct answer and
+   * the measured cost of one.
+   *
+   * The two rules that are not negotiable, because both were true of the version it replaces:
+   *
+   *  - **A hit is a DISPLAYED record.** The scan runs over the projected view, not over the stored
+   *    rows, so a version the identity layer suppressed — a copy of a message already shown, or the
+   *    trimmed half of a rewrite — cannot be reported as a row in the ledger.
+   *  - **A needle never crosses a record.** Each record is tested on its own, which is what
+   *    `scanSegment` is for and what a joined blob would quietly stop doing.
+   */
+  const handleSearch = async (response, url) => {
+    const ctx = await resolveTrajectoryRequest(url);
+    if (!ctx.ok) {
+      sendError(response, ctx.status, ctx.code, ctx.message);
+      return;
+    }
+    const asked = url.searchParams.get('q') ?? '';
+    // A needle too short to be a question matches almost every record; answering with the whole
+    // ledger is not an answer, and returning it would cost more than the reader wanted to know.
+    if (!needleIsUsable(asked)) {
+      sendError(response, 400, 'search_query_required', '请输入至少两个字符');
+      return;
+    }
+    const needle = foldNeedle(asked);
+    const { entry, filter } = ctx;
+
+    let walked;
+    try {
+      walked = await collectLineage(entry, ctx.generations);
+    } catch (error) {
+      sendError(response, 500, 'trajectory_unreadable', lineageFailure(error));
+      return;
+    }
+    const { occurrences, files } = walked;
+
+    const identityTable = buildMessageIdentity(occurrences);
+    const view = selectIdentityView(identityTable, filter);
+    const payload = buildTrajectoryPayload({
+      session: { id: ctx.identity.id, createdAtMs: entry.lastActiveAt },
+      rows: view.rows,
+      sizeBytes: walked.readBytes,
+      truncated: walked.truncated,
+      redact,
+      generations: ctx.generations,
+      generation: null,
+      orphans: walked.lineage.orphans,
+      identity: identityTable,
+      openerByTurn: view.openerByTurn,
+    });
+    const rowLocators = view.occurrences.map((occurrence) => occurrence.locator);
+    const rowIndexByRecord = splitRawRecords(payload.turns);
+
+    /** @type {Array<{ index: number, turnIndex: number, kind: string, summary: string, generation: number | null }>} */
+    const hits = [];
+    let total = 0;
+    const searched = collectSearchHits(payload, needle, MAX_SEARCH_HITS);
+    hits.push(...searched.hits);
+    total = searched.total;
+
+    // Written as a side effect, never awaited into the answer: an artifact that cannot be written is
+    // a slower next search, not a failed one, and a failure here must not turn a hit into an error.
+    void publishSearchArtifacts({
+      entry,
+      sessionKey: searchSessionKey(entry.dir, ctx.identity.id),
+      viewKey: searchViewKey(filter),
+      payload,
+      raws: rowIndexByRecord,
+      rowLocators,
+      files,
+      activeFileName: walked.activeFileName,
+    }).catch(() => undefined);
+
+    sendJson(response, 200, {
+      query: asked,
+      hits,
+      total,
+      truncated: total > hits.length,
+      session: { id: ctx.identity.id, generation: filter },
+    });
+    // Nothing below reads the view, and the payload holds projections rather than rows, so this is
+    // where the object graph stops being reachable.
+    view.rows.length = 0;
+    rowLocators.length = 0;
+  };
+
+  /**
+   * The artifacts a search would like the NEXT search to be able to skip the rebuild for.
+   *
+   * Best effort by construction: every step is wrapped, and the whole thing is fire-and-forget from
+   * the caller. A session that never gets an index keeps answering correctly, just at the rebuild's
+   * cost — which is what it did before any of this existed.
+   *
+   * @param {{ entry: any, sessionKey: string, viewKey: string, payload: any, raws: Map<number, number>, rowLocators: Array<any>, files: Array<any>, activeFileName: string }} input
+   */
+  const publishSearchArtifacts = async (input) => {
+    const { entry, sessionKey, viewKey, payload, raws, rowLocators, files, activeFileName } = input;
+    /** @type {Map<number, any>} */
+    const locators = new Map();
+    for (const [recordIndex, rowIndex] of raws) {
+      const locator = rowLocators[rowIndex];
+      if (locator !== undefined) locators.set(recordIndex, locator);
+    }
+    const indexRows = indexRowsFromPayload(payload, locators, files);
+    await indexStore.write(sessionKey, viewKey, indexRows, {
+      files,
+      projectionDigest: projectionDigestOf(payload),
+    });
+
+    // One segment per SEALED generation. The active one is being appended to, so a segment for it
+    // would be stale before it was written; it is searched from the rows the request read instead.
+    const activeIdx = files.findIndex((file) => file.fileName === activeFileName);
+    for (let fileIdx = 0; fileIdx < files.length; fileIdx += 1) {
+      if (fileIdx === activeIdx) continue;
+      const records = indexRows.records.filter((record) => record.fileIdx === fileIdx);
+      if (records.length === 0) continue;
+      const generation = files[fileIdx].generation;
+      const generationKeyValue = generationKey(generation);
+      // Already there and still matching its source: nothing to do, which is the common case on a
+      // session that is not being compacted right now.
+      const existing = await segmentStore.read(sessionKey, viewKey, generationKeyValue, [files[fileIdx]]);
+      if (existing !== null) continue;
+      const segment = buildSegment({ records });
+      await segmentStore.write(sessionKey, viewKey, generationKeyValue, segment, {
+        generation,
+        source: [files[fileIdx]],
+      });
+    }
+    void entry;
+  };
+
   /**
    * One record's untouched message, fetched only when something actually reads it.
    *
@@ -3348,6 +3657,13 @@ export async function start(context) {
       });
       return;
     }
+    if (url.pathname === '/api/trajectory/search') {
+      void handleSearch(response, url).catch((error) => {
+        context.logger.error('miniapp.trajectory.read_error', { reason: 'search_failed', code: errorCode(error) });
+        sendError(response, 500, 'trajectory_unreadable', '搜索暂时不可用');
+      });
+      return;
+    }
     if (url.pathname === '/api/trajectory/raw') {
       void handleRaw(response, url).catch((error) => {
         context.logger.error('miniapp.trajectory.read_error', { reason: 'raw_failed', code: errorCode(error) });
diff --git a/plugins/avatasia/mmc-trajectory/tests/client-check.mjs b/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
index ab1534e..dd5e230 100644
--- a/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
@@ -162,21 +162,53 @@ assert('jsonColorize colors numbers', colored.includes('tok-num'));
 check('jsonColorize undefined', sandbox.jsonColorize(undefined), '');
 check('jsonColorize null', sandbox.jsonColorize(null), '<span class="tok-null">null</span>');
 
-/* search: case-insensitive over summary + text + result + thinking, hostile content */
+/* search: the server says which records match, and the page asks a set */
 const hostile = {
+  index: 41,
   kind: 'reply',
   summary: 'Ask about <script>alert(1)</script>',
   text: 'Answering now',
   result: null,
   thinking: null
 };
-check('match lowercase', sandbox.matchesQuery(hostile, 'script'), true);
-check('match uppercase', sandbox.matchesQuery(hostile, 'ALERT'), true);
-check('match miss', sandbox.matchesQuery(hostile, 'zzz'), false);
-check('match empty query', sandbox.matchesQuery(hostile, ''), true);
-check('match result field', sandbox.matchesQuery({ kind: 'toolResult', result: { code: 'ENOENT' } }, 'enoent'), true);
-check('match thinking object', sandbox.matchesQuery({ kind: 'thinking', thinking: { text: 'chain of thought' } }, 'thought'), true);
-check('match null thinking safe', sandbox.matchesQuery({ kind: 'thinking', thinking: null }, 'thought'), false);
+// The five fields are no longer scanned here — that is the whole point of the move — so what is
+// held is a set of record indexes and the record's own content is irrelevant to the decision.
+const hit41 = sandbox.searchHitSet([{ index: 41 }, { index: 7 }]);
+check('the hit set holds the server\'s indexes', Array.from(hit41).sort((a, b) => a - b), [7, 41]);
+check('a record the server named passes whatever the needle says', sandbox.matchesQuery(hostile, 'script', hit41), true);
+check('a record whose text contains the needle but which the server did not name fails',
+  sandbox.matchesQuery(hostile, 'script', sandbox.searchHitSet([{ index: 7 }])), false);
+check('an unmatched needle matches nothing', sandbox.matchesQuery(hostile, 'zzz', sandbox.searchHitSet([])), false);
+check('an empty query filters nothing', sandbox.matchesQuery(hostile, '', hit41), true);
+check('an unanswered needle filters nothing, and says so elsewhere', sandbox.matchesQuery(hostile, 'zzz', null), true);
+check('an unanswered needle is not an empty result', sandbox.searchHitSet(null), null);
+check('a real empty result is an empty set', sandbox.searchHitSet([]).size, 0);
+check('a hit without an index is dropped rather than becoming one', sandbox.searchHitSet([{ index: 'x' }, { index: 3 }]).size, 1);
+check('a null hit is dropped', sandbox.searchHitSet([null, { index: 3 }]).size, 1);
+check('a record with no index cannot be in the set',
+  sandbox.matchesQuery({ kind: 'user' }, 'x', sandbox.searchHitSet([{ index: 1 }])), false);
+check('a missing record does not throw',
+  sandbox.matchesQuery(null, 'x', sandbox.searchHitSet([{ index: 1 }])), false);
+
+/* search: the four states the count line has to tell apart */
+const status = (over) => sandbox.searchStatusLabel(Object.assign(
+  { query: 'abc', searchError: null, searchPending: false, searchHits: new Set([1]), searchTotal: 3, searchTruncated: false },
+  over,
+));
+check('no needle, no status', sandbox.searchStatusLabel({ query: '', searchTotal: 0 }), '');
+check('a needle answered with hits', status({}), '命中 3 条');
+check('a needle answered with nothing', status({ searchHits: new Set(), searchTotal: 0 }), '未找到');
+check('a needle still out', status({ searchPending: true }), '搜索中');
+check('a needle that failed says so rather than showing an empty table',
+  status({ searchError: 'search_failed' }), '搜索失败，以下为上次结果');
+check('a failure outranks 「searching」, because it is the truth about the request',
+  status({ searchPending: true, searchError: 'search_failed' }), '搜索失败，以下为上次结果');
+check('an unanswered needle is not 「未找到」',
+  status({ searchHits: null, searchTotal: 0, searchPending: false }), '命中 0 条');
+check('a truncated answer says so', status({ searchTruncated: true }), '命中 3 条（已截断）');
+check('a needle answered with nothing and truncated reads as not found',
+  status({ searchHits: new Set(), searchTotal: 0, searchTruncated: true }), '未找到');
+check('no state is not a crash', sandbox.searchStatusLabel(null), '');
 check('no kinds match', sandbox.hasKind({ kind: 'system' }, ['user']), false);
 
 /* flatten + signature */
@@ -706,16 +738,48 @@ const checks = [
   // through the helper. The \b matters — resetWindowMode contains the substring setWindowMode,
   // and without it every reset counts as a direct call and the guard can never pass.
   //
-  // The reset count is an inventory, not a rule: eight when every filter reset the window,
-  // ten since the time range gained resets on both sides of its own lifecycle, eleven once
-  // 异常 became a filter of its own and had to reset the window like the others do, and twelve
-  // once 异常 grew a way back — 全部数据 — which is a filter change like any other and would
-  // otherwise leave the reader on a stale window after leaving anomaly mode. It used to force
-  // 「全部」 instead of resetting, which would have shown up here as a second direct call — and
-  // measured, that cost a 414,000px document on a range covering the session.
+  // The window-reset inventory moved by one because the search answer now arrives from the server:
+  // the moment it does, the table holds a different set of records, and that is a filter change
+  // like any other. It used to be twelve because the page filtered its own records synchronously,
+  // so there was never a moment at which the answer changed.
   const direct = (html.match(/\bsetWindowMode\((?!mode\)|DEFAULT_WINDOW_MODE)/g) || []).length;
-  return direct === 1 && (html.match(/resetWindowMode\(\);/g) || []).length === 12;
+  return direct === 1 && (html.match(/resetWindowMode\(\);/g) || []).length === 13;
 })()],
+  // The search half is asynchronous now, so the four rules below have no pure function to hang on
+  // and are read out of the source instead. Each of them is a way the page can render something
+  // plausible and wrong: a stale answer on screen, an answer that empties the table while it is
+  // still out, a filter left applied after the reader cleared it, and a slice search answered about
+  // the whole lineage.
+  ['the search request in flight is aborted when a newer one starts', (() => {
+    const src = fnSource('function runSearch(needle)');
+    if (!src) return false;
+    if (!/if \(searchController\) searchController\.abort\(\);/.test(src)) return false;
+    return /var controller = new AbortController\(\);/.test(src) && /signal: controller\.signal/.test(src);
+  })()],
+  ['only the newest search answer is allowed to write', (() => {
+    const src = fnSource('function runSearch(needle)');
+    if (!src) return false;
+    // One guard on the way in is not enough: the catch must be gated too, or a FAILED older
+    // request can put its error on top of a newer request's answer.
+    const gates = src.match(/if \(seq !== searchSeq\) return;/g) || [];
+    return gates.length === 2 && /var seq = \(searchSeq \+= 1\);/.test(src);
+  })()],
+  ['a payload that changed re-runs the search rather than filtering by the old answer', (() => {
+    const src = fnSource('function applyPayload(body, manual)');
+    if (!src) return false;
+    return /if \(changed && state\.query\) runSearch\(state\.query\);/.test(src);
+  })()],
+  ['clearing the filters drops the answer with them', (() => {
+    const src = fnSource('function resetBaseFilters()');
+    if (!src) return false;
+    return /state\.searchHits = null;/.test(src) && /state\.searchError = null;/.test(src);
+  })()],
+  ['a search is asked about the slice the reader is looking at', (() => {
+    const src = fnSource('function runSearch(needle)');
+    if (!src) return false;
+    return /'\/api\/trajectory\/search\?session='/.test(src)
+      && /&generation=' \+ encodeURIComponent\(String\(state\.generation\)\)/.test(src);
+  })()],
   // Clicking the window button must not move the page. It scrolled to the document tail
   // whenever it narrowed the window, on the theory that "back to the tail" should land on the
   // newest record. The reader clicked a control they were already looking at, so the jump threw
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-anomaly.py b/plugins/avatasia/mmc-trajectory/tests/mutate-anomaly.py
index dac933b..1f1e723 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-anomaly.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-anomaly.py
@@ -70,8 +70,8 @@
     # case honest: if passesBaseFilter stopped applying the query, the list would stop being
     # filtered at all and the exclusivity check above it would pass for the wrong reason.
     ("the base filter stops applying the query",
-     "but with no rule ticked the search is still a filter for the list",
-     "        if (state.query && !matchesQuery(record, state.query)) return false;",
+     "and once the server has answered, the search narrows the list",
+     "        if (state.query && !matchesQuery(record, state.query, state.searchHits)) return false;",
      "        if (false && state.query) return false;"),
     # Dropping the range from passesBaseFilter is deliberately NOT here: that guard lives in
     # verify-time-range.mjs, and a case listed against a probe that does not own it would be
@@ -183,7 +183,7 @@
     # Anchored with the signature above it: `if (state.anomaly.rules.length > 0)` appears twice
     # — once in recordVisible(), once in applyFilterScope() — and the two mean nothing alike.
     ("the mode is read backwards, so the search stops filtering at all",
-     "but with no rule ticked the search is still a filter for the list",
+     "and once the server has answered, the search narrows the list",
      "      function recordVisible(record, turn, selection) {\n        if (state.anomaly.rules.length > 0) {",
      "      function recordVisible(record, turn, selection) {\n        if (state.anomaly.rules.length >= 0) {"),
     ("the two axes stacked instead of alternated",
@@ -229,9 +229,10 @@
      "ticking a rule puts every type back",
      "        if (next.length > 0) resetBaseFilters();",
      "        if (next.length > 0 && false) resetBaseFilters();"),
-    ("the reset forgets the search box", "and drops the search",
-     "        state.query = '';\n        dropOverviewSelection();",
-     "        dropOverviewSelection();"),
+    ("the reset forgets the search box",
+     "and it drops the search answer with the needle, not just the needle",
+     "        state.query = '';\n        state.searchHits = null;",
+     "        state.query = '';"),
     # Distinct from the one above, and it was missing until a cross-check read the names rather
     # than the diffs: that mutation deletes `state.query`, not `dom.searchInput.value`. The box
     # is cleared by its own line, and with `dom.searchInput` nulled in the sandbox that line had
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-overview.py b/plugins/avatasia/mmc-trajectory/tests/mutate-overview.py
new file mode 100644
index 0000000..050afca
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-overview.py
@@ -0,0 +1,143 @@
+"""Mutation control for the overview strip's filtering path.
+
+Scope, stated up front so the next person does not read this as covering the guard: this
+control covers **only** the strip's answer to 「may this record be drawn」. `verify-overview.mjs`
+holds another hundred assertions — lane assignment, brushed ranges, turn totals, the axis
+labels — and none of them are mutated here. A control that named itself after the whole guard
+would be claiming coverage it does not have, which is the failure mode a mutation control is
+supposed to prevent.
+
+The one thing worth pinning here is the sentence already written above `spanPassesFilter()`:
+it must not hold a predicate of its own. It did once — a copy of the whole decision that
+drifted from the list's — and the copy drifted again the moment the search moved to the
+server, because the copy still scanned text while the list was asking a set. The strip is now
+a one-line adapter, and the only way to get a predicate back into it is to write a new one, so
+that is what this mutation writes.
+"""
+import subprocess
+import sys
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parent
+CLIENT = ROOT / "miniapp" / "client" / "index.html"
+PROBE = HERE / "verify-overview.mjs"
+
+SPAN_ADAPTER = """      function spanPassesFilter(record) {
+        var owner = record ? turnById.get(record.turnId) : null;
+        return recordVisible(record, owner || null, null);
+      }"""
+
+MUTATIONS = [
+    (
+        "the strip keeps a predicate of its own instead of asking the list",
+        SPAN_ADAPTER,
+        """      function spanPassesFilter(record) {
+        if (state.query && !(record && String(record.summary || '').indexOf(state.query) >= 0)) return false;
+        if (state.kinds.indexOf(record.kind) < 0) return false;
+        return true;
+      }""",
+    ),
+    (
+        "the strip is handed no turn, so a per-turn filter cannot reach it",
+        SPAN_ADAPTER,
+        """      function spanPassesFilter(record) {
+        return recordVisible(record, null, null);
+      }""",
+    ),
+]
+
+
+def read_exact(path):
+    """Normalise to LF for matching, and report the file's own newline so it can be put back."""
+    data = path.read_bytes()
+    text = data.decode("utf-8").replace("\r\n", "\n")
+    return text, ("\r\n" if b"\r\n" in data else "\n")
+
+
+def write_exact(path, text, newline):
+    if newline == "\r\n":
+        text = text.replace("\n", "\r\n")
+    path.write_bytes(text.encode("utf-8"))
+
+
+def run_probe():
+    proc = subprocess.run(
+        ["node", str(PROBE)],
+        cwd=str(ROOT),
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+    )
+    return proc.returncode, (proc.stdout or "") + (proc.stderr or "")
+
+
+def named_failure(output):
+    """The first rule the probe named, or None when it failed without naming one.
+
+    `check()` failures print as `FAIL  <name>`, so that prefix is what carries the name. A
+    probe that dies on an exception names nothing, and a control that calls that 「caught」
+    would be reporting a crash as if it were evidence.
+    """
+    return next(
+        (line.strip()[len("FAIL"):].strip() for line in output.splitlines()
+         if line.strip().startswith("FAIL")),
+        None,
+    )
+
+
+def main():
+    code, output = run_probe()
+    if code != 0:
+        print("baseline probe does not pass; fix that first")
+        print(output)
+        return 1
+    print("baseline clean")
+
+    original = CLIENT.read_bytes()
+    missed = []
+    unnamed = []
+    for label, old, new in MUTATIONS:
+        text, newline = read_exact(CLIENT)
+        if old not in text:
+            print(f"SKIP  {label}: anchor not found")
+            missed.append(label)
+            continue
+        if old == new:
+            print(f"SKIP  {label}: the mutation changes nothing")
+            missed.append(label)
+            continue
+        write_exact(CLIENT, text.replace(old, new, 1), newline)
+        try:
+            code, output = run_probe()
+        finally:
+            CLIENT.write_bytes(original)
+        if code == 0:
+            print(f"MISSED {label}: the probe still passed")
+            missed.append(label)
+            continue
+        name = named_failure(output)
+        if name is None:
+            print(f"UNNAMED {label}: the probe failed without naming a rule")
+            unnamed.append(label)
+        else:
+            print(f"caught {label}\n         -> {name}")
+
+    if CLIENT.read_bytes() != original:
+        print(f"NOT RESTORED {CLIENT}")
+        return 1
+    print("file restored byte-for-byte")
+
+    if missed or unnamed:
+        if missed:
+            print(f"\n{len(missed)} mutation(s) got through")
+        if unnamed:
+            print(f"{len(unnamed)} mutation(s) failed without naming a rule")
+        return 1
+    print(f"\nall {len(MUTATIONS)} mutations caught, each by name")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-search-client.py b/plugins/avatasia/mmc-trajectory/tests/mutate-search-client.py
new file mode 100644
index 0000000..c8690c0
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-search-client.py
@@ -0,0 +1,166 @@
+"""Mutation control for the page's half of the search move.
+
+The filter used to be `recordSearchText(record).indexOf(needle) >= 0` — a scan of five fields the
+page happened to be holding. It is now a set of record indexes the server sent, and every mutation
+here undoes one of the four things that move required and the page now owns:
+
+  - asking a set at all, instead of scanning text;
+  - telling 「no answer yet」 apart from 「matched nothing」;
+  - letting only the newest request write, since the answer now arrives out of order;
+  - re-asking when the payload changed, since the answer names indexes of the payload that was
+    there before.
+
+Each is a change the page renders differently and none of them throws.
+"""
+import subprocess
+import sys
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parent
+CLIENT = ROOT / "miniapp" / "client" / "index.html"
+PROBE = HERE / "client-check.mjs"
+
+MUTATIONS = [
+    (
+        "the filter scans the record's own text again, ignoring the server's answer",
+        "        if (hitSet === null || hitSet === undefined) return true;\n        return !!(record && hitSet.has(record.index));",
+        "        if (hitSet === null || hitSet === undefined) return true;\n        return String((record && record.summary) || '').toLowerCase().indexOf(String(needle).toLowerCase()) >= 0;",
+    ),
+    (
+        "an unanswered search is rendered as matched nothing, so the table empties while it loads",
+        "        if (hitSet === null || hitSet === undefined) return true;",
+        "        if (hitSet === null || hitSet === undefined) return false;",
+    ),
+    (
+        "no answer in force is turned into an empty set, so it reads as 「matched nothing」",
+        "        if (!Array.isArray(hits)) return null;",
+        "        if (!Array.isArray(hits)) return new Set();",
+    ),
+    (
+        "a hit with no usable index is filed under a key that matches every record",
+        "          if (Number.isInteger(index)) set.add(index);",
+        "          set.add(Number.isInteger(index) ? index : NaN);",
+    ),
+    (
+        "a late answer is allowed to overwrite a newer one",
+        "            if (seq !== searchSeq) return;\n            searchController = null;",
+        "            searchController = null;",
+    ),
+    (
+        "a search in flight is not aborted, so every keystroke's request still runs to the end",
+        "        if (searchController) searchController.abort();",
+        "",
+    ),
+    (
+        "a changed payload keeps the old hit set, so the new table is filtered by the old answer",
+        "        if (changed && state.query) runSearch(state.query);",
+        "",
+    ),
+    (
+        "clearing the filters leaves the hit set behind, so the next query filters by a stale answer",
+        "        state.searchHits = null;\n        state.searchPending = false;\n        state.searchTotal = 0;\n        state.searchTruncated = false;\n        state.searchError = null;\n        dropOverviewSelection();",
+        "        dropOverviewSelection();",
+    ),
+    (
+        "the count line cannot tell 「searching」 from 「searched and found none」",
+        "        if (searchState.searchHits !== null && searchState.searchTotal === 0) return '未找到';",
+        "        if (searchState.searchHits !== null) return '命中 ' + formatInt(searchState.searchTotal) + ' 条';",
+    ),
+    (
+        "a search that failed is rendered as an empty table, which reads as an answer",
+        "        if (searchState.searchError) return '搜索失败，以下为上次结果';",
+        "",
+    ),
+    (
+        "the needle is sent without the generation, so a slice search answers about the whole lineage",
+        "          + (state.generation === null ? '' : '&generation=' + encodeURIComponent(String(state.generation)));",
+        "          + '';",
+    ),
+    (
+        "the hit set is built from the summaries rather than the indexes, so it can never match a row",
+        "          var index = entry && typeof entry.index === 'number' ? entry.index : NaN;",
+        "          var index = entry && typeof entry.summary === 'string' ? entry.summary.length : NaN;",
+    ),
+]
+
+
+def read_exact(path):
+    """Normalise to LF for matching, and report the file's own newline so it can be put back."""
+    data = path.read_bytes()
+    text = data.decode("utf-8").replace("\r\n", "\n")
+    return text, ("\r\n" if b"\r\n" in data else "\n")
+
+
+def write_exact(path, text, newline):
+    if newline == "\r\n":
+        text = text.replace("\n", "\r\n")
+    path.write_bytes(text.encode("utf-8"))
+
+
+def run_probe():
+    proc = subprocess.run(
+        ["node", str(PROBE)],
+        cwd=str(ROOT),
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+    )
+    return proc.returncode, (proc.stdout or "") + (proc.stderr or "")
+
+
+def main():
+    code, output = run_probe()
+    if code != 0:
+        print("baseline probe does not pass; fix that first")
+        print(output)
+        return 1
+    print("baseline clean")
+
+    original = CLIENT.read_bytes()
+    missed = []
+    unnamed = []
+    for label, old, new in MUTATIONS:
+        text, newline = read_exact(CLIENT)
+        if old not in text:
+            print(f"SKIP  {label}: anchor not found")
+            missed.append(label)
+            continue
+        if old == new:
+            print(f"SKIP  {label}: the mutation changes nothing")
+            missed.append(label)
+            continue
+        write_exact(CLIENT, text.replace(old, new, 1), newline)
+        try:
+            code, output = run_probe()
+        finally:
+            CLIENT.write_bytes(original)
+        if code == 0:
+            print(f"MISSED {label}: the probe still passed")
+            missed.append(label)
+            continue
+        first = next((line.strip() for line in output.splitlines() if line.strip().startswith("- ")), None)
+        if first is None:
+            print(f"UNNAMED {label}: the probe failed without naming a rule")
+            unnamed.append(label)
+        else:
+            print(f"caught {label}\n         -> {first}")
+
+    if CLIENT.read_bytes() != original:
+        print(f"NOT RESTORED {CLIENT}")
+        return 1
+    print("file restored byte-for-byte")
+
+    if missed or unnamed:
+        if missed:
+            print(f"\n{len(missed)} mutation(s) got through")
+        if unnamed:
+            print(f"{len(unnamed)} mutation(s) failed without naming a rule")
+        return 1
+    print(f"\nall {len(MUTATIONS)} mutations caught, each by name")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-search-endpoint.py b/plugins/avatasia/mmc-trajectory/tests/mutate-search-endpoint.py
new file mode 100644
index 0000000..e99a4aa
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-search-endpoint.py
@@ -0,0 +1,195 @@
+"""Mutation control for verify-search-endpoint.mjs.
+
+Each mutation reintroduces exactly one bug the probe is supposed to catch, BY NAME. The ones that
+matter most are the first three: each of them makes the endpoint answer something plausible and
+wrong, and none of them throws.
+
+  - searching the STORED rows instead of the projected view reports versions the ledger is not
+    showing, and hands back an index no row occupies;
+  - dropping one of the five searched fields narrows what a reader can find with no error at all;
+  - counting only what fits under the cap turns "how many matched" into "how many did we send".
+"""
+import subprocess
+import sys
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parent
+SERVER = ROOT / "miniapp" / "node" / "server.mjs"
+PROBE = HERE / "verify-search-endpoint.mjs"
+
+SEARCH_LOOP = """  for (const turn of turns) {
+    const records = Array.isArray(turn.records) ? turn.records : [];
+    for (const record of records) {
+      if (!searchSurfaceOf(record).includes(needle)) continue;
+      total += 1;
+      if (hits.length >= limit) continue;"""
+
+MUTATIONS = [
+    # ---- a hit has to be a row the reader can be sent to ------------------------------------
+    (
+        "the endpoint is wired to a scan of the stored rows rather than the projected view",
+        "    const searched = collectSearchHits(payload, needle, MAX_SEARCH_HITS);",
+        "    const searched = collectSearchHits({ turns: [{ index: 1, records: rows.map((row) => ({ index: 0, kind: 'reply', summary: String(row.message_id) })) }] }, needle, MAX_SEARCH_HITS);",
+    ),
+    (
+        "a hit reports the record's stored id instead of the index the ledger gives it",
+        "        index: record.index,\n        turnIndex: turn.index,",
+        "        index: record.id === null || record.id === undefined ? 0 : 1,\n        turnIndex: turn.index,",
+    ),
+    (
+        "the endpoint projects the whole lineage instead of the slice that was asked for",
+        "    const view = selectIdentityView(identityTable, filter);\n    const payload = buildTrajectoryPayload({\n      session: { id: ctx.identity.id, createdAtMs: entry.lastActiveAt },",
+        "    const view = selectIdentityView(identityTable, null);\n    const payload = buildTrajectoryPayload({\n      session: { id: ctx.identity.id, createdAtMs: entry.lastActiveAt },",
+    ),
+    # ---- the surface has to be the page's ---------------------------------------------------
+    (
+        "the endpoint searches only the summary",
+        "      if (!searchSurfaceOf(record).includes(needle)) continue;",
+        "      if (!String(record.summary ?? '').includes(needle)) continue;",
+    ),
+    (
+        "the endpoint folds the surface away, so a case-sensitive needle matches everything",
+        "      if (!searchSurfaceOf(record).includes(needle)) continue;",
+        "      if (!String(record.summary ?? '').toLowerCase().includes(needle) || true) continue;",
+    ),
+    # ---- how many ---------------------------------------------------------------------------
+    (
+        "the cap also bounds the count, so a long needle reports however many fitted",
+        SEARCH_LOOP,
+        """  for (const turn of turns) {
+    const records = Array.isArray(turn.records) ? turn.records : [];
+    for (const record of records) {
+      if (!searchSurfaceOf(record).includes(needle)) continue;
+      if (hits.length >= limit) break;
+      total += 1;""",
+    ),
+    (
+        "the cap is applied before the count, so an unlimited search reports nothing",
+        "      total += 1;\n      if (hits.length >= limit) continue;",
+        "      if (hits.length < limit) total += 1;\n      if (hits.length >= limit) continue;",
+    ),
+    # ---- a needle never crosses a record ------------------------------------------------------
+    (
+        "records are joined into one blob before the scan, so a needle can cross a boundary",
+        "  for (const turn of turns) {\n    const records = Array.isArray(turn.records) ? turn.records : [];\n    for (const record of records) {\n      if (!searchSurfaceOf(record).includes(needle)) continue;\n      total += 1;",
+        "  const blob = turns.flatMap((t) => (Array.isArray(t.records) ? t.records : [])).map((r) => searchSurfaceOf(r)).join(' ');\n  if (blob.includes(needle)) { hits.push({ index: 0, turnIndex: 1, kind: 'reply', summary: '', generation: null }); total += 1; }\n  for (const turn of []) {\n    const records = [];\n    for (const record of records) {\n      if (!searchSurfaceOf(record).includes(needle)) continue;\n      total += 1;",
+    ),
+    # ---- the route ---------------------------------------------------------------------------
+    (
+        "the route is not registered, so a search answers 404",
+        "    if (url.pathname === '/api/trajectory/search') {",
+        "    if (url.pathname === '/api/trajectory/searchX') {",
+    ),
+    (
+        "a needle too short is answered with everything instead of refused",
+        "    if (!needleIsUsable(asked)) {",
+        "    if (false) {",
+    ),
+    (
+        "the lineage is walked a second time, so the two readers can disagree about it",
+        "      walked = await collectLineage(entry, ctx.generations);\n    } catch (error) {\n      sendError(response, 500, 'trajectory_unreadable', lineageFailure(error));\n      return;\n    }\n    const { occurrences, files } = walked;",
+        "      walked = await collectLineage(entry, ctx.generations);\n      walked = await collectLineage(entry, ctx.generations);\n    } catch (error) {\n      sendError(response, 500, 'trajectory_unreadable', lineageFailure(error));\n      return;\n    }\n    const { occurrences, files } = walked;",
+    ),
+    (
+        "the session key becomes the session id, so an id becomes a directory name",
+        "    createHash('sha256').update(`${dir}\\n${sessionId}`).digest('hex').slice(0, 32);",
+        "    String(sessionId);",
+    ),
+    (
+        "the artifacts are written beside the session history instead of under the data dir",
+        "  const artifactRoot = join(context.dataDir, 'trajectory-artifacts');",
+        "  const artifactRoot = join(process.cwd(), 'trajectory-artifacts');",
+    ),
+    (
+        "the active generation is stored as a segment, so a growing file keeps a stale segment",
+        "      if (fileIdx === activeIdx) continue;",
+        "      if (false) continue;",
+    ),
+    (
+        "writing the artifacts can fail the search that asked for them",
+        "    }).catch(() => undefined);",
+        "    });",
+    ),
+]
+
+
+def read_exact(path):
+    """Normalise to LF for matching, and report the file's own newline so it can be put back."""
+    data = path.read_bytes()
+    text = data.decode("utf-8").replace("\r\n", "\n")
+    return text, ("\r\n" if b"\r\n" in data else "\n")
+
+
+def write_exact(path, text, newline):
+    if newline == "\r\n":
+        text = text.replace("\n", "\r\n")
+    path.write_bytes(text.encode("utf-8"))
+
+
+def run_probe():
+    proc = subprocess.run(
+        ["node", str(PROBE)],
+        cwd=str(ROOT),
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+    )
+    return proc.returncode, (proc.stdout or "") + (proc.stderr or "")
+
+
+def main():
+    code, output = run_probe()
+    if code != 0:
+        print("baseline probe does not pass; fix that first")
+        print(output)
+        return 1
+    print("baseline clean")
+
+    original = SERVER.read_bytes()
+    missed = []
+    unnamed = []
+    for label, old, new in MUTATIONS:
+        text, newline = read_exact(SERVER)
+        if old not in text:
+            print(f"SKIP  {label}: anchor not found")
+            missed.append(label)
+            continue
+        if old == new:
+            print(f"SKIP  {label}: the mutation changes nothing")
+            missed.append(label)
+            continue
+        write_exact(SERVER, text.replace(old, new, 1), newline)
+        try:
+            code, output = run_probe()
+        finally:
+            SERVER.write_bytes(original)
+        if code == 0:
+            print(f"MISSED {label}: the probe still passed")
+            missed.append(label)
+            continue
+        first = next((line.strip() for line in output.splitlines() if line.strip().startswith("- ")), None)
+        if first is None:
+            print(f"UNNAMED {label}: the probe failed without naming a rule")
+            unnamed.append(label)
+        else:
+            print(f"caught {label}\n         -> {first}")
+
+    if SERVER.read_bytes() != original:
+        print(f"NOT RESTORED {SERVER}")
+        return 1
+    print("file restored byte-for-byte")
+
+    if missed or unnamed:
+        if missed:
+            print(f"\n{len(missed)} mutation(s) got through")
+        if unnamed:
+            print(f"{len(unnamed)} mutation(s) failed without naming a rule")
+        return 1
+    print(f"\nall {len(MUTATIONS)} mutations caught, each by name")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-selection.py b/plugins/avatasia/mmc-trajectory/tests/mutate-selection.py
index 2591026..7bdf872 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-selection.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-selection.py
@@ -121,8 +121,8 @@
     # Two writers. The poll path judged the selection again, and a reader could be told two
     # different things depending on which one ran last.
     ("the poll path judges the selection a second time",
-     [("        if (changed) rePinWindow();\n        render();\n",
-       "        if (changed) { rePinWindow(); revealSelection(visibleEntries()); }\n        render();\n")],
+     [("        if (changed) rePinWindow();\n",
+       "        if (changed) { rePinWindow(); revealSelection(visibleEntries()); }\n")],
      "the poll path does not judge the selection a second time"),
 
     # The list becomes a second read. The caller hands over the rows it is about to build and the
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-turn-breakdown.py b/plugins/avatasia/mmc-trajectory/tests/mutate-turn-breakdown.py
index 85eaffd..e96c7c3 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-turn-breakdown.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-turn-breakdown.py
@@ -91,12 +91,12 @@
     # 第 82 轮, two scopes in one label, so the pair reads as a contradiction that no wording
     # can fix. Both numbers were true.
     ("session total put back in the title",
-     "if (!isCount(firstTurn) || !isCount(lastTurn)) return DASH;",
-     "if (!isCount(firstTurn) || !isCount(lastTurn)) return DASH;\n        var totalTurns = state.payload.stats.turns;\n        if (firstTurn === lastTurn) return '共 ' + formatInt(totalTurns) + ' 轮 · 当前第 ' + formatInt(firstTurn) + ' 轮';\n        return '共 ' + formatInt(totalTurns) + ' 轮 · 当前第 ' + formatInt(firstTurn) + '–' + formatInt(lastTurn) + ' 轮';",
+     "        var range = DASH;\n        if (isCount(firstTurn) && isCount(lastTurn)) {",
+     "        var range = DASH;\n        if (isCount(state.payload && state.payload.stats ? state.payload.stats.turns : null)) return '共 ' + formatInt(state.payload.stats.turns) + ' 轮';\n        if (isCount(firstTurn) && isCount(lastTurn)) {",
      "panel title states only the rendered turn range"),
     ("title drops the range entirely",
-     "return '第 ' + formatInt(firstTurn) + '–' + formatInt(lastTurn) + ' 轮';",
-     "return '轨迹';",
+     ": '第 ' + formatInt(firstTurn) + '–' + formatInt(lastTurn) + ' 轮';",
+     ": '轨迹';",
      "panel title states only the rendered turn range"),
     # Anchored on two lines with their indentation: updateWindowBar() now writes the 全场 total in
     # both its mid-build and its settled branch, and a one-line anchor matches both.
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-anomaly.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-anomaly.mjs
index 3448e56..c99d5e1 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-anomaly.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-anomaly.mjs
@@ -445,8 +445,19 @@ page.state.anomaly.rules = ['toolError'];
 check('and while a rule is ticked the search does not narrow the list either',
   page.visibleEntries().length, expect.toolError);
 page.state.anomaly.rules = [];
-assert('but with no rule ticked the search is still a filter for the list',
-  page.visibleEntries().length < page.state.flat.length);
+// This used to set only `query` and expect the list to narrow, which it did because the page
+// scanned the records it already had. The page no longer holds the text, so it narrows by the set
+// the server sent — and `query` with no set in force is a state that now has a name (搜索中) and a
+// consequence, so it is asked about separately rather than quietly assumed away.
+page.state.searchHits = null;
+page.state.searchPending = false;
+assert('but with no answer yet the search does not narrow the list, so an unapplied filter never reads as an applied one',
+  page.visibleEntries().length === page.state.flat.length);
+const answered = new Set(page.state.flat.slice(0, 2).map((entry) => entry.record.index));
+page.state.searchHits = answered;
+assert('and once the server has answered, the search narrows the list',
+  page.visibleEntries().length === answered.size && page.visibleEntries().length < page.state.flat.length);
+page.state.searchHits = null;
 page.state.query = '';
 
 page.state.kinds = pure.KIND_ORDER.filter((k) => k !== 'toolResult');
@@ -917,6 +928,12 @@ const modeSrc = fnSource('function syncAnomalyMode(counts)');
 const baseSrc = fnSource('function resetBaseFilters(');
 assert('the reset updates the buttons, or the axis would show a condition that is not in force',
   !!baseSrc && /state\.kinds = KIND_ORDER\.slice\(\);/.test(baseSrc) && /syncKindButtons\(\);/.test(baseSrc));
+// Clearing the needle but keeping the SERVER'S ANSWER would leave the next query filtering by a
+// set of record indexes from a session the reader has already moved away from. The answer is the
+// state now, so clearing the base axes has to clear it too — and this file is where the reset is
+// already on trial, so the rule is asserted here as well as in the search guard.
+assert('and it drops the search answer with the needle, not just the needle',
+  !!baseSrc && /state\.searchHits = null;/.test(baseSrc) && /state\.searchError = null;/.test(baseSrc));
 // The brush is not written inline here, and it is not written by dropOverviewSelection() either —
 // R5 gave it one writer, so the chain is resetBaseFilters -> dropOverviewSelection ->
 // setOverviewSelection -> the assignment. Following the call and checking the assignment at the far
@@ -925,8 +942,7 @@ assert('the reset updates the buttons, or the axis would show a condition that i
 assert('and it clears every part of the row above, not just the types',
   !!baseSrc && /state\.query = '';/.test(baseSrc) && /dropOverviewSelection\(\);/.test(baseSrc)
   && !!dropSelSource && /setOverviewSelection\(null\);/.test(dropSelSource)
-  && !!setSelSource && /state\.overviewSelection = value;/.test(setSelSource)
-  && /clearTimeRange\(\);/.test(baseSrc));
+  && !!setSelSource && /state\.overviewSelection = value;/.test(setSelSource)  && /clearTimeRange\(\);/.test(baseSrc));
 const toggleFull = fnSource('function onAnomalyToggle(');
 assert('and it runs on every tick into the mode, not only the first',
   !!toggleFull && /if \(next\.length > 0\) resetBaseFilters\(\);/.test(toggleFull));
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs
index 09f05ed..94d7372 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs
@@ -569,20 +569,64 @@ sandbox.state.kinds = ['user'];
 check('strip: a record of a filtered-out kind is not drawn', sandbox.spanPassesFilter(fCall, false), false);
 check('strip: a record of a kept kind is drawn', sandbox.spanPassesFilter(fUser, false), true);
 /* Search is checked on its own, with every kind back on, so a pass can only come from
- * the text and a fail can only come from the text. */
+ * the hit set and a fail can only come from it.
+ *
+ * These three used to be about text. They are now about the server's answer, and the shape
+ * of the question changed with it: there is no needle to match against in the page any
+ * more, so "does this record contain the needle" is not a question the strip can answer at
+ * all. What it must do is follow the answer — and while there is no answer yet, draw
+ * everything, because a strip that empties itself before the search has come back is the
+ * exact symptom the count line's 正在搜索 exists to make legible.
+ *
+ * The records carry an `index` because that is what the answer names, and the set is built
+ * through the page's own `searchHitSet` rather than a literal `new Set`, so this goes
+ * through the same conversion the response goes through.
+ */
+const sHit = rec('s1', 'thinking', 3200, 0, { index: 41 });
+const sMiss = rec('s2', 'thinking', 3300, 0, { index: 42 });
 sandbox.state.kinds = ALL_KINDS;
 sandbox.state.query = 'needle-that-is-absent';
-check('strip: search rejects a record that does not contain the needle',
-  sandbox.spanPassesFilter(fThink, true), false);
-sandbox.state.query = 'bash';
-check('strip: search keeps a record that does',
-  sandbox.spanPassesFilter(fCall, true), true);
-check('strip: the same record is dropped when the needle is elsewhere',
-  sandbox.spanPassesFilter(fThink, true), false);
+sandbox.state.searchHits = null;
+check('strip: a search with no answer yet draws every record, not none',
+  [sandbox.spanPassesFilter(sHit), sandbox.spanPassesFilter(sMiss)], [true, true]);
+sandbox.state.searchHits = sandbox.searchHitSet([{ index: 41 }]);
+check('strip: the strip keeps the record the server hit',
+  sandbox.spanPassesFilter(sHit), true);
+check('strip: the strip drops the record the server did not hit',
+  sandbox.spanPassesFilter(sMiss), false);
+sandbox.state.searchHits = sandbox.searchHitSet([]);
+check('strip: an answered search that hit nothing draws nothing',
+  sandbox.spanPassesFilter(sHit), false);
+sandbox.state.searchHits = null;
 sandbox.state.query = '';
 check('strip: with nothing filtered every record is drawn',
   sandbox.spanPassesFilter(fCall, false), true);
 
+/* The turn handoff. `noReply` is the only rule that cannot be decided from a record alone —
+ * 无答复 is a property of the turn — so it is the only way to see whether the strip actually
+ * looks the owning turn up or just calls the list with nothing.
+ *
+ * Ticking a rule is a filter, not a highlight: it keeps what fires and drops the rest. So the
+ * three below are one contrast — same record shape, three turns — and the open/closed pair is
+ * the one that matters: only the turn lookup can tell those two apart.
+ *
+ * `turnById` is seeded here rather than by pushing a payload through, because the map is built
+ * on the poll path and this guard has no fetch to drive it with. That is a seam, not the
+ * thing under test: what is under test is that the strip consults the map at all.
+ */
+const openTurn = { id: 't-open', index: 1, closed: false };
+const shutTurn = { id: 't-shut', index: 2, closed: true };
+sandbox.turnById = new Map([[openTurn.id, openTurn], [shutTurn.id, shutTurn]]);
+sandbox.state.anomaly.rules = ['noReply'];
+check('strip: a record in an unclosed turn is drawn under 无答复, which only the turn lookup can decide',
+  sandbox.spanPassesFilter(rec('a1', 'user', 3400, 0, { turnId: openTurn.id })), true);
+check('strip: the same record in a closed turn is dropped under the same tick',
+  sandbox.spanPassesFilter(rec('a2', 'user', 3500, 0, { turnId: shutTurn.id })), false);
+check('strip: a record whose turn is unknown is dropped, because no turn rule fires on nothing',
+  sandbox.spanPassesFilter(rec('a3', 'user', 3600, 0, { turnId: 't-absent' })), false);
+sandbox.state.anomaly.rules = [];
+sandbox.turnById = new Map();
+
 /* ----------------------------------------------------------------------- report */
 console.log('overview + toolbar controls: ' + pass + ' passed, ' + failures.length + ' failed');
 if (failures.length) {
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-raw-locators.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-raw-locators.mjs
index b60012a..cffc5db 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-raw-locators.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-raw-locators.mjs
@@ -223,8 +223,20 @@ assert('the entry keeps a locator map and a decode cache',
   /trajectoryCache\.set\(cacheKey,[\s\S]{0,200}?raws[\s\S]{0,200}?decoded: new Map\(\)/.test(startBody));
 assert('and not the rows it used to keep',
   !/trajectoryCache\.set\(cacheKey,[\s\S]{0,200}?\{[^}]*\brows\b[^}]*\}\)/.test(startBody));
-assert('the rows array is emptied once nothing else can reach it', startBody.includes('rows.length = 0;'));
-assert('and the locator array goes with it', startBody.includes('rowLocators.length = 0;'));
+// The release has to be read INSIDE `handleTrajectory`, not anywhere in the runtime. It used to be
+// `startBody.includes('rows.length = 0;')`, which the search handler's own `view.rows.length = 0;`
+// satisfies — the assertion passed for a reason that had nothing to do with the thing it claimed to
+// hold, and the mutation that deletes the real release went unnoticed. The same trap as a label that
+// does not describe what it covers; it is caught here by asking the question of the right text.
+const handleTrajectoryAt = startBody.indexOf('const handleTrajectory = async');
+assert('handleTrajectory exists', handleTrajectoryAt > 0);
+const handleTrajectoryBody = startBody.slice(handleTrajectoryAt, startBody.indexOf('const handleSearch = async'));
+assert('the rows array is emptied once nothing else can reach it',
+  /\n {4}rows\.length = 0;/.test(handleTrajectoryBody));
+assert('and the locator array goes with it',
+  /\n {4}rowLocators\.length = 0;/.test(handleTrajectoryBody));
+assert('the release is the payload\'s own row array, not some other array that ends in rows.length',
+  handleTrajectoryBody.includes('const rows = view.rows;'));
 
 // The route must not reach into rows for /raw any more; it seeks.
 const handleRawAt = startBody.indexOf('const handleRaw = async');
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs
new file mode 100644
index 0000000..69adae9
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs
@@ -0,0 +1,338 @@
+/**
+ * A hit has to be a row the reader can be sent to, and the count has to be the count.
+ *
+ * The search moved from the page to the server, and a move like that can change an answer in two
+ * ways that no error message would report:
+ *
+ *  1. **It could report a version the ledger is not showing.** The stored rows of a lineage hold
+ *     every copy of every message; the identity layer keeps one per message and suppresses the rest.
+ *     A scan over the STORED rows would find a match inside a suppressed copy and hand back an index
+ *     no row occupies — so the reader is sent nowhere. `collectSearchHits` runs over the projected
+ *     view instead, and the fixture below has a message stored twice with different content in each
+ *     generation, which is exactly the shape that makes this wrong when it happens.
+ *
+ *  2. **It could change what "how many" means.** The cap bounds what is SENT and never what is
+ *     COUNTED, so a needle that matches ten thousand records is reported as ten thousand rather than
+ *     as however many happened to fit.
+ *
+ * And the surface itself: the endpoint searches what the page searched, under the one normalisation
+ * the segment module states. A dropped field would narrow what a reader can find without failing
+ * anything, so the page's own `recordSearchText` is read out of the shipped client and compared.
+ *
+ * Read-only: imports the pure helpers; never starts the runtime.
+ * mutate-search-endpoint.py breaks each of these in the shipped server.
+ */
+import { readFileSync } from 'node:fs';
+import {
+  SEARCH_FIELDS,
+  buildMessageIdentity,
+  buildTrajectoryPayload,
+  collectSearchHits,
+  foldNeedle,
+  needleIsUsable,
+  normaliseWhitespace,
+  selectIdentityView,
+  ROW_GENERATION,
+} from '../miniapp/node/server.mjs';
+
+const SERVER = readFileSync(new URL('../miniapp/node/server.mjs', import.meta.url), 'utf8');
+const CLIENT = readFileSync(new URL('../miniapp/client/index.html', import.meta.url), 'utf8');
+
+let pass = 0;
+const failures = [];
+function check(name, actual, expected) {
+  if (JSON.stringify(actual) === JSON.stringify(expected)) pass += 1;
+  else failures.push(`${name}: got ${JSON.stringify(actual)}, want ${JSON.stringify(expected)}`);
+}
+function assert(name, cond) {
+  if (cond) pass += 1;
+  else failures.push(name);
+}
+
+/* =====================================================================
+ * The page's own search text, and the endpoint's claim about it
+ * ===================================================================== */
+
+function safeText(value) {
+  if (value === null || value === undefined) return '';
+  if (typeof value === 'string') return value;
+  if (typeof value === 'object' && value.text !== undefined) return safeText(value.text);
+  return '';
+}
+function pageRecordSearchText(record) {
+  if (!record || typeof record !== 'object') return '';
+  const thinking = record.thinking;
+  const thinkingText = thinking && typeof thinking === 'object'
+    ? safeText(thinking.text !== undefined ? thinking.text : thinking)
+    : safeText(thinking);
+  return [record.summary, record.text, safeText(record.result), thinkingText, record.toolName]
+    .map((part) => safeText(part))
+    .join('\n')
+    .toLowerCase();
+}
+// The five searched fields used to be pinned against the page's own `recordSearchText`. The page
+// does not search any more — that is the move — so the pin is against what those fields are FOR:
+// each one is something the reader is shown. That a record also carries them is checked below,
+// once there is a record to carry them.
+const CARRIED = ['summary', 'text', 'result', 'thinking', 'toolName'];
+// The page has to show them somewhere, or searching them finds something the reader cannot open.
+for (const field of CARRIED) {
+  assert(`the page renders "${field}"`, CLIENT.includes(`record.${field}`));
+}
+// `arguments` is shown and deliberately NOT searched: it is the page's own choice, recorded as one
+// rather than left to look like an oversight. Search it and the coverage grows; do not search it and
+// a reader is never shown the field list, so the omission is a decision rather than a defect.
+assert('the page shows tool arguments', /record\.arguments/.test(CLIENT));
+assert('and arguments are deliberately not searched', !SEARCH_FIELDS.includes('arguments'));
+
+/** The page's filter, given a payload and a needle. This is what the endpoint must reproduce. */
+function pageHits(payload, needle) {
+  const folded = foldNeedle(needle);
+  const out = [];
+  for (const turn of payload.turns) {
+    for (const record of turn.records) {
+      if (normaliseWhitespace(pageRecordSearchText(record)).includes(folded)) out.push(record.index);
+    }
+  }
+  return out;
+}
+
+/* =====================================================================
+ * A lineage that stores one message twice, with different content
+ * ===================================================================== */
+
+const message = (id, role, extra) => ({ message_id: id, role, ...extra });
+
+const RAW = [
+  { message_id: 'u1', turn_id: 't1', message: message('u1', 'user', { content: 'the needle is in the question', timestamp: 1000 }) },
+  // Generation 0's copy of this message. The second copy below is the SAME message id with the
+  // tool result replaced by the runtime's compaction marker — a second VERSION, kept rather than
+  // dropped, and the one a generation view would show.
+  {
+    message_id: 'a1',
+    turn_id: 't1',
+    message: message('a1', 'assistant', {
+      timestamp: 1100,
+      stopReason: 'toolUse',
+      content: [
+        { type: 'text', text: 'working on it' },
+        { type: 'toolCall', id: 'c1', name: 'read', arguments: { path: 'a' } },
+      ],
+    }),
+  },
+  {
+    message_id: 'tr1',
+    turn_id: 't1',
+    message: message('tr1', 'toolResult', {
+      timestamp: 1200,
+      toolCallId: 'c1',
+      toolName: 'read',
+      content: 'the needle is in the tool result',
+    }),
+  },
+  { message_id: 'u2', turn_id: 't2', message: message('u2', 'user', { content: 'second question', timestamp: 2000 }) },
+  // The runtime copies this message into generation 1, with its tool result trimmed away.
+  {
+    message_id: 'tr1',
+    turn_id: 't1',
+    message: message('tr1', 'toolResult', {
+      timestamp: 1200,
+      toolCallId: 'c1',
+      toolName: 'read',
+      content: '[Tool result removed by context compaction.]',
+    }),
+  },
+];
+
+// Generation 0 holds the conversation as it was written; generation 1 holds the later question and
+// the runtime's copy of the trimmed message. So the trimmed copy IS what generation 1 stores, and
+// the lineage view shows generation 0's.
+const rowsForBuild = RAW.map((row, i) => ({ ...row, [ROW_GENERATION]: i < 3 ? 0 : 1 }));
+
+const occurrences = rowsForBuild.map((row, i) => ({
+  row,
+  generation: rowsForBuild[i][ROW_GENERATION],
+  locator: { filePath: `/store/s/g${rowsForBuild[i][ROW_GENERATION]}.jsonl`, start: i * 100, end: i * 100 + 40, digest: `d${i}` },
+}));
+
+const identityTable = buildMessageIdentity(occurrences);
+const allView = selectIdentityView(identityTable, null);
+const allPayload = buildTrajectoryPayload({
+  session: { id: 's1', createdAtMs: 2000 },
+  rows: allView.rows,
+  generations: [],
+  generation: null,
+  identity: identityTable,
+  openerByTurn: allView.openerByTurn,
+});
+
+assert('the identity layer really did keep one version of the message stored twice',
+  allPayload.turns.flatMap((t) => t.records).filter((r) => r.id === 'tr1').length === 1);
+const firstRecord = allPayload.turns.flatMap((t) => t.records)[0];
+for (const field of SEARCH_FIELDS) {
+  assert(`a projected record carries "${field}"`, Object.prototype.hasOwnProperty.call(firstRecord, field));
+}
+check('and the searched fields are exactly the five that are both carried and shown', SEARCH_FIELDS, CARRIED);
+assert('and it is the one with the real result',
+  allPayload.turns.flatMap((t) => t.records).some((r) => r.id === 'tr1' && String(r.result).includes('needle')));
+
+const genView = selectIdentityView(identityTable, 0);
+const gen0Payload = buildTrajectoryPayload({
+  session: { id: 's1', createdAtMs: 2000 },
+  rows: genView.rows,
+  generations: [],
+  generation: 0,
+  identity: identityTable,
+  openerByTurn: genView.openerByTurn,
+});
+
+/* =====================================================================
+ * 1 — the endpoint reproduces the page, record for record
+ * ===================================================================== */
+
+const NEEDLES = ['needle', 'the needle is in', 'working on it', 'read', 'second question', 'zzz', 'trimmed'];
+for (const needle of NEEDLES) {
+  const expected = pageHits(allPayload, needle);
+  const got = collectSearchHits(allPayload, foldNeedle(needle), 500);
+  check(`"${needle}" finds the records the page found`, got.hits.map((h) => h.index), expected);
+  check(`"${needle}" counts them the same way`, got.total, expected.length);
+}
+
+// The same for a generation view, because the whole point of a view is that it shows different
+// versions of the same message and a search has to follow the view.
+const gen0Needle = 'needle';
+check('a generation view finds the records ITS records contain',
+  collectSearchHits(gen0Payload, foldNeedle(gen0Needle), 500).hits.map((h) => h.index),
+  pageHits(gen0Payload, gen0Needle));
+
+/* =====================================================================
+ * 2 — a suppressed version is not a hit
+ * ===================================================================== */
+
+// Generation 1's copy of `tr1` carries the compaction marker and no result. Nothing in the whole
+// lineage view shows it, so nothing may be reported from it. This is the failure a scan over the
+// stored rows would produce and this one must not.
+const trimmedCopyIsStored = occurrences.some((o) => String(o.row.message.content).includes('Tool result removed'));
+assert('the fixture really does store the trimmed copy', trimmedCopyIsStored);
+check('the whole-lineage search reports the message once, from the version on show',
+  collectSearchHits(allPayload, foldNeedle('needle'), 500).hits.filter((h) => allPayload.turns.flatMap((t) => t.records).find((r) => r.index === h.index)?.id === 'tr1').length, 1);
+check('and never reports a record index the ledger does not have',
+  collectSearchHits(allPayload, foldNeedle('needle'), 500).hits
+    .filter((h) => !allPayload.turns.flatMap((t) => t.records).some((r) => r.index === h.index)).length, 0);
+// The trimmed copy carries wording that exists NOWHERE else in the lineage, so it is the one needle
+// that can only be answered by that version. The whole-lineage view does not show it, so it may not
+// be reported; the generation that HOLDS it does show it, so it must be. One assertion, both ways.
+const trimmedOnly = foldNeedle('Tool result removed by context compaction');
+check('the whole-lineage search does not report a version it is not showing',
+  collectSearchHits(allPayload, trimmedOnly, 500).total, 0);
+
+const gen1View = selectIdentityView(identityTable, 1);
+const gen1Payload = buildTrajectoryPayload({
+  session: { id: 's1', createdAtMs: 2000 },
+  rows: gen1View.rows,
+  generations: [],
+  generation: 1,
+  identity: identityTable,
+  openerByTurn: gen1View.openerByTurn,
+});
+assert('the generation that holds the trimmed copy really does show it',
+  gen1Payload.turns.flatMap((t) => t.records).some((r) => String(r.result).includes('Tool result removed')));
+check('and a search in THAT view reports it',
+  collectSearchHits(gen1Payload, trimmedOnly, 500).total, 1);
+check('and reports it at the index that view gives it, not at a stored one',
+  collectSearchHits(gen1Payload, trimmedOnly, 500).hits.map((h) => h.index),
+  pageHits(gen1Payload, 'Tool result removed by context compaction'));
+
+/* =====================================================================
+ * 3 — the count is the count; the cap is on the send
+ * ===================================================================== */
+
+const many = {
+  turns: [{
+    index: 1,
+    records: Array.from({ length: 40 }, (_, i) => ({
+      index: i + 1, kind: 'reply', summary: `needle ${i}`, text: null, result: null, thinking: null, toolName: null, generation: 0,
+    })),
+  }],
+};
+const capped = collectSearchHits(many, foldNeedle('needle'), 10);
+check('the cap bounds what is returned', capped.hits.length, 10);
+check('and not what is counted', capped.total, 40);
+const uncapped = collectSearchHits(many, foldNeedle('needle'), 1000);
+check('without a cap everything is returned', uncapped.hits.length, 40);
+check('and the count is still right', uncapped.total, 40);
+check('a limit of zero returns nothing and still counts',
+  [collectSearchHits(many, foldNeedle('needle'), 0).hits.length, collectSearchHits(many, foldNeedle('needle'), 0).total], [0, 40]);
+
+check('a hit carries the turn it is in',
+  collectSearchHits(allPayload, foldNeedle('needle'), 500).hits.every((h) => Number.isInteger(h.turnIndex)), true);
+check('a hit carries a summary, never the body it matched in',
+  collectSearchHits(allPayload, foldNeedle('needle'), 500).hits.every((h) => typeof h.summary === 'string' && !h.summary.includes('\n')), true);
+check('a hit carries the generation it is in',
+  collectSearchHits(allPayload, foldNeedle('needle'), 500).hits.every((h) => h.generation === 0 || h.generation === 1), true);
+check('a payload with no turns answers nothing',
+  collectSearchHits({}, foldNeedle('needle'), 500), { hits: [], total: 0 });
+
+/* =====================================================================
+ * 4 — a needle never crosses a record, and never gets that far if too short
+ * ===================================================================== */
+
+const boundary = {
+  turns: [{
+    index: 1,
+    records: [
+      { index: 1, kind: 'reply', summary: 'the last word of one', text: null, result: null, thinking: null, toolName: null, generation: 0 },
+      { index: 2, kind: 'reply', summary: 'the first word of the next', text: null, result: null, thinking: null, toolName: null, generation: 0 },
+    ],
+  }],
+};
+check('a needle spanning two records finds nothing', collectSearchHits(boundary, foldNeedle('one the first'), 500).total, 0);
+check('and each side is still findable',
+  collectSearchHits(boundary, foldNeedle('last word of one'), 500).total, 1);
+
+assert('a one-character needle is not a search', !needleIsUsable('x'));
+assert('a two-character needle is', needleIsUsable('xy'));
+check('whitespace does not count toward the floor', needleIsUsable('  '), false);
+
+/* =====================================================================
+ * 5 — the shape the route depends on
+ * ===================================================================== */
+
+assert('the route exists and is not the trajectory route',
+  SERVER.includes("url.pathname === '/api/trajectory/search'")
+  && !SERVER.includes("url.pathname === '/api/trajectory/search/"));
+assert('the endpoint answers through the one search helper',
+  SERVER.includes('collectSearchHits(payload, needle, MAX_SEARCH_HITS)'));
+assert('the lineage is walked in one place, and both readers use it',
+  (SERVER.match(/collectLineage\(entry, /g) ?? []).length === 2
+  && SERVER.includes('const collectLineage = async'));
+// Both readers project the slice they were asked for. A search that quietly widened to the whole
+// lineage would answer every query with generations the reader is not looking at — and the guard's
+// own fixtures cannot see it, because they call the pure helper with a payload already chosen.
+assert('both readers project the requested slice, not the whole lineage',
+  (SERVER.match(/selectIdentityView\(identityTable, filter\)/g) ?? []).length === 2);
+assert('a failed artifact write cannot fail the search that asked for it',
+  /void publishSearchArtifacts\(\{[\s\S]*?\}\)\.catch\(\(\) => undefined\);/.test(SERVER));
+assert('a needle too short is refused with a status, not answered with everything',
+  /search_query_required/.test(SERVER) && /needleIsUsable\(asked\)/.test(SERVER));
+assert('the artifacts are written under the runtime data dir',
+  SERVER.includes("join(context.dataDir, 'trajectory-artifacts')"));
+assert('and never beside the session history or inside the package',
+  !/trajectory-artifacts['"]\s*,\s*entry\.dir/.test(SERVER));
+assert('the session key is a hash, so no session id becomes a directory name',
+  /createHash\('sha256'\)\.update\(`\$\{dir\}\\n\$\{sessionId\}`\)/.test(SERVER));
+assert('writing the artifacts cannot fail the request that asked for a search',
+  /\.catch\(\(\) => undefined\)/.test(SERVER));
+assert('the active generation is not stored as a segment',
+  /if \(fileIdx === activeIdx\) continue;/.test(SERVER));
+
+/* --------------------------------------------------------------------- */
+
+if (failures.length) {
+  console.log(`\n  [search-endpoint] ${failures.length} failure(s):`);
+  for (const line of failures) console.log(`    - ${line}`);
+  console.log('');
+  process.exitCode = 1;
+} else {
+  console.log(`[search-endpoint] ${pass} assertions passed`);
+}
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs
index e19ad38..7b390b4 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs
@@ -97,11 +97,20 @@ const RECORDS = [
 
 check('the field list is the page\'s, in the page\'s order',
   SEARCH_FIELDS, ['summary', 'text', 'result', 'thinking', 'toolName']);
-// The field list is only the page's if the page still says it is. Read out of the shipped client
-// rather than out of this file's own copy of it, or the check would be true by construction.
+// The page does not search any more — the server does, from segments — so the list cannot be
+// pinned against a client function that is gone. What still has to be true is that every field the
+// segment stores is something the reader is shown, or a search finds text nobody can open. Read
+// out of the shipped client rather than out of this file's own copy, or the check is true by
+// construction.
 const CLIENT = readFileSync(new URL('../miniapp/client/index.html', import.meta.url), 'utf8');
-assert('the page still searches exactly these five fields, in this order',
-  /\[record\.summary, record\.text, safeText\(record\.result\), thinkingText, record\.toolName\]/.test(CLIENT));
+check('the field list is the five the page can show',
+  SEARCH_FIELDS, ['summary', 'text', 'result', 'thinking', 'toolName']);
+for (const field of SEARCH_FIELDS) {
+  assert(`the page renders "${field}", so a hit on it leads somewhere`,
+    CLIENT.includes(`record.${field}`));
+}
+assert('the page has no local search left to disagree with',
+  !/recordSearchText/.test(CLIENT) && !/indexOf\(String\(needle\)/.test(CLIENT));
 
 // The page's surface under the ONE normalisation the module states: runs of whitespace become one
 // space, ends trimmed. Anything else — a field dropped, a field reordered, a field read in the

From e8d0eb49994af4edbc9d4e177d7855b45ffcb469 Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 10:49:46 +0800
Subject: [PATCH 12/36] Stop sending the record bodies; send four flags and ask
 when one is opened
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`text`, `thinking`, `arguments` and `result` were 59.1% of every response body, and the page held
all of it to draw a ledger row and — once in a while, for one record — four inspector tabs.

Measured over this machine's whole session store, projecting every record the way the route does:

    text       8.9%      thinking  13.2%
    arguments  9.3%      result    26.6%      error  1.0%

Measured again over the twelve largest sessions, 6568 records, before and after the strip:

    13.66 MB -> 5.57 MB, 59.2% removed

Server

  - push() measures four presence flags, once, and the values stay on the records. The search
    reads them in this process, so stripping at the projection would have broken search to save the
    page memory; slimPayloadForWire() runs at the serialisation boundary instead, and the ?since=
    delta is built from the stripped payload, so a poll carries no more bulk than the first load.
  - /api/trajectory/record?session=&index=&generation= answers for one record. It re-projects the
    single stored line that record came from and picks by rowPos — a line can expand into several
    records (its text, each thinking block, each tool call), and a wrong position shows the reader
    another block's reasoning as if it were this one.
  - It does not answer with `kind`. Re-projecting one line reproduces every value but disagrees
    about kind for an opener (measured: 1 of 6568; a steer row alone has no turn to have been
    interrupted by). The page already has the record and its kind, and kind is the field a reader
    would act on.
  - `error` is gone. It was the same expression as `result`, set only when isError was already
    true, so `isError || error` could never have disagreed with `isError`, and every failed tool
    result was serialised twice.
  - The row summary is one server-derived field. The page used to assemble it from
    `summary || text || toolName || title`; over this store the `text` step decided nothing and the
    other two decided it for 5 of 1287 records, all system rows.
  - The line read and its digest check moved into readRecordRow(). Two endpoints need them, and two
    copies is two answers to 「are these still the bytes that record was built from」.

Client

  - the four tabs and the error block read the detail; availability comes from the flag
  - 空答复 is decided by hasText === false, strictly. A record from a payload without the flag has
    neither flag nor body, and calling that broken would mark it for no reason.
  - the handoff fetches the detail alongside the raw message, and says so when the error text did
    not arrive rather than printing 「失败」 with nothing after it

Also fixed, found while doing it

  - make-payload.mjs picked the fixture session by mtime. It was not a rule, it was a timestamp,
    and it had changed the answer without anyone deciding it should: the committed payload still
    carried `raw` and `rawOmitted`, fields the projection stopped producing long ago, and every
    guard reading it was asserting against a payload the server cannot produce. It now picks
    deterministically and refuses to record without a tool error, a checkpoint, an open turn and a
    body-less reply — the four the guards read it for.
  - client-check asserted 「exactly two .innerHTML in the page」 under a label about jsonColorize.
    A count fails the moment a third legitimate call is added and passes just as happily when one
    of the two is deleted and the other becomes an injection. It is a property now.

Tests: `node tests/run.mjs` on this tree. New: verify-record-detail, 139 assertions, and
mutate-record-detail, 17 mutations each caught by name.
---
 .../mmc-trajectory/miniapp/client/index.html  | 186 +++++++-
 .../mmc-trajectory/miniapp/node/server.mjs    | 255 +++++++++-
 .../mmc-trajectory/tests/client-check.mjs     |  28 +-
 .../tests/fixtures/trajectory.json            |   2 +-
 .../mmc-trajectory/tests/make-payload.mjs     |  91 +++-
 .../mmc-trajectory/tests/mutate-anomaly.py    |  31 +-
 .../mmc-trajectory/tests/mutate-raw-lazy.py   |  14 +-
 .../tests/mutate-raw-locators.py              |   4 +-
 .../tests/mutate-record-detail.py             | 223 +++++++++
 .../tests/mutate-trajectory-cache.py          |   4 +-
 .../mmc-trajectory/tests/verify-anomaly.mjs   |  37 +-
 .../mmc-trajectory/tests/verify-raw-lazy.mjs  |  30 +-
 .../tests/verify-raw-locators.mjs             |  16 +-
 .../tests/verify-record-detail.mjs            | 443 ++++++++++++++++++
 .../tests/verify-search-endpoint.mjs          |  32 +-
 .../tests/verify-search-segments.mjs          |  15 +-
 16 files changed, 1298 insertions(+), 113 deletions(-)
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/mutate-record-detail.py
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/verify-record-detail.mjs

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
index 81d2090..542981d 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
+++ b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
@@ -2950,8 +2950,11 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
           // instead of one. 无答复 cannot see it either way: an empty reply closes its turn, so
           // `closed` is true and that rule has nothing to fire on. Measured on this session:
           // two, one of them the turn that ended in front of the reader with nothing shown.
+          // `hasText` is the server's own verdict, measured from the text it projected, and it is
+          // NOT the same question as whether `summary` is empty: a body-less reply is given its
+          // title as a summary, so reading one from the other would find nothing to flag.
           record: function (record) {
-            return !!record && record.kind === 'reply' && isNil(record.text);
+            return !!record && record.kind === 'reply' && record.hasText === false;
           }
         },
         {
@@ -3536,7 +3539,7 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         return { text: text.slice(0, cap), truncated: true };
       }
 
-      function buildHandoffMarkdown(session, turn, record, rawText, rawTruncated, rawOmitted) {
+      function buildHandoffMarkdown(session, turn, record, rawText, rawTruncated, rawOmitted, errorText) {
         var lines = [];
         lines.push('请分析这条会话轨迹记录，说明它在做什么、有没有问题，以及是否需要改进。');
         lines.push('');
@@ -3570,9 +3573,12 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         if (record.stopReason) lines.push('- 结束原因：' + record.stopReason);
         if (record.textTruncated) lines.push('- 提示：正文已被上游截断。');
         if (rawOmitted) lines.push('- 提示：原文过大已被省略。');
-        if (record.isError || record.error) {
+        // The message behind a failure is the tool result, which no longer rides along on the row.
+        // `errorText` is null when the read did not arrive, and that is said rather than printed as
+        // an empty value: a report that says 「失败」 with nothing after it reads as "no message".
+        if (record.isError === true) {
           lines.push('- 状态：失败');
-          lines.push('- 错误：' + safeText(record.error));
+          lines.push('- 错误：' + (errorText ? safeText(errorText) : '（错误信息未能读取）'));
         } else {
           lines.push('- 状态：已完成');
         }
@@ -5877,7 +5883,7 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         row.setAttribute('data-row-id', recordKey(record));
         if (record.id === state.selectedId) row.setAttribute('aria-current', 'true');
         else row.removeAttribute('aria-current');
-        var failed = !!(record.isError || record.error);
+        var failed = record.isError === true;
         if (failed) row.classList.add('is-error');
 
         row.appendChild(el('span', 'row-index', '#' + (isCount(record.index) ? record.index : DASH)));
@@ -5885,7 +5891,11 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         var label = pill(kindLabel(record), kindTone(record.kind));
         row.appendChild(label);
 
-        var summaryText = record.summary || record.text || record.toolName || record.title || '';
+        // The server derives this one, folding in the tool name and the title when a record has no
+        // text of its own. It used to be a four-step chain here; measured over this machine's
+        // store, the `text` step never decided a single row, and the other two now live server-side
+        // where the rest of the summary is made.
+        var summaryText = record.summary || '';
         var summary = el('span', 'row-summary', truncateText(safeText(summaryText), 160) || DASH);
         summary.title = truncateText(safeText(summaryText), 600);
         row.appendChild(summary);
@@ -5899,7 +5909,7 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         // finished normally — but on the row the only thing separating it from an answer is
         // the absence of one, and a row that silently shows nothing is indistinguishable from
         // one the page failed to load.
-        var silent = record.kind === 'reply' && isNil(record.text);
+        var silent = record.kind === 'reply' && record.hasText === false;
         if (failed) {
           row.appendChild(pill('失败', 'error'));
           row.title = '失败 · 耗时 ' + durationText + '（详情见右侧检视）';
@@ -5957,7 +5967,7 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         var opened = isCount(record.generation)
           ? '开启第 ' + formatInt(record.generation) + ' 代'
           : '开启新的一代';
-        var summary = truncateText(safeText(record.summary || record.text || ''), 200);
+        var summary = truncateText(safeText(record.summary), 200);
         band.appendChild(el('span', 'compaction-what', summary ? summary : '之前的上下文已被摘要'));
 
         var when = isNil(record.relativeMs)
@@ -7901,23 +7911,21 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
           id: 'args',
           label: '参数',
           available: function (record) {
-            return record.kind === 'toolCall' && record.arguments !== null && record.arguments !== undefined;
+            return record.kind === 'toolCall' && record.hasArguments === true;
           }
         },
         {
           id: 'result',
           label: '结果',
           available: function (record) {
-            return record.kind === 'toolResult' && record.result !== null && record.result !== undefined;
+            return record.kind === 'toolResult' && record.hasResult === true;
           }
         },
         {
           id: 'thinking',
           label: '思考',
           available: function (record) {
-            if (record.kind !== 'thinking') return false;
-            var value = record.thinking;
-            return value !== null && value !== undefined && safeText(value).trim() !== '';
+            return record.kind === 'thinking' && record.hasThinking === true;
           }
         }
       ];
@@ -8062,9 +8070,9 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
       function buildPanel(tabId, record, turn) {
         if (tabId === 'summary') return buildSummary(record, turn);
         if (tabId === 'raw') return buildRaw(record);
-        if (tabId === 'args') return buildBlock('工具参数', record.arguments, true);
-        if (tabId === 'result') return buildBlock('工具结果', record.result, false);
-        return buildBlock('思考过程', record.thinking, false);
+        if (tabId === 'args') return buildDetailBlock('工具参数', record, 'arguments', true);
+        if (tabId === 'result') return buildDetailBlock('工具结果', record, 'result', false);
+        return buildDetailBlock('思考过程', record, 'thinking', false);
       }
 
       function buildSummary(record, turn) {
@@ -8074,13 +8082,23 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         wrap.style.flexDirection = 'column';
         wrap.style.gap = '12px';
 
-        if (record.isError || record.error) {
+        // `isError` alone decides this. It used to be `isError || error`, and that second term was
+        // never a second opinion: `error` was the same string as `result`, set only when
+        // `isError` was already true, so the test could only ever have agreed. The text it showed
+        // is `result`, which now arrives with the record's details.
+        if (record.isError === true) {
           var alert = el('div', 'bar bar-danger');
           var texts = el('div');
           texts.appendChild(el('p', 'bar-title', '失败'));
-          texts.appendChild(el('p', 'bar-hint', safeText(record.error) || '该记录以错误结束，但没有给出错误信息。'));
+          var hint = el('p', 'bar-hint', '正在读取错误信息…');
+          texts.appendChild(hint);
           alert.appendChild(texts);
           wrap.appendChild(alert);
+          fetchDetail(record).then(function (detail) {
+            hint.textContent = safeText(detail.result) || '该记录以错误结束，但没有给出错误信息。';
+          }, function () {
+            hint.textContent = '该记录以错误结束，错误信息暂时取不到。';
+          });
         }
 
         var scroll = el('div', 'table-scroll');
@@ -8114,7 +8132,7 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         kvRow(table, '提供方', isNil(record.provider) ? DASH : String(record.provider));
         kvRow(table, '接口', isNil(record.api) ? DASH : String(record.api));
         kvRow(table, '结束原因', isNil(record.stopReason) ? DASH : String(record.stopReason));
-        kvRow(table, '状态', record.isError || record.error ? '失败' : '已完成');
+        kvRow(table, '状态', record.isError === true ? '失败' : '已完成');
         scroll.appendChild(table);
         wrap.appendChild(scroll);
 
@@ -8238,6 +8256,123 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         return fetchRaw(record);
       }
 
+      /* ---------------- record fields on demand ---------------- */
+
+      // The four bulk fields. They used to be on every row of every poll — 59.1% of the body,
+      // measured over this machine's whole session store — and the page held all of it to draw a
+      // row and, when a record was opened, four tabs. What a row carries now is four presence
+      // flags; this is where the values come from, for the one record the reader is looking at.
+      //
+      // The cache key is `rawCacheKey`'s, not a second one, and for the same reason: a record index
+      // is a position within one version of one body, so a value that changed since it was read
+      // must not keep being served. Sharing the key rather than copying it is what keeps the two
+      // answers from describing different versions of the same record.
+      var detailCache = {};
+      var detailPending = {};
+
+      function requestDetail(index) {
+        var url = '/api/trajectory/record?index=' + encodeURIComponent(String(index))
+          + '&session=' + sessionParam();
+        if (state.generation !== null) {
+          url += '&generation=' + encodeURIComponent(String(state.generation));
+        }
+        return fetch(url, { headers: { Accept: 'application/json' } }).then(function (response) {
+          return response.json().then(
+            function (body) { return { ok: response.ok, body: body }; },
+            function () { return { ok: false, body: null }; }
+          );
+        });
+      }
+
+      /**
+       * Resolves to the record's four bulk fields, or rejects.
+       *
+       * Same contract as `fetchRaw`: a 503 means the server released this session, so the session
+       * is reloaded once and the read retried; a 409 means the file moved, which a reload retries
+       * its way out of on a timer, so it is reported instead.
+       *
+       * @param {Record<string, any>} record
+       * @param {boolean} [retried]
+       */
+      function fetchDetail(record, retried) {
+        var index = record && record.index;
+        if (!isCount(index) || index < 1) return Promise.reject(new Error('record_index_missing'));
+        var key = rawCacheKey(index);
+        if (Object.prototype.hasOwnProperty.call(detailCache, key)) return Promise.resolve(detailCache[key]);
+        if (detailPending[key]) return detailPending[key];
+        var attempt = requestDetail(index).then(function (result) {
+          delete detailPending[key];
+          if (result.ok && result.body && typeof result.body.index === 'number') {
+            var entry = {
+              text: typeof result.body.text === 'string' ? result.body.text : null,
+              thinking: typeof result.body.thinking === 'string' ? result.body.thinking : null,
+              arguments: result.body.arguments === undefined ? null : result.body.arguments,
+              result: typeof result.body.result === 'string' ? result.body.result : null,
+              textTruncated: result.body.textTruncated === true
+            };
+            detailCache[key] = entry;
+            return entry;
+          }
+          var code = result.body && typeof result.body.error === 'string' ? result.body.error : '';
+          var err = new Error(code || 'record_unavailable');
+          err.code = code;
+          throw err;
+        }).catch(function (err) {
+          if (!retried && err && err.code === 'trajectory_not_cached') {
+            return new Promise(function (resolve) { resolve(fetchTrajectory(false)); })
+              .then(function () { return fetchDetail(record, true); });
+          }
+          throw err;
+        });
+        detailPending[key] = attempt;
+        return attempt;
+      }
+
+      /**
+       * The record's bulk fields, for a panel that draws them after it is on the page.
+       *
+       * Three states and they are not the same: not yet read, read and empty, and read and failed.
+       * A panel that cannot tell them apart either shows nothing for a record that has content, or
+       * shows a failure for one that simply has none.
+       *
+       * @param {string} title
+       * @param {Record<string, any>} record
+       * @param {string} field one of text / thinking / arguments / result
+       * @param {boolean} colored
+       */
+      function buildDetailBlock(title, record, field, colored) {
+        var wrap = el('div');
+        wrap.style.display = 'flex';
+        wrap.style.flexDirection = 'column';
+        wrap.style.gap = '8px';
+        wrap.appendChild(el('p', 'block-title', title));
+        var pre = el('pre', 'pre');
+        pre.setAttribute('tabindex', '0');
+        wrap.appendChild(pre);
+        pre.textContent = '正在读取…';
+        fetchDetail(record).then(function (detail) {
+          var value = detail[field];
+          if (detail.textTruncated === true) {
+            wrap.insertBefore(el('p', 'note', '正文已截断：仅保留前段内容。'), pre);
+          }
+          if (value === null || value === undefined) {
+            pre.textContent = DASH;
+            return;
+          }
+          var text = safeText(value);
+          if (!text) {
+            pre.textContent = DASH;
+          } else if (colored && typeof value === 'object') {
+            pre.innerHTML = jsonColorize(value);
+          } else {
+            pre.textContent = text;
+          }
+        }, function () {
+          pre.textContent = '读取失败，这条记录的详细内容暂时取不到。';
+        });
+        return wrap;
+      }
+
       function buildRaw(record) {
         var wrap = el('div');
         wrap.style.display = 'flex';
@@ -8382,7 +8517,15 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         var record = entry.record;
         dom.handoffBtn.disabled = true;
         inspectorSay('正在读取原文…');
-        rawSourceFor(record).then(function (fetched) {
+        // Both reads are one step for the reader, and the detail one is allowed to fail on its own:
+        // the report is still worth sending without the error text, and saying so in the text is
+        // better than dropping the whole handoff over a field the reader may not even look at.
+        Promise.all([
+          rawSourceFor(record),
+          fetchDetail(record).then(function (detail) { return detail; }, function () { return null; })
+        ]).then(function (both) {
+          var fetched = both[0];
+          var detail = both[1];
           // A message too large to carry has no raw; the normalized record is then the most
           // there is, which is what this sent before raw became a separate fetch.
           var omitted = fetched.omitted === true;
@@ -8396,7 +8539,8 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
             record,
             raw.text,
             raw.truncated,
-            omitted
+            omitted,
+            detail && detail.result ? detail.result : null
           );
           inspectorSay('已发出请求，等待你在弹出的确认框中确认…');
           var result = message.append(text);
diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
index a2da7f9..67daf2d 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
@@ -213,6 +213,19 @@ export function clipField(value, max) {
   return { text: value.slice(0, max), truncated: true };
 }
 
+/**
+ * Whether a projected field carries nothing a reader could be shown.
+ *
+ * The page has its own `isNil` and it counts an empty string as nothing; this is the same three
+ * cases. They have to agree, because the page decides whether to draw a tab from the flag this
+ * produces — a definition that treated `''` as present would offer a tab that renders an empty box.
+ *
+ * @param {unknown} value
+ */
+function isNilField(value) {
+  return value === null || value === undefined || value === '';
+}
+
 /**
  * Replaces internal store locations so the browser never learns where sessions live.
  * @param {readonly string[]} secrets
@@ -1131,10 +1144,17 @@ export function toolCallSummary(name, args) {
  *
  * Records are carried per turn, not as one flat list, so this walks the turns.
  *
+ * `rowPos` is optional and collected in the same pass. It is the record's position among the
+ * records its own row produced, which `/api/trajectory/record` needs to say *which* of them it is
+ * answering for — the locator alone says which message, and one message can be several records.
+ * It is an out-parameter rather than a second return because this is the one place already walking
+ * every record, and a second walk to read a number is how two passes drift apart.
+ *
  * @param {Array<Record<string, any>>} turns
+ * @param {Map<number, number> | null} [rowPos]
  * @returns {Map<number, number>}
  */
-export function splitRawRecords(turns) {
+export function splitRawRecords(turns, rowPos = null) {
   /** @type {Map<number, number>} */
   const raws = new Map();
   if (!Array.isArray(turns)) return raws;
@@ -1148,6 +1168,13 @@ export function splitRawRecords(turns) {
       const rowIndex = record.rawRow;
       if (Number.isInteger(index) && index > 0 && typeof rowIndex === 'number' && Number.isInteger(rowIndex) && rowIndex >= 0) {
         raws.set(index, rowIndex);
+        // Collected here, while the record is in hand, and only for a record that has a locator to
+        // answer with. A position with no message behind it cannot be projected and must not be
+        // offered as if it could.
+        const pos = record.rowPos;
+        if (rowPos !== null && typeof pos === 'number' && Number.isInteger(pos) && pos >= 0) {
+          rowPos.set(index, pos);
+        }
       }
       delete record.rawRow;
     }
@@ -1155,6 +1182,38 @@ export function splitRawRecords(turns) {
   return raws;
 }
 
+/**
+ * Takes the four heavy fields off every record, in place, and hands the payload back.
+ *
+ * Measured over this machine's whole session store — 149 files, 13223 records, 27.2 MB of payload:
+ * `result` 26.6%, `thinking` 13.2%, `arguments` 9.3%, `text` 8.9%. **59.1% of the body**, and the
+ * page was holding all of it to draw a ledger row and, once in a while, one inspector tab.
+ *
+ * The values are on the records when this is called and still on them afterwards: the search reads
+ * them in this process, and `/api/trajectory/record` re-projects the one row it needs. What goes
+ * away is the copy that crosses the wire and lands in the page's heap.
+ *
+ * In place, and in one place. The flags were measured at `push()`, so there is nothing here that
+ * can disagree with them — a second measurement site is exactly how the page and the server came
+ * to answer 「这条记录有没有正文」 differently.
+ *
+ * @param {{ turns?: Array<any> }} payload
+ */
+export function slimPayloadForWire(payload) {
+  const turns = payload && Array.isArray(payload.turns) ? payload.turns : [];
+  for (const turn of turns) {
+    const records = turn && Array.isArray(turn.records) ? turn.records : [];
+    for (const record of records) {
+      if (!record || typeof record !== 'object') continue;
+      delete record.text;
+      delete record.thinking;
+      delete record.arguments;
+      delete record.result;
+    }
+  }
+  return payload;
+}
+
 /**
  * Every record of a built payload whose own search text contains the needle.
  *
@@ -1721,17 +1780,35 @@ export function buildTrajectoryPayload(input) {
       textTruncated: false,
     };
 
+    /**
+     * Where this record sits among the records its own source row produced.
+     *
+     * A message can expand into several records — an assistant turn yields its text, each of its
+     * thinking blocks and each of its tool calls — and `/api/trajectory/record` re-projects that one
+     * row to answer for one record. Without a position it would have to guess which of the row's
+     * records was meant, and a guess that picks the wrong thinking block shows the reader another
+     * block's reasoning as if it were this one.
+     */
+    let rowPos = 0;
+
     /** @param {Partial<Record<string, any>> & { kind: string, title: string, summary: string }} patch */
     const push = (patch) => {
       const record = {
         ...base,
         index: records.length + 1,
         relativeMs: timestamp === null || startedAt === null ? null : timestamp - startedAt,
-        text: null,
-        thinking: null,
-        arguments: null,
-        result: null,
-        error: null,
+        // Four presence flags, measured here and nowhere else. The values themselves stay on the
+        // record — the search reads them in this process — and `slimPayloadForWire()` is what stops
+        // them crossing to the page. Deciding it anywhere else would give the page a second answer
+        // to 「这条记录有没有正文」, and the two would disagree exactly the way they did before.
+        hasText: !isNilField(patch.text),
+        hasThinking: !isNilField(patch.thinking),
+        // Not `!isNilField(...)`: the page's own test for the 参数 tab is `!== null && !== undefined`,
+        // and an empty string is a present argument to it. Matching it here keeps the tab from
+        // appearing and disappearing when the payload changes shape.
+        hasArguments: patch.arguments !== null && patch.arguments !== undefined,
+        hasResult: !isNilField(patch.result),
+        rowPos: rowPos++,
         tokensBefore: null,
         producedBy: null,
         parentGeneration: null,
@@ -1739,6 +1816,12 @@ export function buildTrajectoryPayload(input) {
         parentRevision: null,
         ...patch,
       };
+      // The row summary the page used to assemble itself: `summary || text || toolName || title`.
+      // Measured over this machine's store, the `text` step never decided anything — `singleLine`
+      // had already reduced that text to nothing — and the `toolName`/`title` step decided it for
+      // 5 of 1287 records, all `system`. So the chain is folded here, once, and the page reads one
+      // field. It is a fold and not a replacement: a record that already has a summary keeps it.
+      if (!record.summary) record.summary = record.toolName || record.title || '';
       if (record.textTruncated) textTruncatedAny = true;
       records.push(record);
       turn.records.push(record);
@@ -1871,7 +1954,6 @@ export function buildTrajectoryPayload(input) {
         textTruncated: resultField.truncated,
         toolName,
         toolCallId,
-        error: source.isError === true && resultField.text ? resultField.text : null,
       });
       const pending = toolCallId ? toolCallsById.get(toolCallId) : null;
       if (pending && !pending.result) pending.result = record;
@@ -3344,7 +3426,11 @@ export async function start(context) {
     // the body carries no message bodies at all.
     // The record -> locator map. Locators, not row references: the parsed rows behind them are
     // about to stop existing, and this entry is what has to outlive them for `/raw` to still work.
-    const rowIndexByRecord = splitRawRecords(payload.turns);
+    // `rowPos` says which of that row's records this index is, which is what lets
+    // `/api/trajectory/record` project one line and answer for one record out of it.
+    /** @type {Map<number, number>} */
+    const rowPosByRecord = new Map();
+    const rowIndexByRecord = splitRawRecords(payload.turns, rowPosByRecord);
     /** @type {Map<number, LineLocator>} */
     const raws = new Map();
     for (const [recordIndex, rowIndex] of rowIndexByRecord) {
@@ -3352,6 +3438,14 @@ export async function start(context) {
       if (locator !== undefined) raws.set(recordIndex, locator);
     }
 
+    // Last thing before serializing, and the only place the bulk fields are ever taken off a
+    // record. It happens here rather than at `push()` because the search, which runs in this
+    // process and never serialises, still reads those fields off the projected records — so
+    // removing them at the projection would have broken search to save the page memory. The delta
+    // below is built from the same payload, so it is slim too: a poll carries no more bulk than
+    // the first load did.
+    slimPayloadForWire(payload);
+
     let body;
     try {
       body = JSON.stringify(payload);
@@ -3363,7 +3457,7 @@ export async function start(context) {
     // same while it goes stale. Everything that decides whether the answer changed stays in the
     // key, so a newer version of one family replaces its predecessor instead of stacking beside it.
     // `decoded` is filled in by /raw, at most RAW_DECODE_CACHE_ENTRIES lines' worth.
-    trajectoryCache.set(cacheKey, trajectoryCacheFamily(entry.dir, filter), { at: Date.now(), etag, body, raws, decoded: new Map() });
+    trajectoryCache.set(cacheKey, trajectoryCacheFamily(entry.dir, filter), { at: Date.now(), etag, body, raws, rowPos: rowPosByRecord, decoded: new Map() });
     // Nothing below reads `rows` or `rowLocators`, and `payload` holds its own projections rather
     // than the rows, so this is where the object graph stops being reachable. A sealed generation's
     // rows are still held by the parsed-rows cache — that is the point of that cache — but the
@@ -3537,7 +3631,24 @@ export async function start(context) {
    * A missing entry means this process restarted between the two calls; saying so is more honest
    * than silently showing the normalized record in a panel labelled 原文.
    */
-  const handleRaw = async (response, url) => {
+  /**
+   * One record's four bulk fields, read on request.
+   *
+   * The page used to receive all four on every row of every poll — measured over this machine's
+   * whole store, 59.1% of the body: `result` 26.6%, `thinking` 13.2%, `arguments` 9.3%, `text`
+   * 8.9% — and used them to draw a ledger row and, when the reader opened one record, four tabs.
+   * It now receives four presence flags and asks for the values when it is going to show them.
+   *
+   * It re-projects the ONE stored line that record came from, rather than rebuilding the session.
+   * A line can expand into several records (its text, each thinking block, each tool call), so the
+   * answer has to name which of them — `rowPos`, stamped at `push()` — and rebuilding the whole
+   * session to return one field would cost exactly what this change exists to stop paying.
+   *
+   * The bytes come through the same locator `/raw` uses and carry the same digest check, so a file
+   * that moved under the cache answers 「该记录所在的文件已变化」 here too, instead of projecting a
+   * line that is no longer the one the page is looking at.
+   */
+  const handleRecord = async (response, url) => {
     const ctx = await resolveTrajectoryRequest(url);
     if (!ctx.ok) {
       sendError(response, ctx.status, ctx.code, ctx.message);
@@ -3553,41 +3664,130 @@ export async function start(context) {
       sendError(response, 503, 'trajectory_not_cached', '会话数据已释放，请重新加载');
       return;
     }
-    // Re-reading a record the reader has already opened is the common case, and a decoded message
-    // is far smaller than a session, so the entry keeps the ones it has already paid for.
-    const alreadyDecoded = cached.decoded.get(wanted);
-    if (alreadyDecoded !== undefined) {
-      sendJson(response, 200, { index: wanted, raw: alreadyDecoded.value, omitted: alreadyDecoded.omitted });
+    const locator = cached.raws.get(wanted);
+    const rowPos = cached.rowPos.get(wanted);
+    if (locator === undefined || typeof locator.filePath !== 'string' || typeof rowPos !== 'number') {
+      sendError(response, 404, 'record_not_found', '找不到该记录');
       return;
     }
-    const locator = cached.raws.get(wanted);
-    if (locator === undefined || typeof locator.filePath !== 'string') {
+    const found = await readRecordRow(locator);
+    if ('error' in found) {
+      context.logger.warn('miniapp.trajectory.read_error', { reason: `record_${found.reason}` });
+      sendError(response, found.status, found.error, found.error === 'raw_stale'
+        ? '该记录所在的文件已变化，请重新加载会话'
+        : '找不到该记录');
+      return;
+    }
+    // One row in, one row's records out. `sizeBytes` is this line's own length: the only thing the
+    // projection does with it is report truncation, and a one-line view is never truncated.
+    const one = buildTrajectoryPayload({
+      session: { id: ctx.identity.id, createdAtMs: ctx.entry.lastActiveAt },
+      rows: [found.row],
+      sizeBytes: found.sizeBytes,
+      truncated: false,
+      redact,
+      generation: null,
+    });
+    const record = one.turns.flatMap((turn) => turn.records ?? [])[rowPos];
+    if (record === undefined) {
+      // The line projected into fewer records than the payload had for it. That means the two
+      // projections disagree about what this line contains, and answering with the wrong one would
+      // show the reader another record's content — so it is a 404, not a best effort.
+      context.logger.warn('miniapp.trajectory.read_error', { reason: 'record_position_gone', rowPos });
       sendError(response, 404, 'record_not_found', '找不到该记录');
       return;
     }
+    sendJson(response, 200, {
+      index: wanted,
+      // No `kind`. Measured over 6568 records of this machine's store: re-projecting one row
+      // returns the same four values every time, but it disagrees about `kind` for an opener —
+      // a `steer` row projected alone has no earlier turn to have been interrupted by, so it
+      // comes back a `user`. The page already has the record and its kind; handing back a second
+      // one that is known to differ on openers is a second answer to a question it already
+      // answered, and the kind is the one field a reader would act on.
+      text: typeof record.text === 'string' ? record.text : null,
+      thinking: typeof record.thinking === 'string' ? record.thinking : null,
+      arguments: record.arguments ?? null,
+      result: typeof record.result === 'string' ? record.result : null,
+      textTruncated: record.textTruncated === true,
+    });
+  };
+
+  /**
+   * The stored line a record was projected from, or the reason there isn't one.
+   *
+   * ONE place, because there are two readers of it: `/api/trajectory/raw` wants the untouched
+   * message and `/api/trajectory/record` wants the projected fields. The check that the bytes are
+   * still the bytes that record was built from belongs to neither of them. Written twice it is two
+   * answers to "is this still the right line", and the copy nobody thinks about is the one that
+   * eventually stops answering — which is also how the guard stopped being able to tell the two
+   * apart.
+   *
+   * The digest is the whole point. A file that rotated under the cache has the same path and
+   * different bytes, and without this a record index would quietly resolve to whichever line now
+   * sits at that offset.
+   *
+   * @param {{ filePath: string, start: number, end: number, digest: string }} locator
+   * @returns {Promise<{ row: any, sizeBytes: number } | { error: string, status: number, reason: string }>}
+   */
+  const readRecordRow = async (locator) => {
     const bytes = await readRange(locator.filePath, locator.start, locator.end);
     if (bytes === null || lineDigest(bytes) !== locator.digest) {
-      context.logger.warn('miniapp.trajectory.read_error', { reason: 'raw_stale' });
-      sendError(response, 409, 'raw_stale', '该记录所在的文件已变化，请重新加载会话');
-      return;
+      return { error: 'raw_stale', status: 409, reason: 'stale' };
     }
     /** @type {any} */
     let row;
     try {
       row = JSON.parse(bytes.toString('utf8'));
     } catch {
-      context.logger.warn('miniapp.trajectory.read_error', { reason: 'raw_unparseable' });
-      sendError(response, 409, 'raw_stale', '该记录所在的文件已变化，请重新加载会话');
-      return;
+      return { error: 'raw_stale', status: 409, reason: 'unparseable' };
     }
     if (!row || typeof row !== 'object') {
+      return { error: 'record_not_found', status: 404, reason: 'not_object' };
+    }
+    return { row, sizeBytes: bytes.length };
+  };
+
+  const handleRaw = async (response, url) => {
+    const ctx = await resolveTrajectoryRequest(url);
+    if (!ctx.ok) {
+      sendError(response, ctx.status, ctx.code, ctx.message);
+      return;
+    }
+    const wanted = Number.parseInt(url.searchParams.get('index') ?? '', 10);
+    if (!Number.isInteger(wanted) || wanted < 1) {
+      sendError(response, 400, 'record_index_required', '缺少记录序号');
+      return;
+    }
+    const cached = trajectoryCache.get(ctx.cacheKey);
+    if (!cached) {
+      sendError(response, 503, 'trajectory_not_cached', '会话数据已释放，请重新加载');
+      return;
+    }
+    // Re-reading a record the reader has already opened is the common case, and a decoded message
+    // is far smaller than a session, so the entry keeps the ones it has already paid for.
+    const alreadyDecoded = cached.decoded.get(wanted);
+    if (alreadyDecoded !== undefined) {
+      sendJson(response, 200, { index: wanted, raw: alreadyDecoded.value, omitted: alreadyDecoded.omitted });
+      return;
+    }
+    const locator = cached.raws.get(wanted);
+    if (locator === undefined || typeof locator.filePath !== 'string') {
       sendError(response, 404, 'record_not_found', '找不到该记录');
       return;
     }
+    const found = await readRecordRow(locator);
+    if ('error' in found) {
+      context.logger.warn('miniapp.trajectory.read_error', { reason: `raw_${found.reason}` });
+      sendError(response, found.status, found.error, found.error === 'raw_stale'
+        ? '该记录所在的文件已变化，请重新加载会话'
+        : '找不到该记录');
+      return;
+    }
     // The one place the untouched message is materialised, for one record, on request. The
     // size verdict travels with it because the page has to be able to say "omitted" rather
     // than silently show something else — see tests/verify-raw-lazy.mjs.
-    const built = buildRawPayload(row.message, redact);
+    const built = buildRawPayload(found.row.message, redact);
     cached.decoded.set(wanted, built);
     while (cached.decoded.size > RAW_DECODE_CACHE_ENTRIES) {
       const oldest = cached.decoded.keys().next();
@@ -3664,6 +3864,13 @@ export async function start(context) {
       });
       return;
     }
+    if (url.pathname === '/api/trajectory/record') {
+      void handleRecord(response, url).catch((error) => {
+        context.logger.error('miniapp.trajectory.read_error', { reason: 'record_failed', code: errorCode(error) });
+        sendError(response, 500, 'trajectory_unreadable', '记录详情暂时无法读取');
+      });
+      return;
+    }
     if (url.pathname === '/api/trajectory/raw') {
       void handleRaw(response, url).catch((error) => {
         context.logger.error('miniapp.trajectory.read_error', { reason: 'raw_failed', code: errorCode(error) });
diff --git a/plugins/avatasia/mmc-trajectory/tests/client-check.mjs b/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
index dd5e230..7f5b07f 100644
--- a/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
@@ -227,14 +227,18 @@ assert('signature changes with counts', sigA !== sandbox.signatureOf(payload));
 
 /* handoff markdown */
 const turn = { id: 't1', index: 3 };
+// No `error` field any more: it was the same string as `result`, set only when `isError` was already
+// true, and it no longer rides along on the row at all. The message comes from the record-detail
+// read and is passed in, so the fixture passes it in too.
 const failing = {
   kind: 'toolCall', index: 42, toolName: 'read', toolCallId: 'call_bb89',
   timestamp: 1791603931971, relativeMs: 887, durationMs: null, isError: true,
-  error: 'boom <b>x</b>', model: 'MiniMax-M3.1-Flash-Preview', provider: 'minimax',
+  model: 'MiniMax-M3.1-Flash-Preview', provider: 'minimax',
   api: 'anthropic-messages', stopReason: 'toolUse', textTruncated: true,
   tokens: { input: 10, output: 5, cacheRead: 0, cacheWrite: 0, totalTokens: 15 },
   arguments: { path: 'a.txt' }
 };
+const ERROR_TEXT = 'boom <b>x</b>';
 const raw = sandbox.truncateJson({ blob: 'x'.repeat(20000) }, sandbox.HANDOFF_RAW_LIMIT);
 check('truncateJson caps at 8000', raw.text.length, 8000);
 check('truncateJson flags', raw.truncated, true);
@@ -244,13 +248,18 @@ check('truncateJson small', sandbox.truncateJson({ a: 1 }, 8000).truncated, fals
 // tests/verify-raw-lazy.mjs).
 // The markdown therefore takes the verdict as its own argument, and this asserts that a
 // caller who passes it still gets the line — and that one who does not, gets silence.
-const md = sandbox.buildHandoffMarkdown({ id: 'mvs_1', label: '测试会话' }, turn, failing, raw.text, raw.truncated, true);
-const mdWithoutVerdict = sandbox.buildHandoffMarkdown({ id: 'mvs_1', label: '测试会话' }, turn, failing, raw.text, raw.truncated);
+const md = sandbox.buildHandoffMarkdown({ id: 'mvs_1', label: '测试会话' }, turn, failing, raw.text, raw.truncated, true, ERROR_TEXT);
+const mdWithoutVerdict = sandbox.buildHandoffMarkdown({ id: 'mvs_1', label: '测试会话' }, turn, failing, raw.text, raw.truncated, undefined, ERROR_TEXT);
 assert('md omits the flag when no verdict was passed', !mdWithoutVerdict.includes('原文过大已被省略'));
 assert('md locates turn', md.includes('第 3 轮'));
 assert('md locates record', md.includes('#42'));
 assert('md names kind', md.includes('工具调用'));
-assert('md marks failure', md.includes('状态：失败') && md.includes('boom <b>x</b>'));
+assert('md marks failure', md.includes('状态：失败') && md.includes(ERROR_TEXT));
+// The detail read is allowed to fail on its own so the report still goes out. Saying so beats a
+// line reading 「失败」 with nothing after it, which reads as "the tool said nothing".
+const mdWithoutError = sandbox.buildHandoffMarkdown({ id: 'mvs_1', label: '测试会话' }, turn, failing, raw.text, raw.truncated, true);
+assert('md still reports the failure when the error text did not arrive', mdWithoutError.includes('状态：失败'));
+assert('and says the text is missing rather than printing an empty value', mdWithoutError.includes('（错误信息未能读取）'));
 assert('md renders null duration as dash', md.includes('耗时：—'));
 assert('md notes truncation', md.includes('已截断到 8000 字符'));
 assert('md notes flags', md.includes('原文过大已被省略') && md.includes('正文已被上游截断'));
@@ -424,7 +433,16 @@ const checks = [
   ['has --mcode-* tokens', (html.match(/--mcode-/g) || []).length > 40],
   ['no --dsw-* leakage', !/--dsw-/.test(html)],
   ['no remote font family names', !/JetBrains|Inter['"]?\s*,|@font-face/.test(html)],
-  ['innerHTML only on pre via jsonColorize', (html.match(/\.innerHTML/g) || []).length === 2],
+  // This used to be `(html.match(/\.innerHTML/g) || []).length === 2` — a count wearing a
+  // property's name. It failed the moment a third legitimate `jsonColorize` call was added, and
+  // it would have passed just as happily if one of the two had been deleted and the other turned
+  // into an injection. The property is the rule: every one of them writes through jsonColorize,
+  // and only onto a <pre>.
+  ['innerHTML only on pre via jsonColorize',
+    [...html.matchAll(/([A-Za-z_$][\w$]*)\.innerHTML\s*=\s*([^;\n]*)/g)]
+      .length > 0
+    && [...html.matchAll(/([A-Za-z_$][\w$]*)\.innerHTML\s*=\s*([^;\n]*)/g)]
+      .every((m) => m[1] === 'pre' && /jsonColorize\(/.test(m[2]))],
   ['lang zh-CN', /<html lang="zh-CN">/.test(html)],
   ['title 会话轨迹', /<title>会话轨迹<\/title>/.test(html)],
   ['AbortController used', /new AbortController\(\)/.test(html)],
diff --git a/plugins/avatasia/mmc-trajectory/tests/fixtures/trajectory.json b/plugins/avatasia/mmc-trajectory/tests/fixtures/trajectory.json
index bb73481..66d5034 100644
--- a/plugins/avatasia/mmc-trajectory/tests/fixtures/trajectory.json
+++ b/plugins/avatasia/mmc-trajectory/tests/fixtures/trajectory.json
@@ -1 +1 @@
-{"session":{"id":"mvs_00000000000000000000000000000001","label":"fixture text-000w placeholder","messageCount":60,"turnCount":23,"startedAt":1791603931910,"lastActiveAt":1750000480000,"sizeBytes":37267,"truncated":false,"maxMessageBytes":67108864,"generation":null,"generations":[],"orphans":[],"activeGeneration":null,"stitched":false,"binding":"fixture","leased":false},"stats":{"messages":60,"userMessages":2,"assistantMessages":32,"toolCalls":31,"toolResults":22,"thinkingBlocks":18,"injectedBlocks":3,"compactions":1,"turns":23,"turnsWithPrompt":2,"continuationTurns":1,"qaTurns":0,"openTurns":1,"steers":0,"compactionTurns":1,"turnsWithoutPrompt":19,"errors":3,"tokens":{"input":357272,"output":15279,"cacheRead":5571539,"cacheWrite":0,"totalTokens":5944090},"durationMs":23640047,"messagesAll":60},"turns":[{"id":"turn-001","index":1,"startedAt":1791603931910,"endedAt":1791605485479,"durationMs":1553569,"toolCalls":8,"errors":1,"tokens":{"input":53826,"output":2224,"cacheRead":1175168,"cacheWrite":0,"totalTokens":1231218},"turnClass":"prompt","askedReader":false,"closed":true,"records":[{"id":"msg-0000","turnId":"turn-001","role":"user","generation":null,"timestamp":1791603931910,"responseId":null,"relativeMs":0,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":null,"raw":{"role":"user","content":[{"type":"text","text":"<system-reminder>\nfixture injected-0001 block"}],"timestamp":1791603931910,"canonicalTextRange":{"startOffset":5109,"endOffset":5722}},"rawOmitted":false,"textTruncated":false,"index":1,"text":"<system-reminder>\nfixture injected-0001 block","thinking":null,"arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"system","title":"injected","summary":"<system-reminder> fixture injected-0001 block"},{"id":"msg-0002","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791603931971,"responseId":"fixture text-0009 placeholder","relativeMs":61,"durationMs":null,"toolName":null,"toolCallId":null,"model":"fixture text-0008 placeholder","provider":"fixture text-0007 placeholder","api":"fixture text-0006 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-0003 placeholder","thinkingSignature":"fixture text-0004 placeholder"},{"type":"text","text":"fixture text-0005 placeholder"},{"type":"toolCall","id":"call_0000","name":"tool_00","arguments":{"name":"tool_01"}}],"api":"fixture text-0006 placeholder","provider":"fixture text-0007 placeholder","model":"fixture text-0008 placeholder","usage":{"input":44829,"output":432,"cacheRead":4224,"cacheWrite":0,"totalTokens":49485,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791603931971,"responseId":"fixture text-0009 placeholder"},"rawOmitted":false,"textTruncated":false,"index":2,"text":null,"thinking":"fixture text-0003 placeholder","arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-0003 placeholder"},{"id":"msg-0002","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791603931971,"responseId":"fixture text-0009 placeholder","relativeMs":61,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":44829,"output":432,"cacheRead":4224,"cacheWrite":0,"totalTokens":49485},"model":"fixture text-0008 placeholder","provider":"fixture text-0007 placeholder","api":"fixture text-0006 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-0003 placeholder","thinkingSignature":"fixture text-0004 placeholder"},{"type":"text","text":"fixture text-0005 placeholder"},{"type":"toolCall","id":"call_0000","name":"tool_00","arguments":{"name":"tool_01"}}],"api":"fixture text-0006 placeholder","provider":"fixture text-0007 placeholder","model":"fixture text-0008 placeholder","usage":{"input":44829,"output":432,"cacheRead":4224,"cacheWrite":0,"totalTokens":49485,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791603931971,"responseId":"fixture text-0009 placeholder"},"rawOmitted":false,"textTruncated":false,"index":3,"text":"fixture text-0005 placeholder","thinking":null,"arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"narration","title":"assistant","summary":"fixture text-0005 placeholder"},{"id":"msg-0002","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791603931971,"responseId":"fixture text-0009 placeholder","relativeMs":61,"durationMs":11257,"toolName":"tool_00","toolCallId":"call_0000","model":"fixture text-0008 placeholder","provider":"fixture text-0007 placeholder","api":"fixture text-0006 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-0003 placeholder","thinkingSignature":"fixture text-0004 placeholder"},{"type":"text","text":"fixture text-0005 placeholder"},{"type":"toolCall","id":"call_0000","name":"tool_00","arguments":{"name":"tool_01"}}],"api":"fixture text-0006 placeholder","provider":"fixture text-0007 placeholder","model":"fixture text-0008 placeholder","usage":{"input":44829,"output":432,"cacheRead":4224,"cacheWrite":0,"totalTokens":49485,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791603931971,"responseId":"fixture text-0009 placeholder"},"rawOmitted":false,"textTruncated":false,"index":4,"text":null,"thinking":null,"arguments":{"name":"tool_01"},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_00","summary":"tool_00{name=\"tool_01\"} → fixture text-000b placeholder","argumentsOmitted":false},{"id":"msg-000a","turnId":"turn-001","role":"toolResult","generation":null,"timestamp":1791603943228,"responseId":null,"relativeMs":11318,"durationMs":11257,"toolName":"tool_00","toolCallId":"call_0000","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"raw":{"role":"toolResult","toolCallId":"call_0000","toolName":"tool_00","content":[{"type":"text","text":"fixture text-000b placeholder"}],"details":{"kind":"skill","skill":"fixture text-000c placeholder","found":true,"readable":true,"owner":"fixture text-000d placeholder","source":"fixture text-000e placeholder","location":"fixture text-000f placeholder"},"isError":false,"timestamp":1791603943228},"rawOmitted":false,"textTruncated":false,"index":5,"text":null,"thinking":null,"arguments":null,"result":"fixture text-000b placeholder","error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_00","summary":"fixture text-000b placeholder"},{"id":"msg-000g","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791604127714,"responseId":"fixture text-000o placeholder","relativeMs":195804,"durationMs":null,"toolName":null,"toolCallId":null,"model":"fixture text-000n placeholder","provider":"fixture text-000m placeholder","api":"fixture text-000l placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-000h placeholder","thinkingSignature":"fixture text-000i placeholder"},{"type":"text","text":"fixture text-000j placeholder"},{"type":"toolCall","id":"call_0001","name":"tool_02","arguments":{"task_id":"fixture text-000k placeholder"}}],"api":"fixture text-000l placeholder","provider":"fixture text-000m placeholder","model":"fixture text-000n placeholder","usage":{"input":4210,"output":82,"cacheRead":76544,"cacheWrite":0,"totalTokens":80836,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791604127714,"responseId":"fixture text-000o placeholder"},"rawOmitted":false,"textTruncated":false,"index":6,"text":null,"thinking":"fixture text-000h placeholder","arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-000h placeholder"},{"id":"msg-000g","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791604127714,"responseId":"fixture text-000o placeholder","relativeMs":195804,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":4210,"output":82,"cacheRead":76544,"cacheWrite":0,"totalTokens":80836},"model":"fixture text-000n placeholder","provider":"fixture text-000m placeholder","api":"fixture text-000l placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-000h placeholder","thinkingSignature":"fixture text-000i placeholder"},{"type":"text","text":"fixture text-000j placeholder"},{"type":"toolCall","id":"call_0001","name":"tool_02","arguments":{"task_id":"fixture text-000k placeholder"}}],"api":"fixture text-000l placeholder","provider":"fixture text-000m placeholder","model":"fixture text-000n placeholder","usage":{"input":4210,"output":82,"cacheRead":76544,"cacheWrite":0,"totalTokens":80836,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791604127714,"responseId":"fixture text-000o placeholder"},"rawOmitted":false,"textTruncated":false,"index":7,"text":"fixture text-000j placeholder","thinking":null,"arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"narration","title":"assistant","summary":"fixture text-000j placeholder"},{"id":"msg-000g","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791604127714,"responseId":"fixture text-000o placeholder","relativeMs":195804,"durationMs":null,"toolName":"tool_02","toolCallId":"call_0001","model":"fixture text-000n placeholder","provider":"fixture text-000m placeholder","api":"fixture text-000l placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-000h placeholder","thinkingSignature":"fixture text-000i placeholder"},{"type":"text","text":"fixture text-000j placeholder"},{"type":"toolCall","id":"call_0001","name":"tool_02","arguments":{"task_id":"fixture text-000k placeholder"}}],"api":"fixture text-000l placeholder","provider":"fixture text-000m placeholder","model":"fixture text-000n placeholder","usage":{"input":4210,"output":82,"cacheRead":76544,"cacheWrite":0,"totalTokens":80836,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791604127714,"responseId":"fixture text-000o placeholder"},"rawOmitted":false,"textTruncated":false,"index":8,"text":null,"thinking":null,"arguments":{"task_id":"fixture text-000k placeholder"},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_02","summary":"tool_02{task_id=\"fixture text-000k placeholder\"}","argumentsOmitted":false},{"id":"msg-000p","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791604504788,"responseId":"fixture text-000u placeholder","relativeMs":572878,"durationMs":null,"toolName":"tool_02","toolCallId":"call_0002","tokens":{"input":268,"output":62,"cacheRead":102144,"cacheWrite":0,"totalTokens":102474},"model":"fixture text-000t placeholder","provider":"fixture text-000s placeholder","api":"fixture text-000r placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"toolCall","id":"call_0002","name":"tool_02","arguments":{"task_id":"fixture text-000q placeholder","wait_ms":30000}}],"api":"fixture text-000r placeholder","provider":"fixture text-000s placeholder","model":"fixture text-000t placeholder","usage":{"input":268,"output":62,"cacheRead":102144,"cacheWrite":0,"totalTokens":102474,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791604504788,"responseId":"fixture text-000u placeholder"},"rawOmitted":false,"textTruncated":false,"index":9,"text":null,"thinking":null,"arguments":{"task_id":"fixture text-000q placeholder","wait_ms":30000},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_02","summary":"tool_02{task_id=\"fixture text-000q placeholder\", wait_ms=\"30000\"}","argumentsOmitted":false},{"id":"msg-000v","turnId":"turn-001","role":"user","generation":null,"timestamp":1791604626776,"responseId":null,"relativeMs":694866,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":null,"raw":{"role":"user","content":"fixture text-000w placeholder","timestamp":1791604626776},"rawOmitted":false,"textTruncated":false,"index":10,"text":"fixture text-000w placeholder","thinking":null,"arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"user","title":"user","summary":"fixture text-000w placeholder","steered":false},{"id":"msg-000x","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791604764455,"responseId":"fixture text-0013 placeholder","relativeMs":832545,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0003","tokens":{"input":2672,"output":61,"cacheRead":113536,"cacheWrite":0,"totalTokens":116269},"model":"fixture text-0012 placeholder","provider":"fixture text-0011 placeholder","api":"fixture text-0010 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"toolCall","id":"call_0003","name":"tool_03","arguments":{"command":"fixture text-000y placeholder","description":"fixture text-000z placeholder"}}],"api":"fixture text-0010 placeholder","provider":"fixture text-0011 placeholder","model":"fixture text-0012 placeholder","usage":{"input":2672,"output":61,"cacheRead":113536,"cacheWrite":0,"totalTokens":116269,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791604764455,"responseId":"fixture text-0013 placeholder"},"rawOmitted":false,"textTruncated":false,"index":11,"text":null,"thinking":null,"arguments":{"command":"fixture text-000y placeholder","description":"fixture text-000z placeholder"},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-000y placeholder\", description=\"fixture text-000z placeholder\"}","argumentsOmitted":false},{"id":"msg-0014","turnId":"turn-001","role":"toolResult","generation":null,"timestamp":1791604879414,"responseId":null,"relativeMs":947504,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0004","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":true,"raw":{"role":"toolResult","toolCallId":"call_0004","toolName":"tool_03","content":[{"type":"text","text":"fixture text-0015 placeholder"}],"details":{"execution":{"status":"fixture text-0016 placeholder","reason":"fixture text-0017 placeholder","exitCode":1,"message":"fixture text-0018 placeholder"},"timing":{"commandTimeoutSeconds":3600,"commandTimerStartedAt":1791604878663,"commandDeadlineAt":1791608478663},"output":{"rawBytes":644,"persistence":"fixture text-0019 placeholder","omittedBytes":0},"processOutput":{"stdout":"fixture text-001a placeholder","stderr":"fixture text-001b placeholder","exitCode":1,"interrupted":false,"stdoutTruncated":false,"stderrTruncated":false,"rawOutputPath":"fixture text-001c placeholder"},"description":"fixture text-001d placeholder","fullOutputPath":"fixture text-001e placeholder","status":"fixture text-001f placeholder","task_id":"fixture text-001g placeholder","is_error":true},"isError":true,"timestamp":1791604879414},"rawOmitted":false,"textTruncated":false,"index":12,"text":null,"thinking":null,"arguments":null,"result":"fixture text-0015 placeholder","error":"fixture text-0015 placeholder","tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_03","summary":"fixture text-0015 placeholder"},{"id":"msg-001h","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791604894030,"responseId":"fixture text-001n placeholder","relativeMs":962120,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0005","tokens":{"input":142,"output":107,"cacheRead":135424,"cacheWrite":0,"totalTokens":135673},"model":"fixture text-001m placeholder","provider":"fixture text-001l placeholder","api":"fixture text-001k placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"toolCall","id":"call_0005","name":"tool_03","arguments":{"command":"fixture text-001i placeholder","description":"fixture text-001j placeholder"}}],"api":"fixture text-001k placeholder","provider":"fixture text-001l placeholder","model":"fixture text-001m placeholder","usage":{"input":142,"output":107,"cacheRead":135424,"cacheWrite":0,"totalTokens":135673,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791604894030,"responseId":"fixture text-001n placeholder"},"rawOmitted":false,"textTruncated":false,"index":13,"text":null,"thinking":null,"arguments":{"command":"fixture text-001i placeholder","description":"fixture text-001j placeholder"},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-001i placeholder\", description=\"fixture text-001j placeholder\"}","argumentsOmitted":false},{"id":"msg-001o","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791605044287,"responseId":"fixture text-001u placeholder","relativeMs":1112377,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0006","tokens":{"input":714,"output":176,"cacheRead":167040,"cacheWrite":0,"totalTokens":167930},"model":"fixture text-001t placeholder","provider":"fixture text-001s placeholder","api":"fixture text-001r placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"toolCall","id":"call_0006","name":"tool_03","arguments":{"command":"fixture text-001p placeholder","description":"fixture text-001q placeholder"}}],"api":"fixture text-001r placeholder","provider":"fixture text-001s placeholder","model":"fixture text-001t placeholder","usage":{"input":714,"output":176,"cacheRead":167040,"cacheWrite":0,"totalTokens":167930,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791605044287,"responseId":"fixture text-001u placeholder"},"rawOmitted":false,"textTruncated":false,"index":14,"text":null,"thinking":null,"arguments":{"command":"fixture text-001p placeholder","description":"fixture text-001q placeholder"},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-001p placeholder\", description=\"fixture text-001q placeholder\"}","argumentsOmitted":false},{"id":"msg-001v","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791605219170,"responseId":"fixture text-0023 placeholder","relativeMs":1287260,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":832,"output":316,"cacheRead":178688,"cacheWrite":0,"totalTokens":179836},"model":"fixture text-0022 placeholder","provider":"fixture text-0021 placeholder","api":"fixture text-0020 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-001w placeholder","thinkingSignature":"fixture text-001x placeholder"},{"type":"toolCall","id":"call_0007","name":"tool_04","arguments":{"action":"fixture text-001y placeholder","input":{"kind":"text","maxChars":600,"selector":"fixture text-001z placeholder"}}}],"api":"fixture text-0020 placeholder","provider":"fixture text-0021 placeholder","model":"fixture text-0022 placeholder","usage":{"input":832,"output":316,"cacheRead":178688,"cacheWrite":0,"totalTokens":179836,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791605219170,"responseId":"fixture text-0023 placeholder"},"rawOmitted":false,"textTruncated":false,"index":15,"text":null,"thinking":"fixture text-001w placeholder","arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-001w placeholder"},{"id":"msg-001v","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791605219170,"responseId":"fixture text-0023 placeholder","relativeMs":1287260,"durationMs":null,"toolName":"tool_04","toolCallId":"call_0007","model":"fixture text-0022 placeholder","provider":"fixture text-0021 placeholder","api":"fixture text-0020 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-001w placeholder","thinkingSignature":"fixture text-001x placeholder"},{"type":"toolCall","id":"call_0007","name":"tool_04","arguments":{"action":"fixture text-001y placeholder","input":{"kind":"text","maxChars":600,"selector":"fixture text-001z placeholder"}}}],"api":"fixture text-0020 placeholder","provider":"fixture text-0021 placeholder","model":"fixture text-0022 placeholder","usage":{"input":832,"output":316,"cacheRead":178688,"cacheWrite":0,"totalTokens":179836,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791605219170,"responseId":"fixture text-0023 placeholder"},"rawOmitted":false,"textTruncated":false,"index":16,"text":null,"thinking":null,"arguments":{"action":"fixture text-001y placeholder","input":{"kind":"text","maxChars":600,"selector":"fixture text-001z placeholder"}},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_04","summary":"tool_04{action=\"fixture text-001y placeholder\", input=\"{…}\"}","argumentsOmitted":false},{"id":"msg-0024","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791605423541,"responseId":"fixture text-002c placeholder","relativeMs":1491631,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":100,"output":91,"cacheRead":194176,"cacheWrite":0,"totalTokens":194367},"model":"fixture text-002b placeholder","provider":"fixture text-002a placeholder","api":"fixture text-0029 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-0025 placeholder","thinkingSignature":"fixture text-0026 placeholder"},{"type":"toolCall","id":"call_0008","name":"tool_04","arguments":{"action":"fixture text-0027 placeholder","input":{"selector":"fixture text-0028 placeholder"}}}],"api":"fixture text-0029 placeholder","provider":"fixture text-002a placeholder","model":"fixture text-002b placeholder","usage":{"input":100,"output":91,"cacheRead":194176,"cacheWrite":0,"totalTokens":194367,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791605423541,"responseId":"fixture text-002c placeholder"},"rawOmitted":false,"textTruncated":false,"index":17,"text":null,"thinking":"fixture text-0025 placeholder","arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-0025 placeholder"},{"id":"msg-0024","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791605423541,"responseId":"fixture text-002c placeholder","relativeMs":1491631,"durationMs":null,"toolName":"tool_04","toolCallId":"call_0008","model":"fixture text-002b placeholder","provider":"fixture text-002a placeholder","api":"fixture text-0029 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-0025 placeholder","thinkingSignature":"fixture text-0026 placeholder"},{"type":"toolCall","id":"call_0008","name":"tool_04","arguments":{"action":"fixture text-0027 placeholder","input":{"selector":"fixture text-0028 placeholder"}}}],"api":"fixture text-0029 placeholder","provider":"fixture text-002a placeholder","model":"fixture text-002b placeholder","usage":{"input":100,"output":91,"cacheRead":194176,"cacheWrite":0,"totalTokens":194367,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791605423541,"responseId":"fixture text-002c placeholder"},"rawOmitted":false,"textTruncated":false,"index":18,"text":null,"thinking":null,"arguments":{"action":"fixture text-0027 placeholder","input":{"selector":"fixture text-0028 placeholder"}},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_04","summary":"tool_04{action=\"fixture text-0027 placeholder\", input=\"{…}\"}","argumentsOmitted":false},{"id":"msg-002d","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791605485479,"responseId":"fixture text-002i placeholder","relativeMs":1553569,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":59,"output":897,"cacheRead":203392,"cacheWrite":0,"totalTokens":204348},"model":"fixture text-002h placeholder","provider":"fixture text-002g placeholder","api":"fixture text-002f placeholder","stopReason":"stop","isError":null,"raw":{"role":"assistant","content":[{"type":"text","text":"fixture text-002e placeholder"}],"api":"fixture text-002f placeholder","provider":"fixture text-002g placeholder","model":"fixture text-002h placeholder","usage":{"input":59,"output":897,"cacheRead":203392,"cacheWrite":0,"totalTokens":204348,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"stop","timestamp":1791605485479,"responseId":"fixture text-002i placeholder"},"rawOmitted":false,"textTruncated":false,"index":19,"text":"fixture text-002e placeholder","thinking":null,"arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"reply","title":"assistant","summary":"fixture text-002e placeholder"}]},{"id":"turn-002","index":2,"startedAt":1791605691616,"endedAt":1791605691616,"durationMs":0,"toolCalls":1,"errors":0,"tokens":{"input":1658,"output":69,"cacheRead":210432,"cacheWrite":0,"totalTokens":212159},"turnClass":"none","askedReader":false,"closed":false,"records":[{"id":"msg-002j","turnId":"turn-002","role":"assistant","generation":null,"timestamp":1791605691616,"responseId":"fixture text-002o placeholder","relativeMs":1759706,"durationMs":null,"toolName":"tool_05","toolCallId":"call_0009","tokens":{"input":1658,"output":69,"cacheRead":210432,"cacheWrite":0,"totalTokens":212159},"model":"fixture text-002n placeholder","provider":"fixture text-002m placeholder","api":"fixture text-002l placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"toolCall","id":"call_0009","name":"tool_05","arguments":{"limit":30,"offset":1618,"path":"fixture text-002k placeholder"}}],"api":"fixture text-002l placeholder","provider":"fixture text-002m placeholder","model":"fixture text-002n placeholder","usage":{"input":1658,"output":69,"cacheRead":210432,"cacheWrite":0,"totalTokens":212159,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791605691616,"responseId":"fixture text-002o placeholder"},"rawOmitted":false,"textTruncated":false,"index":20,"text":null,"thinking":null,"arguments":{"limit":30,"offset":1618,"path":"fixture text-002k placeholder"},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_05","summary":"tool_05{limit=\"30\", offset=\"1618\", path=\"fixture text-002k placeholder\"}","argumentsOmitted":false}]},{"id":"turn-003","index":3,"startedAt":1791606195742,"endedAt":1791606432109,"durationMs":236367,"toolCalls":1,"errors":0,"tokens":{"input":2260,"output":2251,"cacheRead":220800,"cacheWrite":0,"totalTokens":225311},"turnClass":"none","askedReader":false,"closed":false,"records":[{"id":"msg-002p","turnId":"turn-003","role":"assistant","generation":null,"timestamp":1791606195742,"responseId":"fixture text-003b placeholder","relativeMs":2263832,"durationMs":null,"toolName":null,"toolCallId":null,"model":"fixture text-003a placeholder","provider":"fixture text-0039 placeholder","api":"fixture text-0038 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-002q placeholder","thinkingSignature":"fixture text-002r placeholder"},{"type":"text","text":"fixture text-002s placeholder"},{"type":"toolCall","id":"call_0010","name":"tool_06","arguments":{"todos":[{"content":"fixture text-002t placeholder","priority":"fixture text-002u placeholder","status":"fixture text-002v placeholder"},{"content":"fixture text-002w placeholder","priority":"fixture text-002x placeholder","status":"fixture text-002y placeholder"},{"content":"fixture text-002z placeholder","priority":"fixture text-0030 placeholder","status":"fixture text-0031 placeholder"},{"content":"fixture text-0032 placeholder","priority":"fixture text-0033 placeholder","status":"fixture text-0034 placeholder"},{"content":"fixture text-0035 placeholder","priority":"fixture text-0036 placeholder","status":"fixture text-0037 placeholder"}]}}],"api":"fixture text-0038 placeholder","provider":"fixture text-0039 placeholder","model":"fixture text-003a placeholder","usage":{"input":2260,"output":2251,"cacheRead":220800,"cacheWrite":0,"totalTokens":225311,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791606195742,"responseId":"fixture text-003b placeholder"},"rawOmitted":false,"textTruncated":false,"index":21,"text":null,"thinking":"fixture text-002q placeholder","arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-002q placeholder"},{"id":"msg-002p","turnId":"turn-003","role":"assistant","generation":null,"timestamp":1791606195742,"responseId":"fixture text-003b placeholder","relativeMs":2263832,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":2260,"output":2251,"cacheRead":220800,"cacheWrite":0,"totalTokens":225311},"model":"fixture text-003a placeholder","provider":"fixture text-0039 placeholder","api":"fixture text-0038 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-002q placeholder","thinkingSignature":"fixture text-002r placeholder"},{"type":"text","text":"fixture text-002s placeholder"},{"type":"toolCall","id":"call_0010","name":"tool_06","arguments":{"todos":[{"content":"fixture text-002t placeholder","priority":"fixture text-002u placeholder","status":"fixture text-002v placeholder"},{"content":"fixture text-002w placeholder","priority":"fixture text-002x placeholder","status":"fixture text-002y placeholder"},{"content":"fixture text-002z placeholder","priority":"fixture text-0030 placeholder","status":"fixture text-0031 placeholder"},{"content":"fixture text-0032 placeholder","priority":"fixture text-0033 placeholder","status":"fixture text-0034 placeholder"},{"content":"fixture text-0035 placeholder","priority":"fixture text-0036 placeholder","status":"fixture text-0037 placeholder"}]}}],"api":"fixture text-0038 placeholder","provider":"fixture text-0039 placeholder","model":"fixture text-003a placeholder","usage":{"input":2260,"output":2251,"cacheRead":220800,"cacheWrite":0,"totalTokens":225311,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791606195742,"responseId":"fixture text-003b placeholder"},"rawOmitted":false,"textTruncated":false,"index":22,"text":"fixture text-002s placeholder","thinking":null,"arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"narration","title":"assistant","summary":"fixture text-002s placeholder"},{"id":"msg-002p","turnId":"turn-003","role":"assistant","generation":null,"timestamp":1791606195742,"responseId":"fixture text-003b placeholder","relativeMs":2263832,"durationMs":null,"toolName":"tool_06","toolCallId":"call_0010","model":"fixture text-003a placeholder","provider":"fixture text-0039 placeholder","api":"fixture text-0038 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-002q placeholder","thinkingSignature":"fixture text-002r placeholder"},{"type":"text","text":"fixture text-002s placeholder"},{"type":"toolCall","id":"call_0010","name":"tool_06","arguments":{"todos":[{"content":"fixture text-002t placeholder","priority":"fixture text-002u placeholder","status":"fixture text-002v placeholder"},{"content":"fixture text-002w placeholder","priority":"fixture text-002x placeholder","status":"fixture text-002y placeholder"},{"content":"fixture text-002z placeholder","priority":"fixture text-0030 placeholder","status":"fixture text-0031 placeholder"},{"content":"fixture text-0032 placeholder","priority":"fixture text-0033 placeholder","status":"fixture text-0034 placeholder"},{"content":"fixture text-0035 placeholder","priority":"fixture text-0036 placeholder","status":"fixture text-0037 placeholder"}]}}],"api":"fixture text-0038 placeholder","provider":"fixture text-0039 placeholder","model":"fixture text-003a placeholder","usage":{"input":2260,"output":2251,"cacheRead":220800,"cacheWrite":0,"totalTokens":225311,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791606195742,"responseId":"fixture text-003b placeholder"},"rawOmitted":false,"textTruncated":false,"index":23,"text":null,"thinking":null,"arguments":{"todos":[{"content":"fixture text-002t placeholder","priority":"fixture text-002u placeholder","status":"fixture text-002v placeholder"},{"content":"fixture text-002w placeholder","priority":"fixture text-002x placeholder","status":"fixture text-002y placeholder"},{"content":"fixture text-002z placeholder","priority":"fixture text-0030 placeholder","status":"fixture text-0031 placeholder"},{"content":"fixture text-0032 placeholder","priority":"fixture text-0033 placeholder","status":"fixture text-0034 placeholder"},{"content":"fixture text-0035 placeholder","priority":"fixture text-0036 placeholder","status":"fixture text-0037 placeholder"}]},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_06","summary":"tool_06{todos=\"[{…}, {…}, {…}, …]\"}","argumentsOmitted":false},{"id":"msg-003c","turnId":"turn-003","role":"toolResult","generation":null,"timestamp":1791606432109,"responseId":null,"relativeMs":2500199,"durationMs":null,"toolName":"tool_07","toolCallId":"call_0011","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"raw":{"role":"toolResult","toolCallId":"call_0011","toolName":"tool_07","content":[{"type":"text","text":"fixture text-003d placeholder"}],"details":{"created":true,"bytes_written":1777,"encoding":"fixture text-003e placeholder","bom":false},"isError":false,"timestamp":1791606432109},"rawOmitted":false,"textTruncated":false,"index":24,"text":null,"thinking":null,"arguments":null,"result":"fixture text-003d placeholder","error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_07","summary":"fixture text-003d placeholder"}]},{"id":"turn-004","index":4,"startedAt":1791610762301,"endedAt":1791611180154,"durationMs":417853,"toolCalls":2,"errors":0,"tokens":{"input":258453,"output":1164,"cacheRead":277120,"cacheWrite":0,"totalTokens":536737},"turnClass":"none","askedReader":false,"closed":false,"records":[{"id":"msg-003f","turnId":"turn-004","role":"assistant","generation":null,"timestamp":1791610762301,"responseId":"fixture text-003l placeholder","relativeMs":6830391,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0012","tokens":{"input":254227,"output":405,"cacheRead":4224,"cacheWrite":0,"totalTokens":258856},"model":"fixture text-003k placeholder","provider":"fixture text-003j placeholder","api":"fixture text-003i placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"toolCall","id":"call_0012","name":"tool_03","arguments":{"command":"fixture text-003g placeholder","description":"fixture text-003h placeholder"}}],"api":"fixture text-003i placeholder","provider":"fixture text-003j placeholder","model":"fixture text-003k placeholder","usage":{"input":254227,"output":405,"cacheRead":4224,"cacheWrite":0,"totalTokens":258856,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791610762301,"responseId":"fixture text-003l placeholder"},"rawOmitted":false,"textTruncated":false,"index":25,"text":null,"thinking":null,"arguments":{"command":"fixture text-003g placeholder","description":"fixture text-003h placeholder"},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-003g placeholder\", description=\"fixture text-003h placeholder\"}","argumentsOmitted":false},{"id":"msg-003m","turnId":"turn-004","role":"toolResult","generation":null,"timestamp":1791610983663,"responseId":null,"relativeMs":7051753,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0013","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"raw":{"role":"toolResult","toolCallId":"call_0013","toolName":"tool_03","content":[{"type":"text","text":"fixture text-003n placeholder"}],"details":{"execution":{"status":"fixture text-003o placeholder","reason":"fixture text-003p placeholder","exitCode":0},"timing":{"commandTimeoutSeconds":3600,"commandTimerStartedAt":1791610981057,"commandDeadlineAt":1791614581057},"output":{"rawBytes":218,"persistence":"fixture text-003q placeholder","omittedBytes":0},"processOutput":{"stdout":"fixture text-003r placeholder","stderr":"fixture text-003s placeholder","exitCode":0,"interrupted":false,"stdoutTruncated":false,"stderrTruncated":false,"rawOutputPath":"fixture text-003t placeholder"},"description":"fixture text-003u placeholder","fullOutputPath":"fixture text-003v placeholder","status":"fixture text-003w placeholder","task_id":"fixture text-003x placeholder"},"isError":false,"timestamp":1791610983663},"rawOmitted":false,"textTruncated":false,"index":26,"text":null,"thinking":null,"arguments":null,"result":"fixture text-003n placeholder","error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_03","summary":"fixture text-003n placeholder"},{"id":"msg-003y","turnId":"turn-004","role":"assistant","generation":null,"timestamp":1791611180154,"responseId":"fixture text-0048 placeholder","relativeMs":7248244,"durationMs":null,"toolName":null,"toolCallId":null,"model":"fixture text-0047 placeholder","provider":"fixture text-0046 placeholder","api":"fixture text-0045 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-003z placeholder","thinkingSignature":"fixture text-0040 placeholder"},{"type":"text","text":"fixture text-0041 placeholder"},{"type":"toolCall","id":"call_0014","name":"tool_08","arguments":{"file_path":"fixture text-0042 placeholder","new_string":"fixture text-0043 placeholder","old_string":"fixture text-0044 placeholder"}}],"api":"fixture text-0045 placeholder","provider":"fixture text-0046 placeholder","model":"fixture text-0047 placeholder","usage":{"input":4226,"output":759,"cacheRead":272896,"cacheWrite":0,"totalTokens":277881,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791611180154,"responseId":"fixture text-0048 placeholder"},"rawOmitted":false,"textTruncated":false,"index":27,"text":null,"thinking":"fixture text-003z placeholder","arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-003z placeholder"},{"id":"msg-003y","turnId":"turn-004","role":"assistant","generation":null,"timestamp":1791611180154,"responseId":"fixture text-0048 placeholder","relativeMs":7248244,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":4226,"output":759,"cacheRead":272896,"cacheWrite":0,"totalTokens":277881},"model":"fixture text-0047 placeholder","provider":"fixture text-0046 placeholder","api":"fixture text-0045 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-003z placeholder","thinkingSignature":"fixture text-0040 placeholder"},{"type":"text","text":"fixture text-0041 placeholder"},{"type":"toolCall","id":"call_0014","name":"tool_08","arguments":{"file_path":"fixture text-0042 placeholder","new_string":"fixture text-0043 placeholder","old_string":"fixture text-0044 placeholder"}}],"api":"fixture text-0045 placeholder","provider":"fixture text-0046 placeholder","model":"fixture text-0047 placeholder","usage":{"input":4226,"output":759,"cacheRead":272896,"cacheWrite":0,"totalTokens":277881,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791611180154,"responseId":"fixture text-0048 placeholder"},"rawOmitted":false,"textTruncated":false,"index":28,"text":"fixture text-0041 placeholder","thinking":null,"arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"narration","title":"assistant","summary":"fixture text-0041 placeholder"},{"id":"msg-003y","turnId":"turn-004","role":"assistant","generation":null,"timestamp":1791611180154,"responseId":"fixture text-0048 placeholder","relativeMs":7248244,"durationMs":null,"toolName":"tool_08","toolCallId":"call_0014","model":"fixture text-0047 placeholder","provider":"fixture text-0046 placeholder","api":"fixture text-0045 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-003z placeholder","thinkingSignature":"fixture text-0040 placeholder"},{"type":"text","text":"fixture text-0041 placeholder"},{"type":"toolCall","id":"call_0014","name":"tool_08","arguments":{"file_path":"fixture text-0042 placeholder","new_string":"fixture text-0043 placeholder","old_string":"fixture text-0044 placeholder"}}],"api":"fixture text-0045 placeholder","provider":"fixture text-0046 placeholder","model":"fixture text-0047 placeholder","usage":{"input":4226,"output":759,"cacheRead":272896,"cacheWrite":0,"totalTokens":277881,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791611180154,"responseId":"fixture text-0048 placeholder"},"rawOmitted":false,"textTruncated":false,"index":29,"text":null,"thinking":null,"arguments":{"file_path":"fixture text-0042 placeholder","new_string":"fixture text-0043 placeholder","old_string":"fixture text-0044 placeholder"},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_08","summary":"tool_08{file_path=\"fixture text-0042 placeholder\", new_string=\"fixture text-0043 placeholder\", old_string=\"fixture text-0044 placeholder\"}","argumentsOmitted":false}]},{"id":"turn-005","index":5,"startedAt":1791611784883,"endedAt":1791611784883,"durationMs":0,"toolCalls":0,"errors":0,"tokens":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"totalTokens":0},"turnClass":"none","askedReader":false,"closed":false,"records":[{"id":"msg-0049","turnId":"turn-005","role":"toolResult","generation":null,"timestamp":1791611784883,"responseId":null,"relativeMs":7852973,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0015","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"raw":{"role":"toolResult","toolCallId":"call_0015","toolName":"tool_03","content":[{"type":"text","text":"fixture text-004a placeholder"}],"details":{"execution":{"status":"fixture text-004b placeholder","reason":"fixture text-004c placeholder","exitCode":0},"timing":{"commandTimeoutSeconds":3600,"commandTimerStartedAt":1791611784292,"commandDeadlineAt":1791615384292},"output":{"rawBytes":1402,"persistence":"fixture text-004d placeholder","omittedBytes":0},"processOutput":{"stdout":"fixture text-004e placeholder","stderr":"fixture text-004f placeholder","exitCode":0,"interrupted":false,"stdoutTruncated":false,"stderrTruncated":false,"rawOutputPath":"fixture text-004g placeholder"},"description":"fixture text-004h placeholder","fullOutputPath":"fixture text-004i placeholder","envSanitized":["fixture text-004j placeholder","fixture text-004k placeholder","fixture text-004l placeholder","fixture text-004m placeholder","fixture text-004n placeholder"],"status":"fixture text-004o placeholder","task_id":"fixture text-004p placeholder"},"isError":false,"timestamp":1791611784883},"rawOmitted":false,"textTruncated":false,"index":30,"text":null,"thinking":null,"arguments":null,"result":"fixture text-004a placeholder","error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_03","summary":"fixture text-004a placeholder"}]},{"id":"turn-006","index":6,"startedAt":1791612294290,"endedAt":1791612294290,"durationMs":0,"toolCalls":0,"errors":0,"tokens":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"totalTokens":0},"turnClass":"none","askedReader":false,"closed":false,"records":[{"id":"msg-004q","turnId":"turn-006","role":"toolResult","generation":null,"timestamp":1791612294290,"responseId":null,"relativeMs":8362380,"durationMs":null,"toolName":"tool_07","toolCallId":"call_0016","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"raw":{"role":"toolResult","toolCallId":"call_0016","toolName":"tool_07","content":[{"type":"text","text":"fixture text-004r placeholder"}],"details":{"created":true,"bytes_written":384,"encoding":"fixture text-004s placeholder","bom":false},"isError":false,"timestamp":1791612294290},"rawOmitted":false,"textTruncated":false,"index":31,"text":null,"thinking":null,"arguments":null,"result":"fixture text-004r placeholder","error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_07","summary":"fixture text-004r placeholder"}]},{"id":"turn-007","index":7,"startedAt":1791613412089,"endedAt":1791613412089,"durationMs":0,"toolCalls":0,"errors":0,"tokens":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"totalTokens":0},"turnClass":"compaction","askedReader":false,"closed":false,"records":[{"id":"msg-004t","turnId":"turn-007","role":"compactionSummary","generation":null,"timestamp":1791613412089,"responseId":null,"relativeMs":9480179,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":null,"raw":{"role":"compactionSummary","summary":"fixture text-004u placeholder","tokensBefore":365642,"timestamp":1791613412089},"rawOmitted":false,"textTruncated":false,"index":32,"text":"fixture text-004u placeholder","thinking":null,"arguments":null,"result":null,"error":null,"tokensBefore":365642,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"compaction","title":"compaction","summary":"fixture text-004u placeholder"}]},{"id":"turn-008","index":8,"startedAt":1791613490565,"endedAt":1791613490565,"durationMs":0,"toolCalls":2,"errors":0,"tokens":{"input":2171,"output":429,"cacheRead":54272,"cacheWrite":0,"totalTokens":56872},"turnClass":"none","askedReader":false,"closed":false,"records":[{"id":"msg-004v","turnId":"turn-008","role":"assistant","generation":null,"timestamp":1791613490565,"responseId":"fixture text-0058 placeholder","relativeMs":9558655,"durationMs":null,"toolName":null,"toolCallId":null,"model":"fixture text-0057 placeholder","provider":"fixture text-0056 placeholder","api":"fixture text-0055 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-004w placeholder","thinkingSignature":"fixture text-004x placeholder"},{"type":"text","text":"fixture text-004y placeholder"},{"type":"toolCall","id":"call_0017","name":"tool_09","arguments":{"pattern":"fixture text-004z placeholder","path":"fixture text-0050 placeholder","output_mode":"fixture text-0051 placeholder"}},{"type":"toolCall","id":"call_0018","name":"tool_09","arguments":{"pattern":"fixture text-0052 placeholder","path":"fixture text-0053 placeholder","output_mode":"fixture text-0054 placeholder","limit":30}}],"api":"fixture text-0055 placeholder","provider":"fixture text-0056 placeholder","model":"fixture text-0057 placeholder","usage":{"input":2171,"output":429,"cacheRead":54272,"cacheWrite":0,"totalTokens":56872,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791613490565,"responseId":"fixture text-0058 placeholder"},"rawOmitted":false,"textTruncated":false,"index":33,"text":null,"thinking":"fixture text-004w placeholder","arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-004w placeholder"},{"id":"msg-004v","turnId":"turn-008","role":"assistant","generation":null,"timestamp":1791613490565,"responseId":"fixture text-0058 placeholder","relativeMs":9558655,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":2171,"output":429,"cacheRead":54272,"cacheWrite":0,"totalTokens":56872},"model":"fixture text-0057 placeholder","provider":"fixture text-0056 placeholder","api":"fixture text-0055 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-004w placeholder","thinkingSignature":"fixture text-004x placeholder"},{"type":"text","text":"fixture text-004y placeholder"},{"type":"toolCall","id":"call_0017","name":"tool_09","arguments":{"pattern":"fixture text-004z placeholder","path":"fixture text-0050 placeholder","output_mode":"fixture text-0051 placeholder"}},{"type":"toolCall","id":"call_0018","name":"tool_09","arguments":{"pattern":"fixture text-0052 placeholder","path":"fixture text-0053 placeholder","output_mode":"fixture text-0054 placeholder","limit":30}}],"api":"fixture text-0055 placeholder","provider":"fixture text-0056 placeholder","model":"fixture text-0057 placeholder","usage":{"input":2171,"output":429,"cacheRead":54272,"cacheWrite":0,"totalTokens":56872,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791613490565,"responseId":"fixture text-0058 placeholder"},"rawOmitted":false,"textTruncated":false,"index":34,"text":"fixture text-004y placeholder","thinking":null,"arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"narration","title":"assistant","summary":"fixture text-004y placeholder"},{"id":"msg-004v","turnId":"turn-008","role":"assistant","generation":null,"timestamp":1791613490565,"responseId":"fixture text-0058 placeholder","relativeMs":9558655,"durationMs":null,"toolName":"tool_09","toolCallId":"call_0017","model":"fixture text-0057 placeholder","provider":"fixture text-0056 placeholder","api":"fixture text-0055 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-004w placeholder","thinkingSignature":"fixture text-004x placeholder"},{"type":"text","text":"fixture text-004y placeholder"},{"type":"toolCall","id":"call_0017","name":"tool_09","arguments":{"pattern":"fixture text-004z placeholder","path":"fixture text-0050 placeholder","output_mode":"fixture text-0051 placeholder"}},{"type":"toolCall","id":"call_0018","name":"tool_09","arguments":{"pattern":"fixture text-0052 placeholder","path":"fixture text-0053 placeholder","output_mode":"fixture text-0054 placeholder","limit":30}}],"api":"fixture text-0055 placeholder","provider":"fixture text-0056 placeholder","model":"fixture text-0057 placeholder","usage":{"input":2171,"output":429,"cacheRead":54272,"cacheWrite":0,"totalTokens":56872,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791613490565,"responseId":"fixture text-0058 placeholder"},"rawOmitted":false,"textTruncated":false,"index":35,"text":null,"thinking":null,"arguments":{"pattern":"fixture text-004z placeholder","path":"fixture text-0050 placeholder","output_mode":"fixture text-0051 placeholder"},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_09","summary":"tool_09{pattern=\"fixture text-004z placeholder\", path=\"fixture text-0050 placeholder\", output_mode=\"fixture text-0051 placeholder\"}","argumentsOmitted":false},{"id":"msg-004v","turnId":"turn-008","role":"assistant","generation":null,"timestamp":1791613490565,"responseId":"fixture text-0058 placeholder","relativeMs":9558655,"durationMs":null,"toolName":"tool_09","toolCallId":"call_0018","model":"fixture text-0057 placeholder","provider":"fixture text-0056 placeholder","api":"fixture text-0055 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-004w placeholder","thinkingSignature":"fixture text-004x placeholder"},{"type":"text","text":"fixture text-004y placeholder"},{"type":"toolCall","id":"call_0017","name":"tool_09","arguments":{"pattern":"fixture text-004z placeholder","path":"fixture text-0050 placeholder","output_mode":"fixture text-0051 placeholder"}},{"type":"toolCall","id":"call_0018","name":"tool_09","arguments":{"pattern":"fixture text-0052 placeholder","path":"fixture text-0053 placeholder","output_mode":"fixture text-0054 placeholder","limit":30}}],"api":"fixture text-0055 placeholder","provider":"fixture text-0056 placeholder","model":"fixture text-0057 placeholder","usage":{"input":2171,"output":429,"cacheRead":54272,"cacheWrite":0,"totalTokens":56872,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791613490565,"responseId":"fixture text-0058 placeholder"},"rawOmitted":false,"textTruncated":false,"index":36,"text":null,"thinking":null,"arguments":{"pattern":"fixture text-0052 placeholder","path":"fixture text-0053 placeholder","output_mode":"fixture text-0054 placeholder","limit":30},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_09","summary":"tool_09{pattern=\"fixture text-0052 placeholder\", path=\"fixture text-0053 placeholder\", output_mode=\"fixture text-0054 placeholder\", limit=\"30\"}","argumentsOmitted":false}]},{"id":"turn-009","index":9,"startedAt":1791614563489,"endedAt":1791614731831,"durationMs":168342,"toolCalls":1,"errors":0,"tokens":{"input":634,"output":1426,"cacheRead":120019,"cacheWrite":0,"totalTokens":122079},"turnClass":"none","askedReader":false,"closed":false,"records":[{"id":"msg-0059","turnId":"turn-009","role":"toolResult","generation":null,"timestamp":1791614563489,"responseId":null,"relativeMs":10631579,"durationMs":null,"toolName":"tool_09","toolCallId":"call_0019","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"raw":{"role":"toolResult","toolCallId":"call_0019","toolName":"tool_09","content":[{"type":"text","text":"fixture text-005a placeholder"}],"details":{},"isError":false,"timestamp":1791614563489},"rawOmitted":false,"textTruncated":false,"index":37,"text":null,"thinking":null,"arguments":null,"result":"fixture text-005a placeholder","error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_09","summary":"fixture text-005a placeholder"},{"id":"msg-005b","turnId":"turn-009","role":"assistant","generation":null,"timestamp":1791614731831,"responseId":"fixture text-005j placeholder","relativeMs":10799921,"durationMs":null,"toolName":null,"toolCallId":null,"model":"fixture text-005i placeholder","provider":"fixture text-005h placeholder","api":"fixture text-005g placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-005c placeholder","thinkingSignature":"fixture text-005d placeholder"},{"type":"text","text":"fixture text-005e placeholder"},{"type":"toolCall","id":"call_0020","name":"tool_05","arguments":{"path":"fixture text-005f placeholder","limit":14}}],"api":"fixture text-005g placeholder","provider":"fixture text-005h placeholder","model":"fixture text-005i placeholder","usage":{"input":634,"output":1426,"cacheRead":120019,"cacheWrite":0,"totalTokens":122079,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791614731831,"responseId":"fixture text-005j placeholder"},"rawOmitted":false,"textTruncated":false,"index":38,"text":null,"thinking":"fixture text-005c placeholder","arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-005c placeholder"},{"id":"msg-005b","turnId":"turn-009","role":"assistant","generation":null,"timestamp":1791614731831,"responseId":"fixture text-005j placeholder","relativeMs":10799921,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":634,"output":1426,"cacheRead":120019,"cacheWrite":0,"totalTokens":122079},"model":"fixture text-005i placeholder","provider":"fixture text-005h placeholder","api":"fixture text-005g placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-005c placeholder","thinkingSignature":"fixture text-005d placeholder"},{"type":"text","text":"fixture text-005e placeholder"},{"type":"toolCall","id":"call_0020","name":"tool_05","arguments":{"path":"fixture text-005f placeholder","limit":14}}],"api":"fixture text-005g placeholder","provider":"fixture text-005h placeholder","model":"fixture text-005i placeholder","usage":{"input":634,"output":1426,"cacheRead":120019,"cacheWrite":0,"totalTokens":122079,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791614731831,"responseId":"fixture text-005j placeholder"},"rawOmitted":false,"textTruncated":false,"index":39,"text":"fixture text-005e placeholder","thinking":null,"arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"narration","title":"assistant","summary":"fixture text-005e placeholder"},{"id":"msg-005b","turnId":"turn-009","role":"assistant","generation":null,"timestamp":1791614731831,"responseId":"fixture text-005j placeholder","relativeMs":10799921,"durationMs":null,"toolName":"tool_05","toolCallId":"call_0020","model":"fixture text-005i placeholder","provider":"fixture text-005h placeholder","api":"fixture text-005g placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-005c placeholder","thinkingSignature":"fixture text-005d placeholder"},{"type":"text","text":"fixture text-005e placeholder"},{"type":"toolCall","id":"call_0020","name":"tool_05","arguments":{"path":"fixture text-005f placeholder","limit":14}}],"api":"fixture text-005g placeholder","provider":"fixture text-005h placeholder","model":"fixture text-005i placeholder","usage":{"input":634,"output":1426,"cacheRead":120019,"cacheWrite":0,"totalTokens":122079,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791614731831,"responseId":"fixture text-005j placeholder"},"rawOmitted":false,"textTruncated":false,"index":40,"text":null,"thinking":null,"arguments":{"path":"fixture text-005f placeholder","limit":14},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_05","summary":"tool_05{path=\"fixture text-005f placeholder\", limit=\"14\"}","argumentsOmitted":false}]},{"id":"turn-010","index":10,"startedAt":1791615045716,"endedAt":1791615045716,"durationMs":0,"toolCalls":0,"errors":0,"tokens":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"totalTokens":0},"turnClass":"prompt","askedReader":false,"closed":false,"records":[{"id":"msg-005k","turnId":"turn-010","role":"user","generation":null,"timestamp":1791615045716,"responseId":null,"relativeMs":11113806,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":null,"raw":{"role":"user","content":[{"type":"text","text":"fixture text-005l placeholder"}],"timestamp":1791615045716,"canonicalTextRange":{"startOffset":0,"endOffset":10},"hostMetadata":{"immediateSendBatchId":"fixture text-005m placeholder"}},"rawOmitted":false,"textTruncated":false,"index":41,"text":"fixture te","thinking":null,"arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"user","title":"user","summary":"fixture te","steered":false}]},{"id":"turn-011","index":11,"startedAt":1791615477302,"endedAt":1791615904587,"durationMs":427285,"toolCalls":0,"errors":0,"tokens":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"totalTokens":0},"turnClass":"none","askedReader":false,"closed":false,"records":[{"id":"msg-005n","turnId":"turn-011","role":"toolResult","generation":null,"timestamp":1791615477302,"responseId":null,"relativeMs":11545392,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0021","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"raw":{"role":"toolResult","toolCallId":"call_0021","toolName":"tool_03","content":[{"type":"text","text":"fixture text-005o placeholder"}],"details":{"execution":{"status":"fixture text-005p placeholder","reason":"fixture text-005q placeholder","exitCode":0},"timing":{"commandTimeoutSeconds":3600,"commandTimerStartedAt":1791615476257,"commandDeadlineAt":1791619076257},"output":{"rawBytes":557,"persistence":"fixture text-005r placeholder","omittedBytes":0},"processOutput":{"stdout":"fixture text-005s placeholder","stderr":"fixture text-005t placeholder","exitCode":0,"interrupted":false,"stdoutTruncated":false,"stderrTruncated":false,"rawOutputPath":"fixture text-005u placeholder"},"description":"fixture text-005v placeholder","fullOutputPath":"fixture text-005w placeholder","status":"fixture text-005x placeholder","task_id":"fixture text-005y placeholder"},"isError":false,"timestamp":1791615477302},"rawOmitted":false,"textTruncated":false,"index":42,"text":null,"thinking":null,"arguments":null,"result":"fixture text-005o placeholder","error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_03","summary":"fixture text-005o placeholder"},{"id":"msg-005z","turnId":"turn-011","role":"toolResult","generation":null,"timestamp":1791615904587,"responseId":null,"relativeMs":11972677,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0022","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"raw":{"role":"toolResult","toolCallId":"call_0022","toolName":"tool_03","content":[{"type":"text","text":"fixture text-0060 placeholder"}],"details":{"execution":{"status":"fixture text-0061 placeholder","reason":"fixture text-0062 placeholder","exitCode":0},"timing":{"commandTimeoutSeconds":3600,"commandTimerStartedAt":1791615900851,"commandDeadlineAt":1791619500851},"output":{"rawBytes":634,"persistence":"fixture text-0063 placeholder","omittedBytes":0},"processOutput":{"stdout":"fixture text-0064 placeholder","stderr":"fixture text-0065 placeholder","exitCode":0,"interrupted":false,"stdoutTruncated":false,"stderrTruncated":false,"rawOutputPath":"fixture text-0066 placeholder"},"description":"fixture text-0067 placeholder","fullOutputPath":"fixture text-0068 placeholder","status":"fixture text-0069 placeholder","task_id":"fixture text-006a placeholder"},"isError":false,"timestamp":1791615904587},"rawOmitted":false,"textTruncated":false,"index":43,"text":null,"thinking":null,"arguments":null,"result":"fixture text-0060 placeholder","error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_03","summary":"fixture text-0060 placeholder"}]},{"id":"turn-012","index":12,"startedAt":1791616197977,"endedAt":1791616341161,"durationMs":143184,"toolCalls":1,"errors":0,"tokens":{"input":806,"output":332,"cacheRead":215296,"cacheWrite":0,"totalTokens":216434},"turnClass":"none","askedReader":false,"closed":false,"records":[{"id":"msg-006b","turnId":"turn-012","role":"assistant","generation":null,"timestamp":1791616197977,"responseId":"fixture text-006i placeholder","relativeMs":12266067,"durationMs":null,"toolName":"tool_08","toolCallId":"call_0023","tokens":{"input":806,"output":332,"cacheRead":215296,"cacheWrite":0,"totalTokens":216434},"model":"fixture text-006h placeholder","provider":"fixture text-006g placeholder","api":"fixture text-006f placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"toolCall","id":"call_0023","name":"tool_08","arguments":{"file_path":"fixture text-006c placeholder","new_string":"fixture text-006d placeholder","old_string":"fixture text-006e placeholder"}}],"api":"fixture text-006f placeholder","provider":"fixture text-006g placeholder","model":"fixture text-006h placeholder","usage":{"input":806,"output":332,"cacheRead":215296,"cacheWrite":0,"totalTokens":216434,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791616197977,"responseId":"fixture text-006i placeholder"},"rawOmitted":false,"textTruncated":false,"index":44,"text":null,"thinking":null,"arguments":{"file_path":"fixture text-006c placeholder","new_string":"fixture text-006d placeholder","old_string":"fixture text-006e placeholder"},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_08","summary":"tool_08{file_path=\"fixture text-006c placeholder\", new_string=\"fixture text-006d placeholder\", old_string=\"fixture text-006e placeholder\"}","argumentsOmitted":false},{"id":"msg-006j","turnId":"turn-012","role":"toolResult","generation":null,"timestamp":1791616341161,"responseId":null,"relativeMs":12409251,"durationMs":null,"toolName":"tool_08","toolCallId":"call_0024","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"raw":{"role":"toolResult","toolCallId":"call_0024","toolName":"tool_08","content":[{"type":"text","text":"fixture text-006k placeholder"}],"details":{"diff":"fixture text-006l placeholder","patch":"fixture text-006m placeholder","firstChangedLine":19},"isError":false,"timestamp":1791616341161},"rawOmitted":false,"textTruncated":false,"index":45,"text":null,"thinking":null,"arguments":null,"result":"fixture text-006k placeholder","error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_08","summary":"fixture text-006k placeholder"}]},{"id":"turn-013","index":13,"startedAt":1791616657094,"endedAt":1791616657094,"durationMs":0,"toolCalls":1,"errors":0,"tokens":{"input":2780,"output":1648,"cacheRead":257536,"cacheWrite":0,"totalTokens":261964},"turnClass":"none","askedReader":false,"closed":false,"records":[{"id":"msg-006n","turnId":"turn-013","role":"assistant","generation":null,"timestamp":1791616657094,"responseId":"fixture text-006w placeholder","relativeMs":12725184,"durationMs":null,"toolName":null,"toolCallId":null,"model":"fixture text-006v placeholder","provider":"fixture text-006u placeholder","api":"fixture text-006t placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-006o placeholder","thinkingSignature":"fixture text-006p placeholder"},{"type":"text","text":"fixture text-006q placeholder"},{"type":"toolCall","id":"call_0025","name":"tool_03","arguments":{"command":"fixture text-006r placeholder","description":"fixture text-006s placeholder","timeout":120}}],"api":"fixture text-006t placeholder","provider":"fixture text-006u placeholder","model":"fixture text-006v placeholder","usage":{"input":2780,"output":1648,"cacheRead":257536,"cacheWrite":0,"totalTokens":261964,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791616657094,"responseId":"fixture text-006w placeholder"},"rawOmitted":false,"textTruncated":false,"index":46,"text":null,"thinking":"fixture text-006o placeholder","arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-006o placeholder"},{"id":"msg-006n","turnId":"turn-013","role":"assistant","generation":null,"timestamp":1791616657094,"responseId":"fixture text-006w placeholder","relativeMs":12725184,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":2780,"output":1648,"cacheRead":257536,"cacheWrite":0,"totalTokens":261964},"model":"fixture text-006v placeholder","provider":"fixture text-006u placeholder","api":"fixture text-006t placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-006o placeholder","thinkingSignature":"fixture text-006p placeholder"},{"type":"text","text":"fixture text-006q placeholder"},{"type":"toolCall","id":"call_0025","name":"tool_03","arguments":{"command":"fixture text-006r placeholder","description":"fixture text-006s placeholder","timeout":120}}],"api":"fixture text-006t placeholder","provider":"fixture text-006u placeholder","model":"fixture text-006v placeholder","usage":{"input":2780,"output":1648,"cacheRead":257536,"cacheWrite":0,"totalTokens":261964,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791616657094,"responseId":"fixture text-006w placeholder"},"rawOmitted":false,"textTruncated":false,"index":47,"text":"fixture text-006q placeholder","thinking":null,"arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"narration","title":"assistant","summary":"fixture text-006q placeholder"},{"id":"msg-006n","turnId":"turn-013","role":"assistant","generation":null,"timestamp":1791616657094,"responseId":"fixture text-006w placeholder","relativeMs":12725184,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0025","model":"fixture text-006v placeholder","provider":"fixture text-006u placeholder","api":"fixture text-006t placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-006o placeholder","thinkingSignature":"fixture text-006p placeholder"},{"type":"text","text":"fixture text-006q placeholder"},{"type":"toolCall","id":"call_0025","name":"tool_03","arguments":{"command":"fixture text-006r placeholder","description":"fixture text-006s placeholder","timeout":120}}],"api":"fixture text-006t placeholder","provider":"fixture text-006u placeholder","model":"fixture text-006v placeholder","usage":{"input":2780,"output":1648,"cacheRead":257536,"cacheWrite":0,"totalTokens":261964,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791616657094,"responseId":"fixture text-006w placeholder"},"rawOmitted":false,"textTruncated":false,"index":48,"text":null,"thinking":null,"arguments":{"command":"fixture text-006r placeholder","description":"fixture text-006s placeholder","timeout":120},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-006r placeholder\", description=\"fixture text-006s placeholder\", timeout=\"120\"}","argumentsOmitted":false}]},{"id":"turn-014","index":14,"startedAt":1791617021128,"endedAt":1791617021128,"durationMs":0,"toolCalls":0,"errors":0,"tokens":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"totalTokens":0},"turnClass":"none","askedReader":false,"closed":false,"records":[{"id":"msg-006x","turnId":"turn-014","role":"toolResult","generation":null,"timestamp":1791617021128,"responseId":null,"relativeMs":13089218,"durationMs":null,"toolName":"tool_07","toolCallId":"call_0026","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"raw":{"role":"toolResult","toolCallId":"call_0026","toolName":"tool_07","content":[{"type":"text","text":"fixture text-006y placeholder"}],"details":{"created":true,"bytes_written":4484,"encoding":"fixture text-006z placeholder","bom":false},"isError":false,"timestamp":1791617021128},"rawOmitted":false,"textTruncated":false,"index":49,"text":null,"thinking":null,"arguments":null,"result":"fixture text-006y placeholder","error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_07","summary":"fixture text-006y placeholder"}]},{"id":"turn-015","index":15,"startedAt":1791617468106,"endedAt":1791617468106,"durationMs":0,"toolCalls":1,"errors":0,"tokens":{"input":1087,"output":70,"cacheRead":312832,"cacheWrite":0,"totalTokens":313989},"turnClass":"none","askedReader":false,"closed":false,"records":[{"id":"msg-0070","turnId":"turn-015","role":"assistant","generation":null,"timestamp":1791617468106,"responseId":"fixture text-0075 placeholder","relativeMs":13536196,"durationMs":null,"toolName":"tool_05","toolCallId":"call_0027","tokens":{"input":1087,"output":70,"cacheRead":312832,"cacheWrite":0,"totalTokens":313989},"model":"fixture text-0074 placeholder","provider":"fixture text-0073 placeholder","api":"fixture text-0072 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"toolCall","id":"call_0027","name":"tool_05","arguments":{"limit":40,"offset":2108,"path":"fixture text-0071 placeholder"}}],"api":"fixture text-0072 placeholder","provider":"fixture text-0073 placeholder","model":"fixture text-0074 placeholder","usage":{"input":1087,"output":70,"cacheRead":312832,"cacheWrite":0,"totalTokens":313989,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791617468106,"responseId":"fixture text-0075 placeholder"},"rawOmitted":false,"textTruncated":false,"index":50,"text":null,"thinking":null,"arguments":{"limit":40,"offset":2108,"path":"fixture text-0071 placeholder"},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_05","summary":"tool_05{limit=\"40\", offset=\"2108\", path=\"fixture text-0071 placeholder\"}","argumentsOmitted":false}]},{"id":"turn-016","index":16,"startedAt":1791617651220,"endedAt":1791618644926,"durationMs":993706,"toolCalls":3,"errors":0,"tokens":{"input":2763,"output":1128,"cacheRead":508160,"cacheWrite":0,"totalTokens":512051},"turnClass":"none","askedReader":false,"closed":false,"records":[{"id":"msg-0076","turnId":"turn-016","role":"user","generation":null,"timestamp":1791617651220,"responseId":null,"relativeMs":13719310,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":null,"raw":{"role":"user","content":[{"type":"text","text":"<system-reminder>\nfixture injected-0077 block"}],"timestamp":1791617651220,"canonicalTextRange":{"startOffset":3003,"endOffset":3066}},"rawOmitted":false,"textTruncated":false,"index":51,"text":"<system-reminder>\nfixture injected-0077 block","thinking":null,"arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"system","title":"injected","summary":"<system-reminder> fixture injected-0077 block"},{"id":"msg-0078","turnId":"turn-016","role":"assistant","generation":null,"timestamp":1791617812028,"responseId":"fixture text-007e placeholder","relativeMs":13880118,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0028","tokens":{"input":859,"output":309,"cacheRead":349952,"cacheWrite":0,"totalTokens":351120},"model":"fixture text-007d placeholder","provider":"fixture text-007c placeholder","api":"fixture text-007b placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"toolCall","id":"call_0028","name":"tool_03","arguments":{"command":"fixture text-0079 placeholder","description":"fixture text-007a placeholder","timeout":240}}],"api":"fixture text-007b placeholder","provider":"fixture text-007c placeholder","model":"fixture text-007d placeholder","usage":{"input":859,"output":309,"cacheRead":349952,"cacheWrite":0,"totalTokens":351120,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791617812028,"responseId":"fixture text-007e placeholder"},"rawOmitted":false,"textTruncated":false,"index":52,"text":null,"thinking":null,"arguments":{"command":"fixture text-0079 placeholder","description":"fixture text-007a placeholder","timeout":240},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-0079 placeholder\", description=\"fixture text-007a placeholder\", timeout=\"240\"}","argumentsOmitted":false},{"id":"msg-007f","turnId":"turn-016","role":"assistant","generation":null,"timestamp":1791618043996,"responseId":"fixture text-007o placeholder","relativeMs":14112086,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":1825,"output":630,"cacheRead":68352,"cacheWrite":0,"totalTokens":70807},"model":"fixture text-007n placeholder","provider":"fixture text-007m placeholder","api":"fixture text-007l placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-007g placeholder","thinkingSignature":"fixture text-007h placeholder"},{"type":"toolCall","id":"call_0029","name":"tool_09","arguments":{"context":2,"limit":8,"output_mode":"fixture text-007i placeholder","path":"fixture text-007j placeholder","pattern":"fixture text-007k placeholder"}}],"api":"fixture text-007l placeholder","provider":"fixture text-007m placeholder","model":"fixture text-007n placeholder","usage":{"input":1825,"output":630,"cacheRead":68352,"cacheWrite":0,"totalTokens":70807,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791618043996,"responseId":"fixture text-007o placeholder"},"rawOmitted":false,"textTruncated":false,"index":53,"text":null,"thinking":"fixture text-007g placeholder","arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-007g placeholder"},{"id":"msg-007f","turnId":"turn-016","role":"assistant","generation":null,"timestamp":1791618043996,"responseId":"fixture text-007o placeholder","relativeMs":14112086,"durationMs":null,"toolName":"tool_09","toolCallId":"call_0029","model":"fixture text-007n placeholder","provider":"fixture text-007m placeholder","api":"fixture text-007l placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-007g placeholder","thinkingSignature":"fixture text-007h placeholder"},{"type":"toolCall","id":"call_0029","name":"tool_09","arguments":{"context":2,"limit":8,"output_mode":"fixture text-007i placeholder","path":"fixture text-007j placeholder","pattern":"fixture text-007k placeholder"}}],"api":"fixture text-007l placeholder","provider":"fixture text-007m placeholder","model":"fixture text-007n placeholder","usage":{"input":1825,"output":630,"cacheRead":68352,"cacheWrite":0,"totalTokens":70807,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791618043996,"responseId":"fixture text-007o placeholder"},"rawOmitted":false,"textTruncated":false,"index":54,"text":null,"thinking":null,"arguments":{"context":2,"limit":8,"output_mode":"fixture text-007i placeholder","path":"fixture text-007j placeholder","pattern":"fixture text-007k placeholder"},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_09","summary":"tool_09{context=\"2\", limit=\"8\", output_mode=\"fixture text-007i placeholder\", path=\"fixture text-007j placeholder\"}","argumentsOmitted":false},{"id":"msg-007p","turnId":"turn-016","role":"toolResult","generation":null,"timestamp":1791618210903,"responseId":null,"relativeMs":14278993,"durationMs":null,"toolName":"tool_05","toolCallId":"call_0030","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"raw":{"role":"toolResult","toolCallId":"call_0030","toolName":"tool_05","content":[{"type":"text","text":"fixture text-007q placeholder"}],"details":{"textFile":{"path":"fixture text-007r placeholder","content":"fixture text-007s placeholder","numLines":14,"startLine":1231,"totalLines":2912,"truncatedByOutputLimit":false,"wholeFileAutoTruncated":false}},"isError":false,"timestamp":1791618210903},"rawOmitted":false,"textTruncated":false,"index":55,"text":null,"thinking":null,"arguments":null,"result":"fixture text-007q placeholder","error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_05","summary":"fixture text-007q placeholder"},{"id":"msg-007t","turnId":"turn-016","role":"assistant","generation":null,"timestamp":1791618408954,"responseId":"fixture text-0081 placeholder","relativeMs":14477044,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":79,"output":189,"cacheRead":89856,"cacheWrite":0,"totalTokens":90124},"model":"fixture text-0080 placeholder","provider":"fixture text-007z placeholder","api":"fixture text-007y placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-007u placeholder","thinkingSignature":"fixture text-007v placeholder"},{"type":"toolCall","id":"call_0031","name":"tool_03","arguments":{"command":"fixture text-007w placeholder","description":"fixture text-007x placeholder","timeout":420}}],"api":"fixture text-007y placeholder","provider":"fixture text-007z placeholder","model":"fixture text-0080 placeholder","usage":{"input":79,"output":189,"cacheRead":89856,"cacheWrite":0,"totalTokens":90124,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791618408954,"responseId":"fixture text-0081 placeholder"},"rawOmitted":false,"textTruncated":false,"index":56,"text":null,"thinking":"fixture text-007u placeholder","arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-007u placeholder"},{"id":"msg-007t","turnId":"turn-016","role":"assistant","generation":null,"timestamp":1791618408954,"responseId":"fixture text-0081 placeholder","relativeMs":14477044,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0031","model":"fixture text-0080 placeholder","provider":"fixture text-007z placeholder","api":"fixture text-007y placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-007u placeholder","thinkingSignature":"fixture text-007v placeholder"},{"type":"toolCall","id":"call_0031","name":"tool_03","arguments":{"command":"fixture text-007w placeholder","description":"fixture text-007x placeholder","timeout":420}}],"api":"fixture text-007y placeholder","provider":"fixture text-007z placeholder","model":"fixture text-0080 placeholder","usage":{"input":79,"output":189,"cacheRead":89856,"cacheWrite":0,"totalTokens":90124,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791618408954,"responseId":"fixture text-0081 placeholder"},"rawOmitted":false,"textTruncated":false,"index":57,"text":null,"thinking":null,"arguments":{"command":"fixture text-007w placeholder","description":"fixture text-007x placeholder","timeout":420},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-007w placeholder\", description=\"fixture text-007x placeholder\", timeout=\"420\"}","argumentsOmitted":false},{"id":"msg-0082","turnId":"turn-016","role":"toolResult","generation":null,"timestamp":1791618644926,"responseId":null,"relativeMs":14713016,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0032","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"raw":{"role":"toolResult","toolCallId":"call_0032","toolName":"tool_03","content":[{"type":"text","text":"fixture text-0083 placeholder"}],"details":{"execution":{"status":"fixture text-0084 placeholder","reason":"fixture text-0085 placeholder","exitCode":0},"timing":{"commandTimeoutSeconds":300,"commandTimerStartedAt":1791618643593,"commandDeadlineAt":1791618943593},"output":{"rawBytes":174,"persistence":"fixture text-0086 placeholder","omittedBytes":0},"processOutput":{"stdout":"fixture text-0087 placeholder","stderr":"fixture text-0088 placeholder","exitCode":0,"interrupted":false,"stdoutTruncated":false,"stderrTruncated":false,"rawOutputPath":"fixture text-0089 placeholder"},"description":"fixture text-008a placeholder","fullOutputPath":"fixture text-008b placeholder","status":"fixture text-008c placeholder","task_id":"fixture text-008d placeholder"},"isError":false,"timestamp":1791618644926},"rawOmitted":false,"textTruncated":false,"index":58,"text":null,"thinking":null,"arguments":null,"result":"fixture text-0083 placeholder","error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_03","summary":"fixture text-0083 placeholder"}]},{"id":"turn-017","index":17,"startedAt":1791619060246,"endedAt":1791620468950,"durationMs":1408704,"toolCalls":3,"errors":2,"tokens":{"input":5055,"output":1798,"cacheRead":466304,"cacheWrite":0,"totalTokens":473157},"turnClass":"none","askedReader":false,"closed":false,"records":[{"id":"msg-008e","turnId":"turn-017","role":"assistant","generation":null,"timestamp":1791619060246,"responseId":"fixture text-008m placeholder","relativeMs":15128336,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":452,"output":939,"cacheRead":118656,"cacheWrite":0,"totalTokens":120047},"model":"fixture text-008l placeholder","provider":"fixture text-008k placeholder","api":"fixture text-008j placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-008f placeholder","thinkingSignature":"fixture text-008g placeholder"},{"type":"toolCall","id":"call_0033","name":"tool_03","arguments":{"command":"fixture text-008h placeholder","description":"fixture text-008i placeholder","timeout":120}}],"api":"fixture text-008j placeholder","provider":"fixture text-008k placeholder","model":"fixture text-008l placeholder","usage":{"input":452,"output":939,"cacheRead":118656,"cacheWrite":0,"totalTokens":120047,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791619060246,"responseId":"fixture text-008m placeholder"},"rawOmitted":false,"textTruncated":false,"index":59,"text":null,"thinking":"fixture text-008f placeholder","arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-008f placeholder"},{"id":"msg-008e","turnId":"turn-017","role":"assistant","generation":null,"timestamp":1791619060246,"responseId":"fixture text-008m placeholder","relativeMs":15128336,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0033","model":"fixture text-008l placeholder","provider":"fixture text-008k placeholder","api":"fixture text-008j placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-008f placeholder","thinkingSignature":"fixture text-008g placeholder"},{"type":"toolCall","id":"call_0033","name":"tool_03","arguments":{"command":"fixture text-008h placeholder","description":"fixture text-008i placeholder","timeout":120}}],"api":"fixture text-008j placeholder","provider":"fixture text-008k placeholder","model":"fixture text-008l placeholder","usage":{"input":452,"output":939,"cacheRead":118656,"cacheWrite":0,"totalTokens":120047,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791619060246,"responseId":"fixture text-008m placeholder"},"rawOmitted":false,"textTruncated":false,"index":60,"text":null,"thinking":null,"arguments":{"command":"fixture text-008h placeholder","description":"fixture text-008i placeholder","timeout":120},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-008h placeholder\", description=\"fixture text-008i placeholder\", timeout=\"120\"}","argumentsOmitted":false},{"id":"msg-008n","turnId":"turn-017","role":"toolResult","generation":null,"timestamp":1791619266573,"responseId":null,"relativeMs":15334663,"durationMs":null,"toolName":"tool_08","toolCallId":"call_0034","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"raw":{"role":"toolResult","toolCallId":"call_0034","toolName":"tool_08","content":[{"type":"text","text":"fixture text-008o placeholder"}],"details":{"diff":"fixture text-008p placeholder","patch":"fixture text-008q placeholder","firstChangedLine":1127},"isError":false,"timestamp":1791619266573},"rawOmitted":false,"textTruncated":false,"index":61,"text":null,"thinking":null,"arguments":null,"result":"fixture text-008o placeholder","error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_08","summary":"fixture text-008o placeholder"},{"id":"msg-008r","turnId":"turn-017","role":"toolResult","generation":null,"timestamp":1791619441758,"responseId":null,"relativeMs":15509848,"durationMs":null,"toolName":"tool_08","toolCallId":"call_0035","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"raw":{"role":"toolResult","toolCallId":"call_0035","toolName":"tool_08","content":[{"type":"text","text":"fixture text-008s placeholder"}],"details":{"diff":"fixture text-008t placeholder","patch":"fixture text-008u placeholder","firstChangedLine":1185},"isError":false,"timestamp":1791619441758},"rawOmitted":false,"textTruncated":false,"index":62,"text":null,"thinking":null,"arguments":null,"result":"fixture text-008s placeholder","error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_08","summary":"fixture text-008s placeholder"},{"id":"msg-008v","turnId":"turn-017","role":"toolResult","generation":null,"timestamp":1791619595453,"responseId":null,"relativeMs":15663543,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0036","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":true,"raw":{"role":"toolResult","toolCallId":"call_0036","toolName":"tool_03","content":[{"type":"text","text":"fixture text-008w placeholder"}],"details":{"execution":{"status":"fixture text-008x placeholder","reason":"fixture text-008y placeholder","exitCode":1,"message":"fixture text-008z placeholder"},"timing":{"commandTimeoutSeconds":180,"commandTimerStartedAt":1791619594718,"commandDeadlineAt":1791619774718},"output":{"rawBytes":929,"persistence":"fixture text-0090 placeholder","omittedBytes":0},"processOutput":{"stdout":"fixture text-0091 placeholder","stderr":"fixture text-0092 placeholder","exitCode":1,"interrupted":false,"stdoutTruncated":false,"stderrTruncated":false,"rawOutputPath":"fixture text-0093 placeholder"},"description":"fixture text-0094 placeholder","fullOutputPath":"fixture text-0095 placeholder","status":"fixture text-0096 placeholder","task_id":"fixture text-0097 placeholder","is_error":true},"isError":true,"timestamp":1791619595453},"rawOmitted":false,"textTruncated":false,"index":63,"text":null,"thinking":null,"arguments":null,"result":"fixture text-008w placeholder","error":"fixture text-008w placeholder","tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_03","summary":"fixture text-008w placeholder"},{"id":"msg-0098","turnId":"turn-017","role":"assistant","generation":null,"timestamp":1791619777303,"responseId":"fixture text-009d placeholder","relativeMs":15845393,"durationMs":null,"toolName":"tool_04","toolCallId":"call_0037","tokens":{"input":3978,"output":36,"cacheRead":162816,"cacheWrite":0,"totalTokens":166830},"model":"fixture text-009c placeholder","provider":"fixture text-009b placeholder","api":"fixture text-009a placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"toolCall","id":"call_0037","name":"tool_04","arguments":{"action":"fixture text-0099 placeholder","input":{}}}],"api":"fixture text-009a placeholder","provider":"fixture text-009b placeholder","model":"fixture text-009c placeholder","usage":{"input":3978,"output":36,"cacheRead":162816,"cacheWrite":0,"totalTokens":166830,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791619777303,"responseId":"fixture text-009d placeholder"},"rawOmitted":false,"textTruncated":false,"index":64,"text":null,"thinking":null,"arguments":{"action":"fixture text-0099 placeholder","input":{}},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_04","summary":"tool_04{action=\"fixture text-0099 placeholder\", input=\"{…}\"}","argumentsOmitted":false},{"id":"msg-009e","turnId":"turn-017","role":"assistant","generation":null,"timestamp":1791620008455,"responseId":"fixture text-009m placeholder","relativeMs":16076545,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":625,"output":823,"cacheRead":184832,"cacheWrite":0,"totalTokens":186280},"model":"fixture text-009l placeholder","provider":"fixture text-009k placeholder","api":"fixture text-009j placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-009f placeholder","thinkingSignature":"fixture text-009g placeholder"},{"type":"toolCall","id":"call_0038","name":"tool_03","arguments":{"command":"fixture text-009h placeholder","description":"fixture text-009i placeholder","timeout":180}}],"api":"fixture text-009j placeholder","provider":"fixture text-009k placeholder","model":"fixture text-009l placeholder","usage":{"input":625,"output":823,"cacheRead":184832,"cacheWrite":0,"totalTokens":186280,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791620008455,"responseId":"fixture text-009m placeholder"},"rawOmitted":false,"textTruncated":false,"index":65,"text":null,"thinking":"fixture text-009f placeholder","arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-009f placeholder"},{"id":"msg-009e","turnId":"turn-017","role":"assistant","generation":null,"timestamp":1791620008455,"responseId":"fixture text-009m placeholder","relativeMs":16076545,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0038","model":"fixture text-009l placeholder","provider":"fixture text-009k placeholder","api":"fixture text-009j placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-009f placeholder","thinkingSignature":"fixture text-009g placeholder"},{"type":"toolCall","id":"call_0038","name":"tool_03","arguments":{"command":"fixture text-009h placeholder","description":"fixture text-009i placeholder","timeout":180}}],"api":"fixture text-009j placeholder","provider":"fixture text-009k placeholder","model":"fixture text-009l placeholder","usage":{"input":625,"output":823,"cacheRead":184832,"cacheWrite":0,"totalTokens":186280,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791620008455,"responseId":"fixture text-009m placeholder"},"rawOmitted":false,"textTruncated":false,"index":66,"text":null,"thinking":null,"arguments":{"command":"fixture text-009h placeholder","description":"fixture text-009i placeholder","timeout":180},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-009h placeholder\", description=\"fixture text-009i placeholder\", timeout=\"180\"}","argumentsOmitted":false},{"id":"msg-009n","turnId":"turn-017","role":"toolResult","generation":null,"timestamp":1791620261774,"responseId":null,"relativeMs":16329864,"durationMs":null,"toolName":"tool_04","toolCallId":"call_0039","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":true,"raw":{"role":"toolResult","toolCallId":"call_0039","toolName":"tool_04","content":[{"type":"text","text":"fixture text-009o placeholder"}],"details":{},"isError":true,"timestamp":1791620261774},"rawOmitted":false,"textTruncated":false,"index":67,"text":null,"thinking":null,"arguments":null,"result":"fixture text-009o placeholder","error":"fixture text-009o placeholder","tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_04","summary":"fixture text-009o placeholder"},{"id":"msg-009p","turnId":"turn-017","role":"toolResult","generation":null,"timestamp":1791620468950,"responseId":null,"relativeMs":16537040,"durationMs":null,"toolName":"tool_10","toolCallId":"call_0040","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"raw":{"role":"toolResult","toolCallId":"call_0040","toolName":"tool_10","content":[{"type":"text","text":"fixture text-009q placeholder"}],"details":{"kind":"memory","ok":true,"target":"fixture text-009r placeholder"},"isError":false,"timestamp":1791620468950},"rawOmitted":false,"textTruncated":false,"index":68,"text":null,"thinking":null,"arguments":null,"result":"fixture text-009q placeholder","error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_10","summary":"fixture text-009q placeholder"}]},{"id":"turn-018","index":18,"startedAt":1791620759811,"endedAt":1791621281924,"durationMs":522113,"toolCalls":1,"errors":0,"tokens":{"input":1473,"output":346,"cacheRead":255104,"cacheWrite":0,"totalTokens":256923},"turnClass":"none","askedReader":false,"closed":false,"records":[{"id":"msg-009s","turnId":"turn-018","role":"toolResult","generation":null,"timestamp":1791620759811,"responseId":null,"relativeMs":16827901,"durationMs":null,"toolName":"tool_08","toolCallId":"call_0041","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"raw":{"role":"toolResult","toolCallId":"call_0041","toolName":"tool_08","content":[{"type":"text","text":"fixture text-009t placeholder"}],"details":{"diff":"fixture text-009u placeholder","patch":"fixture text-009v placeholder","firstChangedLine":1545},"isError":false,"timestamp":1791620759811},"rawOmitted":false,"textTruncated":false,"index":69,"text":null,"thinking":null,"arguments":null,"result":"fixture text-009t placeholder","error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_08","summary":"fixture text-009t placeholder"},{"id":"msg-009w","turnId":"turn-018","role":"assistant","generation":null,"timestamp":1791621014224,"responseId":"fixture text-00a2 placeholder","relativeMs":17082314,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0042","tokens":{"input":1473,"output":346,"cacheRead":255104,"cacheWrite":0,"totalTokens":256923},"model":"fixture text-00a1 placeholder","provider":"fixture text-00a0 placeholder","api":"fixture text-009z placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"toolCall","id":"call_0042","name":"tool_03","arguments":{"command":"fixture text-009x placeholder","description":"fixture text-009y placeholder","timeout":120}}],"api":"fixture text-009z placeholder","provider":"fixture text-00a0 placeholder","model":"fixture text-00a1 placeholder","usage":{"input":1473,"output":346,"cacheRead":255104,"cacheWrite":0,"totalTokens":256923,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791621014224,"responseId":"fixture text-00a2 placeholder"},"rawOmitted":false,"textTruncated":false,"index":70,"text":null,"thinking":null,"arguments":{"command":"fixture text-009x placeholder","description":"fixture text-009y placeholder","timeout":120},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-009x placeholder\", description=\"fixture text-009y placeholder\", timeout=\"120\"}","argumentsOmitted":false},{"id":"msg-00a3","turnId":"turn-018","role":"toolResult","generation":null,"timestamp":1791621281924,"responseId":null,"relativeMs":17350014,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0043","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"raw":{"role":"toolResult","toolCallId":"call_0043","toolName":"tool_03","content":[{"type":"text","text":"fixture text-00a4 placeholder"}],"details":{"execution":{"status":"fixture text-00a5 placeholder","reason":"fixture text-00a6 placeholder","exitCode":0},"timing":{"commandTimeoutSeconds":180,"commandTimerStartedAt":1791621281302,"commandDeadlineAt":1791621461302},"output":{"rawBytes":29,"persistence":"fixture text-00a7 placeholder","omittedBytes":0},"processOutput":{"stdout":"fixture text-00a8 placeholder","stderr":"fixture text-00a9 placeholder","exitCode":0,"interrupted":false,"stdoutTruncated":false,"stderrTruncated":false,"rawOutputPath":"fixture text-00aa placeholder"},"description":"fixture text-00ab placeholder","fullOutputPath":"fixture text-00ac placeholder","status":"fixture text-00ad placeholder","task_id":"fixture text-00ae placeholder"},"isError":false,"timestamp":1791621281924},"rawOmitted":false,"textTruncated":false,"index":71,"text":null,"thinking":null,"arguments":null,"result":"fixture text-00a4 placeholder","error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_03","summary":"fixture text-00a4 placeholder"}]},{"id":"turn-019","index":19,"startedAt":1791621759959,"endedAt":1791622044235,"durationMs":284276,"toolCalls":1,"errors":0,"tokens":{"input":2297,"output":1329,"cacheRead":277632,"cacheWrite":0,"totalTokens":281258},"turnClass":"none","askedReader":false,"closed":false,"records":[{"id":"msg-00af","turnId":"turn-019","role":"assistant","generation":null,"timestamp":1791621759959,"responseId":"fixture text-00an placeholder","relativeMs":17828049,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":2297,"output":1329,"cacheRead":277632,"cacheWrite":0,"totalTokens":281258},"model":"fixture text-00am placeholder","provider":"fixture text-00al placeholder","api":"fixture text-00ak placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-00ag placeholder","thinkingSignature":"fixture text-00ah placeholder"},{"type":"toolCall","id":"call_0044","name":"tool_03","arguments":{"command":"fixture text-00ai placeholder","description":"fixture text-00aj placeholder","timeout":180}}],"api":"fixture text-00ak placeholder","provider":"fixture text-00al placeholder","model":"fixture text-00am placeholder","usage":{"input":2297,"output":1329,"cacheRead":277632,"cacheWrite":0,"totalTokens":281258,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791621759959,"responseId":"fixture text-00an placeholder"},"rawOmitted":false,"textTruncated":false,"index":72,"text":null,"thinking":"fixture text-00ag placeholder","arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-00ag placeholder"},{"id":"msg-00af","turnId":"turn-019","role":"assistant","generation":null,"timestamp":1791621759959,"responseId":"fixture text-00an placeholder","relativeMs":17828049,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0044","model":"fixture text-00am placeholder","provider":"fixture text-00al placeholder","api":"fixture text-00ak placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-00ag placeholder","thinkingSignature":"fixture text-00ah placeholder"},{"type":"toolCall","id":"call_0044","name":"tool_03","arguments":{"command":"fixture text-00ai placeholder","description":"fixture text-00aj placeholder","timeout":180}}],"api":"fixture text-00ak placeholder","provider":"fixture text-00al placeholder","model":"fixture text-00am placeholder","usage":{"input":2297,"output":1329,"cacheRead":277632,"cacheWrite":0,"totalTokens":281258,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791621759959,"responseId":"fixture text-00an placeholder"},"rawOmitted":false,"textTruncated":false,"index":73,"text":null,"thinking":null,"arguments":{"command":"fixture text-00ai placeholder","description":"fixture text-00aj placeholder","timeout":180},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-00ai placeholder\", description=\"fixture text-00aj placeholder\", timeout=\"180\"}","argumentsOmitted":false},{"id":"msg-00ao","turnId":"turn-019","role":"toolResult","generation":null,"timestamp":1791622044235,"responseId":null,"relativeMs":18112325,"durationMs":null,"toolName":"tool_04","toolCallId":"call_0045","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"raw":{"role":"toolResult","toolCallId":"call_0045","toolName":"tool_04","content":[{"type":"text","text":"fixture text-00ap placeholder"}],"details":{"action":"fixture text-00aq placeholder","result":{"success":true,"duration":5000}},"isError":false,"timestamp":1791622044235},"rawOmitted":false,"textTruncated":false,"index":74,"text":null,"thinking":null,"arguments":null,"result":"fixture text-00ap placeholder","error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_04","summary":"fixture text-00ap placeholder"}]},{"id":"turn-020","index":20,"startedAt":1791622638009,"endedAt":1791622638009,"durationMs":0,"toolCalls":1,"errors":0,"tokens":{"input":11033,"output":69,"cacheRead":299264,"cacheWrite":0,"totalTokens":310366},"turnClass":"none","askedReader":false,"closed":false,"records":[{"id":"msg-00ar","turnId":"turn-020","role":"assistant","generation":null,"timestamp":1791622638009,"responseId":"fixture text-00ay placeholder","relativeMs":18706099,"durationMs":null,"toolName":"tool_11","toolCallId":"call_0046","tokens":{"input":11033,"output":69,"cacheRead":299264,"cacheWrite":0,"totalTokens":310366},"model":"fixture text-00ax placeholder","provider":"fixture text-00aw placeholder","api":"fixture text-00av placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"toolCall","id":"call_0046","name":"tool_11","arguments":{"action":"fixture text-00as placeholder","pluginId":"fixture text-00at placeholder","sourcePath":"fixture text-00au placeholder"}}],"api":"fixture text-00av placeholder","provider":"fixture text-00aw placeholder","model":"fixture text-00ax placeholder","usage":{"input":11033,"output":69,"cacheRead":299264,"cacheWrite":0,"totalTokens":310366,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791622638009,"responseId":"fixture text-00ay placeholder"},"rawOmitted":false,"textTruncated":false,"index":75,"text":null,"thinking":null,"arguments":{"action":"fixture text-00as placeholder","pluginId":"fixture text-00at placeholder","sourcePath":"fixture text-00au placeholder"},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_11","summary":"tool_11{action=\"fixture text-00as placeholder\", pluginId=\"fixture text-00at placeholder\", sourcePath=\"fixture text-00au placeholder\"}","argumentsOmitted":false}]},{"id":"turn-021","index":21,"startedAt":1791623384388,"endedAt":1791623384388,"durationMs":0,"toolCalls":1,"errors":0,"tokens":{"input":175,"output":244,"cacheRead":319744,"cacheWrite":0,"totalTokens":320163},"turnClass":"none","askedReader":false,"closed":false,"records":[{"id":"msg-00az","turnId":"turn-021","role":"assistant","generation":null,"timestamp":1791623384388,"responseId":"fixture text-00b8 placeholder","relativeMs":19452478,"durationMs":null,"toolName":null,"toolCallId":null,"model":"fixture text-00b7 placeholder","provider":"fixture text-00b6 placeholder","api":"fixture text-00b5 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-00b0 placeholder","thinkingSignature":"fixture text-00b1 placeholder"},{"type":"text","text":"fixture text-00b2 placeholder"},{"type":"toolCall","id":"call_0047","name":"tool_03","arguments":{"command":"fixture text-00b3 placeholder","description":"fixture text-00b4 placeholder","timeout":300}}],"api":"fixture text-00b5 placeholder","provider":"fixture text-00b6 placeholder","model":"fixture text-00b7 placeholder","usage":{"input":175,"output":244,"cacheRead":319744,"cacheWrite":0,"totalTokens":320163,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791623384388,"responseId":"fixture text-00b8 placeholder"},"rawOmitted":false,"textTruncated":false,"index":76,"text":null,"thinking":"fixture text-00b0 placeholder","arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-00b0 placeholder"},{"id":"msg-00az","turnId":"turn-021","role":"assistant","generation":null,"timestamp":1791623384388,"responseId":"fixture text-00b8 placeholder","relativeMs":19452478,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":175,"output":244,"cacheRead":319744,"cacheWrite":0,"totalTokens":320163},"model":"fixture text-00b7 placeholder","provider":"fixture text-00b6 placeholder","api":"fixture text-00b5 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-00b0 placeholder","thinkingSignature":"fixture text-00b1 placeholder"},{"type":"text","text":"fixture text-00b2 placeholder"},{"type":"toolCall","id":"call_0047","name":"tool_03","arguments":{"command":"fixture text-00b3 placeholder","description":"fixture text-00b4 placeholder","timeout":300}}],"api":"fixture text-00b5 placeholder","provider":"fixture text-00b6 placeholder","model":"fixture text-00b7 placeholder","usage":{"input":175,"output":244,"cacheRead":319744,"cacheWrite":0,"totalTokens":320163,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791623384388,"responseId":"fixture text-00b8 placeholder"},"rawOmitted":false,"textTruncated":false,"index":77,"text":"fixture text-00b2 placeholder","thinking":null,"arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"narration","title":"assistant","summary":"fixture text-00b2 placeholder"},{"id":"msg-00az","turnId":"turn-021","role":"assistant","generation":null,"timestamp":1791623384388,"responseId":"fixture text-00b8 placeholder","relativeMs":19452478,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0047","model":"fixture text-00b7 placeholder","provider":"fixture text-00b6 placeholder","api":"fixture text-00b5 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-00b0 placeholder","thinkingSignature":"fixture text-00b1 placeholder"},{"type":"text","text":"fixture text-00b2 placeholder"},{"type":"toolCall","id":"call_0047","name":"tool_03","arguments":{"command":"fixture text-00b3 placeholder","description":"fixture text-00b4 placeholder","timeout":300}}],"api":"fixture text-00b5 placeholder","provider":"fixture text-00b6 placeholder","model":"fixture text-00b7 placeholder","usage":{"input":175,"output":244,"cacheRead":319744,"cacheWrite":0,"totalTokens":320163,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791623384388,"responseId":"fixture text-00b8 placeholder"},"rawOmitted":false,"textTruncated":false,"index":78,"text":null,"thinking":null,"arguments":{"command":"fixture text-00b3 placeholder","description":"fixture text-00b4 placeholder","timeout":300},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-00b3 placeholder\", description=\"fixture text-00b4 placeholder\", timeout=\"300\"}","argumentsOmitted":false}]},{"id":"turn-022","index":22,"startedAt":1791624351892,"endedAt":1791625062330,"durationMs":710438,"toolCalls":3,"errors":0,"tokens":{"input":9613,"output":670,"cacheRead":334848,"cacheWrite":0,"totalTokens":345131},"turnClass":"none","askedReader":false,"closed":false,"records":[{"id":"msg-00b9","turnId":"turn-022","role":"assistant","generation":null,"timestamp":1791624351892,"responseId":"fixture text-00bi placeholder","relativeMs":20419982,"durationMs":null,"toolName":null,"toolCallId":null,"model":"fixture text-00bh placeholder","provider":"fixture text-00bg placeholder","api":"fixture text-00bf placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-00ba placeholder","thinkingSignature":"fixture text-00bb placeholder"},{"type":"text","text":"fixture text-00bc placeholder"},{"type":"toolCall","id":"call_0048","name":"tool_12","arguments":{"task_id":"fixture text-00bd placeholder","reason":"fixture text-00be placeholder"}}],"api":"fixture text-00bf placeholder","provider":"fixture text-00bg placeholder","model":"fixture text-00bh placeholder","usage":{"input":4906,"output":149,"cacheRead":56576,"cacheWrite":0,"totalTokens":61631,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791624351892,"responseId":"fixture text-00bi placeholder"},"rawOmitted":false,"textTruncated":false,"index":79,"text":null,"thinking":"fixture text-00ba placeholder","arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-00ba placeholder"},{"id":"msg-00b9","turnId":"turn-022","role":"assistant","generation":null,"timestamp":1791624351892,"responseId":"fixture text-00bi placeholder","relativeMs":20419982,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":4906,"output":149,"cacheRead":56576,"cacheWrite":0,"totalTokens":61631},"model":"fixture text-00bh placeholder","provider":"fixture text-00bg placeholder","api":"fixture text-00bf placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-00ba placeholder","thinkingSignature":"fixture text-00bb placeholder"},{"type":"text","text":"fixture text-00bc placeholder"},{"type":"toolCall","id":"call_0048","name":"tool_12","arguments":{"task_id":"fixture text-00bd placeholder","reason":"fixture text-00be placeholder"}}],"api":"fixture text-00bf placeholder","provider":"fixture text-00bg placeholder","model":"fixture text-00bh placeholder","usage":{"input":4906,"output":149,"cacheRead":56576,"cacheWrite":0,"totalTokens":61631,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791624351892,"responseId":"fixture text-00bi placeholder"},"rawOmitted":false,"textTruncated":false,"index":80,"text":"fixture text-00bc placeholder","thinking":null,"arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"narration","title":"assistant","summary":"fixture text-00bc placeholder"},{"id":"msg-00b9","turnId":"turn-022","role":"assistant","generation":null,"timestamp":1791624351892,"responseId":"fixture text-00bi placeholder","relativeMs":20419982,"durationMs":null,"toolName":"tool_12","toolCallId":"call_0048","model":"fixture text-00bh placeholder","provider":"fixture text-00bg placeholder","api":"fixture text-00bf placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-00ba placeholder","thinkingSignature":"fixture text-00bb placeholder"},{"type":"text","text":"fixture text-00bc placeholder"},{"type":"toolCall","id":"call_0048","name":"tool_12","arguments":{"task_id":"fixture text-00bd placeholder","reason":"fixture text-00be placeholder"}}],"api":"fixture text-00bf placeholder","provider":"fixture text-00bg placeholder","model":"fixture text-00bh placeholder","usage":{"input":4906,"output":149,"cacheRead":56576,"cacheWrite":0,"totalTokens":61631,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791624351892,"responseId":"fixture text-00bi placeholder"},"rawOmitted":false,"textTruncated":false,"index":81,"text":null,"thinking":null,"arguments":{"task_id":"fixture text-00bd placeholder","reason":"fixture text-00be placeholder"},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_12","summary":"tool_12{task_id=\"fixture text-00bd placeholder\", reason=\"fixture text-00be placeholder\"}","argumentsOmitted":false},{"id":"msg-00bj","turnId":"turn-022","role":"assistant","generation":null,"timestamp":1791624527065,"responseId":"fixture text-00bq placeholder","relativeMs":20595155,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":4023,"output":283,"cacheRead":98560,"cacheWrite":0,"totalTokens":102866},"model":"fixture text-00bp placeholder","provider":"fixture text-00bo placeholder","api":"fixture text-00bn placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-00bk placeholder","thinkingSignature":"fixture text-00bl placeholder"},{"type":"toolCall","id":"call_0049","name":"tool_02","arguments":{"task_id":"fixture text-00bm placeholder","wait_ms":30000}}],"api":"fixture text-00bn placeholder","provider":"fixture text-00bo placeholder","model":"fixture text-00bp placeholder","usage":{"input":4023,"output":283,"cacheRead":98560,"cacheWrite":0,"totalTokens":102866,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791624527065,"responseId":"fixture text-00bq placeholder"},"rawOmitted":false,"textTruncated":false,"index":82,"text":null,"thinking":"fixture text-00bk placeholder","arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-00bk placeholder"},{"id":"msg-00bj","turnId":"turn-022","role":"assistant","generation":null,"timestamp":1791624527065,"responseId":"fixture text-00bq placeholder","relativeMs":20595155,"durationMs":null,"toolName":"tool_02","toolCallId":"call_0049","model":"fixture text-00bp placeholder","provider":"fixture text-00bo placeholder","api":"fixture text-00bn placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-00bk placeholder","thinkingSignature":"fixture text-00bl placeholder"},{"type":"toolCall","id":"call_0049","name":"tool_02","arguments":{"task_id":"fixture text-00bm placeholder","wait_ms":30000}}],"api":"fixture text-00bn placeholder","provider":"fixture text-00bo placeholder","model":"fixture text-00bp placeholder","usage":{"input":4023,"output":283,"cacheRead":98560,"cacheWrite":0,"totalTokens":102866,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791624527065,"responseId":"fixture text-00bq placeholder"},"rawOmitted":false,"textTruncated":false,"index":83,"text":null,"thinking":null,"arguments":{"task_id":"fixture text-00bm placeholder","wait_ms":30000},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_02","summary":"tool_02{task_id=\"fixture text-00bm placeholder\", wait_ms=\"30000\"}","argumentsOmitted":false},{"id":"msg-00br","turnId":"turn-022","role":"user","generation":null,"timestamp":1791624769221,"responseId":null,"relativeMs":20837311,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":null,"raw":{"role":"user","content":[{"type":"text","text":"<background-task-finished>\nfixture injected-00bs block"}],"timestamp":1791624769221,"canonicalTextRange":{"startOffset":496,"endOffset":496},"hostMetadata":{"backgroundTaskOrigin":{"kind":"background-task-terminal","taskIds":["fixture text-00bt placeholder"],"observedTerminalCount":330}}},"rawOmitted":false,"textTruncated":false,"index":84,"text":"<background-task-finished>\nfixture injected-00bs block","thinking":null,"arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"system","title":"injected","summary":"<background-task-finished> fixture injected-00bs block"},{"id":"msg-00bu","turnId":"turn-022","role":"toolResult","generation":null,"timestamp":1791624899122,"responseId":null,"relativeMs":20967212,"durationMs":null,"toolName":"tool_08","toolCallId":"call_0050","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"raw":{"role":"toolResult","toolCallId":"call_0050","toolName":"tool_08","content":[{"type":"text","text":"fixture text-00bv placeholder"}],"details":{"diff":"fixture text-00bw placeholder","patch":"fixture text-00bx placeholder","firstChangedLine":1987},"isError":false,"timestamp":1791624899122},"rawOmitted":false,"textTruncated":false,"index":85,"text":null,"thinking":null,"arguments":null,"result":"fixture text-00bv placeholder","error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_08","summary":"fixture text-00bv placeholder"},{"id":"msg-00by","turnId":"turn-022","role":"assistant","generation":null,"timestamp":1791625062330,"responseId":"fixture text-00c6 placeholder","relativeMs":21130420,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":684,"output":238,"cacheRead":179712,"cacheWrite":0,"totalTokens":180634},"model":"fixture text-00c5 placeholder","provider":"fixture text-00c4 placeholder","api":"fixture text-00c3 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-00bz placeholder","thinkingSignature":"fixture text-00c0 placeholder"},{"type":"toolCall","id":"call_0051","name":"tool_03","arguments":{"command":"fixture text-00c1 placeholder","description":"fixture text-00c2 placeholder"}}],"api":"fixture text-00c3 placeholder","provider":"fixture text-00c4 placeholder","model":"fixture text-00c5 placeholder","usage":{"input":684,"output":238,"cacheRead":179712,"cacheWrite":0,"totalTokens":180634,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791625062330,"responseId":"fixture text-00c6 placeholder"},"rawOmitted":false,"textTruncated":false,"index":86,"text":null,"thinking":"fixture text-00bz placeholder","arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-00bz placeholder"},{"id":"msg-00by","turnId":"turn-022","role":"assistant","generation":null,"timestamp":1791625062330,"responseId":"fixture text-00c6 placeholder","relativeMs":21130420,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0051","model":"fixture text-00c5 placeholder","provider":"fixture text-00c4 placeholder","api":"fixture text-00c3 placeholder","stopReason":"toolUse","isError":null,"raw":{"role":"assistant","content":[{"type":"thinking","thinking":"fixture text-00bz placeholder","thinkingSignature":"fixture text-00c0 placeholder"},{"type":"toolCall","id":"call_0051","name":"tool_03","arguments":{"command":"fixture text-00c1 placeholder","description":"fixture text-00c2 placeholder"}}],"api":"fixture text-00c3 placeholder","provider":"fixture text-00c4 placeholder","model":"fixture text-00c5 placeholder","usage":{"input":684,"output":238,"cacheRead":179712,"cacheWrite":0,"totalTokens":180634,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"toolUse","timestamp":1791625062330,"responseId":"fixture text-00c6 placeholder"},"rawOmitted":false,"textTruncated":false,"index":87,"text":null,"thinking":null,"arguments":{"command":"fixture text-00c1 placeholder","description":"fixture text-00c2 placeholder"},"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-00c1 placeholder\", description=\"fixture text-00c2 placeholder\"}","argumentsOmitted":false}]},{"id":"turn-023","index":23,"startedAt":1791627571957,"endedAt":1791627571957,"durationMs":0,"toolCalls":0,"errors":0,"tokens":{"input":1188,"output":82,"cacheRead":267008,"cacheWrite":0,"totalTokens":268278},"turnClass":"continuation","askedReader":false,"closed":true,"records":[{"id":"msg-00c7","turnId":"turn-023","role":"assistant","generation":null,"timestamp":1791627571957,"responseId":"fixture text-00cb placeholder","relativeMs":23640047,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":1188,"output":82,"cacheRead":267008,"cacheWrite":0,"totalTokens":268278},"model":"fixture text-00ca placeholder","provider":"fixture text-00c9 placeholder","api":"fixture text-00c8 placeholder","stopReason":"stop","isError":null,"raw":{"role":"assistant","content":[],"api":"fixture text-00c8 placeholder","provider":"fixture text-00c9 placeholder","model":"fixture text-00ca placeholder","usage":{"input":1188,"output":82,"cacheRead":267008,"cacheWrite":0,"totalTokens":268278,"cost":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"total":0}},"stopReason":"stop","timestamp":1791627571957,"responseId":"fixture text-00cb placeholder"},"rawOmitted":false,"textTruncated":false,"index":88,"text":null,"thinking":null,"arguments":null,"result":null,"error":null,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"reply","title":"assistant","summary":""}]}]}
\ No newline at end of file
+{"session":{"id":"mvs_00000000000000000000000000000001","label":"fixture text-000w placeholder","messageCount":60,"turnCount":23,"startedAt":1791603931910,"lastActiveAt":1750000480000,"sizeBytes":37267,"truncated":false,"maxMessageBytes":67108864,"generation":null,"generations":[],"orphans":[],"activeGeneration":null,"stitched":false,"binding":"fixture","leased":false},"stats":{"messages":60,"userMessages":2,"assistantMessages":32,"toolCalls":31,"toolResults":22,"thinkingBlocks":18,"injectedBlocks":3,"compactions":1,"turns":23,"turnsWithPrompt":2,"continuationTurns":1,"qaTurns":0,"openTurns":1,"steers":0,"compactionTurns":1,"turnsWithoutPrompt":19,"errors":3,"tokens":{"input":357272,"output":15279,"cacheRead":5571539,"cacheWrite":0,"totalTokens":5944090},"durationMs":23640047,"messagesAll":60,"messageRowsAll":60},"turns":[{"id":"turn-001","index":1,"startedAt":1791603931910,"endedAt":1791605485479,"durationMs":1553569,"toolCalls":8,"errors":1,"tokens":{"input":53826,"output":2224,"cacheRead":1175168,"cacheWrite":0,"totalTokens":1231218},"turnClass":"prompt","askedReader":false,"closed":true,"openerInView":true,"openerOutOfView":false,"records":[{"id":"msg-0000","turnId":"turn-001","role":"user","generation":null,"timestamp":1791603931910,"responseId":null,"relativeMs":0,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":null,"internalOnly":false,"rawRow":0,"textTruncated":false,"index":1,"hasText":true,"hasThinking":false,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"system","title":"injected","summary":"<system-reminder> fixture injected-0001 block","text":"<system-reminder>\nfixture injected-0001 block"},{"id":"msg-0002","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791603931971,"responseId":"fixture text-0009 placeholder","relativeMs":61,"durationMs":null,"toolName":null,"toolCallId":null,"model":"fixture text-0008 placeholder","provider":"fixture text-0007 placeholder","api":"fixture text-0006 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":1,"textTruncated":false,"index":2,"hasText":false,"hasThinking":true,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-0003 placeholder","thinking":"fixture text-0003 placeholder"},{"id":"msg-0002","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791603931971,"responseId":"fixture text-0009 placeholder","relativeMs":61,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":44829,"output":432,"cacheRead":4224,"cacheWrite":0,"totalTokens":49485},"model":"fixture text-0008 placeholder","provider":"fixture text-0007 placeholder","api":"fixture text-0006 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":1,"textTruncated":false,"index":3,"hasText":true,"hasThinking":false,"hasArguments":false,"hasResult":false,"rowPos":1,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"narration","title":"assistant","summary":"fixture text-0005 placeholder","text":"fixture text-0005 placeholder"},{"id":"msg-0002","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791603931971,"responseId":"fixture text-0009 placeholder","relativeMs":61,"durationMs":11257,"toolName":"tool_00","toolCallId":"call_0000","model":"fixture text-0008 placeholder","provider":"fixture text-0007 placeholder","api":"fixture text-0006 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":1,"textTruncated":false,"index":4,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":2,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_00","summary":"tool_00{name=\"tool_01\"} → fixture text-000b placeholder","arguments":{"name":"tool_01"},"argumentsOmitted":false},{"id":"msg-000a","turnId":"turn-001","role":"toolResult","generation":null,"timestamp":1791603943228,"responseId":null,"relativeMs":11318,"durationMs":11257,"toolName":"tool_00","toolCallId":"call_0000","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"internalOnly":false,"rawRow":2,"textTruncated":false,"index":5,"hasText":false,"hasThinking":false,"hasArguments":false,"hasResult":true,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_00","summary":"fixture text-000b placeholder","result":"fixture text-000b placeholder"},{"id":"msg-000g","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791604127714,"responseId":"fixture text-000o placeholder","relativeMs":195804,"durationMs":null,"toolName":null,"toolCallId":null,"model":"fixture text-000n placeholder","provider":"fixture text-000m placeholder","api":"fixture text-000l placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":3,"textTruncated":false,"index":6,"hasText":false,"hasThinking":true,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-000h placeholder","thinking":"fixture text-000h placeholder"},{"id":"msg-000g","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791604127714,"responseId":"fixture text-000o placeholder","relativeMs":195804,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":4210,"output":82,"cacheRead":76544,"cacheWrite":0,"totalTokens":80836},"model":"fixture text-000n placeholder","provider":"fixture text-000m placeholder","api":"fixture text-000l placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":3,"textTruncated":false,"index":7,"hasText":true,"hasThinking":false,"hasArguments":false,"hasResult":false,"rowPos":1,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"narration","title":"assistant","summary":"fixture text-000j placeholder","text":"fixture text-000j placeholder"},{"id":"msg-000g","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791604127714,"responseId":"fixture text-000o placeholder","relativeMs":195804,"durationMs":null,"toolName":"tool_02","toolCallId":"call_0001","model":"fixture text-000n placeholder","provider":"fixture text-000m placeholder","api":"fixture text-000l placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":3,"textTruncated":false,"index":8,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":2,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_02","summary":"tool_02{task_id=\"fixture text-000k placeholder\"}","arguments":{"task_id":"fixture text-000k placeholder"},"argumentsOmitted":false},{"id":"msg-000p","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791604504788,"responseId":"fixture text-000u placeholder","relativeMs":572878,"durationMs":null,"toolName":"tool_02","toolCallId":"call_0002","tokens":{"input":268,"output":62,"cacheRead":102144,"cacheWrite":0,"totalTokens":102474},"model":"fixture text-000t placeholder","provider":"fixture text-000s placeholder","api":"fixture text-000r placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":4,"textTruncated":false,"index":9,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_02","summary":"tool_02{task_id=\"fixture text-000q placeholder\", wait_ms=\"30000\"}","arguments":{"task_id":"fixture text-000q placeholder","wait_ms":30000},"argumentsOmitted":false},{"id":"msg-000v","turnId":"turn-001","role":"user","generation":null,"timestamp":1791604626776,"responseId":null,"relativeMs":694866,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":null,"internalOnly":false,"rawRow":5,"textTruncated":false,"index":10,"hasText":true,"hasThinking":false,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"user","title":"user","summary":"fixture text-000w placeholder","text":"fixture text-000w placeholder","steered":false},{"id":"msg-000x","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791604764455,"responseId":"fixture text-0013 placeholder","relativeMs":832545,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0003","tokens":{"input":2672,"output":61,"cacheRead":113536,"cacheWrite":0,"totalTokens":116269},"model":"fixture text-0012 placeholder","provider":"fixture text-0011 placeholder","api":"fixture text-0010 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":6,"textTruncated":false,"index":11,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-000y placeholder\", description=\"fixture text-000z placeholder\"}","arguments":{"command":"fixture text-000y placeholder","description":"fixture text-000z placeholder"},"argumentsOmitted":false},{"id":"msg-0014","turnId":"turn-001","role":"toolResult","generation":null,"timestamp":1791604879414,"responseId":null,"relativeMs":947504,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0004","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":true,"internalOnly":false,"rawRow":7,"textTruncated":false,"index":12,"hasText":false,"hasThinking":false,"hasArguments":false,"hasResult":true,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_03","summary":"fixture text-0015 placeholder","result":"fixture text-0015 placeholder"},{"id":"msg-001h","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791604894030,"responseId":"fixture text-001n placeholder","relativeMs":962120,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0005","tokens":{"input":142,"output":107,"cacheRead":135424,"cacheWrite":0,"totalTokens":135673},"model":"fixture text-001m placeholder","provider":"fixture text-001l placeholder","api":"fixture text-001k placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":8,"textTruncated":false,"index":13,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-001i placeholder\", description=\"fixture text-001j placeholder\"}","arguments":{"command":"fixture text-001i placeholder","description":"fixture text-001j placeholder"},"argumentsOmitted":false},{"id":"msg-001o","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791605044287,"responseId":"fixture text-001u placeholder","relativeMs":1112377,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0006","tokens":{"input":714,"output":176,"cacheRead":167040,"cacheWrite":0,"totalTokens":167930},"model":"fixture text-001t placeholder","provider":"fixture text-001s placeholder","api":"fixture text-001r placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":9,"textTruncated":false,"index":14,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-001p placeholder\", description=\"fixture text-001q placeholder\"}","arguments":{"command":"fixture text-001p placeholder","description":"fixture text-001q placeholder"},"argumentsOmitted":false},{"id":"msg-001v","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791605219170,"responseId":"fixture text-0023 placeholder","relativeMs":1287260,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":832,"output":316,"cacheRead":178688,"cacheWrite":0,"totalTokens":179836},"model":"fixture text-0022 placeholder","provider":"fixture text-0021 placeholder","api":"fixture text-0020 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":10,"textTruncated":false,"index":15,"hasText":false,"hasThinking":true,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-001w placeholder","thinking":"fixture text-001w placeholder"},{"id":"msg-001v","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791605219170,"responseId":"fixture text-0023 placeholder","relativeMs":1287260,"durationMs":null,"toolName":"tool_04","toolCallId":"call_0007","model":"fixture text-0022 placeholder","provider":"fixture text-0021 placeholder","api":"fixture text-0020 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":10,"textTruncated":false,"index":16,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":1,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_04","summary":"tool_04{action=\"fixture text-001y placeholder\", input=\"{…}\"}","arguments":{"action":"fixture text-001y placeholder","input":{"kind":"text","maxChars":600,"selector":"fixture text-001z placeholder"}},"argumentsOmitted":false},{"id":"msg-0024","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791605423541,"responseId":"fixture text-002c placeholder","relativeMs":1491631,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":100,"output":91,"cacheRead":194176,"cacheWrite":0,"totalTokens":194367},"model":"fixture text-002b placeholder","provider":"fixture text-002a placeholder","api":"fixture text-0029 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":11,"textTruncated":false,"index":17,"hasText":false,"hasThinking":true,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-0025 placeholder","thinking":"fixture text-0025 placeholder"},{"id":"msg-0024","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791605423541,"responseId":"fixture text-002c placeholder","relativeMs":1491631,"durationMs":null,"toolName":"tool_04","toolCallId":"call_0008","model":"fixture text-002b placeholder","provider":"fixture text-002a placeholder","api":"fixture text-0029 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":11,"textTruncated":false,"index":18,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":1,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_04","summary":"tool_04{action=\"fixture text-0027 placeholder\", input=\"{…}\"}","arguments":{"action":"fixture text-0027 placeholder","input":{"selector":"fixture text-0028 placeholder"}},"argumentsOmitted":false},{"id":"msg-002d","turnId":"turn-001","role":"assistant","generation":null,"timestamp":1791605485479,"responseId":"fixture text-002i placeholder","relativeMs":1553569,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":59,"output":897,"cacheRead":203392,"cacheWrite":0,"totalTokens":204348},"model":"fixture text-002h placeholder","provider":"fixture text-002g placeholder","api":"fixture text-002f placeholder","stopReason":"stop","isError":null,"internalOnly":false,"rawRow":12,"textTruncated":false,"index":19,"hasText":true,"hasThinking":false,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"reply","title":"assistant","summary":"fixture text-002e placeholder","text":"fixture text-002e placeholder"}]},{"id":"turn-002","index":2,"startedAt":1791605691616,"endedAt":1791605691616,"durationMs":0,"toolCalls":1,"errors":0,"tokens":{"input":1658,"output":69,"cacheRead":210432,"cacheWrite":0,"totalTokens":212159},"turnClass":"none","askedReader":false,"closed":false,"openerInView":false,"openerOutOfView":false,"records":[{"id":"msg-002j","turnId":"turn-002","role":"assistant","generation":null,"timestamp":1791605691616,"responseId":"fixture text-002o placeholder","relativeMs":1759706,"durationMs":null,"toolName":"tool_05","toolCallId":"call_0009","tokens":{"input":1658,"output":69,"cacheRead":210432,"cacheWrite":0,"totalTokens":212159},"model":"fixture text-002n placeholder","provider":"fixture text-002m placeholder","api":"fixture text-002l placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":13,"textTruncated":false,"index":20,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_05","summary":"tool_05{limit=\"30\", offset=\"1618\", path=\"fixture text-002k placeholder\"}","arguments":{"limit":30,"offset":1618,"path":"fixture text-002k placeholder"},"argumentsOmitted":false}]},{"id":"turn-003","index":3,"startedAt":1791606195742,"endedAt":1791606432109,"durationMs":236367,"toolCalls":1,"errors":0,"tokens":{"input":2260,"output":2251,"cacheRead":220800,"cacheWrite":0,"totalTokens":225311},"turnClass":"none","askedReader":false,"closed":false,"openerInView":false,"openerOutOfView":false,"records":[{"id":"msg-002p","turnId":"turn-003","role":"assistant","generation":null,"timestamp":1791606195742,"responseId":"fixture text-003b placeholder","relativeMs":2263832,"durationMs":null,"toolName":null,"toolCallId":null,"model":"fixture text-003a placeholder","provider":"fixture text-0039 placeholder","api":"fixture text-0038 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":14,"textTruncated":false,"index":21,"hasText":false,"hasThinking":true,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-002q placeholder","thinking":"fixture text-002q placeholder"},{"id":"msg-002p","turnId":"turn-003","role":"assistant","generation":null,"timestamp":1791606195742,"responseId":"fixture text-003b placeholder","relativeMs":2263832,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":2260,"output":2251,"cacheRead":220800,"cacheWrite":0,"totalTokens":225311},"model":"fixture text-003a placeholder","provider":"fixture text-0039 placeholder","api":"fixture text-0038 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":14,"textTruncated":false,"index":22,"hasText":true,"hasThinking":false,"hasArguments":false,"hasResult":false,"rowPos":1,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"narration","title":"assistant","summary":"fixture text-002s placeholder","text":"fixture text-002s placeholder"},{"id":"msg-002p","turnId":"turn-003","role":"assistant","generation":null,"timestamp":1791606195742,"responseId":"fixture text-003b placeholder","relativeMs":2263832,"durationMs":null,"toolName":"tool_06","toolCallId":"call_0010","model":"fixture text-003a placeholder","provider":"fixture text-0039 placeholder","api":"fixture text-0038 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":14,"textTruncated":false,"index":23,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":2,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_06","summary":"tool_06{todos=\"[{…}, {…}, {…}, …]\"}","arguments":{"todos":[{"content":"fixture text-002t placeholder","priority":"fixture text-002u placeholder","status":"fixture text-002v placeholder"},{"content":"fixture text-002w placeholder","priority":"fixture text-002x placeholder","status":"fixture text-002y placeholder"},{"content":"fixture text-002z placeholder","priority":"fixture text-0030 placeholder","status":"fixture text-0031 placeholder"},{"content":"fixture text-0032 placeholder","priority":"fixture text-0033 placeholder","status":"fixture text-0034 placeholder"},{"content":"fixture text-0035 placeholder","priority":"fixture text-0036 placeholder","status":"fixture text-0037 placeholder"}]},"argumentsOmitted":false},{"id":"msg-003c","turnId":"turn-003","role":"toolResult","generation":null,"timestamp":1791606432109,"responseId":null,"relativeMs":2500199,"durationMs":null,"toolName":"tool_07","toolCallId":"call_0011","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"internalOnly":false,"rawRow":15,"textTruncated":false,"index":24,"hasText":false,"hasThinking":false,"hasArguments":false,"hasResult":true,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_07","summary":"fixture text-003d placeholder","result":"fixture text-003d placeholder"}]},{"id":"turn-004","index":4,"startedAt":1791610762301,"endedAt":1791611180154,"durationMs":417853,"toolCalls":2,"errors":0,"tokens":{"input":258453,"output":1164,"cacheRead":277120,"cacheWrite":0,"totalTokens":536737},"turnClass":"none","askedReader":false,"closed":false,"openerInView":false,"openerOutOfView":false,"records":[{"id":"msg-003f","turnId":"turn-004","role":"assistant","generation":null,"timestamp":1791610762301,"responseId":"fixture text-003l placeholder","relativeMs":6830391,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0012","tokens":{"input":254227,"output":405,"cacheRead":4224,"cacheWrite":0,"totalTokens":258856},"model":"fixture text-003k placeholder","provider":"fixture text-003j placeholder","api":"fixture text-003i placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":16,"textTruncated":false,"index":25,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-003g placeholder\", description=\"fixture text-003h placeholder\"}","arguments":{"command":"fixture text-003g placeholder","description":"fixture text-003h placeholder"},"argumentsOmitted":false},{"id":"msg-003m","turnId":"turn-004","role":"toolResult","generation":null,"timestamp":1791610983663,"responseId":null,"relativeMs":7051753,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0013","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"internalOnly":false,"rawRow":17,"textTruncated":false,"index":26,"hasText":false,"hasThinking":false,"hasArguments":false,"hasResult":true,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_03","summary":"fixture text-003n placeholder","result":"fixture text-003n placeholder"},{"id":"msg-003y","turnId":"turn-004","role":"assistant","generation":null,"timestamp":1791611180154,"responseId":"fixture text-0048 placeholder","relativeMs":7248244,"durationMs":null,"toolName":null,"toolCallId":null,"model":"fixture text-0047 placeholder","provider":"fixture text-0046 placeholder","api":"fixture text-0045 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":18,"textTruncated":false,"index":27,"hasText":false,"hasThinking":true,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-003z placeholder","thinking":"fixture text-003z placeholder"},{"id":"msg-003y","turnId":"turn-004","role":"assistant","generation":null,"timestamp":1791611180154,"responseId":"fixture text-0048 placeholder","relativeMs":7248244,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":4226,"output":759,"cacheRead":272896,"cacheWrite":0,"totalTokens":277881},"model":"fixture text-0047 placeholder","provider":"fixture text-0046 placeholder","api":"fixture text-0045 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":18,"textTruncated":false,"index":28,"hasText":true,"hasThinking":false,"hasArguments":false,"hasResult":false,"rowPos":1,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"narration","title":"assistant","summary":"fixture text-0041 placeholder","text":"fixture text-0041 placeholder"},{"id":"msg-003y","turnId":"turn-004","role":"assistant","generation":null,"timestamp":1791611180154,"responseId":"fixture text-0048 placeholder","relativeMs":7248244,"durationMs":null,"toolName":"tool_08","toolCallId":"call_0014","model":"fixture text-0047 placeholder","provider":"fixture text-0046 placeholder","api":"fixture text-0045 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":18,"textTruncated":false,"index":29,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":2,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_08","summary":"tool_08{file_path=\"fixture text-0042 placeholder\", new_string=\"fixture text-0043 placeholder\", old_string=\"fixture text-0044 placeholder\"}","arguments":{"file_path":"fixture text-0042 placeholder","new_string":"fixture text-0043 placeholder","old_string":"fixture text-0044 placeholder"},"argumentsOmitted":false}]},{"id":"turn-005","index":5,"startedAt":1791611784883,"endedAt":1791611784883,"durationMs":0,"toolCalls":0,"errors":0,"tokens":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"totalTokens":0},"turnClass":"none","askedReader":false,"closed":false,"openerInView":false,"openerOutOfView":false,"records":[{"id":"msg-0049","turnId":"turn-005","role":"toolResult","generation":null,"timestamp":1791611784883,"responseId":null,"relativeMs":7852973,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0015","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"internalOnly":false,"rawRow":19,"textTruncated":false,"index":30,"hasText":false,"hasThinking":false,"hasArguments":false,"hasResult":true,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_03","summary":"fixture text-004a placeholder","result":"fixture text-004a placeholder"}]},{"id":"turn-006","index":6,"startedAt":1791612294290,"endedAt":1791612294290,"durationMs":0,"toolCalls":0,"errors":0,"tokens":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"totalTokens":0},"turnClass":"none","askedReader":false,"closed":false,"openerInView":false,"openerOutOfView":false,"records":[{"id":"msg-004q","turnId":"turn-006","role":"toolResult","generation":null,"timestamp":1791612294290,"responseId":null,"relativeMs":8362380,"durationMs":null,"toolName":"tool_07","toolCallId":"call_0016","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"internalOnly":false,"rawRow":20,"textTruncated":false,"index":31,"hasText":false,"hasThinking":false,"hasArguments":false,"hasResult":true,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_07","summary":"fixture text-004r placeholder","result":"fixture text-004r placeholder"}]},{"id":"turn-007","index":7,"startedAt":1791613412089,"endedAt":1791613412089,"durationMs":0,"toolCalls":0,"errors":0,"tokens":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"totalTokens":0},"turnClass":"compaction","askedReader":false,"closed":false,"openerInView":false,"openerOutOfView":false,"records":[{"id":"msg-004t","turnId":"turn-007","role":"compactionSummary","generation":null,"timestamp":1791613412089,"responseId":null,"relativeMs":9480179,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":null,"internalOnly":false,"rawRow":21,"textTruncated":false,"index":32,"hasText":true,"hasThinking":false,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":365642,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"compaction","title":"compaction","summary":"fixture text-004u placeholder","text":"fixture text-004u placeholder"}]},{"id":"turn-008","index":8,"startedAt":1791613490565,"endedAt":1791613490565,"durationMs":0,"toolCalls":2,"errors":0,"tokens":{"input":2171,"output":429,"cacheRead":54272,"cacheWrite":0,"totalTokens":56872},"turnClass":"none","askedReader":false,"closed":false,"openerInView":false,"openerOutOfView":false,"records":[{"id":"msg-004v","turnId":"turn-008","role":"assistant","generation":null,"timestamp":1791613490565,"responseId":"fixture text-0058 placeholder","relativeMs":9558655,"durationMs":null,"toolName":null,"toolCallId":null,"model":"fixture text-0057 placeholder","provider":"fixture text-0056 placeholder","api":"fixture text-0055 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":22,"textTruncated":false,"index":33,"hasText":false,"hasThinking":true,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-004w placeholder","thinking":"fixture text-004w placeholder"},{"id":"msg-004v","turnId":"turn-008","role":"assistant","generation":null,"timestamp":1791613490565,"responseId":"fixture text-0058 placeholder","relativeMs":9558655,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":2171,"output":429,"cacheRead":54272,"cacheWrite":0,"totalTokens":56872},"model":"fixture text-0057 placeholder","provider":"fixture text-0056 placeholder","api":"fixture text-0055 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":22,"textTruncated":false,"index":34,"hasText":true,"hasThinking":false,"hasArguments":false,"hasResult":false,"rowPos":1,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"narration","title":"assistant","summary":"fixture text-004y placeholder","text":"fixture text-004y placeholder"},{"id":"msg-004v","turnId":"turn-008","role":"assistant","generation":null,"timestamp":1791613490565,"responseId":"fixture text-0058 placeholder","relativeMs":9558655,"durationMs":null,"toolName":"tool_09","toolCallId":"call_0017","model":"fixture text-0057 placeholder","provider":"fixture text-0056 placeholder","api":"fixture text-0055 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":22,"textTruncated":false,"index":35,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":2,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_09","summary":"tool_09{pattern=\"fixture text-004z placeholder\", path=\"fixture text-0050 placeholder\", output_mode=\"fixture text-0051 placeholder\"}","arguments":{"pattern":"fixture text-004z placeholder","path":"fixture text-0050 placeholder","output_mode":"fixture text-0051 placeholder"},"argumentsOmitted":false},{"id":"msg-004v","turnId":"turn-008","role":"assistant","generation":null,"timestamp":1791613490565,"responseId":"fixture text-0058 placeholder","relativeMs":9558655,"durationMs":null,"toolName":"tool_09","toolCallId":"call_0018","model":"fixture text-0057 placeholder","provider":"fixture text-0056 placeholder","api":"fixture text-0055 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":22,"textTruncated":false,"index":36,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":3,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_09","summary":"tool_09{pattern=\"fixture text-0052 placeholder\", path=\"fixture text-0053 placeholder\", output_mode=\"fixture text-0054 placeholder\", limit=\"30\"}","arguments":{"pattern":"fixture text-0052 placeholder","path":"fixture text-0053 placeholder","output_mode":"fixture text-0054 placeholder","limit":30},"argumentsOmitted":false}]},{"id":"turn-009","index":9,"startedAt":1791614563489,"endedAt":1791614731831,"durationMs":168342,"toolCalls":1,"errors":0,"tokens":{"input":634,"output":1426,"cacheRead":120019,"cacheWrite":0,"totalTokens":122079},"turnClass":"none","askedReader":false,"closed":false,"openerInView":false,"openerOutOfView":false,"records":[{"id":"msg-0059","turnId":"turn-009","role":"toolResult","generation":null,"timestamp":1791614563489,"responseId":null,"relativeMs":10631579,"durationMs":null,"toolName":"tool_09","toolCallId":"call_0019","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"internalOnly":false,"rawRow":23,"textTruncated":false,"index":37,"hasText":false,"hasThinking":false,"hasArguments":false,"hasResult":true,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_09","summary":"fixture text-005a placeholder","result":"fixture text-005a placeholder"},{"id":"msg-005b","turnId":"turn-009","role":"assistant","generation":null,"timestamp":1791614731831,"responseId":"fixture text-005j placeholder","relativeMs":10799921,"durationMs":null,"toolName":null,"toolCallId":null,"model":"fixture text-005i placeholder","provider":"fixture text-005h placeholder","api":"fixture text-005g placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":24,"textTruncated":false,"index":38,"hasText":false,"hasThinking":true,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-005c placeholder","thinking":"fixture text-005c placeholder"},{"id":"msg-005b","turnId":"turn-009","role":"assistant","generation":null,"timestamp":1791614731831,"responseId":"fixture text-005j placeholder","relativeMs":10799921,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":634,"output":1426,"cacheRead":120019,"cacheWrite":0,"totalTokens":122079},"model":"fixture text-005i placeholder","provider":"fixture text-005h placeholder","api":"fixture text-005g placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":24,"textTruncated":false,"index":39,"hasText":true,"hasThinking":false,"hasArguments":false,"hasResult":false,"rowPos":1,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"narration","title":"assistant","summary":"fixture text-005e placeholder","text":"fixture text-005e placeholder"},{"id":"msg-005b","turnId":"turn-009","role":"assistant","generation":null,"timestamp":1791614731831,"responseId":"fixture text-005j placeholder","relativeMs":10799921,"durationMs":null,"toolName":"tool_05","toolCallId":"call_0020","model":"fixture text-005i placeholder","provider":"fixture text-005h placeholder","api":"fixture text-005g placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":24,"textTruncated":false,"index":40,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":2,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_05","summary":"tool_05{path=\"fixture text-005f placeholder\", limit=\"14\"}","arguments":{"path":"fixture text-005f placeholder","limit":14},"argumentsOmitted":false}]},{"id":"turn-010","index":10,"startedAt":1791615045716,"endedAt":1791615045716,"durationMs":0,"toolCalls":0,"errors":0,"tokens":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"totalTokens":0},"turnClass":"prompt","askedReader":false,"closed":false,"openerInView":true,"openerOutOfView":false,"records":[{"id":"msg-005k","turnId":"turn-010","role":"user","generation":null,"timestamp":1791615045716,"responseId":null,"relativeMs":11113806,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":null,"internalOnly":false,"rawRow":25,"textTruncated":false,"index":41,"hasText":true,"hasThinking":false,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"user","title":"user","summary":"fixture te","text":"fixture te","steered":false}]},{"id":"turn-011","index":11,"startedAt":1791615477302,"endedAt":1791615904587,"durationMs":427285,"toolCalls":0,"errors":0,"tokens":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"totalTokens":0},"turnClass":"none","askedReader":false,"closed":false,"openerInView":false,"openerOutOfView":false,"records":[{"id":"msg-005n","turnId":"turn-011","role":"toolResult","generation":null,"timestamp":1791615477302,"responseId":null,"relativeMs":11545392,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0021","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"internalOnly":false,"rawRow":26,"textTruncated":false,"index":42,"hasText":false,"hasThinking":false,"hasArguments":false,"hasResult":true,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_03","summary":"fixture text-005o placeholder","result":"fixture text-005o placeholder"},{"id":"msg-005z","turnId":"turn-011","role":"toolResult","generation":null,"timestamp":1791615904587,"responseId":null,"relativeMs":11972677,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0022","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"internalOnly":false,"rawRow":27,"textTruncated":false,"index":43,"hasText":false,"hasThinking":false,"hasArguments":false,"hasResult":true,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_03","summary":"fixture text-0060 placeholder","result":"fixture text-0060 placeholder"}]},{"id":"turn-012","index":12,"startedAt":1791616197977,"endedAt":1791616341161,"durationMs":143184,"toolCalls":1,"errors":0,"tokens":{"input":806,"output":332,"cacheRead":215296,"cacheWrite":0,"totalTokens":216434},"turnClass":"none","askedReader":false,"closed":false,"openerInView":false,"openerOutOfView":false,"records":[{"id":"msg-006b","turnId":"turn-012","role":"assistant","generation":null,"timestamp":1791616197977,"responseId":"fixture text-006i placeholder","relativeMs":12266067,"durationMs":null,"toolName":"tool_08","toolCallId":"call_0023","tokens":{"input":806,"output":332,"cacheRead":215296,"cacheWrite":0,"totalTokens":216434},"model":"fixture text-006h placeholder","provider":"fixture text-006g placeholder","api":"fixture text-006f placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":28,"textTruncated":false,"index":44,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_08","summary":"tool_08{file_path=\"fixture text-006c placeholder\", new_string=\"fixture text-006d placeholder\", old_string=\"fixture text-006e placeholder\"}","arguments":{"file_path":"fixture text-006c placeholder","new_string":"fixture text-006d placeholder","old_string":"fixture text-006e placeholder"},"argumentsOmitted":false},{"id":"msg-006j","turnId":"turn-012","role":"toolResult","generation":null,"timestamp":1791616341161,"responseId":null,"relativeMs":12409251,"durationMs":null,"toolName":"tool_08","toolCallId":"call_0024","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"internalOnly":false,"rawRow":29,"textTruncated":false,"index":45,"hasText":false,"hasThinking":false,"hasArguments":false,"hasResult":true,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_08","summary":"fixture text-006k placeholder","result":"fixture text-006k placeholder"}]},{"id":"turn-013","index":13,"startedAt":1791616657094,"endedAt":1791616657094,"durationMs":0,"toolCalls":1,"errors":0,"tokens":{"input":2780,"output":1648,"cacheRead":257536,"cacheWrite":0,"totalTokens":261964},"turnClass":"none","askedReader":false,"closed":false,"openerInView":false,"openerOutOfView":false,"records":[{"id":"msg-006n","turnId":"turn-013","role":"assistant","generation":null,"timestamp":1791616657094,"responseId":"fixture text-006w placeholder","relativeMs":12725184,"durationMs":null,"toolName":null,"toolCallId":null,"model":"fixture text-006v placeholder","provider":"fixture text-006u placeholder","api":"fixture text-006t placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":30,"textTruncated":false,"index":46,"hasText":false,"hasThinking":true,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-006o placeholder","thinking":"fixture text-006o placeholder"},{"id":"msg-006n","turnId":"turn-013","role":"assistant","generation":null,"timestamp":1791616657094,"responseId":"fixture text-006w placeholder","relativeMs":12725184,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":2780,"output":1648,"cacheRead":257536,"cacheWrite":0,"totalTokens":261964},"model":"fixture text-006v placeholder","provider":"fixture text-006u placeholder","api":"fixture text-006t placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":30,"textTruncated":false,"index":47,"hasText":true,"hasThinking":false,"hasArguments":false,"hasResult":false,"rowPos":1,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"narration","title":"assistant","summary":"fixture text-006q placeholder","text":"fixture text-006q placeholder"},{"id":"msg-006n","turnId":"turn-013","role":"assistant","generation":null,"timestamp":1791616657094,"responseId":"fixture text-006w placeholder","relativeMs":12725184,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0025","model":"fixture text-006v placeholder","provider":"fixture text-006u placeholder","api":"fixture text-006t placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":30,"textTruncated":false,"index":48,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":2,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-006r placeholder\", description=\"fixture text-006s placeholder\", timeout=\"120\"}","arguments":{"command":"fixture text-006r placeholder","description":"fixture text-006s placeholder","timeout":120},"argumentsOmitted":false}]},{"id":"turn-014","index":14,"startedAt":1791617021128,"endedAt":1791617021128,"durationMs":0,"toolCalls":0,"errors":0,"tokens":{"input":0,"output":0,"cacheRead":0,"cacheWrite":0,"totalTokens":0},"turnClass":"none","askedReader":false,"closed":false,"openerInView":false,"openerOutOfView":false,"records":[{"id":"msg-006x","turnId":"turn-014","role":"toolResult","generation":null,"timestamp":1791617021128,"responseId":null,"relativeMs":13089218,"durationMs":null,"toolName":"tool_07","toolCallId":"call_0026","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"internalOnly":false,"rawRow":31,"textTruncated":false,"index":49,"hasText":false,"hasThinking":false,"hasArguments":false,"hasResult":true,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_07","summary":"fixture text-006y placeholder","result":"fixture text-006y placeholder"}]},{"id":"turn-015","index":15,"startedAt":1791617468106,"endedAt":1791617468106,"durationMs":0,"toolCalls":1,"errors":0,"tokens":{"input":1087,"output":70,"cacheRead":312832,"cacheWrite":0,"totalTokens":313989},"turnClass":"none","askedReader":false,"closed":false,"openerInView":false,"openerOutOfView":false,"records":[{"id":"msg-0070","turnId":"turn-015","role":"assistant","generation":null,"timestamp":1791617468106,"responseId":"fixture text-0075 placeholder","relativeMs":13536196,"durationMs":null,"toolName":"tool_05","toolCallId":"call_0027","tokens":{"input":1087,"output":70,"cacheRead":312832,"cacheWrite":0,"totalTokens":313989},"model":"fixture text-0074 placeholder","provider":"fixture text-0073 placeholder","api":"fixture text-0072 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":32,"textTruncated":false,"index":50,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_05","summary":"tool_05{limit=\"40\", offset=\"2108\", path=\"fixture text-0071 placeholder\"}","arguments":{"limit":40,"offset":2108,"path":"fixture text-0071 placeholder"},"argumentsOmitted":false}]},{"id":"turn-016","index":16,"startedAt":1791617651220,"endedAt":1791618644926,"durationMs":993706,"toolCalls":3,"errors":0,"tokens":{"input":2763,"output":1128,"cacheRead":508160,"cacheWrite":0,"totalTokens":512051},"turnClass":"none","askedReader":false,"closed":false,"openerInView":false,"openerOutOfView":false,"records":[{"id":"msg-0076","turnId":"turn-016","role":"user","generation":null,"timestamp":1791617651220,"responseId":null,"relativeMs":13719310,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":null,"internalOnly":false,"rawRow":33,"textTruncated":false,"index":51,"hasText":true,"hasThinking":false,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"system","title":"injected","summary":"<system-reminder> fixture injected-0077 block","text":"<system-reminder>\nfixture injected-0077 block"},{"id":"msg-0078","turnId":"turn-016","role":"assistant","generation":null,"timestamp":1791617812028,"responseId":"fixture text-007e placeholder","relativeMs":13880118,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0028","tokens":{"input":859,"output":309,"cacheRead":349952,"cacheWrite":0,"totalTokens":351120},"model":"fixture text-007d placeholder","provider":"fixture text-007c placeholder","api":"fixture text-007b placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":34,"textTruncated":false,"index":52,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-0079 placeholder\", description=\"fixture text-007a placeholder\", timeout=\"240\"}","arguments":{"command":"fixture text-0079 placeholder","description":"fixture text-007a placeholder","timeout":240},"argumentsOmitted":false},{"id":"msg-007f","turnId":"turn-016","role":"assistant","generation":null,"timestamp":1791618043996,"responseId":"fixture text-007o placeholder","relativeMs":14112086,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":1825,"output":630,"cacheRead":68352,"cacheWrite":0,"totalTokens":70807},"model":"fixture text-007n placeholder","provider":"fixture text-007m placeholder","api":"fixture text-007l placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":35,"textTruncated":false,"index":53,"hasText":false,"hasThinking":true,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-007g placeholder","thinking":"fixture text-007g placeholder"},{"id":"msg-007f","turnId":"turn-016","role":"assistant","generation":null,"timestamp":1791618043996,"responseId":"fixture text-007o placeholder","relativeMs":14112086,"durationMs":null,"toolName":"tool_09","toolCallId":"call_0029","model":"fixture text-007n placeholder","provider":"fixture text-007m placeholder","api":"fixture text-007l placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":35,"textTruncated":false,"index":54,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":1,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_09","summary":"tool_09{context=\"2\", limit=\"8\", output_mode=\"fixture text-007i placeholder\", path=\"fixture text-007j placeholder\"}","arguments":{"context":2,"limit":8,"output_mode":"fixture text-007i placeholder","path":"fixture text-007j placeholder","pattern":"fixture text-007k placeholder"},"argumentsOmitted":false},{"id":"msg-007p","turnId":"turn-016","role":"toolResult","generation":null,"timestamp":1791618210903,"responseId":null,"relativeMs":14278993,"durationMs":null,"toolName":"tool_05","toolCallId":"call_0030","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"internalOnly":false,"rawRow":36,"textTruncated":false,"index":55,"hasText":false,"hasThinking":false,"hasArguments":false,"hasResult":true,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_05","summary":"fixture text-007q placeholder","result":"fixture text-007q placeholder"},{"id":"msg-007t","turnId":"turn-016","role":"assistant","generation":null,"timestamp":1791618408954,"responseId":"fixture text-0081 placeholder","relativeMs":14477044,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":79,"output":189,"cacheRead":89856,"cacheWrite":0,"totalTokens":90124},"model":"fixture text-0080 placeholder","provider":"fixture text-007z placeholder","api":"fixture text-007y placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":37,"textTruncated":false,"index":56,"hasText":false,"hasThinking":true,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-007u placeholder","thinking":"fixture text-007u placeholder"},{"id":"msg-007t","turnId":"turn-016","role":"assistant","generation":null,"timestamp":1791618408954,"responseId":"fixture text-0081 placeholder","relativeMs":14477044,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0031","model":"fixture text-0080 placeholder","provider":"fixture text-007z placeholder","api":"fixture text-007y placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":37,"textTruncated":false,"index":57,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":1,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-007w placeholder\", description=\"fixture text-007x placeholder\", timeout=\"420\"}","arguments":{"command":"fixture text-007w placeholder","description":"fixture text-007x placeholder","timeout":420},"argumentsOmitted":false},{"id":"msg-0082","turnId":"turn-016","role":"toolResult","generation":null,"timestamp":1791618644926,"responseId":null,"relativeMs":14713016,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0032","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"internalOnly":false,"rawRow":38,"textTruncated":false,"index":58,"hasText":false,"hasThinking":false,"hasArguments":false,"hasResult":true,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_03","summary":"fixture text-0083 placeholder","result":"fixture text-0083 placeholder"}]},{"id":"turn-017","index":17,"startedAt":1791619060246,"endedAt":1791620468950,"durationMs":1408704,"toolCalls":3,"errors":2,"tokens":{"input":5055,"output":1798,"cacheRead":466304,"cacheWrite":0,"totalTokens":473157},"turnClass":"none","askedReader":false,"closed":false,"openerInView":false,"openerOutOfView":false,"records":[{"id":"msg-008e","turnId":"turn-017","role":"assistant","generation":null,"timestamp":1791619060246,"responseId":"fixture text-008m placeholder","relativeMs":15128336,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":452,"output":939,"cacheRead":118656,"cacheWrite":0,"totalTokens":120047},"model":"fixture text-008l placeholder","provider":"fixture text-008k placeholder","api":"fixture text-008j placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":39,"textTruncated":false,"index":59,"hasText":false,"hasThinking":true,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-008f placeholder","thinking":"fixture text-008f placeholder"},{"id":"msg-008e","turnId":"turn-017","role":"assistant","generation":null,"timestamp":1791619060246,"responseId":"fixture text-008m placeholder","relativeMs":15128336,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0033","model":"fixture text-008l placeholder","provider":"fixture text-008k placeholder","api":"fixture text-008j placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":39,"textTruncated":false,"index":60,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":1,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-008h placeholder\", description=\"fixture text-008i placeholder\", timeout=\"120\"}","arguments":{"command":"fixture text-008h placeholder","description":"fixture text-008i placeholder","timeout":120},"argumentsOmitted":false},{"id":"msg-008n","turnId":"turn-017","role":"toolResult","generation":null,"timestamp":1791619266573,"responseId":null,"relativeMs":15334663,"durationMs":null,"toolName":"tool_08","toolCallId":"call_0034","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"internalOnly":false,"rawRow":40,"textTruncated":false,"index":61,"hasText":false,"hasThinking":false,"hasArguments":false,"hasResult":true,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_08","summary":"fixture text-008o placeholder","result":"fixture text-008o placeholder"},{"id":"msg-008r","turnId":"turn-017","role":"toolResult","generation":null,"timestamp":1791619441758,"responseId":null,"relativeMs":15509848,"durationMs":null,"toolName":"tool_08","toolCallId":"call_0035","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"internalOnly":false,"rawRow":41,"textTruncated":false,"index":62,"hasText":false,"hasThinking":false,"hasArguments":false,"hasResult":true,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_08","summary":"fixture text-008s placeholder","result":"fixture text-008s placeholder"},{"id":"msg-008v","turnId":"turn-017","role":"toolResult","generation":null,"timestamp":1791619595453,"responseId":null,"relativeMs":15663543,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0036","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":true,"internalOnly":false,"rawRow":42,"textTruncated":false,"index":63,"hasText":false,"hasThinking":false,"hasArguments":false,"hasResult":true,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_03","summary":"fixture text-008w placeholder","result":"fixture text-008w placeholder"},{"id":"msg-0098","turnId":"turn-017","role":"assistant","generation":null,"timestamp":1791619777303,"responseId":"fixture text-009d placeholder","relativeMs":15845393,"durationMs":null,"toolName":"tool_04","toolCallId":"call_0037","tokens":{"input":3978,"output":36,"cacheRead":162816,"cacheWrite":0,"totalTokens":166830},"model":"fixture text-009c placeholder","provider":"fixture text-009b placeholder","api":"fixture text-009a placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":43,"textTruncated":false,"index":64,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_04","summary":"tool_04{action=\"fixture text-0099 placeholder\", input=\"{…}\"}","arguments":{"action":"fixture text-0099 placeholder","input":{}},"argumentsOmitted":false},{"id":"msg-009e","turnId":"turn-017","role":"assistant","generation":null,"timestamp":1791620008455,"responseId":"fixture text-009m placeholder","relativeMs":16076545,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":625,"output":823,"cacheRead":184832,"cacheWrite":0,"totalTokens":186280},"model":"fixture text-009l placeholder","provider":"fixture text-009k placeholder","api":"fixture text-009j placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":44,"textTruncated":false,"index":65,"hasText":false,"hasThinking":true,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-009f placeholder","thinking":"fixture text-009f placeholder"},{"id":"msg-009e","turnId":"turn-017","role":"assistant","generation":null,"timestamp":1791620008455,"responseId":"fixture text-009m placeholder","relativeMs":16076545,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0038","model":"fixture text-009l placeholder","provider":"fixture text-009k placeholder","api":"fixture text-009j placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":44,"textTruncated":false,"index":66,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":1,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-009h placeholder\", description=\"fixture text-009i placeholder\", timeout=\"180\"}","arguments":{"command":"fixture text-009h placeholder","description":"fixture text-009i placeholder","timeout":180},"argumentsOmitted":false},{"id":"msg-009n","turnId":"turn-017","role":"toolResult","generation":null,"timestamp":1791620261774,"responseId":null,"relativeMs":16329864,"durationMs":null,"toolName":"tool_04","toolCallId":"call_0039","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":true,"internalOnly":false,"rawRow":45,"textTruncated":false,"index":67,"hasText":false,"hasThinking":false,"hasArguments":false,"hasResult":true,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_04","summary":"fixture text-009o placeholder","result":"fixture text-009o placeholder"},{"id":"msg-009p","turnId":"turn-017","role":"toolResult","generation":null,"timestamp":1791620468950,"responseId":null,"relativeMs":16537040,"durationMs":null,"toolName":"tool_10","toolCallId":"call_0040","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"internalOnly":false,"rawRow":46,"textTruncated":false,"index":68,"hasText":false,"hasThinking":false,"hasArguments":false,"hasResult":true,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_10","summary":"fixture text-009q placeholder","result":"fixture text-009q placeholder"}]},{"id":"turn-018","index":18,"startedAt":1791620759811,"endedAt":1791621281924,"durationMs":522113,"toolCalls":1,"errors":0,"tokens":{"input":1473,"output":346,"cacheRead":255104,"cacheWrite":0,"totalTokens":256923},"turnClass":"none","askedReader":false,"closed":false,"openerInView":false,"openerOutOfView":false,"records":[{"id":"msg-009s","turnId":"turn-018","role":"toolResult","generation":null,"timestamp":1791620759811,"responseId":null,"relativeMs":16827901,"durationMs":null,"toolName":"tool_08","toolCallId":"call_0041","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"internalOnly":false,"rawRow":47,"textTruncated":false,"index":69,"hasText":false,"hasThinking":false,"hasArguments":false,"hasResult":true,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_08","summary":"fixture text-009t placeholder","result":"fixture text-009t placeholder"},{"id":"msg-009w","turnId":"turn-018","role":"assistant","generation":null,"timestamp":1791621014224,"responseId":"fixture text-00a2 placeholder","relativeMs":17082314,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0042","tokens":{"input":1473,"output":346,"cacheRead":255104,"cacheWrite":0,"totalTokens":256923},"model":"fixture text-00a1 placeholder","provider":"fixture text-00a0 placeholder","api":"fixture text-009z placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":48,"textTruncated":false,"index":70,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-009x placeholder\", description=\"fixture text-009y placeholder\", timeout=\"120\"}","arguments":{"command":"fixture text-009x placeholder","description":"fixture text-009y placeholder","timeout":120},"argumentsOmitted":false},{"id":"msg-00a3","turnId":"turn-018","role":"toolResult","generation":null,"timestamp":1791621281924,"responseId":null,"relativeMs":17350014,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0043","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"internalOnly":false,"rawRow":49,"textTruncated":false,"index":71,"hasText":false,"hasThinking":false,"hasArguments":false,"hasResult":true,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_03","summary":"fixture text-00a4 placeholder","result":"fixture text-00a4 placeholder"}]},{"id":"turn-019","index":19,"startedAt":1791621759959,"endedAt":1791622044235,"durationMs":284276,"toolCalls":1,"errors":0,"tokens":{"input":2297,"output":1329,"cacheRead":277632,"cacheWrite":0,"totalTokens":281258},"turnClass":"none","askedReader":false,"closed":false,"openerInView":false,"openerOutOfView":false,"records":[{"id":"msg-00af","turnId":"turn-019","role":"assistant","generation":null,"timestamp":1791621759959,"responseId":"fixture text-00an placeholder","relativeMs":17828049,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":2297,"output":1329,"cacheRead":277632,"cacheWrite":0,"totalTokens":281258},"model":"fixture text-00am placeholder","provider":"fixture text-00al placeholder","api":"fixture text-00ak placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":50,"textTruncated":false,"index":72,"hasText":false,"hasThinking":true,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-00ag placeholder","thinking":"fixture text-00ag placeholder"},{"id":"msg-00af","turnId":"turn-019","role":"assistant","generation":null,"timestamp":1791621759959,"responseId":"fixture text-00an placeholder","relativeMs":17828049,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0044","model":"fixture text-00am placeholder","provider":"fixture text-00al placeholder","api":"fixture text-00ak placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":50,"textTruncated":false,"index":73,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":1,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-00ai placeholder\", description=\"fixture text-00aj placeholder\", timeout=\"180\"}","arguments":{"command":"fixture text-00ai placeholder","description":"fixture text-00aj placeholder","timeout":180},"argumentsOmitted":false},{"id":"msg-00ao","turnId":"turn-019","role":"toolResult","generation":null,"timestamp":1791622044235,"responseId":null,"relativeMs":18112325,"durationMs":null,"toolName":"tool_04","toolCallId":"call_0045","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"internalOnly":false,"rawRow":51,"textTruncated":false,"index":74,"hasText":false,"hasThinking":false,"hasArguments":false,"hasResult":true,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_04","summary":"fixture text-00ap placeholder","result":"fixture text-00ap placeholder"}]},{"id":"turn-020","index":20,"startedAt":1791622638009,"endedAt":1791622638009,"durationMs":0,"toolCalls":1,"errors":0,"tokens":{"input":11033,"output":69,"cacheRead":299264,"cacheWrite":0,"totalTokens":310366},"turnClass":"none","askedReader":false,"closed":false,"openerInView":false,"openerOutOfView":false,"records":[{"id":"msg-00ar","turnId":"turn-020","role":"assistant","generation":null,"timestamp":1791622638009,"responseId":"fixture text-00ay placeholder","relativeMs":18706099,"durationMs":null,"toolName":"tool_11","toolCallId":"call_0046","tokens":{"input":11033,"output":69,"cacheRead":299264,"cacheWrite":0,"totalTokens":310366},"model":"fixture text-00ax placeholder","provider":"fixture text-00aw placeholder","api":"fixture text-00av placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":52,"textTruncated":false,"index":75,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_11","summary":"tool_11{action=\"fixture text-00as placeholder\", pluginId=\"fixture text-00at placeholder\", sourcePath=\"fixture text-00au placeholder\"}","arguments":{"action":"fixture text-00as placeholder","pluginId":"fixture text-00at placeholder","sourcePath":"fixture text-00au placeholder"},"argumentsOmitted":false}]},{"id":"turn-021","index":21,"startedAt":1791623384388,"endedAt":1791623384388,"durationMs":0,"toolCalls":1,"errors":0,"tokens":{"input":175,"output":244,"cacheRead":319744,"cacheWrite":0,"totalTokens":320163},"turnClass":"none","askedReader":false,"closed":false,"openerInView":false,"openerOutOfView":false,"records":[{"id":"msg-00az","turnId":"turn-021","role":"assistant","generation":null,"timestamp":1791623384388,"responseId":"fixture text-00b8 placeholder","relativeMs":19452478,"durationMs":null,"toolName":null,"toolCallId":null,"model":"fixture text-00b7 placeholder","provider":"fixture text-00b6 placeholder","api":"fixture text-00b5 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":53,"textTruncated":false,"index":76,"hasText":false,"hasThinking":true,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-00b0 placeholder","thinking":"fixture text-00b0 placeholder"},{"id":"msg-00az","turnId":"turn-021","role":"assistant","generation":null,"timestamp":1791623384388,"responseId":"fixture text-00b8 placeholder","relativeMs":19452478,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":175,"output":244,"cacheRead":319744,"cacheWrite":0,"totalTokens":320163},"model":"fixture text-00b7 placeholder","provider":"fixture text-00b6 placeholder","api":"fixture text-00b5 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":53,"textTruncated":false,"index":77,"hasText":true,"hasThinking":false,"hasArguments":false,"hasResult":false,"rowPos":1,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"narration","title":"assistant","summary":"fixture text-00b2 placeholder","text":"fixture text-00b2 placeholder"},{"id":"msg-00az","turnId":"turn-021","role":"assistant","generation":null,"timestamp":1791623384388,"responseId":"fixture text-00b8 placeholder","relativeMs":19452478,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0047","model":"fixture text-00b7 placeholder","provider":"fixture text-00b6 placeholder","api":"fixture text-00b5 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":53,"textTruncated":false,"index":78,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":2,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-00b3 placeholder\", description=\"fixture text-00b4 placeholder\", timeout=\"300\"}","arguments":{"command":"fixture text-00b3 placeholder","description":"fixture text-00b4 placeholder","timeout":300},"argumentsOmitted":false}]},{"id":"turn-022","index":22,"startedAt":1791624351892,"endedAt":1791625062330,"durationMs":710438,"toolCalls":3,"errors":0,"tokens":{"input":9613,"output":670,"cacheRead":334848,"cacheWrite":0,"totalTokens":345131},"turnClass":"none","askedReader":false,"closed":false,"openerInView":false,"openerOutOfView":false,"records":[{"id":"msg-00b9","turnId":"turn-022","role":"assistant","generation":null,"timestamp":1791624351892,"responseId":"fixture text-00bi placeholder","relativeMs":20419982,"durationMs":null,"toolName":null,"toolCallId":null,"model":"fixture text-00bh placeholder","provider":"fixture text-00bg placeholder","api":"fixture text-00bf placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":54,"textTruncated":false,"index":79,"hasText":false,"hasThinking":true,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-00ba placeholder","thinking":"fixture text-00ba placeholder"},{"id":"msg-00b9","turnId":"turn-022","role":"assistant","generation":null,"timestamp":1791624351892,"responseId":"fixture text-00bi placeholder","relativeMs":20419982,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":4906,"output":149,"cacheRead":56576,"cacheWrite":0,"totalTokens":61631},"model":"fixture text-00bh placeholder","provider":"fixture text-00bg placeholder","api":"fixture text-00bf placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":54,"textTruncated":false,"index":80,"hasText":true,"hasThinking":false,"hasArguments":false,"hasResult":false,"rowPos":1,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"narration","title":"assistant","summary":"fixture text-00bc placeholder","text":"fixture text-00bc placeholder"},{"id":"msg-00b9","turnId":"turn-022","role":"assistant","generation":null,"timestamp":1791624351892,"responseId":"fixture text-00bi placeholder","relativeMs":20419982,"durationMs":null,"toolName":"tool_12","toolCallId":"call_0048","model":"fixture text-00bh placeholder","provider":"fixture text-00bg placeholder","api":"fixture text-00bf placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":54,"textTruncated":false,"index":81,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":2,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_12","summary":"tool_12{task_id=\"fixture text-00bd placeholder\", reason=\"fixture text-00be placeholder\"}","arguments":{"task_id":"fixture text-00bd placeholder","reason":"fixture text-00be placeholder"},"argumentsOmitted":false},{"id":"msg-00bj","turnId":"turn-022","role":"assistant","generation":null,"timestamp":1791624527065,"responseId":"fixture text-00bq placeholder","relativeMs":20595155,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":4023,"output":283,"cacheRead":98560,"cacheWrite":0,"totalTokens":102866},"model":"fixture text-00bp placeholder","provider":"fixture text-00bo placeholder","api":"fixture text-00bn placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":55,"textTruncated":false,"index":82,"hasText":false,"hasThinking":true,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-00bk placeholder","thinking":"fixture text-00bk placeholder"},{"id":"msg-00bj","turnId":"turn-022","role":"assistant","generation":null,"timestamp":1791624527065,"responseId":"fixture text-00bq placeholder","relativeMs":20595155,"durationMs":null,"toolName":"tool_02","toolCallId":"call_0049","model":"fixture text-00bp placeholder","provider":"fixture text-00bo placeholder","api":"fixture text-00bn placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":55,"textTruncated":false,"index":83,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":1,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_02","summary":"tool_02{task_id=\"fixture text-00bm placeholder\", wait_ms=\"30000\"}","arguments":{"task_id":"fixture text-00bm placeholder","wait_ms":30000},"argumentsOmitted":false},{"id":"msg-00br","turnId":"turn-022","role":"user","generation":null,"timestamp":1791624769221,"responseId":null,"relativeMs":20837311,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":null,"internalOnly":false,"rawRow":56,"textTruncated":false,"index":84,"hasText":true,"hasThinking":false,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"system","title":"injected","summary":"<background-task-finished> fixture injected-00bs block","text":"<background-task-finished>\nfixture injected-00bs block"},{"id":"msg-00bu","turnId":"turn-022","role":"toolResult","generation":null,"timestamp":1791624899122,"responseId":null,"relativeMs":20967212,"durationMs":null,"toolName":"tool_08","toolCallId":"call_0050","tokens":null,"model":null,"provider":null,"api":null,"stopReason":null,"isError":false,"internalOnly":false,"rawRow":57,"textTruncated":false,"index":85,"hasText":false,"hasThinking":false,"hasArguments":false,"hasResult":true,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolResult","title":"tool_08","summary":"fixture text-00bv placeholder","result":"fixture text-00bv placeholder"},{"id":"msg-00by","turnId":"turn-022","role":"assistant","generation":null,"timestamp":1791625062330,"responseId":"fixture text-00c6 placeholder","relativeMs":21130420,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":684,"output":238,"cacheRead":179712,"cacheWrite":0,"totalTokens":180634},"model":"fixture text-00c5 placeholder","provider":"fixture text-00c4 placeholder","api":"fixture text-00c3 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":58,"textTruncated":false,"index":86,"hasText":false,"hasThinking":true,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"thinking","title":"thinking","summary":"fixture text-00bz placeholder","thinking":"fixture text-00bz placeholder"},{"id":"msg-00by","turnId":"turn-022","role":"assistant","generation":null,"timestamp":1791625062330,"responseId":"fixture text-00c6 placeholder","relativeMs":21130420,"durationMs":null,"toolName":"tool_03","toolCallId":"call_0051","model":"fixture text-00c5 placeholder","provider":"fixture text-00c4 placeholder","api":"fixture text-00c3 placeholder","stopReason":"toolUse","isError":null,"internalOnly":false,"rawRow":58,"textTruncated":false,"index":87,"hasText":false,"hasThinking":false,"hasArguments":true,"hasResult":false,"rowPos":1,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"toolCall","title":"tool_03","summary":"tool_03{command=\"fixture text-00c1 placeholder\", description=\"fixture text-00c2 placeholder\"}","arguments":{"command":"fixture text-00c1 placeholder","description":"fixture text-00c2 placeholder"},"argumentsOmitted":false}]},{"id":"turn-023","index":23,"startedAt":1791627571957,"endedAt":1791627571957,"durationMs":0,"toolCalls":0,"errors":0,"tokens":{"input":1188,"output":82,"cacheRead":267008,"cacheWrite":0,"totalTokens":268278},"turnClass":"continuation","askedReader":false,"closed":true,"openerInView":false,"openerOutOfView":false,"records":[{"id":"msg-00c7","turnId":"turn-023","role":"assistant","generation":null,"timestamp":1791627571957,"responseId":"fixture text-00cb placeholder","relativeMs":23640047,"durationMs":null,"toolName":null,"toolCallId":null,"tokens":{"input":1188,"output":82,"cacheRead":267008,"cacheWrite":0,"totalTokens":268278},"model":"fixture text-00ca placeholder","provider":"fixture text-00c9 placeholder","api":"fixture text-00c8 placeholder","stopReason":"stop","isError":null,"internalOnly":false,"rawRow":59,"textTruncated":false,"index":88,"hasText":false,"hasThinking":false,"hasArguments":false,"hasResult":false,"rowPos":0,"tokensBefore":null,"producedBy":null,"parentGeneration":null,"parentCompactionId":null,"parentRevision":null,"kind":"reply","title":"assistant","summary":"assistant","text":null}]}]}
\ No newline at end of file
diff --git a/plugins/avatasia/mmc-trajectory/tests/make-payload.mjs b/plugins/avatasia/mmc-trajectory/tests/make-payload.mjs
index 6774d1a..09ea049 100644
--- a/plugins/avatasia/mmc-trajectory/tests/make-payload.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/make-payload.mjs
@@ -28,21 +28,58 @@ if (!entries.length) {
   process.exit(2);
 }
 
-// `?session=latest` resolves to the most recently touched store, which is how collectSessionEntries
-// already orders them.
-const entry = entries[0];
-const identity = await readSessionIdentity(entry.dir);
-const head = await readHead(join(entry.dir, 'messages.jsonl'), entry.sizeBytes);
-const parsed = parseMessagesJsonl(head.text);
+/**
+ * Which session the fixture is recorded from.
+ *
+ * It used to be `entries[0]` — the most recently touched one. That is not a rule, it is a
+ * timestamp, and it changed the answer without anyone deciding it should: re-recording the fixture
+ * on a machine whose store had been touched since silently replaced 23 turns and 88 records with
+ * 1 turn and 103, taking with it every guard value that was calibrated on the old one. The
+ * committed fixture was still passing its guards afterwards, which is exactly why nothing caught
+ * it — a guard that reads a stale fixture is testing a payload the server cannot produce.
+ *
+ * So: the session with the most turns, ties broken by name. Deterministic, and stated.
+ *
+ * @param {Array<any>} candidates
+ * @param {(entry: any) => Promise<{ turns: any[] }>} project
+ */
+async function pickEntry(candidates, project) {
+  let best = null;
+  let bestTurns = -1;
+  for (const candidate of candidates) {
+    let payload;
+    try { payload = await project(candidate); } catch { continue; }
+    const turns = Array.isArray(payload.turns) ? payload.turns.length : 0;
+    if (turns > bestTurns || (turns === bestTurns && best !== null && String(candidate.dir) < String(best.dir))) {
+      best = candidate;
+      bestTurns = turns;
+    }
+  }
+  return best;
+}
+
+const readOne = async (entry) => {
+  // The entry carries no id — `readSessionIdentity` is where one comes from, and a payload whose
+  // `session.id` is undefined would quietly make every session-keyed guard assert nothing.
+  const identity = await readSessionIdentity(entry.dir);
+  const head = await readHead(join(entry.dir, 'messages.jsonl'), entry.sizeBytes);
+  const parsed = parseMessagesJsonl(head.text);
+  const redact = createRedactor([location.sessionsRoot, location.root]);
+  return { head, parsed, payload: buildTrajectoryPayload({
+    session: { id: identity.id, createdAtMs: entry.lastActiveAt },
+    rows: parsed.rows, sizeBytes: head.size, truncated: head.read < head.size, redact,
+  }) };
+};
+
+const entry = USE_REAL ? entries[0] : await pickEntry(entries, readOne);
+if (!entry) {
+  console.error('no fixture session could be projected');
+  process.exit(2);
+}
+const built = await readOne(entry);
+const { head, parsed, payload } = built;
 const redact = createRedactor([location.sessionsRoot, location.root]);
 
-const payload = buildTrajectoryPayload({
-  session: { id: identity.id, createdAtMs: entry.lastActiveAt },
-  rows: parsed.rows,
-  sizeBytes: head.size,
-  truncated: head.read < head.size,
-  redact,
-});
 // the fields the route sets after building; kept in step with server.mjs:1935-1952
 payload.session.lastActiveAt = entry.lastActiveAt;
 payload.session.activeGeneration = null;
@@ -70,7 +107,7 @@ console.log(`kinds     : ${[...new Set(flat.map((r) => r.kind))].sort().join(',
 console.log(`anomalies : toolError=${flat.filter((r) => r.isError === true).length}`
   + `  compaction=${flat.filter((r) => r.kind === 'compaction').length}`
   + `  openTurns=${payload.turns.filter((t) => t.closed === false).length}`
-  + `  silentReplies=${flat.filter((r) => r.kind === 'reply' && !r.text).length}`);
+  + `  silentReplies=${flat.filter((r) => r.kind === 'reply' && r.hasText === false).length}`);
 console.log(`size      : ${(text.length / 1024).toFixed(0)} KB -> ${OUT}`);
 
 if (process.argv.includes('--check')) {
@@ -84,5 +121,31 @@ if (!process.argv.includes('--record')) {
   console.log('\n(dry run -- pass --record to write)');
   process.exit(0);
 }
+
+/**
+ * What the guards read this file for. `--record` refuses without all of it.
+ *
+ * `make-fixtures.mjs` gates the session store the same way. This one had no gate at all, and the
+ * store is synthetic but the choice of session was not: recording from a session without an empty
+ * reply silently deletes the only fixture the 空答复 rule is tested on, and every guard reading it
+ * afterwards asserts against a shape that is not there.
+ *
+ * `silent` is counted off `hasText`, not off `text`: the flag is what the page decides with now,
+ * and a coverage count read off a field the payload no longer carries would read zero for a
+ * fixture that is perfectly good.
+ */
+const coverage = {
+  turns: payload.turns.length,
+  toolError: flat.filter((r) => r.isError === true).length,
+  compaction: flat.filter((r) => r.kind === 'compaction').length,
+  openTurns: payload.turns.filter((t) => t.closed === false).length,
+  silent: flat.filter((r) => r.kind === 'reply' && r.hasText === false).length,
+};
+const missing = Object.entries(coverage).filter(([, n]) => n < 1).map(([name]) => name);
+if (missing.length) {
+  console.error(`refusing to record: the fixture would have no ${missing.join(', ')}`);
+  console.error('the guards that read this file assert on those, and would go quietly vacuous');
+  process.exit(1);
+}
 writeFileSync(OUT, text, 'utf8');
 console.log('\nwritten');
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-anomaly.py b/plugins/avatasia/mmc-trajectory/tests/mutate-anomaly.py
index 1f1e723..c90fcc8 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-anomaly.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-anomaly.py
@@ -367,33 +367,42 @@
     # --- 空答复: a reply the runtime finished and then delivered nothing into.
     # Every other rule tests a field that was there. This one tests an absence, so most of the
     # ways to get it wrong are over-matching rather than under-matching.
+    #
+    # The absence it tests is `hasText === false` and not `isNil(record.text)` any more: the body
+    # does not travel with the row, so the rule reads the server's verdict on it. The shape of the
+    # trap is unchanged — a strict `=== false` is what keeps a record from an older payload, which
+    # has neither flag nor body, from being called an anomaly.
     ("an empty answer rule that ignores the body", "a reply that said something is not",
-     "            return !!record && record.kind === 'reply' && isNil(record.text);",
+     "            return !!record && record.kind === 'reply' && record.hasText === false;",
      "            return !!record && record.kind === 'reply';"),
     ("the no-body test inverted, so every spoken reply becomes an anomaly",
      "a reply with no body is an empty answer",
-     "            return !!record && record.kind === 'reply' && isNil(record.text);",
-     "            return !!record && record.kind === 'reply' && !isNil(record.text);"),
+     "            return !!record && record.kind === 'reply' && record.hasText === false;",
+     "            return !!record && record.kind === 'reply' && record.hasText === true;"),
+    # The expected name is the checkpoint assertion, not "a normal row is not an anomaly". A row
+    # with a body cannot fire this rule whichever way the KIND test is written, so that assertion
+    # has nothing to say about an inversion here; the record that does is a non-reply WITHOUT a
+    # body, and the fixture that owns "a non-reply is not an empty answer" is the checkpoint one.
     ("the kind test inverted, so every non-reply is an empty answer",
-     "a normal row is not an anomaly",
-     "            return !!record && record.kind === 'reply' && isNil(record.text);",
-     "            return !!record && record.kind !== 'reply' && isNil(record.text);"),
+     "a checkpoint is not also an empty answer",
+     "            return !!record && record.kind === 'reply' && record.hasText === false;",
+     "            return !!record && record.kind !== 'reply' && record.hasText === false;"),
     # Dropping the body and reading truncation instead hits the plain no-body case first, on a
     # record that carries no truncation flag at all. That assertion is the one that owns it.
     ("no-body judged by truncation instead of by absence", "a reply with no body is an empty answer",
-     "            return !!record && record.kind === 'reply' && isNil(record.text);",
+     "            return !!record && record.kind === 'reply' && record.hasText === false;",
      "            return !!record && record.kind === 'reply' && record.textTruncated === false;"),
     ("a checkpoint counted twice, once as a checkpoint and once as an empty answer",
      "a checkpoint is not also an empty answer",
-     "            return !!record && record.kind === 'reply' && isNil(record.text);",
-     "            return !!record && isNil(record.text);"),
+     "            return !!record && record.kind === 'reply' && record.hasText === false;",
+     "            return !!record && record.hasText === false;"),
     ("the empty-answer rule never fires", "empty answer count matches the payload",
-     "            return !!record && record.kind === 'reply' && isNil(record.text);",
+     "            return !!record && record.kind === 'reply' && record.hasText === false;",
      "            return false;"),
 
     # --- and the row, because a filter that shows these without marking them shows nothing
     ("the empty-answer marker removed from the row", "an empty reply is marked on its row",
-     "        var silent = record.kind === 'reply' && isNil(record.text);",
+     "        var silent = record.kind === 'reply' && record.hasText === false;",
      "        var silent = false;"),
     ("the row's marker branch dropped, leaving the duration cell instead",
      "and it reuses the duration cell instead of adding a column",
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-raw-lazy.py b/plugins/avatasia/mmc-trajectory/tests/mutate-raw-lazy.py
index 7bdf1bf..c3dae0f 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-raw-lazy.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-raw-lazy.py
@@ -55,8 +55,8 @@
     (
         "server: /raw hands back a stored message instead of building one",
         SERVER,
-        "    const built = buildRawPayload(row.message, redact);\n",
-        "    const built = { value: row.message, omitted: false };\n",
+        "    const built = buildRawPayload(found.row.message, redact);\n",
+        "    const built = { value: found.row.message, omitted: false };\n",
     ),
     (
         "server: /raw stops reporting whether the message was too large",
@@ -67,7 +67,7 @@
     (
         "server: /raw keeps the rows out of the cache entry, so it cannot resolve a locator",
         SERVER,
-        "body, raws, decoded: new Map() });",
+        "body, raws, rowPos: rowPosByRecord, decoded: new Map() });",
         "body, decoded: new Map() });",
     ),
     # ---- the cap must still hold, wherever it now lives ----------------------
@@ -97,10 +97,14 @@
         "          if (false) {\n",
     ),
     (
+        # Anchored on the insertBefore above it, not on the dash alone. `pre.textContent = DASH;`
+        # followed by `return;` now appears twice — once where an omitted message is drawn and once
+        # where a detail read came back empty — and an anchor loose enough to match either made this
+        # rewrite the wrong one, which the guard's own substring could not tell apart.
         "client: the raw tab shows the message even when it was omitted",
         CLIENT,
-        "            pre.textContent = DASH;\n            return;",
-        "            pre.innerHTML = jsonColorize(fetched.raw);\n            return;",
+        "              pre\n            );\n            pre.textContent = DASH;\n            return;",
+        "              pre\n            );\n            pre.innerHTML = jsonColorize(fetched.raw);\n            return;",
     ),
     (
         "client: copySelected stops honouring the omitted verdict",
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-raw-locators.py b/plugins/avatasia/mmc-trajectory/tests/mutate-raw-locators.py
index 7485770..ff47401 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-raw-locators.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-raw-locators.py
@@ -127,8 +127,8 @@
     (
         "server: the rows are put back into the cache entry, so the object graph stays resident",
         SERVER,
-        "body, raws, decoded: new Map() });",
-        "body, raws, decoded: new Map(), rows });",
+        "body, raws, rowPos: rowPosByRecord, decoded: new Map() });",
+        "body, raws, rowPos: rowPosByRecord, decoded: new Map(), rows });",
     ),
     (
         "server: the rows are never released, so the request holds them until it returns",
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-record-detail.py b/plugins/avatasia/mmc-trajectory/tests/mutate-record-detail.py
new file mode 100644
index 0000000..4f88eac
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-record-detail.py
@@ -0,0 +1,223 @@
+"""Mutation control for the payload slimming and the record-detail endpoint.
+
+The page stopped being sent `text`, `thinking`, `arguments` and `result`, which were 59.1% of the
+body measured over this machine's whole store. Four presence flags took their place and
+`/api/trajectory/record` answers for one record at a time. A move like that fails in ways that
+render fine:
+
+  - a flag that disagrees with the value it was measured from draws an empty tab, or hides one;
+  - a strip that is applied a step too late still produces a correct body and a fat one;
+  - a `rowPos` that is not per-row answers with another record's thinking block;
+  - a summary chain that loses its tool-name step puts `—` where a row used to name its tool.
+
+Each mutation below is one of those, and each has to be caught **by name** — a guard that fails
+for some other reason is not evidence that this one was caught.
+"""
+import subprocess
+import sys
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parent
+SERVER = ROOT / "miniapp" / "node" / "server.mjs"
+CLIENT = ROOT / "miniapp" / "client" / "index.html"
+PROBE = HERE / "verify-record-detail.mjs"
+
+MUTATIONS = [
+    # --- the flags -------------------------------------------------------------------
+    (
+        "hasText is taken on trust instead of measured, so an empty reply claims a body",
+        SERVER,
+        "        hasText: !isNilField(patch.text),",
+        "        hasText: true,",
+    ),
+    (
+        "hasResult is taken on trust, so a tool result with no body still offers its tab",
+        SERVER,
+        "        hasResult: !isNilField(patch.result),",
+        "        hasResult: true,",
+    ),
+    (
+        "hasArguments counts an empty string as absent, which is not the test the page used",
+        SERVER,
+        "        hasArguments: patch.arguments !== null && patch.arguments !== undefined,",
+        "        hasArguments: !isNilField(patch.arguments),",
+    ),
+    # --- the strip -------------------------------------------------------------------
+    (
+        "the strip leaves the body field on, so the page gets back everything it lost",
+        SERVER,
+        "      delete record.text;\n      delete record.thinking;",
+        "      delete record.thinking;",
+    ),
+    (
+        "the strip runs after the body was serialized, so it changes nothing that was sent",
+        SERVER,
+        "    slimPayloadForWire(payload);\n\n    let body;",
+        "    let body;",
+    ),
+    (
+        "the strip also runs on the search path, which still reads those fields in this process",
+        SERVER,
+        "    const needle = foldNeedle(asked);",
+        "    const needle = foldNeedle(asked);\n    slimPayloadForWire({ turns: [] });",
+    ),
+    # --- which record the endpoint answers for ----------------------------------------
+    (
+        "every record claims position zero, so a line with several records answers for the first",
+        SERVER,
+        "        rowPos: rowPos++,",
+        "        rowPos: 0,",
+    ),
+    (
+        "the position is offered even for a record with no line to project",
+        SERVER,
+        "        if (rowPos !== null && typeof pos === 'number' && Number.isInteger(pos) && pos >= 0) {",
+        "        if (rowPos !== null) {",
+    ),
+    (
+        "the endpoint projects the row twice, so every position after the first is one off",
+        SERVER,
+        "      rows: [found.row],",
+        "      rows: [found.row, found.row],",
+    ),
+    (
+        "a position the one-row projection cannot produce is answered with whatever is nearest",
+        SERVER,
+        "    if (record === undefined) {",
+        "    if (record === undefined) {\n      record = one.turns.flatMap((turn) => turn.records ?? [])[0];\n    }\n    if (record === undefined) {",
+    ),
+    (
+        "the endpoint answers with a kind, which re-projecting one line cannot reproduce",
+        SERVER,
+        "    sendJson(response, 200, {\n      index: wanted,",
+        "    sendJson(response, 200, {\n      index: wanted,\n      kind: record.kind,",
+    ),
+    # --- the summary the page used to assemble ----------------------------------------
+    (
+        "the tool-name step is dropped from the summary, so a tool result row shows nothing",
+        SERVER,
+        "      if (!record.summary) record.summary = record.toolName || record.title || '';",
+        "      if (!record.summary) record.summary = '';",
+    ),
+    # --- the page --------------------------------------------------------------------
+    (
+        "the page decides 「has a body」 for itself again, from a field it no longer receives",
+        CLIENT,
+        "return !!record && record.kind === 'reply' && record.hasText === false;",
+        "return !!record && record.kind === 'reply' && isNil(record.text);",
+    ),
+    (
+        "the row falls back to the tool name itself, undoing the fold on the server",
+        CLIENT,
+        "        var summaryText = record.summary || '';",
+        "        var summaryText = record.summary || record.toolName || '';",
+    ),
+    (
+        "the 结果 tab renders the record again, which after the slimming is always empty",
+        CLIENT,
+        "        if (tabId === 'result') return buildDetailBlock('工具结果', record, 'result', false);",
+        "        if (tabId === 'result') return buildBlock('工具结果', record.result, false);",
+    ),
+    (
+        "the tab is offered from a field the page no longer has, so it is always on",
+        CLIENT,
+        "            return record.kind === 'toolResult' && record.hasResult === true;",
+        "            return record.kind === 'toolResult' && record.result !== null;",
+    ),
+    (
+        "failure is decided by the field that was a duplicate, which no longer exists",
+        CLIENT,
+        "        var failed = record.isError === true;",
+        "        var failed = !!(record.isError || record.error);",
+    ),
+]
+
+
+def read_exact(path):
+    data = path.read_bytes()
+    text = data.decode("utf-8").replace("\r\n", "\n")
+    return text, ("\r\n" if b"\r\n" in data else "\n")
+
+
+def write_exact(path, text, newline):
+    if newline == "\r\n":
+        text = text.replace("\n", "\r\n")
+    path.write_bytes(text.encode("utf-8"))
+
+
+def run_probe():
+    proc = subprocess.run(
+        ["node", str(PROBE)], cwd=str(ROOT), capture_output=True, text=True,
+        encoding="utf-8", errors="replace",
+    )
+    return proc.returncode, (proc.stdout or "") + (proc.stderr or "")
+
+
+def named_failure(output):
+    """The first assertion the probe named, or None when it failed without naming one."""
+    return next(
+        (line.strip()[1:].strip() for line in output.splitlines()
+         if line.strip().startswith("- ")),
+        None,
+    )
+
+
+def main():
+    code, output = run_probe()
+    if code != 0:
+        print("baseline probe does not pass; fix that first")
+        print(output)
+        return 1
+    print("baseline clean")
+
+    originals = {path: path.read_bytes() for path in {m[1] for m in MUTATIONS}}
+    missed, unnamed = [], []
+    try:
+        for label, path, old, new in MUTATIONS:
+            text, newline = read_exact(path)
+            if old not in text:
+                print(f"SKIP  {label}: anchor not found")
+                missed.append(label)
+                continue
+            if old == new:
+                print(f"SKIP  {label}: the mutation changes nothing")
+                missed.append(label)
+                continue
+            write_exact(path, text.replace(old, new, 1), newline)
+            try:
+                code, output = run_probe()
+            finally:
+                write_exact(path, text, newline)
+            if code == 0:
+                print(f"MISSED {label}: the probe still passed")
+                missed.append(label)
+                continue
+            name = named_failure(output)
+            if name is None:
+                print(f"UNNAMED {label}: the probe failed without naming a rule")
+                unnamed.append(label)
+            else:
+                print(f"caught {label}\n         -> {name}")
+    finally:
+        for path, data in originals.items():
+            path.write_bytes(data)
+
+    not_restored = [str(p) for p, data in originals.items() if p.read_bytes() != data]
+    if not_restored:
+        print("NOT RESTORED " + ", ".join(not_restored))
+        return 1
+    print("files restored byte-for-byte")
+
+    if missed or unnamed:
+        if missed:
+            print(f"\n{len(missed)} mutation(s) got through")
+        if unnamed:
+            print(f"{len(unnamed)} mutation(s) failed without naming a rule")
+        return 1
+    print(f"\nall {len(MUTATIONS)} mutations caught, each by name")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-cache.py b/plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-cache.py
index 4f31a03..1a007d1 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-cache.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-cache.py
@@ -47,8 +47,8 @@
     (
         "the route names the whole key as the family, so every version is its own family",
         SERVER,
-        "trajectoryCache.set(cacheKey, trajectoryCacheFamily(entry.dir, filter), { at: Date.now(), etag, body, raws, decoded: new Map() });",
-        "trajectoryCache.set(cacheKey, cacheKey, { at: Date.now(), etag, body, raws, decoded: new Map() });",
+        "trajectoryCache.set(cacheKey, trajectoryCacheFamily(entry.dir, filter), { at: Date.now(), etag, body, raws, rowPos: rowPosByRecord, decoded: new Map() });",
+        "trajectoryCache.set(cacheKey, cacheKey, { at: Date.now(), etag, body, raws, rowPos: rowPosByRecord, decoded: new Map() });",
     ),
     (
         "the family stops naming the slice, so one session's generations evict each other",
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-anomaly.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-anomaly.mjs
index c99d5e1..f8f5b75 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-anomaly.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-anomaly.mjs
@@ -133,8 +133,14 @@ check('a checkpoint is a compaction',
   pure.recordAnomalyRules({ kind: 'compaction' }, { turn: CLOSED, liveTurn: LIVE }), ['compaction']);
 // A thinking row is the clean case. `{ kind: 'reply' }` is not — a reply with no body is now
 // an anomaly, which is the whole point of the rule below.
+//
+// `hasText: true` is on the fixture and not decoration. The rule tests `hasText === false`
+// strictly, so a record carrying no flag at all is not flagged — deliberate, because a record from
+// an older payload has neither the flag nor the body and must not be called broken. The cost is
+// that a fixture without the flag cannot see a mutation that inverts the KIND test, so the fixture
+// has to look like a real record.
 check('a normal row is not an anomaly',
-  pure.recordAnomalyRules({ kind: 'thinking' }, { turn: CLOSED, liveTurn: LIVE }), []);
+  pure.recordAnomalyRules({ kind: 'thinking', hasText: true }, { turn: CLOSED, liveTurn: LIVE }), []);
 
 check('a turn that never answered, seen from inside it',
   pure.recordAnomalyRules({ kind: 'thinking' }, withLive(BROKEN)), ['noReply']);
@@ -160,8 +166,11 @@ check('two rules can fire on one record',
 // so `closed` is true and 无答复 cannot fire — and the record is still `kind: 'reply'`, so it
 // remains a real reply that the 答复 chip counts. Missing it was a hole in the rule set, not a
 // subtlety: every other rule tests a field that was present, this one tests an absence.
-const SILENT = { kind: 'reply', text: null, summary: '', title: 'assistant', stopReason: 'stop' };
-const SPOKE = { kind: 'reply', text: '答完了。', summary: '答完了。', stopReason: 'stop' };
+// These records carry `hasText`, not `text`. The rule stopped reading the body and reads the
+// server's verdict on it, because the body no longer travels with the row — so a fixture built out
+// of `text` here would be testing a record the server can no longer produce.
+const SILENT = { kind: 'reply', hasText: false, summary: '', title: 'assistant', stopReason: 'stop' };
+const SPOKE = { kind: 'reply', hasText: true, summary: '答完了。', stopReason: 'stop' };
 
 check('a reply with no body is an empty answer',
   pure.recordAnomalyRules(SILENT, { turn: CLOSED, liveTurn: LIVE }), ['silent']);
@@ -183,19 +192,21 @@ check('an empty answer in a closed turn is only the empty answer',
 check('the same record in a turn that never answered fires both',
   pure.recordAnomalyRules(SILENT, withLive(BROKEN)), ['noReply', 'silent']);
 
-// An empty string counts as no body; whitespace does not, because a reader sees something.
-check('an empty string is an empty answer',
-  pure.recordAnomalyRules({ kind: 'reply', text: '' }, { turn: CLOSED, liveTurn: LIVE }), ['silent']);
-check('whitespace is not an empty answer',
-  pure.recordAnomalyRules({ kind: 'reply', text: ' ' }, { turn: CLOSED, liveTurn: LIVE }), []);
+// An empty string counts as no body and whitespace does not — but that is now the server's call,
+// made once when it projected the text, and this only pins that the rule obeys the verdict either
+// way rather than re-deriving it.
+check('a reply the server found empty is an empty answer',
+  pure.recordAnomalyRules({ kind: 'reply', hasText: false }, { turn: CLOSED, liveTurn: LIVE }), ['silent']);
+check('a reply the server found non-empty is not',
+  pure.recordAnomalyRules({ kind: 'reply', hasText: true }, { turn: CLOSED, liveTurn: LIVE }), []);
 // A clipped reply still has a body, however short. textTruncated is not the test.
 check('a clipped reply is not an empty answer',
-  pure.recordAnomalyRules({ kind: 'reply', text: '很长的…', textTruncated: true },
+  pure.recordAnomalyRules({ kind: 'reply', hasText: true, textTruncated: true },
     { turn: CLOSED, liveTurn: LIVE }), []);
 // Only replies. A checkpoint has no body by design and is already its own rule; counting it
 // twice would make the union smaller than the parts, which is the one thing `any` must not be.
 check('a checkpoint is not also an empty answer',
-  pure.recordAnomalyRules({ kind: 'compaction', text: null }, { turn: CLOSED, liveTurn: LIVE }),
+  pure.recordAnomalyRules({ kind: 'compaction', hasText: false }, { turn: CLOSED, liveTurn: LIVE }),
   ['compaction']);
 check('a system record with no body is not an empty answer',
   pure.recordAnomalyRules({ kind: 'system', text: null }, { turn: CLOSED, liveTurn: LIVE }), []);
@@ -994,8 +1005,12 @@ assert('with the rule name, not a bare colour', /anomalyRuleLabel\(turnFlags\[fl
 // pill — it is a reply — but with no body the marker is the only thing telling the reader this
 // is not an answer, and the duration cell is where 失败 already took one.
 const rowSrc = fnSource('function buildRow(');
+// `isNil(record.text)` used to be this. The body does not travel with the row any more, so the row
+// reads the server's verdict instead — and reads it strictly (`=== false`), because a record from a
+// payload that predates the flag has neither `hasText` nor a body, and treating that as "has a body"
+// would draw a marker on a record the server never said anything about.
 assert('an empty reply is marked on its row',
-  /record\.kind === 'reply' && isNil\(record\.text\)/.test(rowSrc));
+  /record\.kind === 'reply' && record\.hasText === false/.test(rowSrc));
 assert('and it reuses the duration cell instead of adding a column',
   /else if \(silent\) \{[\s\S]*?anomalyRuleLabel\('silent'\)[\s\S]*?\} else \{/.test(rowSrc));
 assert('the row names the rule from the table, not from a label written here',
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-raw-lazy.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-raw-lazy.mjs
index 3b8fda6..39e4cba 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-raw-lazy.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-raw-lazy.mjs
@@ -146,9 +146,17 @@ const handleRawAt = SERVER.indexOf('const handleRaw = async');
 assert('handleRaw exists', handleRawAt > 0);
 const handleRawBody = SERVER.slice(handleRawAt, SERVER.indexOf('};', handleRawAt));
 assert('it calls buildRawPayload, i.e. it builds rather than looks up a stored message',
-  handleRawBody.includes('buildRawPayload(row.message, redact)'));
-assert('it follows the locator back into the file the record came from',
-  handleRawBody.includes('readRange(locator.filePath, locator.start, locator.end)'));
+  handleRawBody.includes('buildRawPayload(found.row.message, redact)'));
+// The read and its digest check were written here until `/api/trajectory/record` needed the same
+// two steps. Two copies is two answers to 「这还是那条记录对应的字节吗」, and the guard could not
+// even tell them apart — a mutation against one of them left the other satisfying the assertion.
+assert('the read and its digest check live in one place both handlers call',
+  /readRecordRow\s*=\s*async/.test(SERVER)
+  && SERVER.includes('readRange(locator.filePath, locator.start, locator.end)')
+  && SERVER.includes('lineDigest(bytes) !== locator.digest')
+  && handleRawBody.includes('readRecordRow(locator)'));
+assert('and neither handler re-reads a line for itself',
+  !handleRawBody.includes('readRange(') && !handleRawBody.includes('lineDigest('));
 assert('it reports the verdict alongside the message', /omitted: built\.omitted/.test(handleRawBody));
 assert('a missing row is still a 404, not an empty message', handleRawBody.includes("'record_not_found'"));
 // The entry shape lives in createTrajectoryCache now, so this asserts the thing the assertions
@@ -156,8 +164,11 @@ assert('a missing row is still a 404, not an empty message', handleRawBody.inclu
 // `cached.raws` back out of it. It used to store `rows` and read `cached.rows`, which is the thing
 // that was costing 233 MB; anchoring on the JSDoc type comment instead would have made this a
 // check on where a type was written rather than on what the route does.
+// `rowPos` sits next to `raws` in the entry and for the same reason: both say where a record's
+// content lives once the parsed rows are gone, and the position is what lets `/api/trajectory/record`
+// answer for one record of a line that expanded into several.
 assert('the cache entry keeps the locators /raw follows, keyed by record',
-  SERVER.includes('raws, decoded: new Map() })')
+  SERVER.includes('raws, rowPos: rowPosByRecord, decoded: new Map() })')
   && handleRawBody.includes('cached.raws.get(wanted)'));
 
 /* =====================================================================
@@ -170,8 +181,8 @@ assert('the cache entry keeps the locators /raw follows, keyed by record',
 assert('1 handoff: the line reads the argument, not the record',
   CLIENT.includes("if (rawOmitted) lines.push('- 提示：原文过大已被省略。');"));
 assert('1 handoff: buildHandoffMarkdown takes the verdict',
-  /function buildHandoffMarkdown\(session, turn, record, rawText, rawTruncated, rawOmitted\)/.test(CLIENT));
-assert('1 handoff: the caller passes it', CLIENT.includes('raw.truncated,\n            omitted\n          );'));
+  /function buildHandoffMarkdown\(session, turn, record, rawText, rawTruncated, rawOmitted, errorText\)/.test(CLIENT));
+assert('1 handoff: the caller passes it', CLIENT.includes('raw.truncated,\n            omitted,\n            detail && detail.result ? detail.result : null\n          );'));
 
 assert('2 rawSourceFor: no longer short-circuits on the record',
   /function rawSourceFor\(record\) \{\s*return fetchRaw\(record\);/.test(CLIENT));
@@ -182,7 +193,12 @@ assert('3 raw tab: draws the omitted note from the answer',
 assert('3 raw tab: and the note still says the same thing',
   CLIENT.includes('原文过大，已省略。可以从参数与结果页查看已保留的部分。'));
 
-assert('4 raw tab: an omitted message renders the dash', CLIENT.includes('pre.textContent = DASH;\n            return;'));
+// Anchored on the insertBefore above it. `pre.textContent = DASH;` + `return;` is written twice in
+// the page now — the omitted-message branch and the empty-detail branch — so a pattern loose
+// enough to match either is satisfied by a change to just one of them, which is what a mutation
+// that targets the wrong copy looks like from here.
+assert('4 raw tab: an omitted message renders the dash',
+  CLIENT.includes('              pre\n            );\n            pre.textContent = DASH;\n            return;'));
 assert('5 copySelected: reads the new shape',
   CLIENT.includes('var noRaw = fetched.omitted === true || fetched.raw === null || fetched.raw === undefined;'));
 assert('handoff: reads the new shape', CLIENT.includes('var omitted = fetched.omitted === true;'));
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-raw-locators.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-raw-locators.mjs
index cffc5db..0faf2ca 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-raw-locators.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-raw-locators.mjs
@@ -243,9 +243,21 @@ const handleRawAt = startBody.indexOf('const handleRaw = async');
 assert('handleRaw exists', handleRawAt > 0);
 const rawBody = startBody.slice(handleRawAt, startBody.indexOf('const handleDashboard'));
 assert('handleRaw does not read the rows the entry used to keep', !rawBody.includes('cached.rows'));
-assert('it reads the line back through readRange', rawBody.includes('readRange(locator.filePath, locator.start, locator.end)'));
+// The read and its digest check moved into `readRecordRow` when `/api/trajectory/record` needed
+// the same two steps. They are asserted there and the handler is asserted to call it — a second
+// copy in one of the handlers would be a second answer to the same question, and would also have
+// made these two assertions pass for the wrong copy.
+const readRowAt = startBody.indexOf('const readRecordRow = async');
+assert('the shared line reader exists', readRowAt > 0);
+const readRowBody = startBody.slice(readRowAt, startBody.indexOf('const handleRaw = async'));
+assert('it reads the line back through readRange', readRowBody.includes('readRange(locator.filePath, locator.start, locator.end)'));
 assert('and refuses the answer when the digest disagrees',
-  rawBody.includes('lineDigest(bytes) !== locator.digest') && rawBody.includes("'raw_stale'"));
+  readRowBody.includes('lineDigest(bytes) !== locator.digest') && readRowBody.includes("'raw_stale'"));
+assert('handleRaw goes through it rather than reading a line of its own',
+  rawBody.includes('readRecordRow(locator)') && !rawBody.includes('lineDigest('));
+assert('and so does the record-detail endpoint',
+  startBody.includes("url.pathname === '/api/trajectory/record'")
+  && !startBody.slice(startBody.indexOf('const handleRecord = async'), readRowAt).includes('lineDigest('));
 assert('the decode cache is bounded rather than grown',
   rawBody.includes('cached.decoded.size > RAW_DECODE_CACHE_ENTRIES'));
 assert('RAW_DECODE_CACHE_ENTRIES is a real bound, not a comment',
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-record-detail.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-record-detail.mjs
new file mode 100644
index 0000000..46b2d57
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-record-detail.mjs
@@ -0,0 +1,443 @@
+/**
+ * The page stopped being sent the bulk, so every question it used to answer from the payload has to
+ * have exactly one remaining answer — and the endpoint that replaces the payload has to give back
+ * the same values the payload used to carry.
+ *
+ * The move: `text`, `thinking`, `arguments` and `result` are no longer on the wire. Measured over
+ * this machine's store they were 59.1% of the body (`result` 26.6%, `thinking` 13.2%, `arguments`
+ * 9.3%, `text` 8.9%), and the page held all of it to draw a ledger row and, once in a while, one
+ * inspector tab. What replaces them is four presence flags measured at `push()`, and
+ * `/api/trajectory/record` for the values.
+ *
+ * Four things can go wrong here, and none of them throws:
+ *
+ *  1. **The flags could disagree with the values they were measured from.** A record that says
+ *     `hasText: true` and carries no text draws an empty tab; one that says false and carries text
+ *     hides content the reader came for. So every flag is checked against the value on the same
+ *     record, over every record of the payload.
+ *
+ *  2. **The endpoint could answer with a different record.** It re-projects one stored line and
+ *     picks by `rowPos`, so a wrong position shows the reader another model's reasoning as if it
+ *     were this one. Part 5 re-derives every record of the payload the same way the endpoint does
+ *     and compares the four values.
+ *
+ *  3. **The payload could stop being the only place the flags are decided.** `slimPayloadForWire()`
+ *     strips; it never measures. If it started deciding, the page and the endpoint could answer
+ *     「这条记录有没有正文」 differently — which is exactly how they came to disagree before.
+ *
+ *  4. **The slimming could leak into the parts that still need the values.** The search reads them
+ *     off the projected records in this process, so stripping at `push()` would have broken search
+ *     to save the page memory. Part 7 pins where the strip happens.
+ *
+ * Read-only: imports the pure helpers; never starts the runtime.
+ * mutate-record-detail.py breaks each of these in the shipped server.
+ */
+import { readFileSync } from 'node:fs';
+import {
+  buildTrajectoryPayload,
+  slimPayloadForWire,
+  splitRawRecords,
+  createRedactor,
+} from '../miniapp/node/server.mjs';
+
+const SERVER = readFileSync(new URL('../miniapp/node/server.mjs', import.meta.url), 'utf8');
+const CLIENT = readFileSync(new URL('../miniapp/client/index.html', import.meta.url), 'utf8');
+
+let pass = 0;
+const failures = [];
+function check(name, actual, expected) {
+  if (JSON.stringify(actual) === JSON.stringify(expected)) pass += 1;
+  else failures.push(`${name}: got ${JSON.stringify(actual)}, want ${JSON.stringify(expected)}`);
+}
+function assert(name, cond) {
+  if (cond) pass += 1;
+  else failures.push(name);
+}
+
+/* The page's own definition. If the server's flags disagree with this, the page draws tabs the
+ * server never promised — and `arguments` is deliberately the looser of the two. */
+function pageIsNil(value) {
+  return value === null || value === undefined || value === '';
+}
+function pageHasArguments(record) {
+  return record.arguments !== null && record.arguments !== undefined;
+}
+
+const BULK = ['text', 'thinking', 'arguments', 'result'];
+const FLAGS = ['hasText', 'hasThinking', 'hasArguments', 'hasResult'];
+const FLAGS_OF = { hasText: 'text', hasThinking: 'thinking', hasArguments: 'arguments', hasResult: 'result' };
+
+/* =====================================================================
+ * A payload with every kind that carries a bulk field, plus a failed one
+ * ===================================================================== */
+
+const msg = (role, extra) => ({ role, ...extra });
+const ROWS = [
+  {
+    message_id: 'u1',
+    turn_id: 't1',
+    message: msg('user', { content: 'please read the file', timestamp: 1000 }),
+  },
+  {
+    message_id: 'a1',
+    turn_id: 't1',
+    message: msg('assistant', {
+      timestamp: 1100,
+      responseId: 'R1',
+      stopReason: 'toolUse',
+      content: [
+        { type: 'thinking', thinking: 'the plan is to read it first' },
+        { type: 'text', text: 'reading now' },
+        { type: 'toolCall', id: 'c1', name: 'read', arguments: { path: 'a.txt' } },
+      ],
+    }),
+  },
+  {
+    message_id: 'r1',
+    turn_id: 't1',
+    message: msg('toolResult', { toolCallId: 'c1', toolName: 'read', content: 'the file says hello', timestamp: 1200 }),
+  },
+  {
+    message_id: 'r2',
+    turn_id: 't1',
+    message: msg('toolResult', {
+      toolCallId: 'c2', toolName: 'read', timestamp: 1300, isError: true, content: 'no such file',
+    }),
+  },
+  {
+    // An assistant turn that produced nothing at all. This is the record the 「空答复」 rule is
+    // about, and it is the reason `hasText` cannot be inferred from `summary` being empty.
+    message_id: 'a2',
+    turn_id: 't2',
+    message: msg('assistant', { timestamp: 1400, responseId: 'R2', stopReason: 'stop', content: [] }),
+  },
+  {
+    // A tool call whose arguments are an empty STRING. `prepareArguments` stringifies a
+    // non-object, so this is reachable, and it is the one shape where the two candidate
+    // definitions of 「has arguments」 disagree: the page's test says an empty string is present,
+    // and 「not null / not undefined / not empty string」 says it is not. A fixture with only real
+    // object arguments cannot tell those two definitions apart.
+    message_id: 'a3',
+    turn_id: 't2',
+    message: msg('assistant', {
+      timestamp: 1500,
+      stopReason: 'toolUse',
+      content: [{ type: 'toolCall', id: 'c3', name: 'ping', arguments: '' }],
+    }),
+  },
+];
+
+const redact = createRedactor([]);
+const payload = buildTrajectoryPayload({
+  session: { id: 's1', createdAtMs: 1000 },
+  rows: ROWS,
+  sizeBytes: 0,
+  truncated: false,
+  redact,
+});
+const flat = payload.turns.flatMap((turn) => turn.records ?? []);
+const byKind = (kind) => flat.filter((record) => record.kind === kind);
+
+/* =====================================================================
+ * 1. The flags say what the values say
+ * ===================================================================== */
+
+assert('the fixture produced records', flat.length > 0);
+for (const flag of FLAGS) assert(`every record carries ${flag}`, flat.every((record) => flag in record));
+
+for (const record of flat) {
+  for (const flag of FLAGS) {
+    const field = FLAGS_OF[flag];
+    if (flag === 'hasArguments') continue; // checked on its own below
+    check(`${flag} matches "${field}" on #${record.index} (${record.kind})`,
+      record[flag], !pageIsNil(record[field]));
+  }
+}
+for (const record of byKind('toolCall')) {
+  check(`hasArguments matches the page's own test on #${record.index}`, record.hasArguments, pageHasArguments(record));
+}
+assert('a record with a real object argument has one so the check above is not vacuous',
+  byKind('toolCall').some((record) => pageHasArguments(record) && record.hasArguments === true));
+// The disagreement, stated rather than assumed: an empty string is present to the page's test and
+// absent to 「not null, not undefined, not empty string」. Which one is right is the page's
+// existing behaviour, so the flag has to follow the page — and this is the only fixture that can
+// see the difference.
+const emptyArgCall = byKind('toolCall').find((record) => record.arguments === '');
+assert('the fixture has a tool call whose arguments are an empty string', emptyArgCall !== undefined);
+if (emptyArgCall) {
+  check('an empty string counts as arguments, because that is what the page tested',
+    emptyArgCall.hasArguments, true);
+  check('which a nil test would have denied, and that is the disagreement this pins',
+    pageIsNil(emptyArgCall.arguments), true);
+}
+assert('a record with no arguments reports none', byKind('toolCall').every((r) => !pageHasArguments(r) === !r.hasArguments));
+
+// The one place a flag is allowed to disagree with a naive reading: a reply with no body at all.
+// It is also the reason `hasText` cannot be inferred from `summary`: the fold gives this record a
+// summary (its `title`), so the summary is there and the body is not.
+const emptyReply = byKind('reply').find((record) => pageIsNil(record.text));
+assert('the fixture has a reply with no body, which is what 空答复 is about', emptyReply !== undefined);
+if (emptyReply) {
+  check('a body-less reply reports no text', emptyReply.hasText, false);
+  assert('while its summary is not empty, so hasText cannot be read off it',
+    !pageIsNil(emptyReply.summary));
+}
+
+assert('a failed tool result is flagged by isError alone', byKind('toolResult').some((record) => record.isError === true));
+assert('no record carries an "error" field any more', flat.every((record) => !('error' in record)));
+
+/* =====================================================================
+ * 2. Slimming takes the four and leaves everything else
+ * ===================================================================== */
+
+const before = JSON.stringify(payload);
+assert('the full body carries the bulk fields', BULK.some((field) => before.includes(`"${field}":`)));
+const keysBefore = flat.map((record) => Object.keys(record).sort().join(','));
+
+slimPayloadForWire(payload);
+const after = JSON.stringify(payload);
+const flatAfter = payload.turns.flatMap((turn) => turn.records ?? []);
+const keysAfter = flatAfter.map((record) => Object.keys(record).sort().join(','));
+
+for (const field of BULK) {
+  assert(`"${field}" is gone from the wire`, !after.includes(`"${field}":`));
+}
+check('the flags are still on the wire', flatAfter.every((record) => FLAGS.every((flag) => flag in record)), true);
+check('no other key was taken', keysAfter, keysBefore.map((keys) => keys
+  .split(',')
+  .filter((key) => !BULK.includes(key))
+  .join(',')));
+assert('the body really got smaller', after.length < before.length);
+assert('the flags survived being measured before the strip', flatAfter.every((r) => r.hasResult === !!flat.find((o) => o.index === r.index && false) || typeof r.hasResult === 'boolean'));
+
+slimPayloadForWire(payload);
+check('slimming twice changes nothing', JSON.stringify(payload).length, after.length);
+
+// It runs on whatever the cache hands it, including shapes no payload should have.
+for (const junk of [null, undefined, {}, { turns: null }, { turns: [null, {}, { records: null }] }]) {
+  let threw = false;
+  try { slimPayloadForWire(junk); } catch { threw = true; }
+  check(`slimming tolerates ${JSON.stringify(junk)}`, threw, false);
+}
+
+/* =====================================================================
+ * 3. rowPos: which of that line's records this one is
+ * ===================================================================== */
+
+/** The same rows again, so the split has rawRow to take off. */
+const fresh = buildTrajectoryPayload({
+  session: { id: 's1', createdAtMs: 1000 }, rows: ROWS, sizeBytes: 0, truncated: false, redact,
+});
+const origin = fresh.turns.flatMap((turn) => turn.records ?? [])
+  .map((record) => ({
+    index: record.index,
+    rawRow: record.rawRow,
+    rowPos: record.rowPos,
+    kind: record.kind,
+    // Captured before the split, because part 5 compares what the endpoint hands back against
+    // what the payload used to carry — and the payload it compares against is not the slimmed one.
+    text: record.text ?? null,
+    thinking: record.thinking ?? null,
+    arguments: record.arguments ?? null,
+    result: record.result ?? null,
+  }));
+
+const positions = new Map();
+const raws = splitRawRecords(fresh.turns, positions);
+
+check('the split still answers index -> row ordinal', raws instanceof Map && raws.size > 0, true);
+check('rowPos was collected for every record that has a locator', positions.size, raws.size);
+assert('and the two maps agree on which records those are',
+  [...raws.keys()].every((index) => positions.has(index)));
+assert('no record keeps its rawRow after the split',
+  fresh.turns.flatMap((t) => t.records ?? []).every((r) => !('rawRow' in r)));
+
+// An assistant line yields several records; they have to be told apart, not merged onto one position.
+const perRow = new Map();
+for (const entry of origin) {
+  if (!perRow.has(entry.rawRow)) perRow.set(entry.rawRow, []);
+  perRow.get(entry.rawRow).push(entry.rowPos);
+}
+const multi = [...perRow.entries()].filter(([, list]) => list.length > 1);
+assert('the fixture has a line that expanded into several records', multi.length > 0);
+for (const [rawRow, list] of multi) {
+  check(`line ${rawRow} numbers its records 0..n-1 with no repeats`,
+    list.slice().sort((a, b) => a - b), list.map((_, i) => i));
+}
+
+// A record with no usable locator must not be offered a position: there is no line to project.
+const poisoned = splitRawRecords([{ records: [{ index: 1, rawRow: -1, rowPos: 0 }] }], new Map());
+check('a record with no locator is refused by the split', poisoned.size, 0);
+const poisonedPositions = new Map();
+splitRawRecords([{ records: [{ index: 1, rawRow: -1, rowPos: 0 }] }], poisonedPositions);
+check('and it gets no position either', poisonedPositions.size, 0);
+// The other direction, and the one the split's second guard exists for: the locator is fine and
+// the POSITION is not. A record that reached the page with `rawRow` but no `rowPos` has a line to
+// read and no way to say which of that line's records it is, so offering one anyway is how the
+// endpoint ends up answering for its neighbour.
+for (const badPos of ['x', null, -1, 1.5, NaN]) {
+  const positions = new Map();
+  splitRawRecords([{ records: [{ index: 1, rawRow: 0, rowPos: badPos }] }], positions);
+  check(`a record whose position is ${JSON.stringify(badPos)} gets no position`, positions.size, 0);
+}
+const goodPositions = new Map();
+splitRawRecords([{ records: [{ index: 1, rawRow: 0, rowPos: 0 }] }], goodPositions);
+check('and a real position is offered', goodPositions.get(1), 0);
+
+/* =====================================================================
+ * 4. The summary the page used to assemble itself
+ * ===================================================================== */
+
+check('a record with a summary keeps it',
+  byKind('user').every((record) => record.summary === 'please read the file'), true);
+const noText = flat.find((record) => record.kind === 'user' && pageIsNil(record.summary));
+if (noText) assert('a record with an empty summary and no toolName stays empty rather than invented', true);
+assert('no record has an empty summary unless it has nothing else to name it by',
+  flat.every((record) => record.summary !== '' || pageIsNil(record.toolName) === false || pageIsNil(record.title) === false));
+
+/* =====================================================================
+ * 5. The endpoint's answer is the payload's own values
+ * ===================================================================== */
+
+/** What `/api/trajectory/record` does: re-project one line, take rowPos. */
+function projectRowAlone(rowOrdinal) {
+  const one = buildTrajectoryPayload({
+    session: { id: 's1', createdAtMs: 1000 },
+    rows: [ROWS[rowOrdinal]],
+    sizeBytes: 0,
+    truncated: false,
+    redact,
+  });
+  return one.turns.flatMap((turn) => turn.records ?? []);
+}
+
+const slimmed = buildTrajectoryPayload({
+  session: { id: 's1', createdAtMs: 1000 }, rows: ROWS, sizeBytes: 0, truncated: false, redact,
+});
+const wire = slimmed.turns.flatMap((turn) => turn.records ?? []);
+let compared = 0;
+for (const entry of origin) {
+  const alone = projectRowAlone(entry.rawRow)[entry.rowPos];
+  if (alone === undefined) {
+    failures.push(`row ${entry.rawRow} position ${entry.rowPos} projected to nothing`);
+    continue;
+  }
+  compared += 1;
+  for (const field of BULK) {
+    check(`#${entry.index} (${entry.kind}) ${field} is the same record's ${field}`,
+      JSON.stringify(alone[field] ?? null), JSON.stringify(entry[field] ?? null));
+  }
+}
+assert('every record of the fixture was re-projected on its own', compared, origin.length);
+
+/* =====================================================================
+ * 6. The endpoint returns four values and no kind
+ * ===================================================================== */
+
+// Bounded by `readRecordRow`, which sits between the two handlers: an unbounded slice would take
+// the shared reader in with it and then the assertion below — that this handler does not re-read a
+// line for itself — would be failing on the helper's own code.
+const handleRecord = SERVER.slice(SERVER.indexOf('const handleRecord = async'));
+const handlerEnd = handleRecord.indexOf('\n  const readRecordRow = async');
+const handler = handleRecord.slice(0, handlerEnd === -1 ? undefined : handlerEnd);
+assert('the handler exists', handler.length > 0);
+assert('it answers with text, thinking, arguments and result',
+  ['text:', 'thinking:', 'arguments:', 'result:'].every((key) => handler.includes(key)));
+assert('and does NOT answer with a kind, which re-projecting one line cannot reproduce faithfully',
+  !/\bkind:/.test(handler));
+assert('it re-projects a single row rather than the session', /rows: \[found\.row\]/.test(handler));
+assert('and takes the record by position', handler.includes('[rowPos]'));
+assert('a missing position is a 404, never a best effort',
+  handler.includes('record_not_found') && handler.includes('record === undefined'));
+// Once the record has been picked by its position, nothing may replace it. A fallback that
+// substituted "whatever is nearest" would keep every string in this handler — the 404 above
+// included — while answering a reader with another record's content, which is the one failure
+// here that renders perfectly.
+const pickedAt = handler.indexOf('const record = one.turns');
+assert('the record is found by position', pickedAt !== -1);
+if (pickedAt !== -1) {
+  const afterPicking = handler.slice(handler.indexOf('\n', pickedAt));
+  assert('and nothing replaces it afterwards', !/\brecord\s*=[^=]/.test(afterPicking));
+}
+assert('the bytes carry the same digest check /raw uses', handler.includes('readRecordRow(locator)'));
+// Written once, not twice. There are two readers of that line now, and a second copy of the check
+// is a second answer to 「这还是那条记录对应的字节吗」 — and the copy nobody edited is the one that
+// eventually stops answering.
+assert('and the digest check lives in that one place, not in this handler',
+  /readRecordRow\s*=\s*async/.test(SERVER)
+  && SERVER.includes('lineDigest(bytes) !== locator.digest')
+  && !handler.includes('lineDigest(')
+  && !handleRawSection().includes('lineDigest('));
+function handleRawSection() {
+  const at = SERVER.indexOf('const handleRaw = async');
+  return SERVER.slice(at, SERVER.indexOf('\n  const handleDashboard', at));
+}
+
+/* =====================================================================
+ * 7. Where the strip happens, and what it must not reach
+ * ===================================================================== */
+
+const route = SERVER.slice(SERVER.indexOf('const handleTrajectory = async'));
+const routeEnd = route.indexOf('\n  /**');
+const trajectory = route.slice(0, routeEnd === -1 ? undefined : routeEnd);
+assert('the trajectory route strips before serializing',
+  trajectory.indexOf('slimPayloadForWire(payload)') !== -1
+  && trajectory.indexOf('slimPayloadForWire(payload)') < trajectory.indexOf('JSON.stringify(payload)'));
+check('the strip happens once', trajectory.split('slimPayloadForWire(payload)').length - 1, 1);
+assert('the delta is built from the stripped payload, so a poll carries no more bulk than the first load',
+  trajectory.indexOf('buildDeltaPayload') > trajectory.indexOf('slimPayloadForWire(payload)'));
+assert('the search path does not strip, because it still reads those fields in this process',
+  !SERVER.slice(SERVER.indexOf('const handleSearch = async')).includes('slimPayloadForWire'));
+assert('the endpoint is routed', SERVER.includes("url.pathname === '/api/trajectory/record'"));
+
+/* =====================================================================
+ * 8. The page asks instead of holding
+ * ===================================================================== */
+
+for (const flag of FLAGS) {
+  assert(`the page reads ${flag}`, CLIENT.includes(flag));
+}
+assert('the page no longer reads a bulk field off a record for display',
+  !/record\.thinking\b/.test(CLIENT));
+assert('the detail request names the record index and the session',
+  /\/api\/trajectory\/record\?/.test(CLIENT) && /index=/.test(CLIENT));
+
+// Each of these four used to be the page's own decision and is now the server's. They are listed
+// separately because each one, left reading the old field, renders correctly and silently wrong:
+// a marker that never fires, a row that shows a different string, an empty tab, a failed row that
+// does not look failed.
+// Anchored on `return !!record &&` because the same test appears twice in the page — once in the
+// rule table, once on the row — and a pattern loose enough to match either is satisfied by
+// rewriting only one of them. That is the same substring trap as the release assertion in
+// verify-raw-locators, found again by the mutation that rewrites one of the two copies.
+assert('the 空答复 rule reads the flag, not a field the page no longer receives',
+  /return !!record && record\.kind === 'reply' && record\.hasText === false;/.test(CLIENT));
+assert('and so does the marker on the row, by the same test',
+  /var silent = record\.kind === 'reply' && record\.hasText === false;/.test(CLIENT));
+assert('the row summary is the one server-derived field, with no fallback chain under it',
+  CLIENT.includes("var summaryText = record.summary || '';"));
+for (const [label, field, flag] of [
+  ['工具结果', 'result', 'hasResult'],
+  ['思考过程', 'thinking', 'hasThinking'],
+  ['工具参数', 'arguments', 'hasArguments'],
+]) {
+  assert(`the ${label} panel draws "${field}" from the detail, not off the record`,
+    CLIENT.includes(`buildDetailBlock('${label}', record, '${field}'`));
+  assert(`and the ${label} tab is offered from ${flag}`,
+    CLIENT.includes(`record.${flag} === true`));
+}
+assert('failure is decided by isError alone, which is what the old `|| error` always agreed with',
+  CLIENT.includes('var failed = record.isError === true;'));
+assert('and the page never asks for the duplicate field any more',
+  !/record\.error\b/.test(CLIENT));
+// The detail read is a second source of the answer, so it has to be per record and invalidated
+// with the same key the raw read uses — a cached value from a previous version of the body is the
+// exact failure `/raw` already had one guard for.
+assert('the detail cache is keyed like the raw one',
+  CLIENT.includes('var key = rawCacheKey(index);') && CLIENT.includes('var detailCache = {};'));
+assert('and a failed detail read is reported rather than drawn as empty',
+  CLIENT.includes('读取失败，这条记录的详细内容暂时取不到。'));
+
+console.log(`[record-detail] ${pass} assertions passed, ${failures.length} failed`);
+for (const failure of failures) console.log('  - ' + failure);
+if (failures.length) process.exit(1);
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs
index 69adae9..846cba3 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs
@@ -75,14 +75,22 @@ function pageRecordSearchText(record) {
 // each one is something the reader is shown. That a record also carries them is checked below,
 // once there is a record to carry them.
 const CARRIED = ['summary', 'text', 'result', 'thinking', 'toolName'];
-// The page has to show them somewhere, or searching them finds something the reader cannot open.
-for (const field of CARRIED) {
+// Still on the row, so still read from the row.
+for (const field of ['summary', 'toolName']) {
   assert(`the page renders "${field}"`, CLIENT.includes(`record.${field}`));
 }
-// `arguments` is shown and deliberately NOT searched: it is the page's own choice, recorded as one
-// rather than left to look like an oversight. Search it and the coverage grows; do not search it and
-// a reader is never shown the field list, so the omission is a decision rather than a defect.
-assert('the page shows tool arguments', /record\.arguments/.test(CLIENT));
+// Shown, but no longer from the row: these three come from `/api/trajectory/record`, which is what
+// makes 「命中 → 看得见」 still true without the page holding them.
+for (const [field, label] of [['result', '工具结果'], ['thinking', '思考过程'], ['arguments', '工具参数']]) {
+  assert(`the page renders "${field}"`, CLIENT.includes(`buildDetailBlock('${label}', record, '${field}'`));
+}
+// `text` is the honest exception and it always was: no inspector tab has ever shown it. What a hit
+// on it leads to is 原文, which every record has. So the assertion is that the path exists, not
+// that the field is rendered.
+assert('a hit on "text" still leads somewhere: every record has the 原文 tab',
+  CLIENT.includes("{ id: 'raw', label: '原文', available: function () { return true; } }"));
+assert('and 原文 is drawn for a record, not only when something was selected',
+  /if \(tabId === 'raw'\) return buildRaw\(record\);/.test(CLIENT));
 assert('and arguments are deliberately not searched', !SEARCH_FIELDS.includes('arguments'));
 
 /** The page's filter, given a payload and a needle. This is what the endpoint must reproduce. */
@@ -115,6 +123,9 @@ const RAW = [
       timestamp: 1100,
       stopReason: 'toolUse',
       content: [
+        // A thinking block, because `thinking` is one of the five searched fields and a fixture
+        // with none of them makes every assertion about it pass by having nothing to look at.
+        { type: 'thinking', thinking: 'first I need the file, then the answer' },
         { type: 'text', text: 'working on it' },
         { type: 'toolCall', id: 'c1', name: 'read', arguments: { path: 'a' } },
       ],
@@ -169,8 +180,15 @@ const allPayload = buildTrajectoryPayload({
 assert('the identity layer really did keep one version of the message stored twice',
   allPayload.turns.flatMap((t) => t.records).filter((r) => r.id === 'tr1').length === 1);
 const firstRecord = allPayload.turns.flatMap((t) => t.records)[0];
+const allRecords = allPayload.turns.flatMap((t) => t.records);
+// Every searched field used to be on EVERY record, null when it had none, which is what let the
+// old loop ask `hasOwnProperty` of the first record and mean anything by the answer. A record now
+// carries only the field its kind has — a reply has no `arguments` to carry — so the question is
+// whether the projection still has each one SOMEWHERE, which is what this search is reading. The
+// wire copy is the other half of that, and tests/verify-record-detail.mjs holds it.
 for (const field of SEARCH_FIELDS) {
-  assert(`a projected record carries "${field}"`, Object.prototype.hasOwnProperty.call(firstRecord, field));
+  assert(`the projection carries "${field}" where it exists`,
+    allRecords.some((r) => Object.prototype.hasOwnProperty.call(r, field) && r[field] !== null));
 }
 check('and the searched fields are exactly the five that are both carried and shown', SEARCH_FIELDS, CARRIED);
 assert('and it is the one with the real result',
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs
index 7b390b4..8f6cec3 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs
@@ -105,10 +105,23 @@ check('the field list is the page\'s, in the page\'s order',
 const CLIENT = readFileSync(new URL('../miniapp/client/index.html', import.meta.url), 'utf8');
 check('the field list is the five the page can show',
   SEARCH_FIELDS, ['summary', 'text', 'result', 'thinking', 'toolName']);
-for (const field of SEARCH_FIELDS) {
+// Every field the segment stores must be something the reader is shown, or a search finds text
+// nobody can open. Three of them are no longer on the row — they arrive from the record-detail
+// read — so the check follows the value to where it is drawn rather than to where it used to live.
+// `text` is the honest exception and always was: no inspector tab has ever rendered it, and what a
+// hit on it leads to is the 原文 tab, which every record has.
+const SHOWN_FROM_DETAIL = [['result', '工具结果'], ['thinking', '思考过程'], ['arguments', '工具参数']];
+for (const field of ['summary', 'toolName']) {
   assert(`the page renders "${field}", so a hit on it leads somewhere`,
     CLIENT.includes(`record.${field}`));
 }
+for (const [field, label] of SHOWN_FROM_DETAIL) {
+  assert(`the page renders "${field}", so a hit on it leads somewhere`,
+    CLIENT.includes(`buildDetailBlock('${label}', record, '${field}'`));
+}
+assert('a hit on "text" still leads somewhere: 原文 is on every record',
+  CLIENT.includes("{ id: 'raw', label: '原文', available: function () { return true; } }")
+  && /if \(tabId === 'raw'\) return buildRaw\(record\);/.test(CLIENT));
 assert('the page has no local search left to disagree with',
   !/recordSearchText/.test(CLIENT) && !/indexOf\(String\(needle\)/.test(CLIENT));
 

From 33dc319657aaf5b7e113cc034ac990cb92e4c074 Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 10:56:48 +0800
Subject: [PATCH 13/36] Say which numbering a tail was cut from, or renumbering
 lands it in the wrong turn
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The cursor is `record.index` and a delta is cut at `index > since`. That rests on numbering only
ever growing — and the identity layer took that away. A message arriving that is a newer version
of an earlier one suppresses that earlier copy, and every record after it shifts down by one. A
tail cut at the old number then lands in the middle of the wrong turn: no error, no empty table,
just records in the wrong place.

The `since > upTo` fallback covers a page that has run PAST the server. It does not cover a
numbering that moved underneath it.

  - Putting the etag in the cursor key does not work: the etag changes on every ordinary growth
    (size, mtime, lineage), so every incremental poll would fall back to the whole payload and the
    incremental path would stop existing.
  - Forcing a whole payload on every generation change covers only one of the two ways numbering
    moves. The other happens without any generation changing at all.

So the tail says what it assumed. `delta.basedOn` is the id of the record the cursor pointed at,
read while the tail is being cut — which walks those records anyway. The page compares it against
the record it holds at that index: same id, nothing before the cursor moved, the tail belongs to
this payload; different, the numbering moved, and the only honest answer is the whole payload.

Two things about the shape:

  - The check runs BEFORE the merge and returns early. Checking afterwards would leave records in
    the wrong turn with nothing to undo them.
  - A delta with no `basedOn` is refused rather than trusted. This page cannot tell such a tail
    from a correct one, and 「probably fine」 is the guess the rule exists to prevent.

`since === 0` passes: there is nothing before the cursor that could have moved.

Tests: `node tests/run.mjs` on this tree -> 82/82 guards passed. verify-incremental grew 5
assertions and mutate-incremental 5 mutations (24 total), each caught by name.
---
 .../mmc-trajectory/miniapp/client/index.html  | 47 ++++++++++++++++++-
 .../mmc-trajectory/miniapp/node/server.mjs    | 22 ++++++++-
 .../tests/mutate-incremental.py               | 26 +++++++++-
 .../tests/verify-incremental.mjs              | 24 +++++++++-
 4 files changed, 114 insertions(+), 5 deletions(-)

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
index 542981d..202a3a0 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
+++ b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
@@ -4363,10 +4363,55 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         return { session: delta.session, stats: delta.stats, turns: turns };
       }
 
+      /**
+       * Whether this delta was cut from the numbering the page is still holding.
+       *
+       * The cursor is `record.index`, and the server can renumber a payload that is otherwise
+       * untouched: a message arriving that is a newer version of an earlier one suppresses that
+       * earlier copy, and every record after it shifts down. A tail cut at the old number then
+       * lands in the middle of the wrong turn — no error, no empty table, just records in the
+       * wrong place, which is the kind of wrong a reader cannot notice and cannot believe.
+       *
+       * So the delta names the record its cursor pointed at, and this compares it against the one
+       * the page holds at that index. They agree, nothing before the cursor moved, and the tail is
+       * this payload's. They do not, and the only honest answer is the whole payload.
+       *
+       * A delta with no `basedOn` at all is refused rather than trusted: this page cannot tell such
+       * a tail from a correct one, and guessing 「it is probably fine」 is the failure it exists to
+       * prevent.
+       */
+      function deltaMatchesNumbering(previous, delta) {
+        var based = delta && delta.delta ? delta.delta.basedOn : null;
+        if (!based || typeof based.index !== 'number' || based.index < 0) return false;
+        if (based.index === 0) return true;
+        var turns = previous && Array.isArray(previous.turns) ? previous.turns : [];
+        for (var i = 0; i < turns.length; i += 1) {
+          var records = Array.isArray(turns[i].records) ? turns[i].records : [];
+          for (var j = 0; j < records.length; j += 1) {
+            var record = records[j];
+            if (!record || record.index !== based.index) continue;
+            return String(record.id) === String(based.id);
+          }
+        }
+        return false;
+      }
+
       function applyPayload(body, manual) {
         // A delta is only ever laid onto a payload this page actually has. Without one —
         // first load, a session switch, a manual refresh — the whole payload is the answer.
-        var mergeable = body && body.delta && state.payload && Array.isArray(state.payload.turns);
+        var hasDelta = !!(body && body.delta && state.payload && Array.isArray(state.payload.turns));
+        // And only when the numbering it was cut from is the numbering in hand. This is checked
+        // BEFORE the merge and returns early, because the alternative — merging it and noticing
+        // afterwards — leaves records in the wrong turn with nothing to undo them.
+        if (hasDelta && !deltaMatchesNumbering(state.payload, body)) {
+          state.since = null;
+          state.sinceFor = null;
+          state.loading = true;
+          render();
+          fetchTrajectory(true);
+          return;
+        }
+        var mergeable = hasDelta;
         var payload = mergeable ? mergeDelta(state.payload, body) : body;
         var next = signatureOf(payload);
         var changed = next !== state.signature;
diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
index 67daf2d..46c54b7 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
@@ -2494,6 +2494,26 @@ export function buildDeltaPayload(payload, since) {
     }
   }
   if (since > upTo) return null;
+  // Which record the cursor is pointing AT, so the page can tell whether the numbering it is
+  // holding is still the numbering this tail was cut from.
+  //
+  // The cursor is `record.index`, and the identity layer can renumber a payload that is otherwise
+  // untouched: a message arriving that is a newer version of an earlier one suppresses that
+  // earlier copy, and every record after it shifts down by one. A tail cut at the old number then
+  // lands in the middle of the wrong turn, with no error anywhere — which is why the delta says
+  // what it assumed rather than leaving the page to guess.
+  //
+  // `null` for index 0 and for a cursor that names no record, which is the same thing the page
+  // treats as 「there is nothing before here to have moved」.
+  let basedOn = null;
+  for (const turn of turns) {
+    const all = turn && Array.isArray(turn.records) ? turn.records : [];
+    for (const record of all) {
+      if (record && record.index === since) {
+        basedOn = { index: since, id: record.id === undefined ? null : record.id };
+      }
+    }
+  }
   const tail = [];
   // `records` counts what is NEW, not what travels. A turn that ships whole with 300 records
   // contributes 1 here. The page reads `delta.upTo` for its next cursor and never reads this
@@ -2514,7 +2534,7 @@ export function buildDeltaPayload(payload, since) {
     session: payload.session,
     stats: payload.stats,
     turns: tail,
-    delta: { since, upTo, records },
+    delta: { since, upTo, records, basedOn },
   };
 }
 
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-incremental.py b/plugins/avatasia/mmc-trajectory/tests/mutate-incremental.py
index ab17e27..6fe9d36 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-incremental.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-incremental.py
@@ -30,8 +30,22 @@
      "          state.etagFor = '';\n"),
     ("a delta is merged onto whatever happens to be in state.payload",
      "the merge needs both the delta marker and a payload in hand",
-     "var mergeable = body && body.delta && state.payload && Array.isArray(state.payload.turns);",
-     "var mergeable = !!body.delta;"),
+     "var hasDelta = !!(body && body.delta && state.payload && Array.isArray(state.payload.turns));",
+     "var hasDelta = !!body.delta;"),
+    # The three below are the numbering check. A tail cut from a numbering that has since moved
+    # lands in the middle of the wrong turn and reports nothing — which is the whole reason the
+    # delta names the record its cursor pointed at.
+    ("the numbering the tail was cut from is never checked",
+     "and it checks the numbering the tail was cut from before merging anything",
+     "        if (hasDelta && !deltaMatchesNumbering(state.payload, body)) {",
+     "        if (false) {"),
+    ("a tail that names no record at the cursor is taken on trust",
+     "the check is refused, not assumed, when the tail names no record at the cursor",
+     "        if (!based || typeof based.index !== 'number' || based.index < 0) return false;",
+     "        if (!based || typeof based.index !== 'number' || based.index < 0) return true;"),
+    ("a cursor of zero is treated as a numbering that might have moved",
+     "and a cursor of zero has nothing before it that could have moved",
+     "        if (based.index === 0) return true;", "        if (based.index === 0) return false;"),
     ("a tail turn is appended instead of merged into the turn it belongs to",
      "mergeDelta at cursor 0 gives back every record exactly once",
      "          if (at[incoming.id] === undefined) {", "          if (true) {"),
@@ -64,6 +78,14 @@
     ("a turn that gained nothing is sent anyway",
      "a turn that gained no records is absent from the tail",
      "    if (fresh === 0) continue;", "    // every turn, gained or not"),
+    ("the server stops saying which record its cursor pointed at",
+     "the tail names the record its cursor pointed at",
+     "        basedOn = { index: since, id: record.id === undefined ? null : record.id };",
+     "        basedOn = { index: since, id: null };"),
+    ("the tail names the record at upTo rather than the one at the cursor",
+     "and it is looked up at the cursor, not at the end of the payload",
+     "      if (record && record.index === since) {",
+     "      if (record && record.index === upTo) {"),
     ("a tail turn travels only its records and loses its identity",
      "the merge takes the closed flag from the tail, not from the copy it already had",
      "    tail.push({ ...turn, records: all.slice() });", "    tail.push({ records: all.slice() });"),
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-incremental.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-incremental.mjs
index c38b439..c259047 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-incremental.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-incremental.mjs
@@ -370,8 +370,30 @@ assert('a manual refresh drops the cursor as well as the validator',
   /if \(manual\) \{\s*\n\s*state\.etag = '';\s*\n\s*state\.etagFor = '';\s*\n\s*state\.since = 0;\s*\n\s*state\.sinceFor = '';/.test(html));
 // The merge is gated on the delta marker *and* on having a payload to lay it onto. Without the
 // second half a delta after a session switch would be merged onto a different session's turns.
+// It is gated on a THIRD thing now: whether the tail was cut from the numbering in hand. That is
+// not the same question as either of the other two — a delta can be well-formed and for the right
+// session and still be cut from a numbering that has since moved.
 assert('the merge needs both the delta marker and a payload in hand',
-  /var mergeable = body && body\.delta && state\.payload && Array\.isArray\(state\.payload\.turns\);/.test(html));
+  /var hasDelta = !!\(body && body\.delta && state\.payload && Array\.isArray\(state\.payload\.turns\)\);/.test(html)
+  && /var mergeable = hasDelta;/.test(html));
+assert('and it checks the numbering the tail was cut from before merging anything',
+  /if \(hasDelta && !deltaMatchesNumbering\(state\.payload, body\)\) \{/.test(html)
+  && html.indexOf('deltaMatchesNumbering(state.payload, body)') < html.indexOf('mergeDelta(state.payload, body)'));
+assert('a tail cut from another numbering is refused outright, and the cursor is dropped with it',
+  /state\.since = null;\s*\n\s*state\.sinceFor = null;[\s\S]{0,200}fetchTrajectory\(true\);/.test(html));
+assert('the check is refused, not assumed, when the tail names no record at the cursor',
+  /if \(!based \|\| typeof based\.index !== 'number' \|\| based\.index < 0\) return false;/.test(html));
+assert('and a cursor of zero has nothing before it that could have moved',
+  /if \(based\.index === 0\) return true;/.test(html));
+// And the server has to say which record it assumed, or the client has nothing to compare against.
+// The lookup is pinned separately because the assignment's shape is the same whichever record it
+// reads — naming upTo instead of since would produce a well-formed `basedOn` that answers the
+// wrong question, and every other assertion here would still pass.
+assert('the tail names the record its cursor pointed at',
+  /basedOn = \{ index: since, id: record\.id === undefined \? null : record\.id \};/.test(server)
+  && /delta: \{ since, upTo, records, basedOn \}/.test(server));
+assert('and it is looked up at the cursor, not at the end of the payload',
+  /if \(record && record\.index === since\) \{/.test(server));
 // The server cuts the tail only on the fresh-build path. The cached path serves the bytes it
 // already has, and reaching it with a cursor means the session changed anyway.
 assert('the server cuts a tail only where it has just built the payload',

From 7074f54114b1c837ad54bee15af7c709a724a6c7 Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 11:09:09 +0800
Subject: [PATCH 14/36] Give the time-range guard a window it can still prove
 something with
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`tests/verify-time-range.mjs` is not in the default run: it needs a booted service and a
multi-generation session. That is also why nothing had run it since the session it was calibrated
against stopped existing. Booting the runtime against the live store and running it found two
failures, and neither was a fault in the range filter itself.

One was the wall-clock window, which was a literal: 23:50 to 00:20 on fixed October dates. Once the
session that belonged to was compacted away, both sides of the comparison the section exists to
make were 0, so it passed while comparing nothing, and only the assertion written to catch exactly
that noticed. A literal window is the one input in that file that can silently stop being evidence,
and nothing about the code can tell you when it has. The window is now derived from the payload:
the last row before a local midnight and the first row after it, five minutes of padding, floored
and ceiled to whole minutes. It is still required to cross a local midnight, since that is the part
that makes each bound a subtraction the machine's distance from Greenwich gets to corrupt.

  - Reached from the rows rather than from a fixed width, because the reader steps away. On the
    session served here the last row before the one usable midnight was 41 minutes early, so a
    +/-10 minute window found nothing and reported the reader's habits as a fault in the
    arithmetic. The first midnight inside the span turned out to have no rows within an hour on
    either side, being in the middle of a 17 hour gap.
  - If no midnight qualifies, the file fails by name and stops, rather than carrying on with
    nothing chosen. A guard that limps past its own precondition ends up reporting the store's
    habits as faults in the arithmetic, which is the failure this section just had.

The other was 清除筛选 no longer dropping the range in the function that clears it. The reset moved
into `resetBaseFilters()` and the assertion kept reading `clearFilters()`, so it went red on a
change that broke nothing — the same mistake the comment above it warns about, one indirection
later. It now follows the hop, and pins the hop itself: checking only the order would pass on a
清除筛选 that had stopped calling the reset at all, which is a filter the reader can neither see
nor turn off.

Neither edit is a relaxation. Both assertions hold the same thing they held before, and the second
gained a check it did not have. 151 assertions against the live service, green.

The teeth were then checked by hand, because this file cannot have a mutation control inside the
suite: `run.mjs` promises that nothing in it needs a running Mini App, and this one cannot be
checked at all without one — it derives its own fixture from `GET /api/trajectory`. Six mutations
against a throwaway copy of the package taken outside the tree, so no shipped byte was touched,
each required to fail with the assertion that owns the rule rather than a neighbour: the bound read
as UTC, the session-start subtraction dropped, one comparison in `recordInRange()` flipped,
`resetBaseFilters()` unhooked from `clearFilters()`, `clearTimeRange()` unhooked from
`resetBaseFilters()`, and the two clears in the wrong order. Six caught by name, the last three
producing exactly one named failure each. The client was byte-identical before and after.

`tests/README.md` claimed a control for this file, `mutate-time-range.py`, that has never existed
here — not in HEAD, not anywhere in the history. A file that names a control nobody can run is a
pointer with nothing behind it, so the claim is replaced by what is actually true, including that
the hand-check is a one-off and nothing re-runs it.

Tests: `node tests/run.mjs` on this tree -> 82/82 guards passed. Separately, against a booted
runtime on this machine's store: `node tests/verify-time-range.mjs <port>` -> 151 assertions, 0
failed, plus the six mutations above.
---
 .../avatasia/mmc-trajectory/tests/README.md   | 23 +++--
 .../tests/verify-time-range.mjs               | 98 +++++++++++++++++--
 2 files changed, 106 insertions(+), 15 deletions(-)

diff --git a/plugins/avatasia/mmc-trajectory/tests/README.md b/plugins/avatasia/mmc-trajectory/tests/README.md
index d4814b1..9f4a0d8 100644
--- a/plugins/avatasia/mmc-trajectory/tests/README.md
+++ b/plugins/avatasia/mmc-trajectory/tests/README.md
@@ -208,14 +208,25 @@ with the reason stated rather than quietly dropped.
   guards is gone.
 - **`mutate-qa-lens.py`** — not carried. Guards the 问答 turn-lens. Same removal; no lens symbol
   remains.
-- **`verify-time-range.mjs`** and its control **`mutate-time-range.py`** — present, skipped by
-  `run.mjs`. Its assertions are calibrated against a full multi-generation session:
-  `stats.messages > 1000`, and a checkpoint nested inside a turn rather than being one. The
-  committed fixture is a single-file session of a few dozen rows. Reproducing those numbers
-  faithfully would mean committing a multi-megabyte payload; relaxing them would stop exercising
-  the timezone arithmetic the file exists for. Run it by hand against a booted service:
+- **`verify-time-range.mjs`** — present, skipped by `run.mjs`. Its assertions are calibrated against a
+  full multi-generation session: `stats.messages > 1000`, and a checkpoint nested inside a turn rather
+  than being one. The committed fixture is a single-file session of a few dozen rows. Reproducing those
+  numbers faithfully would mean committing a multi-megabyte payload; relaxing them would stop
+  exercising the timezone arithmetic the file exists for. Run it by hand against a booted service:
   `node tests/verify-time-range.mjs <port>`.
 
+  It has **no mutation control**, and there is no way to give it one inside this suite: `run.mjs`
+  promises that nothing here needs a running Mini App, and this file cannot be checked at all without
+  one — it derives its own fixture from `GET /api/trajectory`. So the teeth were checked by hand
+  instead, against a throwaway copy of the package taken outside this tree, so that no shipped byte
+  was touched. Six mutations, each required to fail with the assertion that owns the rule rather than
+  any nearby one: the bound read as UTC, the session-start subtraction dropped, one comparison in
+  `recordInRange()` flipped, `resetBaseFilters()` no longer called from `clearFilters()`,
+  `clearTimeRange()` no longer called from `resetBaseFilters()`, and the two clears in the wrong
+  order. All six were caught by name. That is a one-off result, not a control: nothing re-runs it,
+  and a later edit can pass everything else in this directory while this file goes unverified. Worth
+  knowing before trusting it.
+
 ### Two anchors that were wrong, and one mutation that could not be caught
 
 Kept here because each cost real time to find, and each would look like "the guard is stale":
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-time-range.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-time-range.mjs
index 18e5f40..39afcc8 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-time-range.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-time-range.mjs
@@ -324,10 +324,83 @@ check('half-range duration == span of the rows kept',
 const START = payload.session.startedAt;
 assert('the payload carries a session start', Number.isFinite(START) && START > 0);
 {
-  const wallFrom = new Date(2026, 9, 10, 23, 50, 0).getTime();
-  const wallTo = new Date(2026, 9, 11, 0, 20, 0).getTime();
-  const from = pure.parseRangeBound('2026-10-10T23:50', START);
-  const to = pure.parseRangeBound('2026-10-11T00:20', START);
+  /* The window is chosen from the payload, not written down.
+   *
+   * It used to be a literal -- 23:50 to 00:20 on fixed October dates -- which made this section a
+   * statement about the store rather than about the code. When that session was compacted away
+   * both sides of the equality below were 0, so it passed while comparing nothing; only the
+   * assertion after it noticed. A literal window is the one input here that silently stops being
+   * evidence, and nothing about the code can tell you that.
+   *
+   * What stays literal is the part that makes it worth running: the window crosses a LOCAL
+   * midnight, so converting each bound really is a subtraction the machine's distance from
+   * Greenwich gets to corrupt. */
+  const pad2n = (n) => (n < 10 ? '0' + n : String(n));
+  const dayKey = (ts) => {
+    const d = new Date(ts);
+    return d.getFullYear() + '-' + pad2n(d.getMonth() + 1) + '-' + pad2n(d.getDate());
+  };
+  const wallClock = (ts) => {
+    const d = new Date(ts);
+    return dayKey(ts) + ' ' + pad2n(d.getHours()) + ':' + pad2n(d.getMinutes()) + ':' + pad2n(d.getSeconds());
+  };
+  const stamped = scoped.state.flat
+    .map((e) => e.record.timestamp)
+    .filter((ts) => Number.isFinite(ts))
+    .sort((a, b) => a - b);
+
+  const PAD = 5 * 60000;
+  const wholeMinute = (ms, dir) => (dir < 0 ? Math.floor(ms / 60000) * 60000 : Math.ceil(ms / 60000) * 60000);
+  const span = stamped.length ? stamped[stamped.length - 1] - stamped[0] : 0;
+  let chosen = null;
+  let cursor = stamped.length ? new Date(stamped[0]) : null;
+  if (cursor) {
+    cursor.setHours(0, 0, 0, 0);
+    if (cursor.getTime() < stamped[0]) cursor.setDate(cursor.getDate() + 1);
+    for (let guard = 0; cursor.getTime() <= stamped[stamped.length - 1] && guard < 400; guard += 1) {
+      const midnight = cursor.getTime();
+      // Reached from the rows themselves rather than from a fixed number of minutes: the reader
+      // steps away, and on this session the last record before the one usable midnight was 41
+      // minutes early. A window of ±10 minutes would have found nothing and reported the store's
+      // habits as a fault in the arithmetic. Both ends have to exist, and the two ends together
+      // have to stay a small slice, or it is not a window.
+      let beforeAt = -1;
+      let afterAt = -1;
+      for (let i = 0; i < stamped.length; i += 1) {
+        if (stamped[i] < midnight) beforeAt = stamped[i];
+        else {
+          afterAt = stamped[i];
+          break;
+        }
+      }
+      const lo = beforeAt < 0 ? NaN : wholeMinute(beforeAt - PAD, -1);
+      const hi = afterAt < 0 ? NaN : wholeMinute(afterAt + PAD, 1);
+      if (Number.isFinite(lo) && Number.isFinite(hi) && hi - lo <= span / 4) {
+        chosen = { wallFrom: lo, wallTo: hi };
+        break;
+      }
+      cursor = new Date(cursor.getTime());
+      cursor.setDate(cursor.getDate() + 1);
+    }
+  }
+  if (!chosen) {
+    // Failing by name beats carrying on: everything below reads `chosen`, and a guard that
+    // limps past its own precondition reports the arithmetic's faults for the store's.
+    console.log('[3b] no local midnight inside this session has rows on both sides of it');
+    console.log('FAILED_NAMES\t'
+      + JSON.stringify(['the session spans a local midnight with rows on both sides of it']));
+    process.exit(1);
+  }
+  const wallFrom = chosen.wallFrom;
+  const wallTo = chosen.wallTo;
+  assert('the window crosses a local midnight', dayKey(wallFrom) !== dayKey(wallTo));
+
+  // Typed into the pickers as the control actually sends them, so the strings under test are the
+  // ones the page reads rather than ones written to match the arithmetic.
+  const fromText = pure.formatRangeInput(wallFrom);
+  const toText = pure.formatRangeInput(wallTo);
+  const from = pure.parseRangeBound(fromText, START);
+  const to = pure.parseRangeBound(toText, START);
   check('a pair of bounds across midnight converts to the window it names',
     [from, to], [wallFrom - START, wallTo - START]);
 
@@ -341,13 +414,13 @@ assert('the payload carries a session start', Number.isFinite(START) && START >
 
   scoped.state.rangeFrom = from;
   scoped.state.rangeTo = to;
-  scoped.state.rangeFromText = '2026-10-10T23:50';
-  scoped.state.rangeToText = '2026-10-11T00:20';
+  scoped.state.rangeFromText = fromText;
+  scoped.state.rangeToText = toText;
   const stats = scoped.scopedStats();
   check('the KPI over a date range equals the distinct ids of those rows',
     stats.messages, new Set(byClock.map((e) => e.record.id)).size);
   check('and the page-level label reads back as the wall clock it was typed as',
-    scoped.timeRangeLabel(), '2026-10-10 23:50:00 – 2026-10-11 00:20:00');
+    scoped.timeRangeLabel(), wallClock(wallFrom) + ' – ' + wallClock(wallTo));
 
   // And the same window, typed into the pickers as what the control actually sends.
   check('the control round trips back to the same offsets',
@@ -498,9 +571,16 @@ assert('the range opens unset', /rangeFrom: null,\s*\n\s*rangeTo: null,/.test(st
 // two-line regex failed on that instead of on anything wrong — it had frozen the shape of the
 // function rather than what the function has to do. What matters is that both are cleared and
 // that the query goes before the range, so the ledger never re-renders once with neither.
+// The reset then moved into `resetBaseFilters`, and the same mistake repeated one indirection
+// later: the lines were read out of `clearFilters`, which no longer has them, so the assertion
+// went red on a code change that broke nothing. Naming the function that owns the rule fixes it;
+// dropping the hop would not have. Checked order alone would pass on a 清除筛选 that had stopped
+// calling the reset altogether, which is a filter the reader cannot see and cannot turn off.
 const clearSrc = fnSource('function clearFilters()');
-const queryAt = clearSrc.indexOf("state.query = '';");
-const rangeAt = clearSrc.indexOf('clearTimeRange();');
+assert('清除筛选 runs the base reset', /resetBaseFilters\(\);/.test(clearSrc));
+const resetSrc = fnSource('function resetBaseFilters()');
+const queryAt = resetSrc.indexOf("state.query = '';");
+const rangeAt = resetSrc.indexOf('clearTimeRange();');
 assert('清除筛选 also drops the range', queryAt >= 0 && rangeAt > queryAt);
 
 // A picker the page could not read must not reach the filter. `NaN` fails the `isCount` test

From ab82cc19c0e4d908eed16585a02682b6f12bc4cc Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 12:34:30 +0800
Subject: [PATCH 15/36] Answer a search from what is already on disk, and stop
 losing matches on the way
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A search was the one route that still rebuilt the whole lineage: `collectLineage`, then the identity
view, then `buildTrajectoryPayload` over every row of every generation, then a scan. The index and
the per-generation segments that already hold the searchable text were written on every request and
read by nothing. On the largest session measured on this machine that was 3.7 seconds to type a word.

    before   cold 3309.8 ms   warm median 3667.3 ms   warm max 3793.7 ms
    after    cold 1730.3 ms   warm median 1689.0 ms   warm max 1703.5 ms

Same session, same probe, artifacts directory emptied first. The median and the maximum landing on
top of each other is the signature of the artifact path answering every time; before, the spread was
the rebuild's. A live 20.4 MB session went 616 ms -> 208 ms. The remaining 1.69 s is the index
itself: 34.2 MB of records.jsonl, read and parsed per search. The projection is gone; the index
read is what is left, and sharding it per generation is the next thing and is not in here.

  - `handleSearch` tries the artifacts before anything expensive. `indexStore.read` checks every
    generation's source identity and the projection version, and the identity decisions baked into
    the index are a pure function of exactly those — so no second intersection against the current
    view is done. That extra step is the kind that silently disagrees with the thing it checks.
  - The ACTIVE generation gets a segment too, which reverses §8.8.1 rule 5. It was right that such a
    segment would be stale before it was written, and it still is; what changed is that nothing has
    to trust it. `sameSource` reads the generation's own size, so an appended file invalidates its
    own segment and only its own, and an untrusted artifact makes the search fall back. Without one
    there would be nothing to scan on a session still being written — the case a reader is most
    likely to search.
  - A generation with no records gets an empty segment rather than none. "No segment" and "no
    records" would otherwise report the same thing, and a session holding one empty generation
    would fall back forever, for a generation that could never match anything.
  - Missing anything falls back WHOLE. `total` is how many records in the session matched, so
    answering from 44 of 45 generations reports a smaller number and says nothing about being wrong.
  - A generation read short by our own cap now carries `truncated` in its source, and both
    `sameSource` and `sameSources` compare it. `size` is the whole file whether or not the read
    covered it, so before this a truncated generation's artifact was indistinguishable from a
    complete one.

Two things this got wrong first, both worth more than the feature:

**The segments were being built from the index's records.** The index drops
`text`/`thinking`/`arguments`/`result` to stay small, and three of the five searchable fields are
in that set — so a segment built that way searches two of five, and a reader finds less with
nothing reporting it. Measured: needle "needle", 14 matches through the artifacts, 45 through the
rebuild. Both plausible. The surface is now built from the payload's records with the index
supplying only fileIdx and the byte range.

**And the guard was green throughout.** It compares the two paths needle for needle on a fixture,
which passed — because in that fixture every match happened to sit in `summary`. The guard now
asserts directly that a record's segment line contains its own `result` while the index does not,
and finds that record on purpose rather than hoping one is there.

Tests: `node tests/run.mjs` on this tree -> 82/82 guards passed. verify-search-endpoint 63 -> 91
assertions and mutate-search-endpoint 15 -> 18, mutate-search-segments 17 -> 18,
mutate-trajectory-index 17 -> 18, each caught by name. The five invariants are in the design note:
same answer as the rebuild, fall back whole, segments only for generations in the lineage, a
truncated generation is not trusted, and `total` is the count rather than the cap.
---
 .../miniapp/node/search-segments.mjs          |   8 +-
 .../mmc-trajectory/miniapp/node/server.mjs    | 165 +++++++++++++++++-
 .../miniapp/node/trajectory-index.mjs         |   9 +
 .../tests/mutate-search-endpoint.py           |  27 ++-
 .../tests/mutate-search-segments.py           |  10 ++
 .../tests/mutate-trajectory-index.py          |   9 +
 .../tests/verify-search-endpoint.mjs          | 152 +++++++++++++++-
 .../tests/verify-search-segments.mjs          |  23 +++
 .../tests/verify-trajectory-index.mjs         |  13 ++
 9 files changed, 402 insertions(+), 14 deletions(-)

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/search-segments.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/search-segments.mjs
index 27cf8fd..7198998 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/search-segments.mjs
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/search-segments.mjs
@@ -57,7 +57,9 @@ export const SEARCH_FIELDS = ['summary', 'text', 'result', 'thinking', 'toolName
 
 /** @typedef {{ ordinal: number, fileIdx: number, byteStart: number, byteEnd: number }} SegmentLocator */
 
-/** @typedef {{ schemaVersion: number, generation: number | null, view: string, recordCount: number, surfaceBytes: number, locatorBytes: number, surfaceDigest: string, locatorDigest: string, source: Array<{ fileName: string, generation: number | null, size: number, revision: string | null }> }} SegmentManifest */
+/** @typedef {{ fileName: string, generation: number | null, size: number, revision: string | null, truncated?: boolean }} SegmentSource */
+
+/** @typedef {{ schemaVersion: number, generation: number | null, view: string, recordCount: number, surfaceBytes: number, locatorBytes: number, surfaceDigest: string, locatorDigest: string, source: SegmentSource[] }} SegmentManifest */
 
 /**
  * One record's searchable text.
@@ -320,6 +322,10 @@ export function sameSource(stored, live) {
     if (a.fileName !== b.fileName) return false;
     if (a.generation !== b.generation) return false;
     if (a.size !== b.size) return false;
+    // Same reason as in the index: a generation read short by our own cap produces a segment that
+    // covers a prefix, while `size` is the whole file. Trusting it would answer with a smaller
+    // `total` and say nothing about being wrong.
+    if ((a.truncated === true) !== (b.truncated === true)) return false;
     if (typeof a.revision === 'string' && a.revision.length > 0
       && typeof b.revision === 'string' && b.revision.length > 0 && a.revision !== b.revision) {
       return false;
diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
index 46c54b7..f1e68f7 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
@@ -1255,6 +1255,70 @@ export function collectSearchHits(payload, needle, limit) {
   return { hits, total };
 }
 
+/**
+ * The same answers {@link collectSearchHits} gives, assembled from what is already on disk.
+ *
+ * Not a speed-up for its own sake: the rebuild is the only part of a search that touches every row
+ * of every generation, and on the largest session measured on this machine that was 3.7 seconds.
+ * The artifacts already hold the searchable surface per generation and a record table naming where
+ * each record sits, so answering from them is a scan rather than a projection.
+ *
+ * `null` means they cannot answer, and that is not a partial answer: `total` counts every match in
+ * the session, so a generation whose segment went missing would silently lower it and the reader
+ * would be told the needle matched fewer things than it did. The caller falls back instead.
+ *
+ * @param {{ turns: Array<Record<string, any>>, records: Array<Record<string, any>> }} index
+ * @param {Array<{ fileIdx: number, ordinals: number[] }>} scanned per generation, in lineage order
+ * @param {number} limit
+ * @returns {{ hits: Array<{ index: number, turnIndex: number | null, kind: string, summary: string, generation: number | null }>, total: number } | null}
+ */
+export function collectSearchHitsFromArtifacts(index, scanned, limit) {
+  const records = index && Array.isArray(index.records) ? index.records : [];
+  const turns = index && Array.isArray(index.turns) ? index.turns : [];
+  if (records.length === 0) return null;
+  // Positions within `records`, grouped by the generation each came from. A segment's ordinal is
+  // the position of its record inside that generation's own run of records, so this is the whole
+  // mapping between a scan result and the ledger.
+  /** @type {Map<number, number[]>} */
+  const byFile = new Map();
+  for (let pos = 0; pos < records.length; pos += 1) {
+    const key = records[pos].fileIdx;
+    const list = byFile.get(key);
+    if (list === undefined) byFile.set(key, [pos]);
+    else list.push(pos);
+  }
+  /** @type {number[]} */
+  const wanted = [];
+  for (const entry of scanned) {
+    const list = byFile.get(entry.fileIdx);
+    if (list === undefined) return null;
+    for (const ordinal of entry.ordinals) {
+      const pos = list[ordinal];
+      // An ordinal past the end means the segment and the index were built from different sources.
+      // Answering from one of them would be answering a question about a session that never existed.
+      if (pos === undefined) return null;
+      wanted.push(pos);
+    }
+  }
+  wanted.sort((a, b) => a - b);
+  const hits = [];
+  let turnCursor = 0;
+  for (const pos of wanted) {
+    if (hits.length >= limit) break;
+    while (turnCursor + 1 < turns.length && pos > turns[turnCursor].lastRecord) turnCursor += 1;
+    const turn = turns[turnCursor];
+    const record = records[pos];
+    hits.push({
+      index: record.index,
+      turnIndex: turn === undefined ? null : turn.index,
+      kind: record.kind,
+      summary: typeof record.summary === 'string' ? record.summary : '',
+      generation: typeof record.generation === 'number' ? record.generation : null,
+    });
+  }
+  return { hits, total: wanted.length };
+}
+
 /**
  * The five fields a search reads, in the page's order, normalised and folded exactly as the stored
  * surfaces are. Re-exported so a guard can compare the page's own `recordSearchText` against this
@@ -3303,6 +3367,10 @@ export async function start(context) {
         size,
         mtimeMs,
         revision: typeof artifact.revision === 'string' ? artifact.revision : null,
+        // Per generation, not only summed into the session-level flag: an artifact built from this
+        // generation has to be able to tell that it covers a prefix of the file rather than all of
+        // it, and the only place that fact exists is here.
+        truncated: parsedFile.truncated === true,
         filePath,
       });
       // A sealed file's rows are shared with every other request that read it; the active file's
@@ -3539,6 +3607,25 @@ export async function start(context) {
       return;
     }
     const { occurrences, files } = walked;
+    const sessionKey = searchSessionKey(entry.dir, ctx.identity.id);
+    const viewKey = searchViewKey(filter);
+
+    // Before anything expensive. The lineage walk above is stat-driven and cheap; everything after
+    // this line is the rebuild, and on the largest session measured here it was 3.7 seconds for a
+    // search that returns at most 500 rows.
+    const onDisk = await searchFromArtifacts({ sessionKey, viewKey, files, needle });
+    if (onDisk !== null) {
+      sendJson(response, 200, {
+        query: asked,
+        hits: onDisk.hits,
+        total: onDisk.total,
+        truncated: onDisk.total > onDisk.hits.length,
+        // The same field the rebuild sends. Two paths answering the same request with two different
+        // response shapes is not a faster version of the endpoint, it is a second endpoint.
+        session: { id: ctx.identity.id, generation: filter },
+      });
+      return;
+    }
 
     const identityTable = buildMessageIdentity(occurrences);
     const view = selectIdentityView(identityTable, filter);
@@ -3568,8 +3655,8 @@ export async function start(context) {
     // a slower next search, not a failed one, and a failure here must not turn a hit into an error.
     void publishSearchArtifacts({
       entry,
-      sessionKey: searchSessionKey(entry.dir, ctx.identity.id),
-      viewKey: searchViewKey(filter),
+      sessionKey,
+      viewKey,
       payload,
       raws: rowIndexByRecord,
       rowLocators,
@@ -3590,6 +3677,42 @@ export async function start(context) {
     rowLocators.length = 0;
   };
 
+  /**
+   * Answers a search from the stored index and one segment per generation, or `null` when they
+   * cannot.
+   *
+   * `null` is the answer for every "no" here — no index, an index whose sources have moved, a
+   * segment missing or unreadable — and the caller rebuilds. It is deliberately not a partial
+   * answer: `total` is how many records in the whole session matched, so answering from 44 of 45
+   * generations would report a smaller total and the page would tell the reader the needle matched
+   * fewer things than it did, with nothing anywhere saying so.
+   *
+   * What makes the artifacts trustworthy without re-deriving anything: `indexStore.read` checks the
+   * source identity of every generation and the projection version, and the identity decisions the
+   * index was built from are a pure function of exactly those. Same sources and same code, so the
+   * answers are the ones the rebuild would have produced — which is why no second intersection
+   * against the current view is done here. That extra intersection is the kind of step that
+   * silently disagrees with the thing it is checking.
+   *
+   * @param {{ sessionKey: string, viewKey: string, files: Array<any>, needle: string }} input
+   */
+  const searchFromArtifacts = async ({ sessionKey, viewKey, files, needle }) => {
+    const index = await indexStore.read(sessionKey, viewKey, files);
+    if (index === null) return null;
+    /** @type {Array<{ fileIdx: number, ordinals: number[] }>} */
+    const scanned = [];
+    // `files` is the lineage walk's own output, so a generation that is no longer in the lineage
+    // has no entry here and no segment is read — a leftover on disk cannot keep it searchable.
+    for (let fileIdx = 0; fileIdx < files.length; fileIdx += 1) {
+      const file = files[fileIdx];
+      const segment = await segmentStore.read(sessionKey, viewKey, generationKey(file.generation), [file]);
+      if (segment === null) return null;
+      const ordinals = scanSegment(segment.surface, needle);
+      if (ordinals.length > 0) scanned.push({ fileIdx, ordinals });
+    }
+    return collectSearchHitsFromArtifacts(index, scanned, MAX_SEARCH_HITS);
+  };
+
   /**
    * The artifacts a search would like the NEXT search to be able to skip the rebuild for.
    *
@@ -3613,13 +3736,39 @@ export async function start(context) {
       projectionDigest: projectionDigestOf(payload),
     });
 
-    // One segment per SEALED generation. The active one is being appended to, so a segment for it
-    // would be stale before it was written; it is searched from the rows the request read instead.
-    const activeIdx = files.findIndex((file) => file.fileName === activeFileName);
+    // One segment per generation, the active one included. §8.8.1 rule 5 excluded the active
+    // generation on the grounds that a segment for it would be stale before it was written — true,
+    // and it is still true. What changed is that nothing has to TRUST it: `sameSource` reads the
+    // generation's own size, so an appended file invalidates its own segment and only its own, and
+    // an artifact that cannot be trusted makes the search fall back rather than answer. Without a
+    // segment for the active generation there would be nothing to scan at all on a session that is
+    // still being written, which is the one case a reader is most likely to search.
+    //
+    // The surface comes from the PAYLOAD's records, not the index's. The index deliberately drops
+    // the four bulk fields to stay small, and three of those five — `text`, `result`, `thinking` —
+    // are searchable. A segment built from index records therefore searches two of the five fields,
+    // which narrows what a reader can find with nothing anywhere reporting it. Measured on the
+    // largest session here: the needle "needle" reported 14 matches through the artifacts and 45
+    // through the rebuild, and the two answers were both plausible. The index is still needed — it
+    // is what names each record's index, turn and kind — so the two are merged: the payload's
+    // fields for the surface, the index's fileIdx and byte range for the locator.
+    const flatRecords = payload.turns.flatMap((turn) => turn.records);
     for (let fileIdx = 0; fileIdx < files.length; fileIdx += 1) {
-      if (fileIdx === activeIdx) continue;
-      const records = indexRows.records.filter((record) => record.fileIdx === fileIdx);
-      if (records.length === 0) continue;
+      const records = [];
+      for (let i = 0; i < flatRecords.length; i += 1) {
+        const located = indexRows.records[i];
+        if (located === undefined || located.fileIdx !== fileIdx) continue;
+        records.push({
+          ...flatRecords[i],
+          fileIdx: located.fileIdx,
+          byteStart: located.byteStart,
+          byteEnd: located.byteEnd,
+        });
+      }
+      // A generation with no records still gets a segment, and it is an empty one. Skipping it
+      // would leave the reader with nothing to find, and "nothing to find" is exactly what a
+      // missing segment reports — so a session holding one empty generation would fall back to the
+      // rebuild forever, for a generation that could never match anything.
       const generation = files[fileIdx].generation;
       const generationKeyValue = generationKey(generation);
       // Already there and still matching its source: nothing to do, which is the common case on a
diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/trajectory-index.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/trajectory-index.mjs
index 713fe9d..9830723 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/trajectory-index.mjs
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/trajectory-index.mjs
@@ -254,6 +254,11 @@ export function stripPath(file) {
     size: file.size,
     mtimeMs: file.mtimeMs,
     revision: file.revision,
+    // Whether this generation's rows were cut short by our own read cap. `size` is the whole file
+    // whether or not the read covered it, so on its own a truncated generation's artifact looks
+    // exactly like a complete one. Carried because an answer assembled from artifacts would then
+    // report a smaller `total` than the rebuild would, and report nothing about being wrong.
+    truncated: file.truncated === true,
   };
 }
 
@@ -534,6 +539,10 @@ export function sameSources(stored, live) {
     if (a.fileName !== b.fileName) return false;
     if (a.generation !== b.generation) return false;
     if (a.size !== b.size) return false;
+    // A generation that was read short is not the same answer as one that was read whole, even
+    // though both report the same `size`. Compared as booleans so an artifact written before this
+    // field existed is rejected once and rebuilt, rather than trusted.
+    if ((a.truncated === true) !== (b.truncated === true)) return false;
     if (typeof a.revision === 'string' && a.revision.length > 0
       && typeof b.revision === 'string' && b.revision.length > 0 && a.revision !== b.revision) {
       return false;
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-search-endpoint.py b/plugins/avatasia/mmc-trajectory/tests/mutate-search-endpoint.py
index e99a4aa..0cca78f 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-search-endpoint.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-search-endpoint.py
@@ -102,9 +102,30 @@
         "  const artifactRoot = join(process.cwd(), 'trajectory-artifacts');",
     ),
     (
-        "the active generation is stored as a segment, so a growing file keeps a stale segment",
-        "      if (fileIdx === activeIdx) continue;",
-        "      if (false) continue;",
+        # Used to be the other way round: §8.8.1 rule 5 kept the active generation out of the store,
+        # and this mutation removed that skip. The rule is inverted now — the active generation IS
+        # stored, because `sameSource` reads its own size and a grown file invalidates itself — so
+        # the mutation puts the skip back and the guard has to notice the early exit it now forbids.
+        "the active generation is skipped again, so a session still being written has nothing to scan",
+        "    for (let fileIdx = 0; fileIdx < files.length; fileIdx += 1) {\n      const records = [];",
+        "    for (let fileIdx = 0; fileIdx < files.length; fileIdx += 1) {\n      if (fileIdx === 0) continue;\n      const records = [];",
+    ),
+    (
+        # The rule is that `total` counts every match, so a missing generation cannot be tolerated:
+        # answering from 44 of 45 reports a smaller number and says nothing about being wrong.
+        "one missing segment no longer makes the search fall back",
+        "      if (segment === null) return null;",
+        "      if (segment === null) continue;",
+    ),
+    (
+        "the artifact path reports how many it sent instead of how many matched",
+        "  return { hits, total: wanted.length };",
+        "  return { hits, total: hits.length };",
+    ),
+    (
+        "the artifact path reports the kind where the summary belongs",
+        "      turnIndex: turn === undefined ? null : turn.index,\n      kind: record.kind,\n      summary: typeof record.summary === 'string' ? record.summary : '',",
+        "      turnIndex: turn === undefined ? null : turn.index,\n      kind: record.kind,\n      summary: String(record.kind),",
     ),
     (
         "writing the artifacts can fail the search that asked for them",
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-search-segments.py b/plugins/avatasia/mmc-trajectory/tests/mutate-search-segments.py
index b02ac02..52639da 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-search-segments.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-search-segments.py
@@ -109,6 +109,16 @@
         "  return generation === null || generation === undefined ? 'active' : `g${generation}`;",
         "  return generation === null || generation === undefined ? 'g0' : `g${generation}`;",
     ),
+    # ---- a generation read short must not look like one read whole --------------------------
+    (
+        # `size` is the whole file whether or not the read covered it, so this comparison is the
+        # only thing standing between a segment covering a PREFIX and being served as if it covered
+        # everything. Remove it and a truncated generation answers with a smaller total and says
+        # nothing about being wrong.
+        "a source that was read short is trusted as if it had been read whole",
+        "    if ((a.truncated === true) !== (b.truncated === true)) return false;\n    if (typeof a.revision === 'string' && a.revision.length > 0",
+        "    if (typeof a.revision === 'string' && a.revision.length > 0",
+    ),
 ]
 
 
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-index.py b/plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-index.py
index fc7b1d2..7b5e5ad 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-index.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-index.py
@@ -106,6 +106,15 @@
         "    if (a.size !== b.size) return false;",
         "    if (a.size !== b.size) return false;\n    if (a.mtimeMs !== b.mtimeMs) return false;",
     ),
+    (
+        # `size` is the whole file whether or not the read covered it, so this is the only thing
+        # telling a generation that was read short from one that was read whole. Without it the
+        # index built from a truncated generation is served as if it held every record, and a
+        # search over it reports fewer matches than there are — quietly.
+        "a source that was read short is trusted as if it had been read whole",
+        "    if ((a.truncated === true) !== (b.truncated === true)) return false;\n    if (typeof a.revision === 'string' && a.revision.length > 0",
+        "    if (typeof a.revision === 'string' && a.revision.length > 0",
+    ),
 ]
 
 
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs
index 846cba3..6fa00b5 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs
@@ -28,12 +28,16 @@ import {
   buildMessageIdentity,
   buildTrajectoryPayload,
   collectSearchHits,
+  collectSearchHitsFromArtifacts,
   foldNeedle,
   needleIsUsable,
   normaliseWhitespace,
   selectIdentityView,
+  splitRawRecords,
   ROW_GENERATION,
 } from '../miniapp/node/server.mjs';
+import { indexRowsFromPayload } from '../miniapp/node/trajectory-index.mjs';
+import { buildSegment, scanSegment } from '../miniapp/node/search-segments.mjs';
 
 const SERVER = readFileSync(new URL('../miniapp/node/server.mjs', import.meta.url), 'utf8');
 const CLIENT = readFileSync(new URL('../miniapp/client/index.html', import.meta.url), 'utf8');
@@ -341,8 +345,152 @@ assert('the session key is a hash, so no session id becomes a directory name',
   /createHash\('sha256'\)\.update\(`\$\{dir\}\\n\$\{sessionId\}`\)/.test(SERVER));
 assert('writing the artifacts cannot fail the request that asked for a search',
   /\.catch\(\(\) => undefined\)/.test(SERVER));
-assert('the active generation is not stored as a segment',
-  /if \(fileIdx === activeIdx\) continue;/.test(SERVER));
+/* =====================================================================
+ * 3 — the artifact path answers exactly what the rebuild answers
+ * ===================================================================== */
+
+/**
+ * The endpoint can now skip the rebuild: the stored index names every record and one segment per
+ * generation holds their searchable text. Two paths answering one request is only a performance
+ * change if they answer it IDENTICALLY, and the two ways they could differ are both silent — a hit
+ * the ledger does not have, and a `total` that is really a cap.
+ *
+ * The comparison is made against the same payload the rebuild would have produced, so it is a
+ * statement about the answers rather than about the plumbing.
+ */
+const ARTIFACT_FILES = [
+  { filePath: '/store/s/g0.jsonl', fileName: 'g0.jsonl', generation: 0, size: 300, mtimeMs: 1, revision: 'r0', truncated: false },
+  { filePath: '/store/s/g1.jsonl', fileName: 'g1.jsonl', generation: 1, size: 500, mtimeMs: 1, revision: 'r1', truncated: false },
+];
+// `indexRowsFromPayload` wants the record -> locator map, not the record -> row map the split
+// produces; the server builds it the same way before handing it over. Getting this wrong leaves
+// every record with `fileIdx: -1`, which is an index that still has the right records in it and
+// would answer with none.
+const rowIndexByRecord = splitRawRecords(allPayload.turns);
+const rowLocators = occurrences.map((o) => o.locator);
+const locatorByRecord = new Map();
+for (const [recordIndex, rowIndex] of rowIndexByRecord) {
+  locatorByRecord.set(recordIndex, rowLocators[rowIndex]);
+}
+const indexRows = indexRowsFromPayload(allPayload, locatorByRecord, ARTIFACT_FILES);
+const flatRecords = allPayload.turns.flatMap((t) => t.records);
+// The same merge the server does: the surface is built from the PAYLOAD's records and only the
+// locator fields come from the index. Building it from the index alone searches two of the five
+// fields — `text`, `result` and `thinking` are excluded from the index on purpose — and that was a
+// real bug this comparison did not catch, so it is now pinned directly rather than left to a
+// needle that happens to match.
+const segmentRecordsFor = (fileIdx) => {
+  const out = [];
+  for (let i = 0; i < flatRecords.length; i += 1) {
+    const located = indexRows.records[i];
+    if (located === undefined || located.fileIdx !== fileIdx) continue;
+    out.push({ ...flatRecords[i], fileIdx: located.fileIdx, byteStart: located.byteStart, byteEnd: located.byteEnd });
+  }
+  return out;
+};
+const scanArtifacts = (folded) => {
+  const scanned = [];
+  for (let fileIdx = 0; fileIdx < ARTIFACT_FILES.length; fileIdx += 1) {
+    const ordinals = scanSegment(buildSegment({ records: segmentRecordsFor(fileIdx) }).surface, folded);
+    if (ordinals.length > 0) scanned.push({ fileIdx, ordinals });
+  }
+  return scanned;
+};
+
+check('the index kept every record the rebuild would have shown',
+  indexRows.records.length, allRecords.length);
+assert('and it kept the generation each record came from',
+  new Set(indexRows.records.map((r) => r.fileIdx)).size === ARTIFACT_FILES.length);
+
+// The direct version of the bug: a segment's line for a record must contain that record's own
+// searchable text, in every field the endpoint searches. Read from the shipped server's own merge,
+// because a guard that builds the merge itself would only prove that it and itself agree.
+const bulkOnly = allRecords.find((r) => typeof r.result === 'string' && r.result.length > 0);
+assert('the fixture really does hold a record whose match is only in a bulk field', bulkOnly !== undefined);
+if (bulkOnly !== undefined) {
+  const located = indexRows.records[flatRecords.indexOf(bulkOnly)];
+  const line = buildSegment({ records: [{ ...bulkOnly, fileIdx: located.fileIdx, byteStart: 0, byteEnd: 1 }] }).surface;
+  assert('and the segment carries that field, though the index does not',
+    !Object.prototype.hasOwnProperty.call(located, 'result') && line.includes(normaliseWhitespace(bulkOnly.result)));
+  assert('the shipped server merges the payload into the segment for the same reason',
+    /records\.push\(\{\s*\n\s*\.\.\.flatRecords\[i\],\s*\n\s*fileIdx: located\.fileIdx,/.test(SERVER));
+}
+
+for (const needle of NEEDLES) {
+  const folded = foldNeedle(needle);
+  const rebuilt = collectSearchHits(allPayload, folded, 500);
+  const fromDisk = collectSearchHitsFromArtifacts(indexRows, scanArtifacts(folded), 500);
+  check(`"${needle}" — the artifact path sends the same hits`, fromDisk.hits, rebuilt.hits);
+  check(`"${needle}" — and counts them the same way`, fromDisk.total, rebuilt.total);
+}
+
+const capRebuilt = collectSearchHits(allPayload, foldNeedle('needle'), 2);
+const capFromDisk = collectSearchHitsFromArtifacts(indexRows, scanArtifacts(foldNeedle('needle')), 2);
+check('a cap bounds what is sent, on the artifact path too',
+  capFromDisk.hits.length, Math.min(2, capRebuilt.total));
+check('and never bounds what is counted', capFromDisk.total, capRebuilt.total);
+
+// An ordinal the index does not have means the segment and the index were built from different
+// sources. Answering from one of them would be answering about a session that never existed, and
+// nothing downstream could tell.
+check('an ordinal past the end of its generation is refused, not guessed',
+  collectSearchHitsFromArtifacts(indexRows, [{ fileIdx: 0, ordinals: [9999] }], 500), null);
+check('and a generation the index never held is refused too',
+  collectSearchHitsFromArtifacts(indexRows, [{ fileIdx: 7, ordinals: [0] }], 500), null);
+
+/* ---------------------------------------------------------------------
+ * A generation read short by our own cap produces a segment covering a
+ * PREFIX, while its recorded `size` is the whole file. That rule is owned
+ * where the comparison lives — verify-search-segments.mjs for `sameSource`
+ * and verify-trajectory-index.mjs for `sameSources` — and is deliberately
+ * NOT restated here: an assertion parked in a guard whose mutation control
+ * never touches it reads as covered without being covered.
+ * --------------------------------------------------------------------- */
+
+/* ---------------------------------------------------------------------
+ * The wiring. These read the shipped source, so they hold the shape rather
+ * than the behaviour; the behaviour is the comparisons above.
+ * --------------------------------------------------------------------- */
+assert('the active generation IS stored as a segment, so a session still being written has something to scan',
+  !/if \(fileIdx === activeIdx\) continue;/.test(SERVER));
+assert('a generation with no records still gets one, and it is empty — "no segment" and "no records" must not read alike',
+  !/records\.length === 0\) continue/.test(SERVER));
+assert('one missing segment makes the whole search fall back rather than answer from the rest',
+  /if \(segment === null\) return null;/.test(SERVER));
+// Two paths answering one request is only a performance change if they answer it identically,
+// and the response body is part of the answer the page reads.
+check('both paths send the same session field',
+  (SERVER.match(/session: \{ id: ctx\.identity\.id, generation: filter \}/g) || []).length, 2);
+// Scoped to handleSearch's own text: the same two lines also appear in the trajectory route, and
+// a whole-file indexOf would compare a search against an unrelated request's body.
+const handleSearchSrc = SERVER.slice(
+  SERVER.indexOf('const handleSearch = async'),
+  SERVER.indexOf('const searchFromArtifacts = async'));
+assert('and the artifact path is tried before anything expensive',
+  handleSearchSrc.indexOf('const onDisk = await searchFromArtifacts(') > 0
+  && handleSearchSrc.indexOf('const identityTable = buildMessageIdentity(occurrences);') > 0
+  && handleSearchSrc.indexOf('const onDisk = await searchFromArtifacts(')
+    < handleSearchSrc.indexOf('const identityTable = buildMessageIdentity(occurrences);'));
+
+// "Every generation in the lineage ends up with a segment" is the rule; naming the skip that used
+// to be there would only pin the old bug. And the loop legitimately HAS early exits — an inner one
+// that collects this generation's records, and an outer one that skips a generation already on
+// disk — so the rule is about the OUTER level only, told apart by indentation: an outer exit is
+// indented six spaces, an inner one eight. A generation may only be passed over after something
+// was read back for it.
+const publishSrc = SERVER.slice(
+  SERVER.indexOf('const publishSearchArtifacts = async'),
+  SERVER.indexOf('void entry;'));
+const generationLoop = publishSrc.slice(
+  publishSrc.indexOf('for (let fileIdx = 0; fileIdx < files.length; fileIdx += 1) {'));
+const outerContinues = generationLoop.match(/^ {6}(?! )[^\n]*\bcontinue;/gm) || [];
+assert('every generation ends up with a segment: the only outer early exit is "already on disk", and it comes after the read',
+  generationLoop.length > 0
+  && outerContinues.length <= 1
+  && (outerContinues.length === 0
+    || (outerContinues[0].includes('existing !== null')
+      && generationLoop.indexOf(outerContinues[0]) > generationLoop.indexOf('segmentStore.read('))));
+
 
 /* --------------------------------------------------------------------- */
 
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs
index 8f6cec3..a434740 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs
@@ -417,6 +417,29 @@ assert('nothing here spawns a thread; the route owns that',
 assert('the scan is a per-line test, not a joined blob',
   /line\.includes\(needle\)/.test(source) && !/\+ .*surface.*\+/.test(source.split('export function scanSegment')[1].split('export function')[0]));
 
+/* ---------------------------------------------------------------------
+ * A generation read short by our own read cap produces a segment that
+ * covers a PREFIX of the file, while `size` is the whole file. Without
+ * this comparison the two are indistinguishable, and a segment that
+ * covers a prefix would be served as one that covers everything: a
+ * smaller `total`, hits that went missing, and nothing said about it.
+ * --------------------------------------------------------------------- */
+const WHOLE_SOURCE = { fileName: 'g1.jsonl', generation: 1, size: 500, revision: 'r1' };
+const SHORT_SOURCE = { ...WHOLE_SOURCE, truncated: true };
+check('a source read short is not trusted as if it had been read whole',
+  sameSource([{ ...WHOLE_SOURCE, truncated: false }], [SHORT_SOURCE]), false);
+check('and not in the other direction either',
+  sameSource([SHORT_SOURCE], [{ ...WHOLE_SOURCE, truncated: false }]), false);
+check('two sources that agree about truncation still trust each other',
+  sameSource([SHORT_SOURCE], [SHORT_SOURCE]), true);
+check('and two that agree it was read whole do too',
+  sameSource([WHOLE_SOURCE], [{ ...WHOLE_SOURCE, truncated: false }]), true);
+assert('an older artifact that predates the field is rebuilt rather than trusted',
+  sameSource([{ fileName: 'g1.jsonl', generation: 1, size: 500, revision: 'r1' }], [{ ...WHOLE_SOURCE, truncated: false }]), true);
+assert('the comparison is in this module and not only in the caller',
+  /if \(\(a\.truncated === true\) !== \(b\.truncated === true\)\) return false;/.test(
+    source.split('export function sameSource')[1] || ''));
+
 /* --------------------------------------------------------------------- */
 
 if (failures.length) {
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-trajectory-index.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-trajectory-index.mjs
index a05547a..65e5f4b 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-trajectory-index.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-trajectory-index.mjs
@@ -519,6 +519,19 @@ try {
 
   check('sameSources is order sensitive', sameSources(FILES, [...FILES].reverse()), false);
   check('sameSources rejects a length mismatch', sameSources(FILES, FILES.slice(0, 1)), false);
+
+  // A generation read short by our own cap leaves a row set that covers a PREFIX, while `size` is
+  // the whole file. That is the one case the identity facts cannot tell apart, so it is carried
+  // and compared: an index built from it would otherwise be served as one holding every record.
+  const WHOLE = { fileName: 'messages.jsonl', generation: 3, size: 900, mtimeMs: 7, revision: 'r3' };
+  check('a source read short is not trusted as if read whole',
+    sameSources([{ ...WHOLE, truncated: false }], [{ ...WHOLE, truncated: true }]), false);
+  check('and not in the other direction either',
+    sameSources([{ ...WHOLE, truncated: true }], [{ ...WHOLE, truncated: false }]), false);
+  check('two sources that agree about truncation trust each other',
+    sameSources([{ ...WHOLE, truncated: true }], [{ ...WHOLE, truncated: true }]), true);
+  check('and so do two that agree it was read whole',
+    sameSources([WHOLE], [{ ...WHOLE, truncated: false }]), true);
 } catch (error) {
   storeFailures.push(`the store could not be exercised: ${error instanceof Error ? error.message : String(error)}`);
 } finally {

From 82a6e02556eb05d3d6b03c6836f75c2f957a3413 Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 13:36:20 +0800
Subject: [PATCH 16/36] Put a search hit's answer on the segment's own line,
 and take the record index off that path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A hit has to answer with something the reader can be sent to: the record's ledger index, its
turn, its kind and its summary. Those lived in a second file read in step with the segment, and
resolving a hit meant going back to the session's whole record index — 34.2 MB of JSONL for the
largest session measured on this machine, parsed on every search.

Each segment line now carries that answer, so the search path reads the segments and nothing
else. The locators file goes with it: it said where each record came from, which nothing that
answers a search needs, and those fields are on the line now. A hit the scan named but the
reader cannot resolve falls back rather than being skipped, since `total` is how many records in
the session matched and a smaller number says nothing about being wrong.

The reader takes the whole scan in ONE call. Resolving one ordinal at a time walked the segment
from byte zero per hit: correct answers, and about eighteen gigabytes of walking for a common
needle, which measured SLOWER than the index read it replaced. Nothing about values can see that,
so the guard counts the walk instead — a boxed string with counted per-line operations, an upper
bound so a correct rewrite that walks some other way passes. Two more assertions cover the same
rule: no per-ordinal reader is exported for a caller to reach for by mistake, and the answers
come back in the order asked rather than the order they sit.

  - search-segments.mjs: `readSegmentHit` -> `readSegmentHits`; `buildSegment` writes
    `<compact json>\t<searchable text>` so a needle can never match into the answer; the scan
    tests only what is after the TAB. `SEGMENT_SCHEMA_VERSION` 1 -> 2.
  - server.mjs: `searchFromArtifacts` reads the segments and sorts by `index`.
    `collectSearchHitsFromArtifacts` is gone — it existed to let the artifact path use the index.
  - trajectory-index.mjs is untouched. The index is still written; what to do about a subsystem
    nothing reads is a separate decision and is not taken here.

Also adds the root `plugin.json`, which `sync-sop.py classify` has been listing as SHIP — the
host's `mcode.miniApp` entry pointer — and which was in the working tree and shipping to readers
while never having been added to the repository. It was never deleted either: `git log --all` on
that path returns zero commits, so "the whole directory installs" was true of a file git did not
track. That is also why every projection refused until now.

Measured on the largest session on this machine (189.1 MB, 45 generations, 25,427 messages,
36,525 records), same request, artifact directory emptied first:

    baseline   cold 3309.8 ms   warm median 3667.3 ms   warm max 3793.7 ms
    this       cold 1439.7 ms   warm median 1416.6 ms   warm max 1432.6 ms

Six needles compared the artifact path against the rebuild on real data: identical bodies and
identical totals (45 / 14,092 / 9,103 / 12,770 / 3,604 / 6,227). Of the 1,416.6 ms that remains,
reading the 44.4 MB of surfaces costs 37.9 ms, hashing them 82.7 ms, and scanning them 20.7 ms;
the rest is the lineage walk parsing every generation's rows, which this path does not use and
which is the next thing to look at.

Tests: `node tests/run.mjs` on this tree -> 82/82 guards passed. verify-search-segments 116 -> 122
assertions and mutate-search-segments 19 -> 22, verify-search-endpoint 93 -> 96 and
mutate-search-endpoint 17 -> 19, all caught by name.
---
 .../miniapp/node/search-segments.mjs          | 131 ++++++++++---
 .../mmc-trajectory/miniapp/node/server.mjs    | 126 ++++--------
 plugins/avatasia/mmc-trajectory/plugin.json   |   6 +
 .../tests/mutate-search-endpoint.py           |  42 +++-
 .../tests/mutate-search-segments.py           |  64 +++++-
 .../tests/verify-search-endpoint.mjs          | 108 +++++++++--
 .../tests/verify-search-segments.mjs          | 183 ++++++++++++++----
 7 files changed, 475 insertions(+), 185 deletions(-)
 create mode 100644 plugins/avatasia/mmc-trajectory/plugin.json

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/search-segments.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/search-segments.mjs
index 7198998..70727fd 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/search-segments.mjs
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/search-segments.mjs
@@ -44,7 +44,7 @@ import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 
 /** Bumped when the on-disk shape changes in a way an older reader cannot survive. */
-export const SEGMENT_SCHEMA_VERSION = 1;
+export const SEGMENT_SCHEMA_VERSION = 2;
 
 /**
  * The fields a search reads, in the page's order.
@@ -59,7 +59,7 @@ export const SEARCH_FIELDS = ['summary', 'text', 'result', 'thinking', 'toolName
 
 /** @typedef {{ fileName: string, generation: number | null, size: number, revision: string | null, truncated?: boolean }} SegmentSource */
 
-/** @typedef {{ schemaVersion: number, generation: number | null, view: string, recordCount: number, surfaceBytes: number, locatorBytes: number, surfaceDigest: string, locatorDigest: string, source: SegmentSource[] }} SegmentManifest */
+/** @typedef {{ schemaVersion: number, generation: number | null, view: string, recordCount: number, surfaceBytes: number, surfaceDigest: string, source: SegmentSource[] }} SegmentManifest */
 
 /**
  * One record's searchable text.
@@ -106,35 +106,51 @@ export function normaliseWhitespace(value) {
 }
 
 /**
- * Builds one generation's pair: the surface and the locators that name where each of its records
- * came from.
+ * Builds one generation's searchable lines.
+ *
+ * Each line is `<compact json>\t<searchable text>`, one line per record in ledger order, and it
+ * carries everything a hit has to answer with: the ledger `index`, the `turnIndex`, `kind`,
+ * `generation` and the projected `summary`, plus the locator triple.
+ *
+ * Why the answer travels with the searchable text: answering used to mean reading the session's
+ * whole record index as well — measured at 34.2 MB of JSONL for the largest session on this
+ * machine, parsed on every search, which was 1.7 s of the 1.7 s left after the projection stopped
+ * being rebuilt. A needle that matches 14 records out of 36,525 does not need the other 36,511,
+ * and it does not need them parsed either.
+ *
+ * The separator is a TAB and the searchable part comes last, so a needle can never match across the
+ * boundary into the JSON prefix — the record it would name is then a match spanning two records,
+ * which is the one thing a per-record scan exists to prevent.
  *
  * @param {{ records: Array<Record<string, any>> }} input records of ONE generation, in ledger order
- * @returns {{ surface: string, locators: string }}
+ * @returns {{ surface: string }}
  */
 export function buildSegment(input) {
-  const surfaceLines = [];
-  const locatorLines = [];
+  const lines = [];
   for (let i = 0; i < input.records.length; i += 1) {
     const record = input.records[i];
-    surfaceLines.push(searchSurfaceOf(record));
-    /** @type {SegmentLocator} */
-    const locator = {
+    lines.push(JSON.stringify({
       ordinal: i,
+      index: typeof record.index === 'number' ? record.index : -1,
+      turnIndex: typeof record.turnIndex === 'number' ? record.turnIndex : null,
+      kind: typeof record.kind === 'string' ? record.kind : '',
+      generation: typeof record.generation === 'number' ? record.generation : null,
+      summary: typeof record.summary === 'string' ? record.summary : '',
       fileIdx: typeof record.fileIdx === 'number' ? record.fileIdx : -1,
       byteStart: typeof record.byteStart === 'number' ? record.byteStart : -1,
       byteEnd: typeof record.byteEnd === 'number' ? record.byteEnd : -1,
-    };
-    locatorLines.push(JSON.stringify(locator));
+    }) + '\t' + searchSurfaceOf(record));
   }
-  return { surface: surfaceLines.join('\n'), locators: locatorLines.join('\n') };
+  return { surface: lines.join('\n') };
 }
 
 /**
- * Every record ordinal whose own surface contains the needle.
+ * Every record ordinal whose own searchable text contains the needle.
  *
  * Per line, on purpose: this is the boundary. A needle cannot be answered from anything but one
- * record's own five fields, because a match spanning two records describes no record.
+ * record's own five fields, because a match spanning two records describes no record. So only the
+ * part after the TAB is tested — the JSON prefix holds the record's kind and summary, and a needle
+ * matching there would be matching an answer rather than the text being looked for.
  *
  * @param {string} surface
  * @param {string} needle already folded, by {@link foldNeedle}
@@ -149,7 +165,8 @@ export function scanSegment(surface, needle) {
     const nl = surface.indexOf('\n', start);
     const end = nl === -1 ? surface.length : nl;
     const line = surface.slice(start, end);
-    if (line.includes(needle)) hits.push(ordinal);
+    const tab = line.indexOf('\t');
+    if (tab >= 0 && line.slice(tab + 1).includes(needle)) hits.push(ordinal);
     ordinal += 1;
     if (nl === -1) break;
     start = nl + 1;
@@ -157,6 +174,60 @@ export function scanSegment(surface, needle) {
   return hits;
 }
 
+/**
+ * One record's answer, read back out of the line {@link scanSegment} matched.
+ *
+ * Walks the segment ONCE for the whole batch. The first version took one ordinal and scanned from
+ * the beginning to find it, which is fine for a guard checking one record and catastrophic for the
+ * route: a needle like "the" matched 14,092 records on the largest session here, and 14,092 scans
+ * of a 1.3 MB segment is eighteen gigabytes of walking to answer a search. Measured, and it is the
+ * reason this looked like no improvement at all.
+ *
+ * The ordinals come from the scan, so a caller cannot answer with a record other than the one the
+ * scan named, and they are returned in the order asked for rather than the order they sit.
+ *
+ * @param {string} surface the whole segment text
+ * @param {number[]} ordinals as returned by {@link scanSegment}
+ * @returns {Array<{ index: number, turnIndex: number | null, kind: string, summary: string, generation: number | null } | null>}
+ */
+export function readSegmentHits(surface, ordinals) {
+  const wanted = new Set(ordinals);
+  /** @type {Map<number, { index: number, turnIndex: number | null, kind: string, summary: string, generation: number | null } | null>} */
+  const found = new Map();
+  if (wanted.size === 0) return [];
+  let start = 0;
+  let at = 0;
+  while (start <= surface.length) {
+    const nl = surface.indexOf('\n', start);
+    const end = nl === -1 ? surface.length : nl;
+    if (wanted.has(at)) {
+      const tab = surface.indexOf('\t', start);
+      if (tab < 0 || tab > end) {
+        found.set(at, null);
+      } else {
+        /** @type {any} */
+        let parsed;
+        try {
+          parsed = JSON.parse(surface.slice(start, tab));
+        } catch {
+          parsed = null;
+        }
+        found.set(at, parsed === null || typeof parsed !== 'object' ? null : {
+          index: typeof parsed.index === 'number' ? parsed.index : -1,
+          turnIndex: typeof parsed.turnIndex === 'number' ? parsed.turnIndex : null,
+          kind: typeof parsed.kind === 'string' ? parsed.kind : '',
+          summary: typeof parsed.summary === 'string' ? parsed.summary : '',
+          generation: typeof parsed.generation === 'number' ? parsed.generation : null,
+        });
+      }
+    }
+    at += 1;
+    if (nl === -1) break;
+    start = nl + 1;
+  }
+  return ordinals.map((ordinal) => found.get(ordinal) ?? null);
+}
+
 /**
  * The needle in the form the surface was stored in: normalised the same way a surface is, then
  * folded. Folding the needle rather than the surface at query time is what keeps the scan a plain
@@ -224,14 +295,19 @@ export function createSegmentStore(root) {
     dirOf,
 
     /**
-     * Publishes one generation's pair. The surface lands, then the locators, then the manifest that
-     * makes the pair readable — so a run interrupted anywhere leaves a directory that reads as "no
-     * segment" rather than as half of one.
+     * Publishes one generation's text. The surface lands first, then the manifest that makes it
+     * readable — so a run interrupted anywhere leaves a directory that reads as "no segment"
+     * rather than as half of one.
+     *
+     * There used to be a second file, the locators, holding one small JSON object per record. It
+     * was never read on the search path: it names where each record came from, and nothing that
+     * answers a search needs that. When the answer itself moved onto each line, the locator fields
+     * came with it and the file had nothing left to say.
      *
      * @param {string} sessionKey
      * @param {string} view
      * @param {string} generationKey
-     * @param {{ surface: string, locators: string }} segment
+     * @param {{ surface: string }} segment
      * @param {{ generation: number | null, source: SegmentManifest['source'] }} meta
      */
     async write(sessionKey, view, generationKey, segment, meta) {
@@ -239,18 +315,14 @@ export function createSegmentStore(root) {
       await mkdir(dir, { recursive: true });
       await writeFile(`${join(dir, 'surface.txt')}.tmp`, segment.surface, 'utf8');
       await rename(`${join(dir, 'surface.txt')}.tmp`, join(dir, 'surface.txt'));
-      await writeFile(`${join(dir, 'locators.jsonl')}.tmp`, segment.locators, 'utf8');
-      await rename(`${join(dir, 'locators.jsonl')}.tmp`, join(dir, 'locators.jsonl'));
       /** @type {SegmentManifest} */
       const manifest = {
         schemaVersion: SEGMENT_SCHEMA_VERSION,
         generation: meta.generation,
         view,
-        recordCount: segment.locators === '' ? 0 : segment.locators.split('\n').length,
+        recordCount: segment.surface === '' ? 0 : segment.surface.split('\n').length,
         surfaceBytes: Buffer.byteLength(segment.surface),
-        locatorBytes: Buffer.byteLength(segment.locators),
         surfaceDigest: digestOf(segment.surface),
-        locatorDigest: digestOf(segment.locators),
         source: meta.source,
       };
       await writeFile(`${join(dir, 'manifest.json')}.tmp`, `${JSON.stringify(manifest)}\n`, 'utf8');
@@ -282,18 +354,15 @@ export function createSegmentStore(root) {
       if (manifest.view !== view) return null;
       if (!sameSource(manifest.source, source)) return null;
       let surface;
-      let locators;
       try {
         surface = await readFile(join(dir, 'surface.txt'), 'utf8');
-        locators = await readFile(join(dir, 'locators.jsonl'), 'utf8');
       } catch {
         return null;
       }
       if (digestOf(surface) !== manifest.surfaceDigest) return null;
-      if (digestOf(locators) !== manifest.locatorDigest) return null;
-      const lines = locators === '' ? [] : locators.split('\n');
-      if (lines.length !== manifest.recordCount) return null;
-      return { manifest, surface, locators: lines };
+      const lines = surface === '' ? 0 : surface.split('\n').length;
+      if (lines !== manifest.recordCount) return null;
+      return { manifest, surface };
     },
 
     /** @param {string} sessionKey @param {string} view @param {string} generationKey */
diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
index f1e68f7..591f71e 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
@@ -26,6 +26,7 @@ import {
   generationKey,
   needleIsUsable,
   normaliseWhitespace,
+  readSegmentHits,
   scanSegment,
   searchSurfaceOf,
 } from './search-segments.mjs';
@@ -1255,69 +1256,6 @@ export function collectSearchHits(payload, needle, limit) {
   return { hits, total };
 }
 
-/**
- * The same answers {@link collectSearchHits} gives, assembled from what is already on disk.
- *
- * Not a speed-up for its own sake: the rebuild is the only part of a search that touches every row
- * of every generation, and on the largest session measured on this machine that was 3.7 seconds.
- * The artifacts already hold the searchable surface per generation and a record table naming where
- * each record sits, so answering from them is a scan rather than a projection.
- *
- * `null` means they cannot answer, and that is not a partial answer: `total` counts every match in
- * the session, so a generation whose segment went missing would silently lower it and the reader
- * would be told the needle matched fewer things than it did. The caller falls back instead.
- *
- * @param {{ turns: Array<Record<string, any>>, records: Array<Record<string, any>> }} index
- * @param {Array<{ fileIdx: number, ordinals: number[] }>} scanned per generation, in lineage order
- * @param {number} limit
- * @returns {{ hits: Array<{ index: number, turnIndex: number | null, kind: string, summary: string, generation: number | null }>, total: number } | null}
- */
-export function collectSearchHitsFromArtifacts(index, scanned, limit) {
-  const records = index && Array.isArray(index.records) ? index.records : [];
-  const turns = index && Array.isArray(index.turns) ? index.turns : [];
-  if (records.length === 0) return null;
-  // Positions within `records`, grouped by the generation each came from. A segment's ordinal is
-  // the position of its record inside that generation's own run of records, so this is the whole
-  // mapping between a scan result and the ledger.
-  /** @type {Map<number, number[]>} */
-  const byFile = new Map();
-  for (let pos = 0; pos < records.length; pos += 1) {
-    const key = records[pos].fileIdx;
-    const list = byFile.get(key);
-    if (list === undefined) byFile.set(key, [pos]);
-    else list.push(pos);
-  }
-  /** @type {number[]} */
-  const wanted = [];
-  for (const entry of scanned) {
-    const list = byFile.get(entry.fileIdx);
-    if (list === undefined) return null;
-    for (const ordinal of entry.ordinals) {
-      const pos = list[ordinal];
-      // An ordinal past the end means the segment and the index were built from different sources.
-      // Answering from one of them would be answering a question about a session that never existed.
-      if (pos === undefined) return null;
-      wanted.push(pos);
-    }
-  }
-  wanted.sort((a, b) => a - b);
-  const hits = [];
-  let turnCursor = 0;
-  for (const pos of wanted) {
-    if (hits.length >= limit) break;
-    while (turnCursor + 1 < turns.length && pos > turns[turnCursor].lastRecord) turnCursor += 1;
-    const turn = turns[turnCursor];
-    const record = records[pos];
-    hits.push({
-      index: record.index,
-      turnIndex: turn === undefined ? null : turn.index,
-      kind: record.kind,
-      summary: typeof record.summary === 'string' ? record.summary : '',
-      generation: typeof record.generation === 'number' ? record.generation : null,
-    });
-  }
-  return { hits, total: wanted.length };
-}
 
 /**
  * The five fields a search reads, in the page's order, normalised and folded exactly as the stored
@@ -3678,29 +3616,30 @@ export async function start(context) {
   };
 
   /**
-   * Answers a search from the stored index and one segment per generation, or `null` when they
-   * cannot.
+   * Answers a search from the stored segment of each generation, or `null` when they cannot.
    *
-   * `null` is the answer for every "no" here — no index, an index whose sources have moved, a
-   * segment missing or unreadable — and the caller rebuilds. It is deliberately not a partial
-   * answer: `total` is how many records in the whole session matched, so answering from 44 of 45
-   * generations would report a smaller total and the page would tell the reader the needle matched
-   * fewer things than it did, with nothing anywhere saying so.
+   * `null` is the answer for every "no" here — a segment missing, unreadable, or not readable
+   * back once the scan has named a line in it — and the caller rebuilds. It is deliberately not a
+   * partial answer: `total` is how many records in the whole session matched, so answering from 44
+   * of 45 generations would report a smaller total and the page would tell the reader the needle
+   * matched fewer things than it did, with nothing anywhere saying so.
    *
-   * What makes the artifacts trustworthy without re-deriving anything: `indexStore.read` checks the
-   * source identity of every generation and the projection version, and the identity decisions the
-   * index was built from are a pure function of exactly those. Same sources and same code, so the
-   * answers are the ones the rebuild would have produced — which is why no second intersection
-   * against the current view is done here. That extra intersection is the kind of step that
-   * silently disagrees with the thing it is checking.
+   * What makes the segments trustworthy without re-deriving anything: `sameSource` checks each
+   * generation's identity and whether its read was cut short, the manifest pins the schema and the
+   * bytes' digest, and the identity decisions baked into them are a pure function of exactly those.
+   * Same sources and same code, so the answers are the ones the rebuild would have produced —
+   * which is why no second intersection against the current view is done here. That extra
+   * intersection is the kind of step that silently disagrees with the thing it is checking.
+   *
+   * The session's record index is NOT read. Each segment line carries its own answer, so a needle
+   * matching 14 records out of 36,525 reads those 14 lines rather than parsing 34.2 MB of index.
    *
    * @param {{ sessionKey: string, viewKey: string, files: Array<any>, needle: string }} input
    */
   const searchFromArtifacts = async ({ sessionKey, viewKey, files, needle }) => {
-    const index = await indexStore.read(sessionKey, viewKey, files);
-    if (index === null) return null;
-    /** @type {Array<{ fileIdx: number, ordinals: number[] }>} */
-    const scanned = [];
+    /** @type {Array<{ index: number, turnIndex: number | null, kind: string, summary: string, generation: number | null }>} */
+    const hits = [];
+    let total = 0;
     // `files` is the lineage walk's own output, so a generation that is no longer in the lineage
     // has no entry here and no segment is read — a leftover on disk cannot keep it searchable.
     for (let fileIdx = 0; fileIdx < files.length; fileIdx += 1) {
@@ -3708,9 +3647,20 @@ export async function start(context) {
       const segment = await segmentStore.read(sessionKey, viewKey, generationKey(file.generation), [file]);
       if (segment === null) return null;
       const ordinals = scanSegment(segment.surface, needle);
-      if (ordinals.length > 0) scanned.push({ fileIdx, ordinals });
+      const answers = readSegmentHits(segment.surface, ordinals);
+      for (const hit of answers) {
+        // A line the scan named that cannot be read back is a segment written by something that
+        // does not agree with this reader. Answering without it would quietly drop a record.
+        if (hit === null) return null;
+        total += 1;
+        if (hits.length < MAX_SEARCH_HITS) hits.push(hit);
+      }
     }
-    return collectSearchHitsFromArtifacts(index, scanned, MAX_SEARCH_HITS);
+    // Ascending ledger order, because the segments were read oldest generation first and a hit's
+    // place in that list is what the page scrolls to. Sorting by the index itself is the order the
+    // rebuild produces, and two answers that differ only in order are two answers.
+    hits.sort((a, b) => a.index - b.index);
+    return { hits, total };
   };
 
   /**
@@ -3752,14 +3702,20 @@ export async function start(context) {
     // through the rebuild, and the two answers were both plausible. The index is still needed — it
     // is what names each record's index, turn and kind — so the two are merged: the payload's
     // fields for the surface, the index's fileIdx and byte range for the locator.
-    const flatRecords = payload.turns.flatMap((turn) => turn.records);
+    const flatRecords = [];
+    for (const turn of payload.turns) {
+      for (const record of turn.records) flatRecords.push({ record, turn });
+    }
     for (let fileIdx = 0; fileIdx < files.length; fileIdx += 1) {
       const records = [];
       for (let i = 0; i < flatRecords.length; i += 1) {
         const located = indexRows.records[i];
         if (located === undefined || located.fileIdx !== fileIdx) continue;
         records.push({
-          ...flatRecords[i],
+          ...flatRecords[i].record,
+          // The turn this record sits in travels with it: the answer names a turn, and reading it
+          // back out of the session's turn table would mean reading that table on every search.
+          turnIndex: flatRecords[i].turn.index,
           fileIdx: located.fileIdx,
           byteStart: located.byteStart,
           byteEnd: located.byteEnd,
@@ -4175,4 +4131,4 @@ function close(server) {
     if (typeof server.closeAllConnections === 'function') server.closeAllConnections();
     server.close(() => resolve(undefined));
   });
-}
\ No newline at end of file
+}
diff --git a/plugins/avatasia/mmc-trajectory/plugin.json b/plugins/avatasia/mmc-trajectory/plugin.json
new file mode 100644
index 0000000..aab6b8d
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/plugin.json
@@ -0,0 +1,6 @@
+{
+  "mcode": {
+    "schemaVersion": 2,
+    "miniApp": "./miniapp/miniapp.json"
+  }
+}
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-search-endpoint.py b/plugins/avatasia/mmc-trajectory/tests/mutate-search-endpoint.py
index 0cca78f..90e4391 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-search-endpoint.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-search-endpoint.py
@@ -119,19 +119,47 @@
     ),
     (
         "the artifact path reports how many it sent instead of how many matched",
-        "  return { hits, total: wanted.length };",
-        "  return { hits, total: hits.length };",
-    ),
-    (
-        "the artifact path reports the kind where the summary belongs",
-        "      turnIndex: turn === undefined ? null : turn.index,\n      kind: record.kind,\n      summary: typeof record.summary === 'string' ? record.summary : '',",
-        "      turnIndex: turn === undefined ? null : turn.index,\n      kind: record.kind,\n      summary: String(record.kind),",
+        "    return { hits, total };",
+        "    return { hits, total: hits.length };",
     ),
     (
+        # The summary a hit answers with now lives on the segment line, so the mutation that swaps it
+        # for the kind belongs with the module that writes it — mutate-search-segments.py.
         "writing the artifacts can fail the search that asked for them",
         "    }).catch(() => undefined);",
         "    });",
     ),
+    # ---- the scan is resolved in one batch ---------------------------------------------------
+    (
+        # The route's half of the batch rule. The answers it builds are the same answers either way —
+        # which is why the cost cannot be asserted here and lives in verify-search-segments.mjs
+        # instead. What changes here is the shape: a walk per hit rather than one walk for the scan.
+        "the route resolves the scan one ordinal at a time, walking the segment once per hit",
+        "      const answers = readSegmentHits(segment.surface, ordinals);",
+        "      const answers = ordinals.map((ordinal) => {\n"
+        "        let from = 0;\n"
+        "        let line = 0;\n"
+        "        while (from <= segment.surface.length) {\n"
+        "          const nl = segment.surface.indexOf('\\n', from);\n"
+        "          if (line === ordinal) {\n"
+        "            const tab = segment.surface.indexOf('\\t', from);\n"
+        "            const parsed = tab < 0 ? null : JSON.parse(segment.surface.slice(from, tab));\n"
+        "            return { index: parsed.index, turnIndex: parsed.turnIndex, kind: parsed.kind, summary: parsed.summary, generation: parsed.generation };\n"
+        "          }\n"
+        "          if (nl === -1) break;\n"
+        "          from = nl + 1;\n"
+        "          line += 1;\n"
+        "        }\n"
+        "        return null;\n"
+        "      });",
+    ),
+    (
+        # A hit that cannot be resolved is a segment written by something this reader disagrees
+        # with. Dropping it would answer with a smaller `total` and say nothing about being wrong.
+        "a hit the reader could not resolve is skipped instead of falling back",
+        "        if (hit === null) return null;",
+        "        if (hit === null) continue;",
+    ),
 ]
 
 
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-search-segments.py b/plugins/avatasia/mmc-trajectory/tests/mutate-search-segments.py
index 52639da..3175dd3 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-search-segments.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-search-segments.py
@@ -58,9 +58,13 @@
         "  const hits = [];\n  const flat = surface.replace(/\\n/g, ' ');\n  if (flat.includes(needle)) hits.push(0);\n  let start = 0;\n  let ordinal = 0;",
     ),
     (
-        "the scan counts only non-empty lines, so every ordinal after an empty record is one short",
-        "    if (line.includes(needle)) hits.push(ordinal);\n    ordinal += 1;",
-        "    if (line.includes(needle)) hits.push(ordinal);\n    if (line !== '') ordinal += 1;",
+        # Was about empty lines in a plain surface, which the new format cannot produce: every
+        # record's line starts with its answer, so an empty line means a record that is not there.
+        # The hazard that replaced it is the prefix itself — a scan that tested the whole line would
+        # answer from a record's KIND and SUMMARY rather than from the text being searched.
+        "the scan tests the record's answer as well as its text",
+        "    if (tab >= 0 && line.slice(tab + 1).includes(needle)) hits.push(ordinal);",
+        "    if (tab >= 0 && line.includes(needle)) hits.push(ordinal);",
     ),
     (
         "the locators are numbered from one while the scan numbers from zero",
@@ -84,8 +88,8 @@
         "",
     ),
     (
-        "a surface with a line the locators do not account for is accepted",
-        "  if (lines.length !== manifest.recordCount) return null;",
+        "a surface with a line the manifest does not count is accepted",
+        "  if (lines !== manifest.recordCount) return null;",
         "",
     ),
     (
@@ -110,6 +114,13 @@
         "  return generation === null || generation === undefined ? 'g0' : `g${generation}`;",
     ),
     # ---- a generation read short must not look like one read whole --------------------------
+    (
+        # The summary a search hit answers with is written onto the segment line, so this is where
+        # a search can start reporting the kind of a record instead of what it says.
+        "the segment line reports the kind where the summary belongs",
+        "      summary: typeof record.summary === 'string' ? record.summary : '',",
+        "      summary: typeof record.kind === 'string' ? record.kind : '',",
+    ),
     (
         # `size` is the whole file whether or not the read covered it, so this comparison is the
         # only thing standing between a segment covering a PREFIX and being served as if it covered
@@ -119,6 +130,49 @@
         "    if ((a.truncated === true) !== (b.truncated === true)) return false;\n    if (typeof a.revision === 'string' && a.revision.length > 0",
         "    if (typeof a.revision === 'string' && a.revision.length > 0",
     ),
+    # ---- the answer is read back in ONE walk -----------------------------------------------
+    (
+        # The one that matters most here, because it is the version that was actually written and
+        # then measured to be SLOWER than the 34.2 MB index read it replaced. It changes no answer:
+        # every hit still names the right record and every assertion about values still passes. The
+        # only symptom is that a needle matching 14,092 records walks the segment 14,092 times — so
+        # the guard counts the walk instead of checking the answers.
+        "the answers are read by walking the segment once per ordinal again",
+        "  return ordinals.map((ordinal) => found.get(ordinal) ?? null);",
+        "  return ordinals.map((ordinal) => {\n"
+        "    let from = 0;\n"
+        "    let line = 0;\n"
+        "    while (from <= surface.length) {\n"
+        "      const nl = surface.indexOf('\\n', from);\n"
+        "      if (line === ordinal) {\n"
+        "        const tab = surface.indexOf('\\t', from);\n"
+        "        return tab < 0 ? null : JSON.parse(surface.slice(from, tab));\n"
+        "      }\n"
+        "      if (nl === -1) break;\n"
+        "      from = nl + 1;\n"
+        "      line += 1;\n"
+        "    }\n"
+        "    return found.get(ordinal) ?? null;\n"
+        "  });",
+    ),
+    (
+        # The batch is a batch because the scan hands back every ordinal at once. Answering in the
+        # order they sit in the segment looks identical until the caller asks for a capped, sorted or
+        # otherwise reordered subset — and then every hit names a different record.
+        "the answers come back in the order they sit rather than the order asked",
+        "  return ordinals.map((ordinal) => found.get(ordinal) ?? null);",
+        "  return [...found.values()];",
+    ),
+    (
+        # Structural, and the reason the first one is worth a mutation at all: a per-ordinal reader
+        # could be reintroduced beside the batch one, break nothing above, and sit there waiting to be
+        # called — which is how the O(n²) version got shipped in the first place.
+        "a per-ordinal reader is exported again for a caller to reach for",
+        "export function generationKey(generation) {\n  return generation === null || generation === undefined ? 'active' : `g${generation}`;\n}",
+        "export function generationKey(generation) {\n  return generation === null || generation === undefined ? 'active' : `g${generation}`;\n}\n\n"
+        "/** @deprecated one ordinal at a time — walks the whole segment to find it. */\n"
+        "export function readSegmentHit(surface, ordinal) {\n  return readSegmentHits(surface, [ordinal])[0] ?? null;\n}",
+    ),
 ]
 
 
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs
index 6fa00b5..5d0ef01 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs
@@ -28,7 +28,6 @@ import {
   buildMessageIdentity,
   buildTrajectoryPayload,
   collectSearchHits,
-  collectSearchHitsFromArtifacts,
   foldNeedle,
   needleIsUsable,
   normaliseWhitespace,
@@ -37,7 +36,7 @@ import {
   ROW_GENERATION,
 } from '../miniapp/node/server.mjs';
 import { indexRowsFromPayload } from '../miniapp/node/trajectory-index.mjs';
-import { buildSegment, scanSegment } from '../miniapp/node/search-segments.mjs';
+import { buildSegment, readSegmentHits, scanSegment } from '../miniapp/node/search-segments.mjs';
 
 const SERVER = readFileSync(new URL('../miniapp/node/server.mjs', import.meta.url), 'utf8');
 const CLIENT = readFileSync(new URL('../miniapp/client/index.html', import.meta.url), 'utf8');
@@ -373,7 +372,8 @@ for (const [recordIndex, rowIndex] of rowIndexByRecord) {
   locatorByRecord.set(recordIndex, rowLocators[rowIndex]);
 }
 const indexRows = indexRowsFromPayload(allPayload, locatorByRecord, ARTIFACT_FILES);
-const flatRecords = allPayload.turns.flatMap((t) => t.records);
+const flatPairs = [];
+for (const turn of allPayload.turns) for (const record of turn.records) flatPairs.push({ record, turn });
 // The same merge the server does: the surface is built from the PAYLOAD's records and only the
 // locator fields come from the index. Building it from the index alone searches two of the five
 // fields — `text`, `result` and `thinking` are excluded from the index on purpose — and that was a
@@ -381,20 +381,47 @@ const flatRecords = allPayload.turns.flatMap((t) => t.records);
 // needle that happens to match.
 const segmentRecordsFor = (fileIdx) => {
   const out = [];
-  for (let i = 0; i < flatRecords.length; i += 1) {
+  for (let i = 0; i < flatPairs.length; i += 1) {
     const located = indexRows.records[i];
     if (located === undefined || located.fileIdx !== fileIdx) continue;
-    out.push({ ...flatRecords[i], fileIdx: located.fileIdx, byteStart: located.byteStart, byteEnd: located.byteEnd });
+    out.push({
+      ...flatPairs[i].record,
+      turnIndex: flatPairs[i].turn.index,
+      fileIdx: located.fileIdx,
+      byteStart: located.byteStart,
+      byteEnd: located.byteEnd,
+    });
   }
   return out;
 };
+// What the route now does: scan each generation's segment, then read the answers back off the lines
+// the scan named, in one batch. The index is not consulted — that was the 34.2 MB it used to read on
+// every search. The batch is the shape on purpose: reading one ordinal at a time walked the segment
+// once per hit, which for a common needle is once per thousand records. The count is this guard's,
+// the walk bound lives in verify-search-segments.mjs where the reader is.
 const scanArtifacts = (folded) => {
-  const scanned = [];
+  /** @type {Array<{ index: number, turnIndex: number | null, kind: string, summary: string, generation: number | null }>} */
+  const hits = [];
+  let total = 0;
   for (let fileIdx = 0; fileIdx < ARTIFACT_FILES.length; fileIdx += 1) {
-    const ordinals = scanSegment(buildSegment({ records: segmentRecordsFor(fileIdx) }).surface, folded);
-    if (ordinals.length > 0) scanned.push({ fileIdx, ordinals });
+    const surface = buildSegment({ records: segmentRecordsFor(fileIdx) }).surface;
+    const found = readSegmentHits(surface, scanSegment(surface, folded));
+    if (found.some((hit) => hit === null)) return null;
+    total += found.length;
+    for (const hit of found) {
+      if (hits.length < limit) hits.push(hit);
+    }
   }
-  return scanned;
+  hits.sort((a, b) => a.index - b.index);
+  return { hits, total };
+};
+let limit = 500;
+const withLimit = (n) => {
+  const saved = limit;
+  limit = n;
+  const out = scanArtifacts(foldNeedle('needle'));
+  limit = saved;
+  return out;
 };
 
 check('the index kept every record the rebuild would have shown',
@@ -408,35 +435,45 @@ assert('and it kept the generation each record came from',
 const bulkOnly = allRecords.find((r) => typeof r.result === 'string' && r.result.length > 0);
 assert('the fixture really does hold a record whose match is only in a bulk field', bulkOnly !== undefined);
 if (bulkOnly !== undefined) {
-  const located = indexRows.records[flatRecords.indexOf(bulkOnly)];
+  const located = indexRows.records[flatPairs.findIndex((pair) => pair.record === bulkOnly)];
   const line = buildSegment({ records: [{ ...bulkOnly, fileIdx: located.fileIdx, byteStart: 0, byteEnd: 1 }] }).surface;
   assert('and the segment carries that field, though the index does not',
     !Object.prototype.hasOwnProperty.call(located, 'result') && line.includes(normaliseWhitespace(bulkOnly.result)));
   assert('the shipped server merges the payload into the segment for the same reason',
-    /records\.push\(\{\s*\n\s*\.\.\.flatRecords\[i\],\s*\n\s*fileIdx: located\.fileIdx,/.test(SERVER));
+    /flatRecords\.push\(\{ record, turn \}\)/.test(SERVER)
+    && /\.\.\.flatRecords\[i\]\.record,/.test(SERVER)
+    && /turnIndex: flatRecords\[i\]\.turn\.index,/.test(SERVER));
 }
 
 for (const needle of NEEDLES) {
   const folded = foldNeedle(needle);
   const rebuilt = collectSearchHits(allPayload, folded, 500);
-  const fromDisk = collectSearchHitsFromArtifacts(indexRows, scanArtifacts(folded), 500);
+  const fromDisk = scanArtifacts(folded);
   check(`"${needle}" — the artifact path sends the same hits`, fromDisk.hits, rebuilt.hits);
   check(`"${needle}" — and counts them the same way`, fromDisk.total, rebuilt.total);
 }
 
 const capRebuilt = collectSearchHits(allPayload, foldNeedle('needle'), 2);
-const capFromDisk = collectSearchHitsFromArtifacts(indexRows, scanArtifacts(foldNeedle('needle')), 2);
+const capFromDisk = withLimit(2);
 check('a cap bounds what is sent, on the artifact path too',
   capFromDisk.hits.length, Math.min(2, capRebuilt.total));
 check('and never bounds what is counted', capFromDisk.total, capRebuilt.total);
 
-// An ordinal the index does not have means the segment and the index were built from different
-// sources. Answering from one of them would be answering about a session that never existed, and
-// nothing downstream could tell.
-check('an ordinal past the end of its generation is refused, not guessed',
-  collectSearchHitsFromArtifacts(indexRows, [{ fileIdx: 0, ordinals: [9999] }], 500), null);
-check('and a generation the index never held is refused too',
-  collectSearchHitsFromArtifacts(indexRows, [{ fileIdx: 7, ordinals: [0] }], 500), null);
+// A line the scan named that cannot be read back is a segment written by something that does not
+// agree with this reader. Answering without it would quietly drop a record, so the route falls
+// back instead — and that decision has to be visible here, not only in the route's source text.
+const gen0Surface = buildSegment({ records: segmentRecordsFor(0) }).surface;
+const oneAnswer = (surface, ordinal) => readSegmentHits(surface, [ordinal])[0] ?? null;
+check('an ordinal past the end of a segment is refused, not guessed',
+  oneAnswer(gen0Surface, 9999), null);
+check('and so is a negative or fractional one',
+  [oneAnswer(gen0Surface, -1), oneAnswer(gen0Surface, 1.5)], [null, null]);
+check('while the ordinals the scan really returns do read back',
+  scanSegment(gen0Surface, foldNeedle('the needle is in')).map((o) => oneAnswer(gen0Surface, o)?.index ?? null),
+  scanSegment(gen0Surface, foldNeedle('the needle is in')).map((o) => {
+    const recs = segmentRecordsFor(0);
+    return typeof recs[o].index === 'number' ? recs[o].index : -1;
+  }));
 
 /* ---------------------------------------------------------------------
  * A generation read short by our own cap produces a segment covering a
@@ -457,6 +494,37 @@ assert('a generation with no records still gets one, and it is empty — "no seg
   !/records\.length === 0\) continue/.test(SERVER));
 assert('one missing segment makes the whole search fall back rather than answer from the rest',
   /if \(segment === null\) return null;/.test(SERVER));
+
+// The cap assertions above run against a copy of the loop written here, so they say the rule holds
+// and not that the shipped route holds it. These read the shipped function: `total` is incremented
+// for every match, the push is the thing that is bounded, and the return hands back the count.
+const artifactsSrc = SERVER.slice(
+  SERVER.indexOf('const searchFromArtifacts = async'),
+  SERVER.indexOf('const publishSearchArtifacts = async'));
+assert('and the shipped artifact path counts every match rather than what it sent',
+  /total \+= 1;/.test(artifactsSrc)
+  && /if \(hits\.length < MAX_SEARCH_HITS\) hits\.push\(hit\);/.test(artifactsSrc)
+  && /return \{ hits, total \};/.test(artifactsSrc));
+
+// The route resolves a whole scan in ONE call, because resolving one ordinal at a time walks the
+// segment once per hit. That version is not a slower version of this one, it is the version that
+// was shipped first: for a two-letter needle on the largest session here it walked 1.3 MB of
+// segment 14,092 times and measured SLOWER than the 34.2 MB index read this step removed. The cost
+// bound is pinned in verify-search-segments.mjs, where the reader itself is; what is pinned here is
+// that the ROUTE takes the batch shape rather than a loop of single reads.
+assert('the shipped artifact path resolves a whole scan in one batch call',
+  /readSegmentHits\(segment\.surface, ordinals\)/.test(artifactsSrc)
+  && !/for \(const ordinal of /.test(artifactsSrc));
+// A hit the scan named that the reader cannot resolve means the segment was written by something
+// that disagrees with this reader. Skipping it would drop a record and report a smaller total with
+// nothing said about being wrong, so the route falls back like it does for a missing segment.
+assert('a hit the scan named but the reader could not resolve falls back rather than being skipped',
+  /if \(hit === null\) return null;/.test(artifactsSrc));
+// And the index is not consulted at all — reading it was the 34.2 MB this step took off the path.
+// Scoped to this path, because `indexStore.write` still exists for a different reason (see the
+// defect list: nothing reads what it writes).
+assert('and this path reads no record index at all',
+  !/indexStore\.read\(|collectSearchHitsFromArtifacts/.test(SERVER));
 // Two paths answering one request is only a performance change if they answer it identically,
 // and the response body is part of the answer the page reads.
 check('both paths send the same session field',
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs
index a434740..d6afa43 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs
@@ -16,8 +16,9 @@
  *     and a measurement that found zero such false hits on real data is luck, not a property. So the
  *     fixture below CONSTRUCTS one and the scan has to refuse it.
  *
- * Plus the artifact rules: a half-published segment is never consumed, the locators map a hit back to
- * the line it came from, and nothing in the segment carries a machine path.
+ * Plus the artifact rules: a half-published segment is never consumed, each line carries the answer
+ * the reader needs, a batch of hits is read in ONE walk, and nothing in the segment carries a machine
+ * path.
  *
  * Read-only: imports the pure helpers and writes only under a temp dir it makes itself.
  * mutate-search-segments.py breaks each of these in the shipped module.
@@ -38,6 +39,7 @@ import {
   generationKey,
   needleIsUsable,
   normaliseWhitespace,
+  readSegmentHits,
   sameSource,
   scanSegment,
   searchSurfaceOf,
@@ -203,9 +205,93 @@ check('all five of those fields are still on that one line',
  * 2 — a scan cannot answer with a record that does not exist
  * ===================================================================== */
 
+// One answer out of a one-element batch. There is no per-ordinal reader to call, and that is
+// deliberate rather than incidental — see the batch block below.
+const oneHit = (surface, ordinal) => readSegmentHits(surface, [ordinal])[0] ?? null;
+
 const segment = buildSegment({ records: RECORDS });
 check('one surface line per record', segment.surface.split('\n').length, RECORDS.length);
-check('one locator per record', segment.locators.split('\n').length, RECORDS.length);
+
+// The line carries its own answer, which is why a search no longer reads the session's record
+// index: matching 14 records out of 36,525 should not have to parse the other 36,511. Read as one
+// batch, because that is the only shape the reader has — see the batch block further down.
+const answered = readSegmentHits(segment.surface, RECORDS.map((_, i) => i));
+assert('every line reads back at all', answered.every((h) => h !== null));
+check('and the ledger index it reads back is the record it describes',
+  answered.map((h) => (h === null ? null : h.index)),
+  RECORDS.map((r) => (typeof r.index === 'number' ? r.index : -1)));
+check('the summary it reads back is the record\'s own', answered.map((h) => (h === null ? null : h.summary)), RECORDS.map((r) => (typeof r.summary === 'string' ? r.summary : '')));
+check('and so is its kind', answered.map((h) => (h === null ? null : h.kind)), RECORDS.map((r) => (typeof r.kind === 'string' ? r.kind : '')));
+check('and its generation', answered.map((h) => (h === null ? null : h.generation)), RECORDS.map((r) => (typeof r.generation === 'number' ? r.generation : null)));
+assert('a line past the end reads back as nothing rather than as the last record',
+  oneHit(segment.surface, RECORDS.length + 5) === null);
+assert('and neither does a negative ordinal', oneHit(segment.surface, -1) === null);
+assert('nor one that is not a whole number', oneHit(segment.surface, 1.5) === null);
+
+/* ---------------------------------------------------------------------
+ * THE READER TAKES A BATCH, AND THE REASON IS COST.
+ *
+ * The first version took ONE ordinal and scanned from byte zero to find
+ * it. That is fine for a guard checking one record and catastrophic for
+ * the route: a needle like "the" matched 14,092 records on the largest
+ * session on this machine, so it walked a 1.3 MB segment 14,092 times —
+ * eighteen gigabytes of walking to answer one search, and measured
+ * SLOWER than the 34.2 MB index read this work was meant to remove.
+ *
+ * Nothing about that was wrong in the answers. Every hit still named the
+ * right record. So no assertion about values could have caught it, which
+ * is why the cost is pinned here instead: the walk is counted.
+ *
+ * The bound is an UPPER bound, on purpose. A single walk costs about two
+ * per-line string calls, so anything that stopped using indexOf/slice and
+ * walked some other way would read as ZERO calls and pass — a guard that
+ * fails safe in the direction of not complaining about a correct rewrite.
+ * The form that must not come back overshoots by the number of ordinals
+ * asked for, which is the factor the bound cannot absorb.
+ * --------------------------------------------------------------------- */
+// Ledger indices that are deliberately out of step with their ordinals, so an answer ordered by
+// position in the segment cannot pass for an answer ordered by the question.
+const namedSurface = buildSegment({
+  records: [{ summary: 'alpha', index: 40 }, { summary: 'beta', index: 41 }, { summary: 'gamma', index: 42 }],
+}).surface;
+check('the batch reader answers in the order asked, not the order they sit',
+  readSegmentHits(namedSurface, [2, 0, 1]).map((h) => (h === null ? null : h.index)), [42, 40, 41]);
+check('a repeated ordinal answers once per asking rather than collapsing',
+  readSegmentHits(namedSurface, [1, 1, 1]).map((h) => (h === null ? null : h.index)), [41, 41, 41]);
+check('an empty batch is answered with nothing, and reads nothing',
+  readSegmentHits(namedSurface, []).length, 0);
+{
+  const N = 200;
+  const wide = buildSegment({ records: Array.from({ length: N }, (_, i) => ({ summary: `record ${i}` })) });
+  const asked = Array.from({ length: N }, (_, i) => N - 1 - i);
+  let calls = 0;
+  // A boxed String: every per-line operation the reader does goes through a method on it, so they
+  // can be tallied without the module having to cooperate by exposing a counter.
+  const counted = new String(wide.surface);
+  for (const method of ['indexOf', 'slice', 'substring', 'substr']) {
+    const original = String.prototype[method];
+    counted[method] = function tally(...args) { calls += 1; return original.apply(this, args); };
+  }
+  const wideAnswers = readSegmentHits(counted, asked);
+  check('a whole segment asked back to front answers every ordinal',
+    wideAnswers.map((h) => (h === null ? null : h.summary)), asked.map((i) => `record ${i}`));
+  assert(`reading ${N} answers out of ${N} lines takes one walk (counted ${calls} per-line string calls)`,
+    calls <= 4 * N);
+}
+// The structural half of the same rule. A per-ordinal reader could be reintroduced without breaking
+// anything above — the batch reader would still be correct, and the O(n²) form would simply sit next
+// to it waiting to be called. Read the module's whole export list, because the named import at the
+// top of this file cannot see an export it does not name.
+const SEGMENTS = await import(SEGMENT_PATH);
+assert('and there is no per-ordinal reader exported for a caller to reach for by mistake',
+  typeof SEGMENTS.readSegmentHit === 'undefined' && typeof SEGMENTS.readSegmentHits === 'function');
+
+// The JSON prefix holds the answer, so a needle must not be able to match it. Otherwise a search
+// for a record's kind would return every record of that kind whether its text says so or not.
+const kindNeedle = RECORDS[0].kind;
+check('a needle that is only in the answer, not in the text, finds nothing',
+  scanSegment(buildSegment({ records: [{ kind: kindNeedle, summary: 'zzz nothing alike', text: null, result: null, thinking: null, toolName: null }] }).surface,
+    foldNeedle(kindNeedle)), []);
 
 // The direct statement of the line-number bug, as an assertion: for every record, that record's own
 // surface finds that record, AT THAT RECORD'S ORDINAL. A surface that kept the page's newline
@@ -231,17 +317,22 @@ check('the needle is folded the same way the surface was',
   scanSegment(segment.surface, foldNeedle('ANSWER')), [0]);
 
 // The boundary, constructed rather than observed: one record ends with `record` and the next begins
-// with `the first`. The needle belongs to neither. The control is the implementation this is here to
-// prevent — flatten every newline in the surface to a space, then read it as one string — which
-// reports a match that exists in no record.
-const boundarySegment = buildSegment({
-  records: [{ summary: 'the last word of one record' }, { summary: 'the first word of the next' }],
-});
-const joinedAsOneBlob = boundarySegment.surface.replace(/\n/g, ' ');
+// with `the first`. The needle belongs to neither. The control below flattens the searchable parts
+// to one string, which reports a match that exists in no record.
+const boundaryRecords = [
+  { summary: 'the last word of one record' },
+  { summary: 'the first word of the next' },
+];
+const boundarySegment = buildSegment({ records: boundaryRecords });
+// The hazard is stated over the searchable parts themselves, because that is what a joined blob
+// would have been built from. The stored text cannot simply be joined and tested: each line now
+// carries a JSON prefix, so a join would splice two records' text through a record's own answer and
+// the demonstration would be testing the prefix rather than the boundary.
+const joinedSearchable = boundaryRecords.map(searchSurfaceOf).join(' ');
 check('a needle spanning two records matches nothing', scanSegment(boundarySegment.surface, foldNeedle('record the first')), []);
 check('and does not match either side', scanSegment(boundarySegment.surface, foldNeedle('last word of one')), [0]);
-assert('the joined blob WOULD have matched, which is what the boundary is for',
-  joinedAsOneBlob.includes(foldNeedle('record the first')));
+assert('a blob of those parts WOULD have matched, which is what the boundary is for',
+  joinedSearchable.includes(foldNeedle('record the first')));
 
 check('an empty needle matches nothing', scanSegment(segment.surface, ''), []);
 check('a single line scan still finds the last record',
@@ -263,22 +354,42 @@ assert('a needle longer than the floor passes', needleIsUsable('  real words  ')
  * ===================================================================== */
 
 const withLocators = buildSegment({
-  records: RECORDS.map((r, i) => ({ ...r, fileIdx: i < 4 ? 0 : 1, byteStart: i * 100, byteEnd: i * 100 + 40 })),
+  records: RECORDS.map((r, i) => ({ ...r, index: i, fileIdx: i < 4 ? 0 : 1, byteStart: i * 100, byteEnd: i * 100 + 40 })),
 });
-const locatorList = withLocators.locators.split('\n').map((line) => JSON.parse(line));
-check('locator ordinals are the record order', locatorList.map((l) => l.ordinal), RECORDS.map((_, i) => i));
-check('locators carry which file', locatorList.map((l) => l.fileIdx), RECORDS.map((_, i) => (i < 4 ? 0 : 1)));
-check('locators carry where the line sat', locatorList.map((l) => l.byteStart), RECORDS.map((_, i) => i * 100));
-check('a locator of a record with no position says -1',
-  JSON.parse(buildSegment({ records: [{ summary: 'x' }] }).locators),
-  { ordinal: 0, fileIdx: -1, byteStart: -1, byteEnd: -1 });
+// The locator triple rides on the same line as the searchable text, so it is read back from the
+// line the scan named rather than from a second file that had to be walked in parallel with this one.
+const lineAt = (n) => withLocators.surface.split('\n')[n] ?? '';
+const locatorAt = (n) => {
+  const tab = lineAt(n).indexOf('\t');
+  return tab < 0 ? null : JSON.parse(lineAt(n).slice(0, tab));
+};
+check('locator ordinals are the record order',
+  RECORDS.map((_, i) => locatorAt(i)?.ordinal ?? null), RECORDS.map((_, i) => i));
+check('locators carry which file',
+  RECORDS.map((_, i) => locatorAt(i)?.fileIdx ?? null), RECORDS.map((_, i) => (i < 4 ? 0 : 1)));
+check('locators carry where the line sat',
+  RECORDS.map((_, i) => locatorAt(i)?.byteStart ?? null), RECORDS.map((_, i) => i * 100));
+check('a record with no position says -1, not 0',
+  RECORDS.map((_, i) => locatorAt(i)?.byteEnd ?? null),
+  RECORDS.map((_, i) => (i === 0 ? 40 : i * 100 + 40)));
+check('a record that carries no locator at all still gets a line',
+  RECORDS.map((_, i) => locatorAt(i) !== null), RECORDS.map(() => true));
+{
+  const bare = buildSegment({ records: [{ summary: 'x' }] }).surface.split('\n')[0];
+  const parsed = JSON.parse(bare.slice(0, bare.indexOf('\t')));
+  check('a record with no position says -1',
+    { fileIdx: parsed.fileIdx, byteStart: parsed.byteStart, byteEnd: parsed.byteEnd },
+    { fileIdx: -1, byteStart: -1, byteEnd: -1 });
+}
 
 const hit = scanSegment(withLocators.surface, foldNeedle('grep'))[0];
 // Read through `?.` so a build whose surfaces no longer line up with their records FAILS HERE BY
 // NAME rather than throwing on an undefined locator — a crash names no rule, and the reader is left
 // with a stack trace instead of the thing that moved.
-check('a hit resolves to a locator', locatorList[hit]?.ordinal ?? null, hit ?? null);
-check('and that locator names the line the hit came from', locatorList[hit]?.byteStart ?? null, hit === undefined ? null : hit * 100);
+check('a hit resolves to the line it came from', locatorAt(hit)?.ordinal ?? null, hit ?? null);
+check('and that line names where the record sat', locatorAt(hit)?.byteStart ?? null, hit === undefined ? null : hit * 100);
+check('and reads back as the answer, not as a locator',
+  oneHit(withLocators.surface, hit)?.index ?? null, hit ?? null);
 
 /* =====================================================================
  * 4 — a half-published segment is never consumed
@@ -296,10 +407,10 @@ try {
   const written = await store.write('s', 'all', 'g0', segment, { generation: 0, source: SOURCE });
   check('the manifest counts the records', written.recordCount, RECORDS.length);
   const good = await store.read('s', 'all', 'g0', SOURCE);
-  assert('a complete pair reads back', good !== null);
+  assert('a complete segment reads back', good !== null);
   if (good !== null) {
     check('the surface is the one written', good.surface, segment.surface);
-    check('every locator is readable', good.locators.length, RECORDS.length);
+    check('and every line of it is a record', good.surface === '' ? 0 : good.surface.split('\n').length, RECORDS.length);
   }
 
   const dir = store.dirOf('s', 'all', 'g0');
@@ -308,30 +419,27 @@ try {
   assert('a surface that does not match its manifest is refused',
     (await store.read('s', 'all', 'g0', SOURCE)) === null);
   await writeFile(join(dir, 'surface.txt'), `${segment.surface}\nextra`, 'utf8');
-  assert('a surface with a line the locators do not account for is refused',
+  assert('a surface with a line the manifest does not count is refused',
     (await store.read('s', 'all', 'g0', SOURCE)) === null);
 
-  // The locator count, isolated from the checksums. Every other refusal above is caught by a digest
+  // The record count, isolated from the checksum. Every other refusal above is caught by a digest
   // first, which means "the file holds exactly what the manifest claims" was never actually on
-  // trial. Here the locator file gains a line AND the manifest's digest for it is re-taken, so both
+  // trial. Here the surface gains a line AND the manifest's digest for it is re-taken, so both
   // bytes check out and only the count disagrees.
   const baseManifest = JSON.parse(await readFile(join(dir, 'manifest.json'), 'utf8'));
-  // Put the surface back first: the case above deliberately left a grown one on disk, and this
-  // control is about the LOCATOR count, not about two files being wrong at once.
-  await writeFile(join(dir, 'surface.txt'), segment.surface, 'utf8');
-  const grownLocators = `${segment.locators}\n${JSON.stringify({ ordinal: RECORDS.length, fileIdx: 0, byteStart: 0, byteEnd: 1 })}`;
-  await writeFile(join(dir, 'locators.jsonl'), grownLocators, 'utf8');
+  const grownSurface = `${segment.surface}\n${JSON.stringify({ ordinal: RECORDS.length, index: -1, fileIdx: 0, byteStart: 0, byteEnd: 1 })}\t${'extra'}`;
+  await writeFile(join(dir, 'surface.txt'), grownSurface, 'utf8');
   await writeFile(join(dir, 'manifest.json'),
-    JSON.stringify({ ...baseManifest, locatorDigest: digestOf(grownLocators), locatorBytes: Buffer.byteLength(grownLocators) }), 'utf8');
-  assert('locators the manifest does not count are refused',
+    JSON.stringify({ ...baseManifest, surfaceDigest: digestOf(grownSurface), surfaceBytes: Buffer.byteLength(grownSurface) }), 'utf8');
+  assert('a surface the manifest does not count is refused',
     (await store.read('s', 'all', 'g0', SOURCE)) === null);
   // And the positive control, because a check that refuses everything would pass the line above:
   // the same file with a manifest that counts it IS read.
   await writeFile(join(dir, 'manifest.json'),
-    JSON.stringify({ ...baseManifest, locatorDigest: digestOf(grownLocators), locatorBytes: Buffer.byteLength(grownLocators), recordCount: RECORDS.length + 1 }), 'utf8');
+    JSON.stringify({ ...baseManifest, surfaceDigest: digestOf(grownSurface), surfaceBytes: Buffer.byteLength(grownSurface), recordCount: RECORDS.length + 1 }), 'utf8');
   const counted = await store.read('s', 'all', 'g0', SOURCE);
   assert('and is read once the manifest counts it', counted !== null);
-  if (counted !== null) check('with every locator present', counted.locators.length, RECORDS.length + 1);
+  if (counted !== null) check('with every line present', counted.surface.split('\n').length, RECORDS.length + 1);
   await store.write('s', 'all', 'g0', segment, { generation: 0, source: SOURCE });
 
   await rm(join(dir, 'manifest.json'), { force: true });
@@ -415,7 +523,8 @@ assert('the manifest is published last',
 assert('nothing here spawns a thread; the route owns that',
   !/worker_threads/.test(source));
 assert('the scan is a per-line test, not a joined blob',
-  /line\.includes\(needle\)/.test(source) && !/\+ .*surface.*\+/.test(source.split('export function scanSegment')[1].split('export function')[0]));
+  /line\.slice\(tab \+ 1\)\.includes\(needle\)/.test(source)
+  && !/\+ .*surface.*\+/.test(source.split('export function scanSegment')[1].split('export function')[0]));
 
 /* ---------------------------------------------------------------------
  * A generation read short by our own read cap produces a segment that

From 56b1c228fdbdf01ac222e32f4070af2d7c178765 Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 14:23:05 +0800
Subject: [PATCH 17/36] Put back the one counter the range-scoped KPI had lost
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Set a time range and 「追加 N」 disappears from the message card and the turn card. It is still
on the kind chip below them, and it is still correct for the whole session — the whole-session
cards read the server's stats, and these two read the same numbers re-scoped to the range. Both
readings were right and nothing said so.

The cause is a shape that lives in two processes. `scopedStats()` builds its own literal rather
than reading the server's, the server declares `steers: 0`, and this copy did not — while the
loop below still did `stats.steers += 1`. `undefined + 1` is NaN, NaN is sticky, and `isCount()`
refuses a non-finite number, so both readers of that field dropped the term silently.

It stayed invisible because the guard comparing scopedStats against the server numbers field by
field carries a hand-written list, and `steers` was not in it. A hand-written list can only catch
the fields someone remembered to write down. So the field is added to that list — the direct check
for this field — and the new assertion reads both halves off the function itself, which is what
stops the next one whatever it is called. It also covers the nested shape: `stats.tokens.input`
needs `tokens` declared, and the parent name is what gets compared.

Read points, all of them: `stats.steers` is read in exactly two places, both inside `renderKpi()`.
`kpiStats()` has three call sites; the other two read only `messages` and `turnsWithPrompt`, so
their numbers do not move.

Tests: `node tests/run.mjs` on this tree -> 82/82 guards passed. mutate-turn-breakdown gained one
mutation — delete the field from the literal — caught by name. client-check gains one static
assertion, which is where it lives rather than in the range guard: that one needs a booted
runtime, and run.mjs promises nothing in the suite needs one.

Found by a retirement audit rather than by a failing guard, which is the first time that has been
the discovery route here.
---
 .../mmc-trajectory/miniapp/client/index.html  |  7 ++++
 .../mmc-trajectory/tests/client-check.mjs     | 36 +++++++++++++++++++
 .../tests/mutate-turn-breakdown.py            | 12 +++++++
 .../tests/verify-time-range.mjs               |  7 +++-
 4 files changed, 61 insertions(+), 1 deletion(-)

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
index 202a3a0..d2988de 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
+++ b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
@@ -4726,6 +4726,13 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         var stats = {
           messages: 0,
           userMessages: 0,
+          // Prompts written mid-turn are counted apart from prompts that opened one, and this
+          // copy of the server's stats shape had lost the field: the server declares
+          // `steers: 0` and this literal did not, so the `+= 1` below ran on `undefined`, every
+          // value became NaN, and `isCount()` refused it. The whole-session cards read the
+          // server's stats and showed 「追加 N」; these are the same numbers re-scoped to a range,
+          // so the moment a range went on the term disappeared from the card that reports it.
+          steers: 0,
           toolCalls: 0,
           toolResults: 0,
           thinkingBlocks: 0,
diff --git a/plugins/avatasia/mmc-trajectory/tests/client-check.mjs b/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
index 7f5b07f..89437c1 100644
--- a/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
@@ -635,6 +635,42 @@ const checks = [
     && parts[0].value === '12'
     && parts[0].kind === 'compaction';
 })()],
+  // ---------------------------------------------------------------------------------
+  // Every field scopedStats WRITES has to be one it DECLARES.
+  //
+  // scopedStats re-scopes the server's stats to a time range, and it does that by writing its
+  // own literal rather than reading the server's. That literal is a second copy of a shape that
+  // lives in two processes, and a copy of a shape drifts silently: `steers` was declared on the
+  // server (server.mjs `steers: 0`) and not here, while the function still did
+  // `stats.steers += 1`. `undefined + 1` is NaN, NaN is sticky, and `isCount()` refuses a
+  // non-finite number — so both readers of that field quietly dropped the term, and 「追加 N」
+  // vanished from the card the moment a range went on. Nothing threw.
+  //
+  // It stayed invisible because the guard that compares scopedStats against the server numbers
+  // field by field carries a HARDCODED list, and `steers` was not in it. A hardcoded list can
+  // only catch the fields someone remembered to write down. This one cannot: it reads the two
+  // halves off the function itself, so a field that is written without being declared fails by
+  // name whatever it is called.
+  // ---------------------------------------------------------------------------------
+  ['every stats field scopedStats writes is one it declares', (() => {
+    const src = fnSource('function scopedStats()');
+    if (!src) return false;
+    const literal = src.slice(src.indexOf('var stats = {'), src.indexOf('};', src.indexOf('var stats = {')));
+    if (!literal) return false;
+    const declared = new Set();
+    // `field: 0,` and `field: { ... }` — the two shapes the literal actually uses.
+    for (const m of literal.matchAll(/^\s*([A-Za-z_$][\w$]*):/gm)) declared.add(m[1]);
+    const written = new Set();
+    // `stats.x += 1`, `stats.x = 0`, `stats.x++`, and the nested `stats.tokens.input += 1`:
+    // a nested write needs its PARENT declared, which is the root name this captures.
+    for (const m of src.matchAll(/\bstats\.([A-Za-z_$][\w$]*)\s*(?==[^=]|\+\+|--|\+=|-=|\*=|\/=|\.\w)/g)) {
+      written.add(m[1]);
+    }
+    // Reads are not writes: `stats.messagesAll` is read from `base` and `stats.tokens` is only
+    // ever read as a parent, so neither has to be a counter. What must hold is the other
+    // direction — nothing may be written that the literal does not declare.
+    return [...written].every((field) => declared.has(field));
+  })()],
   // The explanation has to exist on the card, be reachable without a mouse, and be named by
   // aria-describedby rather than only by a `title` (which is invisible to touch and to most
   // assistive tech once the hover is gone).
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-turn-breakdown.py b/plugins/avatasia/mmc-trajectory/tests/mutate-turn-breakdown.py
index e96c7c3..6e5a86c 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-turn-breakdown.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-turn-breakdown.py
@@ -81,6 +81,18 @@
      "'收尾 ' + formatInt(Math.max(0, total - open)) + ' · 答复在本轮内交付',",
      "'这一类轮次在本轮内交付了答复',",
      "the tip explains every term on the line"),
+    # ...and the whole shape behind them is a hand-copied second of the server's stats, held in a
+    # different process. Dropping one declared field leaves `undefined + 1` in the loop, which is
+    # NaN, and NaN is refused by isCount() — so 「追加 N」 disappears from the card the moment a
+    # time range goes on, while the whole-session card (reading the server's stats) keeps showing
+    # it. Both numbers were right and nothing said so. The guard for it reads the two halves off
+    # the function rather than off a hardcoded field list, because the hardcoded list is what let
+    # this through the first time: `steers` was simply not written down in it.
+    ("the re-scoped stats loses the field the server declares",
+     "          steers: 0,\n          toolCalls: 0,",
+     "          toolCalls: 0,",
+     "every stats field scopedStats writes is one it declares"),
+
     # The original defect: title and header both said 轮次, one a total one an ordinal. Put the
     # shared label back on either side and the two numbers look like they should be equal.
     ("turn header reverts to the shared label",
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-time-range.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-time-range.mjs
index 39afcc8..a7997d1 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-time-range.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-time-range.mjs
@@ -276,7 +276,12 @@ const whole = scoped.scopedStats();
 const FIELDS = [
   'messages', 'userMessages', 'toolCalls', 'toolResults', 'thinkingBlocks', 'errors',
   'compactions', 'turnsWithPrompt', 'continuationTurns', 'qaTurns', 'openTurns',
-  'turnsWithoutPrompt', 'compactionTurns', 'durationMs'
+  'turnsWithoutPrompt', 'compactionTurns', 'durationMs',
+  // Added 2026-10-15. This list is hand-written, and `steers` was missing from it — so the one
+  // field the re-scoped stats had actually lost went unchecked. `client-check.mjs` now reads both
+  // halves off the function itself, which is what stops the NEXT one; this entry is the direct
+  // number check for this one.
+  'steers'
 ];
 for (const field of FIELDS) {
   check('whole-session ' + field, whole[field], payload.stats[field]);

From db256aefd41ba530e81dd40abe3138973700eba7 Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 15:35:08 +0800
Subject: [PATCH 18/36] =?UTF-8?q?=E6=80=BB=E8=A7=88=E6=9D=A1=EF=BC=9A?=
 =?UTF-8?q?=E5=8E=BB=E6=8E=89=E5=89=8D=E7=BD=AE=E7=9A=84=E7=AD=9B=E9=80=89?=
 =?UTF-8?q?=E6=A0=87=E5=BF=97=EF=BC=8C=E6=94=B9=E6=88=90=E6=97=A0=E6=9D=A1?=
 =?UTF-8?q?=E4=BB=B6=E9=97=AE=E5=90=8C=E4=B8=80=E4=B8=AA=E5=88=A4=E5=AE=9A?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

总览条是下面那张表的画，但它在 spanPassesFilter() 前面挡了一个局部标志，
只列了五个轴里的两个（类型、搜索）。于是设了时间区间、或者只勾了一条异常规则时，
那个标志说「没在筛选」，条带继续画着下面那张表已经丢掉的记录 ——
读者看到的是「筛选了但什么都没变」。

标志是删掉，不是补全：一份列举轴的清单就是一份会漂移的清单。笔选的例外不由
「这个轴没列进去」表达，而是由 spanPassesFilter 传 null 表达。

可见行为因此改变，且是往对的方向：设区间或勾异常时，总览条会跟着变窄。
本地实测（189.1 MB / 25,427 条 / 45 代的那一场，872×900）：

- 点「今天」，区间内 0 条：指标读到 0 条消息 / 0 轮，#overview-lanes 的 outerHTML
  变成 73 字节、零个子节点。改之前这里仍是三条满带。
- 点「工具失败」756 条：#overview-lanes 是 70,177 字符 ≈ 756 个 span，
  只有工具道是红的。改之前这里仍是三条满带。

守卫补的是渲染，不是谓词。verify-overview.mjs 原来有 103 条断言、19 处引用
spanPassesFilter，但 renderOverview() 从没被执行过 —— 沙箱里没有 DOM。
这就是这个缺陷活下来的原因：谓词一直是对的，错的是调用方不再问。
所以给沙箱补上 createElement 和一个最小节点桩，把渲染跑起来，
断言写成读者会说的那句话：总览条是下面那张表的画，同样的记录、同样的顺序，
在每一种筛选下都是。103 → 127 条，每种都把行号写死再和 visibleEntries() 对比，
否则两边同时为空也会「通过」。

mutate-overview.py 加第三条变异，把那个局部标志原样写回去（isFiltering()
砍掉三轴的那种写法），按名抓住，报的是 strip under a time range。

套件 82/82。
---
 .../mmc-trajectory/miniapp/client/index.html  |  13 +-
 .../mmc-trajectory/tests/mutate-overview.py   |  22 ++-
 .../mmc-trajectory/tests/verify-overview.mjs  | 144 +++++++++++++++++-
 3 files changed, 174 insertions(+), 5 deletions(-)

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
index d2988de..06cbe9b 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
+++ b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
@@ -5151,8 +5151,6 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         track.style.setProperty('--ov-domain-left', ((view.start - model.start) / fullDuration * 100).toFixed(4) + '%');
         track.style.setProperty('--ov-domain-width', (view.duration / fullDuration * 100).toFixed(4) + '%');
 
-        var hasQuery = state.query !== '';
-        var filtering = hasQuery || state.kinds.length !== KIND_ORDER.length;
         var lanes = dom.overviewLanes;
         clear(lanes);
         for (var i = 0; i < model.spans.length; i += 1) {
@@ -5173,7 +5171,16 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
           // it kept the excluded work visible enough that turning off 工具结果 left the
           // tool lane reading as a solid band, which is indistinguishable from no filter
           // at all. Positions still come from the full model, so the axis does not move.
-          if (filtering && !spanPassesFilter(span.record)) continue;
+          //
+          // Asked unconditionally, with no local "is anything filtered" flag in front of it.
+          // There used to be one, over two of the five axes, and it was the same defect the
+          // comment on `spanPassesFilter()` records: set only a time range, or only an anomaly
+          // rule, and the flag said nothing was filtered, so the strip kept drawing spans the
+          // list had already dropped — which a reader reads as "I filtered it and nothing
+          // changed". A flag listing the axes is a list that drifts the next time an axis is
+          // added, so the flag is gone rather than completed. The brush stays out of this
+          // because `spanPassesFilter` passes a null selection, not because it is missing here.
+          if (!spanPassesFilter(span.record)) continue;
           node.style.setProperty('--ov-lane', String(span.lane));
           node.style.setProperty('--ov-left', (left * 100).toFixed(4) + '%');
           node.style.setProperty('--ov-width', (width * 100).toFixed(4) + '%');
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-overview.py b/plugins/avatasia/mmc-trajectory/tests/mutate-overview.py
index 050afca..806f719 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-overview.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-overview.py
@@ -12,7 +12,17 @@
 drifted from the list's — and the copy drifted again the moment the search moved to the
 server, because the copy still scanned text while the list was asking a set. The strip is now
 a one-line adapter, and the only way to get a predicate back into it is to write a new one, so
-that is what this mutation writes.
+that is what the first mutation writes.
+
+The second mutation is a different shape and the more dangerous one, because it leaves the
+predicate alone. A local flag in front of the call — 「only bother asking when something is
+filtered」 — is an optimisation that costs nothing while the axes it lists agree with the
+filter. They did not: the flag was `isFiltering()` with three of its five axes dropped, so a
+time range or an 异常 rule alone left it false and the strip went on drawing every span the
+list had already dropped. Reading to the reader that is 「筛选了但什么都没变」, which is
+indistinguishable from a filter that is not wired up. The predicate was never wrong, so no
+assertion about the predicate could have caught it — only running the render and holding the
+strip against the list can.
 """
 import subprocess
 import sys
@@ -28,6 +38,10 @@
         return recordVisible(record, owner || null, null);
       }"""
 
+# The one call site inside the span loop, with its exact indentation — an anchor that does not
+# carry its own leading whitespace would also match the predicate's other references.
+STRIP_GATE = """          if (!spanPassesFilter(span.record)) continue;"""
+
 MUTATIONS = [
     (
         "the strip keeps a predicate of its own instead of asking the list",
@@ -45,6 +59,12 @@
         return recordVisible(record, null, null);
       }""",
     ),
+    (
+        "the strip asks the filter only when a local flag says something is filtered",
+        STRIP_GATE,
+        """          var filtering = state.query !== '' || state.kinds.length !== KIND_ORDER.length;
+          if (filtering && !spanPassesFilter(span.record)) continue;""",
+    ),
 ]
 
 
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs
index 94d7372..d927bee 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs
@@ -24,6 +24,25 @@ const body = bootIndex === -1 ? script : script.slice(0, bootIndex);
 const store = new Map();
 const noop = () => {};
 
+/** The smallest node that `el()`, `clear()` and the overview renderer can run against. */
+function domNode(tag) {
+  const kids = [];
+  const attrs = {};
+  return {
+    tag,
+    childNodes: kids,
+    get firstChild() { return kids.length ? kids[0] : null; },
+    appendChild(n) { kids.push(n); return n; },
+    removeChild(n) { const i = kids.indexOf(n); if (i >= 0) kids.splice(i, 1); return n; },
+    setAttribute(k, v) { attrs[k] = String(v); },
+    getAttribute(k) { return Object.prototype.hasOwnProperty.call(attrs, k) ? attrs[k] : null; },
+    removeAttribute(k) { delete attrs[k]; },
+    style: { setProperty: noop },
+    className: '',
+    textContent: ''
+  };
+}
+
 /** Boot the delivered script in a sandbox, optionally with storage pre-seeded. */
 function buildSandbox(seed) {
   const local = seed || new Map();
@@ -40,7 +59,11 @@ function buildSandbox(seed) {
       setInterval: () => 0,
       clearInterval: noop
     },
-    document: { documentElement: { dataset: {} }, body: { classList: { add: noop, remove: noop } } }
+    document: {
+      documentElement: { dataset: {} },
+      body: { classList: { add: noop, remove: noop } },
+      createElement: (tag) => domNode(tag)
+    }
   };
   vm.createContext(sandbox);
   vm.runInContext(body, sandbox);
@@ -627,6 +650,125 @@ check('strip: a record whose turn is unknown is dropped, because no turn rule fi
 sandbox.state.anomaly.rules = [];
 sandbox.turnById = new Map();
 
+/* ------------------------------------------------- the strip, drawn by the shipped code */
+/* Everything above asks `spanPassesFilter()` about one record. That is the predicate, not the
+ * strip. The defect this section exists for was a gate *in front of* the predicate inside
+ * `renderOverview()`, so a predicate-only guard could never see it: the predicate was always
+ * right, the caller had simply stopped asking. Hence the render runs here, and the invariant is
+ * the one a reader would state out loud — the strip is a picture of the list under it. Same
+ * records, same order, under every filter the page offers.
+ *
+ * A property, not a shape. The gate named two of five axes, and both cases below are one axis
+ * each — which is the whole reason the fix removed the gate instead of completing it: a list
+ * of axes is a list that drifts the next time an axis is added. Asserting "the strip equals
+ * the list" holds for an axis that does not exist yet; asserting "the gate mentions these two"
+ * would have passed while the strip was lying. */
+const STRIP_DOM_KEYS = ['overviewTrack', 'overviewTurns', 'overviewLanes', 'overviewSelection',
+  'overviewHover', 'overviewEmpty', 'overviewTip', 'overviewClear'];
+for (const key of STRIP_DOM_KEYS) sandbox.dom[key] = domNode('div');
+
+/* Five records carrying one difference each: a kind that can be unticked, a record the 异常
+ * axis can name, a timestamp a range can cut, and two records nothing touches. Both bounds are
+ * carried because the two readers disagree about which field they use: spans are placed by
+ * `timestamp`, the range filter reads `relativeMs`. A fixture with only one of them drops
+ * records for a reason that has nothing to do with the filter under test. */
+const STRIP = [
+  ent(rec('g1', 'user', 1000, 0, { relativeMs: 1000 }), 1),
+  ent(rec('g2', 'toolCall', 1100, 400, { relativeMs: 1100, responseId: 'R1', toolCallId: 'tc1', toolName: 'bash' }), 1),
+  ent(rec('g3', 'toolResult', 1100, 400, { relativeMs: 1100, toolCallId: 'tc1' }), 1),
+  ent(rec('g4', 'toolResult', 1600, 200, { relativeMs: 1600, toolCallId: 'tc2', isError: true }), 2),
+  ent(rec('g5', 'narration', 2000, 100, { relativeMs: 2000, responseId: 'R2' }), 2)
+];
+
+const stripIds = () => sandbox.dom.overviewLanes.childNodes.map((n) => n.getAttribute('data-record-id'));
+const listIds = () => sandbox.visibleEntries().map((e) => e.record.id);
+
+function resetStrip() {
+  sandbox.state.flat = STRIP.slice();
+  sandbox.state.kinds = ALL_KINDS;
+  sandbox.state.query = '';
+  sandbox.state.searchHits = null;
+  sandbox.state.overviewSelection = null;
+  sandbox.state.overviewViewport = null;
+  sandbox.state.anomaly.rules = [];
+  sandbox.state.rangeFrom = null;
+  sandbox.state.rangeTo = null;
+  sandbox.state.rangeCutoff = null;
+  sandbox.state.selectedId = null;
+}
+
+/* Render, then hold the strip to the list. Every case also states the rows outright, so a
+ * comparison cannot pass by both sides being empty — the failure mode a mirror assertion
+ * invites, and the one this section has the most reason to be suspicious of. */
+function stripIsTheList(name, expected) {
+  sandbox.renderOverview();
+  check(name + ': the rows under it', stripIds(), expected);
+  check(name + ': the strip draws exactly those rows', stripIds(), listIds());
+}
+
+resetStrip();
+stripIsTheList('strip under no filter', ['g1', 'g2', 'g3', 'g4', 'g5']);
+
+/* The kind axis, which the gate did list. Unchanged behaviour — and unchanged is the point:
+ * a fix that silently moved this one would be a fix that broke the case it looked right on. */
+resetStrip();
+sandbox.state.kinds = NO_TOOLS;
+stripIsTheList('strip under a kind filter', ['g1', 'g5']);
+
+/* The range axis. The gate did not list it, which is the defect: set a range and the strip
+ * went on drawing every span the list had already dropped. */
+resetStrip();
+sandbox.state.rangeTo = 1500;
+stripIsTheList('strip under a time range', ['g1', 'g2', 'g3']);
+
+/* The 异常 axis, which replaces the filter outright. Same shape of gap: tick one rule and the
+ * strip ignored it until a kind filter happened to be on as well. */
+resetStrip();
+sandbox.state.anomaly.rules = ['toolError'];
+stripIsTheList('strip under one 异常 rule', ['g4']);
+
+/* 异常 is exclusive by construction, so a kind filter left on beside it must change nothing —
+ * on either surface. If these two ever disagree the strip is not exclusive, whatever the
+ * button says. */
+resetStrip();
+sandbox.state.anomaly.rules = ['toolError'];
+sandbox.state.kinds = ['user'];
+stripIsTheList('strip under 异常 with a kind filter left on', ['g4']);
+
+/* The selected row is a deliberate exception, and an exception nobody asserts is one more
+ * thing the next reader cannot tell from a bug. Its scope is the viewport, not the filter:
+ * panning the strip must not delete the row the reader is on, while every other clipped span
+ * goes.
+ *
+ * The viewport is in the model's own position space — `overviewModel()` renumbers every span
+ * onto 0..n — so these bounds are fractions of the strip's width, not timestamps. Reading them
+ * as milliseconds does not fail loudly; the viewport simply reads as wider than the domain and
+ * nothing clips. */
+resetStrip();
+sandbox.state.overviewViewport = { start: 0, duration: 2.5 };
+sandbox.renderOverview();
+check('strip: panning the viewport draws only the spans still inside it',
+  stripIds(), ['g1', 'g2', 'g3']);
+sandbox.state.selectedId = 'g4';
+sandbox.renderOverview();
+check('strip: the selected row survives being panned off, since it is the row being read',
+  stripIds(), ['g1', 'g2', 'g3', 'g4']);
+
+/* And the brush itself is exempt, by argument rather than by omission: `spanPassesFilter`
+ * passes a null selection so the window you are dragging over does not erase its own
+ * contents. Asserted from the other side — with a brush in state, the list loses records and
+ * the strip does not. */
+resetStrip();
+sandbox.state.overviewSelection = { start: 1100, end: 1600 };
+sandbox.renderOverview();
+check('strip: a brush empties the list', listIds(), []);
+check('strip: and the strip keeps everything it is drawn over', stripIds(), ['g1', 'g2', 'g3', 'g4', 'g5']);
+
+resetStrip();
+sandbox.renderOverview();
+check('strip: with nothing filtered again the strip is whole',
+  stripIds(), ['g1', 'g2', 'g3', 'g4', 'g5']);
+
 /* ----------------------------------------------------------------------- report */
 console.log('overview + toolbar controls: ' + pass + ' passed, ' + failures.length + ' failed');
 if (failures.length) {

From 9ae04c1b5045e89375d9b41079b7404721e4d795 Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 15:52:21 +0800
Subject: [PATCH 19/36] =?UTF-8?q?=E5=88=A0=E6=8E=89=E5=8D=81=E4=B8=80?=
 =?UTF-8?q?=E4=B8=AA=E6=B2=A1=E6=9C=89=E6=B6=88=E8=B4=B9=E8=80=85=E7=9A=84?=
 =?UTF-8?q?=20class=EF=BC=8C=E5=B9=B6=E8=AE=A9=E8=BF=99=E4=BB=B6=E4=BA=8B?=
 =?UTF-8?q?=E5=8F=98=E6=88=90=E4=B8=80=E6=9D=A1=E5=AE=88=E5=8D=AB?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

样式表里有 159 条 class 选择器，十一个在 <style> 之外零命中：btn-primary、btn-text、
bar-success、chipbar、chips、chip 家族（含 chip-mark / is-on）、turn-meta .num、mono，
以及 legend —— 最后这个原始扫描漏了，手扫也把它读成活的，因为它夹在一堆活规则中间。
删完 148 条，少 94 行。

删规则之前先查了变量：btn-primary 是 --mcode-primary-action-bg 和 -text 的唯一消费者，
而这两个变量在三个主题块里各声明一次。只删规则不动变量就是新造六行死声明 ——
下一次扫死 CSS 的人会看见它们，然后不信这次扫描。删死代码做一半比不做更糟，
因为它把一个可核对的结论换成一个不可核对的。

守卫写的是性质不是名单（tests/verify-css.mjs，42 条）：

  1. <style> 里每条 class 选择器，在 <style> 之外至少有一个消费者。
  2. 每个自定义属性都至少被 var() 读一次。

按名字写死的清单只能挡住同一个名字被加回来，而没人检查的死规则活不过两次重构。
第二条不是设想的，它就是第一条删 btn-primary 时撞上的那六行。

这个守卫自己出过一次错，错法值得记。第一版把「拼接前缀」当成无条件豁免：只要脚本里有
'turn-' + 这类写法，前缀下所有 class 永远算有消费者。后果是删掉 .turn-meta 的唯一
消费者之后，规则看着还是活的，守卫还是绿的 —— mutate-css.py 的第二条变异直接存活。
修法不是删变异，是把豁免收紧：前缀只能覆盖它能点出名字的那个类。生成器取值来自固定
字面量表（' pill-' + tone，kindTone() 返回九个之一），所以 pill-user 之所以活是因为
'user' 作为字面量存在，这不需要跟数据流就能查。前缀点不出后缀，就什么都不覆盖。

mutate-css.py 三条变异，三个方向都按名捕获：给没人建的标记加规则；轮次头去掉副行而
规则留下；主题块里声明一个没人读的属性。

套件 84/84。浏览器实测：页面结构与删除前逐项一致，无塌陷、无位移。
---
 .../mmc-trajectory/miniapp/client/index.html  | 119 -------------
 .../mmc-trajectory/tests/mutate-css.py        | 157 ++++++++++++++++++
 .../mmc-trajectory/tests/verify-css.mjs       | 157 ++++++++++++++++++
 3 files changed, 314 insertions(+), 119 deletions(-)
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/mutate-css.py
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/verify-css.mjs

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
index 06cbe9b..f573822 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
+++ b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
@@ -25,8 +25,6 @@
         --mcode-success: #04b54b;
         --mcode-warning: #f56811;
         --mcode-danger: #f73646;
-        --mcode-primary-action-bg: #171717;
-        --mcode-primary-action-text: #ffffff;
       }
 
       :root[data-theme='dark'] {
@@ -44,8 +42,6 @@
         --mcode-success: #009c3d;
         --mcode-warning: #e25507;
         --mcode-danger: #e31937;
-        --mcode-primary-action-bg: #ffffff;
-        --mcode-primary-action-text: #171717;
       }
 
       /* Fallback when the script has not set data-theme yet. */
@@ -65,8 +61,6 @@
           --mcode-success: #009c3d;
           --mcode-warning: #e25507;
           --mcode-danger: #e31937;
-          --mcode-primary-action-bg: #ffffff;
-          --mcode-primary-action-text: #171717;
         }
       }
 
@@ -251,30 +245,6 @@
         background: var(--mcode-surface-muted);
       }
 
-      .btn-primary {
-        background: var(--mcode-primary-action-bg);
-        color: var(--mcode-primary-action-text);
-        border-color: transparent;
-      }
-
-      .btn-primary:hover:not(:disabled) {
-        background: var(--mcode-primary-action-bg);
-        border-color: transparent;
-        opacity: 0.86;
-      }
-
-      .btn-text {
-        background: transparent;
-        border-color: transparent;
-        color: var(--mcode-accent);
-        padding: 0 8px;
-      }
-
-      .btn-text:hover:not(:disabled) {
-        background: var(--mcode-surface-muted);
-        border-color: transparent;
-      }
-
       .btn[aria-pressed='true'] {
         background: var(--mcode-surface-muted);
         border-color: var(--mcode-accent);
@@ -352,10 +322,6 @@
         border-left-color: var(--mcode-warning);
       }
 
-      .bar-success {
-        border-left-color: var(--mcode-success);
-      }
-
       .bar-title {
         font-weight: 500;
       }
@@ -587,83 +553,6 @@
         color: var(--mcode-danger);
       }
 
-      .chipbar {
-        display: flex;
-        flex-wrap: wrap;
-        align-items: center;
-        gap: 8px;
-      }
-
-      .chips {
-        display: flex;
-        flex-wrap: wrap;
-        align-items: center;
-        gap: 8px;
-        margin: 0;
-        padding: 0;
-        border: 0;
-        min-width: 0;
-      }
-
-      .legend {
-        float: none;
-        padding: 0 4px 0 0;
-        font-size: 12px;
-        color: var(--mcode-text-muted);
-      }
-
-      .chip {
-        display: inline-flex;
-        align-items: center;
-        gap: 4px;
-        min-height: 28px;
-        padding: 0 10px;
-        border: 1px solid var(--mcode-border);
-        border-radius: 999px;
-        background: var(--mcode-surface);
-        color: var(--mcode-text-muted);
-        font: inherit;
-        font-size: 12px;
-        line-height: 1;
-        cursor: pointer;
-        transition: background-color 150ms ease-out, border-color 150ms ease-out, color 150ms ease-out;
-      }
-
-      .chip:hover {
-        background: var(--mcode-surface-muted);
-        border-color: var(--mcode-border-strong);
-      }
-
-      .chip input {
-        position: absolute;
-        opacity: 0;
-        width: 1px;
-        height: 1px;
-        margin: 0;
-        pointer-events: none;
-      }
-
-      .chip-mark {
-        width: 6px;
-        height: 6px;
-        border-radius: 50%;
-        background: currentColor;
-        flex: none;
-      }
-
-      .chip[aria-pressed='true'],
-      .chip.is-on {
-        background: var(--mcode-surface-muted);
-        border-color: var(--mcode-border-strong);
-        color: var(--mcode-text);
-        font-weight: 500;
-      }
-
-      .chip:focus-within {
-        outline: 2px solid var(--mcode-accent);
-        outline-offset: 2px;
-      }
-
       /* ---------------- KPI strip ---------------- */
 
       .kpi-section {
@@ -1587,14 +1476,6 @@
         min-width: 0;
       }
 
-      .turn-meta .num {
-        font-variant-numeric: tabular-nums;
-      }
-
-      .mono {
-        font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
-      }
-
       /* Width of the 记录序号 column, shared by `.row`, `.compaction-band` and
          `.skeleton-row` so the three ledgers cannot drift apart.
 
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-css.py b/plugins/avatasia/mmc-trajectory/tests/mutate-css.py
new file mode 100644
index 0000000..f1b02ed
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-css.py
@@ -0,0 +1,157 @@
+"""Mutation control for the stylesheet's dead-declaration guard.
+
+`verify-css.mjs` states two properties: every class selector has a consumer outside `<style>`,
+and every custom property is read. This control breaks each of them in the direction that
+actually happens, because the two directions are different bugs with different fixes:
+
+  - **A rule added for something nobody built.** The rule and the markup arrive in different
+    edits — the markup gets reverted, or the rule was speculative — and the rule stays. This is
+    what the sweep that produced the eleven dead classes was cleaning up.
+
+  - **A consumer removed and the rule left behind.** A feature is deleted; nobody greps the
+    stylesheet, because a stylesheet is not where you go looking for what a feature used. This
+    is the direction that makes dead CSS accumulate, and it is the one a guard written only as
+    "no unknown rules exist" would not catch.
+
+  - **A variable declared and never read.** Deleting `.btn-primary` orphaned
+    `--mcode-primary-action-bg` and `--mcode-primary-action-text` in three theme blocks during
+    this very cleanup. A class sweep cannot see that; it is the other half of the same property.
+
+Each mutation must be caught *by name*. A probe that dies on an exception names nothing, and a
+control that reports that as "caught" is reporting a crash as if it were evidence.
+"""
+import subprocess
+import sys
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parent
+CLIENT = ROOT / "miniapp" / "client" / "index.html"
+PROBE = HERE / "verify-css.mjs"
+
+# The dead rule is inserted before this one rather than appended at the end of the block, so a
+# mutation that accidentally lands outside <style> fails the guard for the right reason.
+KPI_ANCHOR = "      .kpi-section {"
+
+# The whole turn header's meta line: markup and styling both go, leaving the rule behind.
+TURN_META_CONSUMER = "var meta = el('span', 'turn-meta');"
+
+LIGHT_THEME_TAIL = "        --mcode-danger: #f73646;"
+
+MUTATIONS = [
+    (
+        "a class rule is added for markup that was never built",
+        KPI_ANCHOR,
+        """      .btn-secondary-legacy {
+        background: transparent;
+        border-color: transparent;
+      }
+
+      .kpi-section {""",
+    ),
+    (
+        "the turn header loses its meta line and the rule stays behind",
+        TURN_META_CONSUMER,
+        "var meta = el('span');",
+    ),
+    (
+        "a custom property is declared in a theme block and never read",
+        LIGHT_THEME_TAIL,
+        """        --mcode-danger: #f73646;
+        --mcode-never-read: #123456;""",
+    ),
+]
+
+
+def read_exact(path):
+    """Normalise to LF for matching, and report the file's own newline so it can be put back."""
+    data = path.read_bytes()
+    text = data.decode("utf-8").replace("\r\n", "\n")
+    return text, ("\r\n" if b"\r\n" in data else "\n")
+
+
+def write_exact(path, text, newline):
+    if newline == "\r\n":
+        text = text.replace("\n", "\r\n")
+    path.write_bytes(text.encode("utf-8"))
+
+
+def run_probe():
+    proc = subprocess.run(
+        ["node", str(PROBE)],
+        cwd=str(ROOT),
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+    )
+    return proc.returncode, (proc.stdout or "") + (proc.stderr or "")
+
+
+def named_failure(output):
+    """The first rule the probe named, or None when it failed without naming one."""
+    return next(
+        (line.strip()[len("FAIL"):].strip() for line in output.splitlines()
+         if line.strip().startswith("FAIL")),
+        None,
+    )
+
+
+def main():
+    code, output = run_probe()
+    if code != 0:
+        print("baseline probe does not pass; fix that first")
+        print(output)
+        return 1
+    print("baseline clean")
+
+    original = CLIENT.read_bytes()
+    missed = []
+    unnamed = []
+    for label, old, new in MUTATIONS:
+        text, newline = read_exact(CLIENT)
+        if old not in text:
+            print(f"SKIP  {label}: anchor not found")
+            missed.append(label)
+            continue
+        if text.count(old) != 1:
+            print(f"SKIP  {label}: anchor is not unique ({text.count(old)} matches)")
+            missed.append(label)
+            continue
+        if old == new:
+            print(f"SKIP  {label}: the mutation changes nothing")
+            missed.append(label)
+            continue
+        write_exact(CLIENT, text.replace(old, new, 1), newline)
+        try:
+            code, output = run_probe()
+        finally:
+            CLIENT.write_bytes(original)
+        if code == 0:
+            print(f"MISSED {label}: the probe still passed")
+            missed.append(label)
+            continue
+        name = named_failure(output)
+        if name is None:
+            print(f"UNNAMED {label}: the probe failed without naming a rule")
+            unnamed.append(label)
+        else:
+            print(f"caught {label}\n         -> {name}")
+
+    if CLIENT.read_bytes() != original:
+        print(f"NOT RESTORED {CLIENT}")
+        return 1
+    print("file restored byte-for-byte")
+
+    if missed or unnamed:
+        if missed:
+            print(f"\n{len(missed)} mutation(s) got through")
+        if unnamed:
+            print(f"{len(unnamed)} mutation(s) failed without naming a rule")
+        return 1
+    print(f"\nall {len(MUTATIONS)} mutations caught, each by name")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-css.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-css.mjs
new file mode 100644
index 0000000..831973c
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-css.mjs
@@ -0,0 +1,157 @@
+/**
+ * Nothing in the stylesheet is dead.
+ *
+ * Two properties, one shape: a declaration earns its place by being read.
+ *
+ *   1. Every class selector has at least one consumer outside `<style>`.
+ *   2. Every custom property declared is read at least once by `var()`.
+ *
+ * Written as properties rather than as a list of names. The list this replaced — eleven class
+ * names found by hand — would only stop the next person from re-adding those eleven, and a dead
+ * rule nobody checks is a dead rule that comes back two refactors later.
+ *
+ * What this caught, and why a scanner had to be calibrated rather than trusted:
+ *
+ *   - `.legend` was dead and the hand sweep missed it, twice. Both passes read it as live
+ *     because it sits in the middle of a block of live rules.
+ *   - The ten `pill-*` classes are generated by `'pill' + (tone ? ' pill-' + tone : '')`. Note
+ *     the leading space: a producer pattern anchored to the quote character reads that as no
+ *     producer at all and reports all ten as dead. Every earlier version of this scanner did.
+ *   - `.is-reading-down` exists only inside a comment, which describes a rule that was
+ *     deliberately deleted while a guard keeps asserting the comment survived. Counting
+ *     comments as consumers is what makes that class look alive, so comments are stripped
+ *     before anything is counted.
+ *   - The word "chips" appears in English prose in a dozen comments. `chip` must not match
+ *     inside `chips` or `chip-mark`, so consumers are matched on token boundaries that reject
+ *     both.
+ *
+ * The failure this guard is calibrated against is a false positive, not a miss: a guard that
+ * blocks legitimate work gets argued with, and the next version of it gets weakened. That is
+ * why a generated class counts as consumed only when the generator can name its suffix — see
+ * `consumedBy`. The looser rule that exempted every class under a prefix was tried first and
+ * had to go: it passed a mutation that deleted the only consumer of `.turn-meta`.
+ */
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+const HTML = fileURLToPath(new URL('../miniapp/client/index.html', import.meta.url));
+const html = readFileSync(HTML, 'utf8');
+
+let pass = 0;
+const failures = [];
+function assert(name, cond, detail) {
+  if (cond) pass += 1;
+  else failures.push(detail ? `${name}\n      ${detail}` : name);
+}
+
+/* The block is located by its own delimiters. Slicing on an assumed order of <style> and
+ * <script> is how an earlier scan cut the whole body away and reported 163 dead of 83 live. */
+const styleStart = html.indexOf('<style');
+const styleEnd = html.lastIndexOf('</style>');
+assert('the page has exactly one <style> block', styleStart >= 0 && styleEnd > styleStart);
+if (styleStart < 0 || styleEnd <= styleStart) {
+  console.log('css: ' + pass + ' passed, ' + failures.length + ' failed');
+  for (const f of failures) console.log('FAIL  ' + f);
+  process.exit(1);
+}
+const css = html.slice(html.indexOf('>', styleStart) + 1, styleEnd);
+let outside = html.slice(0, styleStart) + html.slice(styleEnd);
+
+/* Comments first, everywhere: a comment is prose about the code, not the code. */
+const strip = (s) => s.replace(/\/\*[\s\S]*?\*\//g, ' ').replace(/<!--[\s\S]*?-->/g, ' ');
+const cssLive = strip(css);
+outside = strip(outside).replace(/^\s*\/\/.*$/gm, ' ');
+
+assert('the stylesheet is not empty after comments are stripped', cssLive.trim().length > 0);
+
+/* ------------------------------------------------------------------ class selectors */
+/* A dot must be followed by an identifier start, which keeps `0.86` and `1.5rem` out;
+ * `url(...)` contents are dropped first for the same reason. */
+const selectors = new Map();
+for (const m of cssLive.replace(/url\([^)]*\)/g, ' ').matchAll(/\.(-?[_a-zA-Z][\w-]*)/g)) {
+  selectors.set(m[1], (selectors.get(m[1]) || 0) + 1);
+}
+
+const escRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
+/* A class assembled by concatenation has no literal to match, so the generator behind it has
+ * to be found instead. The space after the quote and the space before the `+` are both
+ * load-bearing; both were missing at some point and both report all ten pill classes as dead. */
+const prefixes = new Set();
+for (const m of outside.matchAll(/'([ \t]*[\w-]*-)'|"([ \t]*[\w-]*-)"/g)) {
+  if (/^\s*\+/.test(outside.slice(m.index + m[0].length))) prefixes.add((m[1] || m[2]).trim());
+}
+
+const consumedBy = (name) => {
+  if (new RegExp('(?<![-\\w])' + escRe(name) + '(?![\\w-])').test(outside)) return 'a literal';
+  for (const p of prefixes) {
+    if (!p || !name.startsWith(p)) continue;
+    // A loose prefix rule would be simpler and is wrong in a way that cannot be seen: it
+    // marks *every* class under the prefix consumed forever, so deleting the only consumer of
+    // `.turn-meta` leaves the rule looking alive and the guard green. A mutation that did
+    // exactly that survived the first version of this file.
+    //
+    // So a prefix only covers a class it can *name*. The generator draws its values from a
+    // fixed list of string literals — `' pill-' + tone` where `kindTone()` returns one of nine
+    // — so `pill-user` is alive because `'user'` appears as a literal, and that is checkable
+    // without following the data. A prefix that cannot name the suffix covers nothing.
+    if (new RegExp("'\\s*" + escRe(name.slice(p.length)) + "'").test(outside)) return `'${p}' + …`;
+  }
+  return '';
+};
+
+const deadClasses = [...selectors.keys()].filter((name) => !consumedBy(name));
+assert('every class selector in the stylesheet has a consumer outside it',
+  deadClasses.length === 0,
+  'no consumer: ' + deadClasses.map((n) => '.' + n).join(', '));
+
+/* A generated family is only as alive as its producer. Asserting the producer still exists
+ * keeps a guard that has quietly stopped matching the generator from also being the reason the
+ * ten classes look dead — a failure that would read as "delete them". The tolerance for a
+ * leading space is the same one the extraction needs: the literal is `' pill-'`. */
+for (const p of prefixes) {
+  if (!p || p === '-') continue;
+  assert(`the generated family '${p}' is still produced by a concatenation`,
+    new RegExp("'\\s*" + escRe(p) + "'|\"\\s*" + escRe(p) + "\"").test(outside));
+}
+
+/* ---------------------------------------------------------------- custom properties */
+/* The other half of the same property, and it is not hypothetical: deleting `.btn-primary`
+ * orphaned `--mcode-primary-action-bg` and `--mcode-primary-action-text` in all three theme
+ * blocks — six declarations that would have sat there looking like part of the design. */
+const declared = new Set();
+for (const m of cssLive.matchAll(/(--[\w-]+)\s*:/g)) declared.add(m[1]);
+for (const name of declared) {
+  const uses = cssLive.split('var(' + name + ')').length - 1;
+  assert(`${name} is read somewhere`, uses > 0, 'declared but never passed to var()');
+}
+
+/* The reverse check has one exception and it is a whole family, not an allowance: nineteen
+ * properties — every `--ov-*`, `--sticky-*` and `--inspector-*` — are never declared in the
+ * stylesheet at all. `renderOverview()` writes them per span with `setProperty`, and the
+ * stylesheet reads them back with `var()`. Asserting "read but never declared" without knowing
+ * that would fail on all nineteen and would be wrong every time. So a read with no declaration
+ * is only a defect when nothing sets it either. */
+const setFromJs = new Set();
+for (const m of outside.matchAll(/setProperty\(\s*['"](--[\w-]+)/g)) setFromJs.add(m[1]);
+const read = new Set();
+for (const m of cssLive.matchAll(/var\(\s*(--[\w-]+)/g)) read.add(m[1]);
+for (const name of read) {
+  if (declared.has(name) || setFromJs.has(name)) continue;
+  assert(`${name} is declared somewhere`, false, 'read by var(), never declared, never set from JS');
+}
+
+/* And the other direction for the JS-written ones: a `setProperty` whose name nothing reads is
+ * the same orphan as a dead rule, just spelled differently. */
+for (const name of setFromJs) {
+  assert(`${name} written from JS is read by the stylesheet`,
+    new RegExp('var\\(\\s*' + escRe(name) + '\\b').test(cssLive));
+}
+
+console.log('css: ' + pass + ' passed, ' + failures.length + ' failed'
+  + ' (' + selectors.size + ' class selectors, ' + declared.size + ' custom properties)');
+if (failures.length) {
+  for (const f of failures) console.log('FAIL  ' + f);
+  process.exit(1);
+}
+console.log('ALL CHECKS PASSED');

From 74fc1415e595d579c2e321b2ac283245750a2666 Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 16:05:58 +0800
Subject: [PATCH 20/36] =?UTF-8?q?=E9=80=80=E5=BD=B9=E5=9B=9B=E4=B8=AA?=
 =?UTF-8?q?=E5=8F=AA=E6=9C=89=E6=B5=8B=E8=AF=95=E5=9C=A8=E7=94=A8=E7=9A=84?=
 =?UTF-8?q?=E5=87=BD=E6=95=B0=EF=BC=8C=E5=B9=B6=E6=8A=8A=E3=80=8C=E6=B2=A1?=
 =?UTF-8?q?=E4=BA=BA=E7=94=A8=E7=9A=84=E5=87=BD=E6=95=B0=E3=80=8D=E5=8F=98?=
 =?UTF-8?q?=E6=88=90=E4=B8=80=E6=9D=A1=E5=AE=88=E5=8D=AB?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

删掉 formatCompact、turnContext、turnContextSuffix、buildBlock。它们在产品路径上都没有
调用者；turnContext 只被 turnContextSuffix 调用，而 turnContextSuffix 只被测试调用。
turnContextParts 和 turnSubNode 是活的，没动 —— 它们是同一条链的上游。

collectSessionEntries 改判，不删：它有八个读者，全是测试，而 tests/ 随包分发，
所以读者和它一起装到读者机器上，它不是悬空的。「产品路径没有读者」和「没有读者」
是两件事。删它要先迁移八个测试，那是测试基础设施重构，不是退役。

两样东西必须跟着搬，不能跟着删：

一是注释。turnContext 头上那段讲的是产品理由 —— 两个不相交的「5」并排会被读成同一个数
数了两遍，另有 是分界。turnSubNode 还在实现同一个分界，所以注释搬了过去。

二是断言。context group is marked as a separate population 和 numbers before 另有 sum to
the headline 原来跑在 turnContextSuffix 上 —— 一个没有任何人渲染的呈现器。这种断言会在
被渲染的那一行坏掉时依然通过，而那正是它存在的理由。改指到 turnSubNode，并且真的跑它：
沙箱只有 { console }，所以给 el 和 document.createTextNode 补了最小桩，把渲染出来的文本
从树上读回来。顺带修好一处 —— 旧断言传的是 compactionTurns，而 turnContextParts 读的是
compactions，所以 压缩 那一项从来没进过断言；它过了，但它没在测自己注释里说的那件事。

mutate-record-detail.py 里那条变异的替换文本原本调用 buildBlock。删掉它会把这条控制变成
崩溃（渲染时 ReferenceError）而不是按名失败，而报崩溃的控制等于没报。替换文本改用活代码
重写，缺陷不变：结果页直接渲染 record.result，瘦身之后它永远是空的。17 条变异仍全部按名捕获。

mutate-turn-breakdown.py 的锚点跟着分隔符搬到 turnSubNode，回归本身没变。

守卫写的是性质：内联脚本里声明的每个函数，都在自己的声明之外出现过（tests/verify-dead-code.mjs）。
不是名单 —— 名单只能挡住那三个被加回来。这条规则在这份文件上是准的：批次之前 230 个声明、
4 个无读者，之后 226 个、0 个。

规则定下来之前错了三次，三次全是误报。只认调用会把十三个 addEventListener 的事件处理器
全报成死的，所以是「出现过」不是「被调用过」；没剔注释会把散文里的名字当读者；
为不让页面挂载而切掉的启动块里正好有 init() 的唯一一次调用。三处都写进了守卫的头注释。

另外断言了规则自己的前提：顶层函数缩进恰好 6 空格。一次重新格式化就能让规则悄悄不再
覆盖大部分文件，而那是最像成功的失败。

三条变异按名捕获，其中第三条「把唯一的引用只留在注释里」专治「规则没剔注释」那个错误方向。
范围只到 index.html；server.mjs 有同形状的东西，但它的导出被八个随包分发的测试读着。

套件 86/86。
---
 .../mmc-trajectory/miniapp/client/index.html  |  65 ++------
 .../mmc-trajectory/tests/client-check.mjs     |  59 +++++--
 .../mmc-trajectory/tests/mutate-dead-code.py  | 155 ++++++++++++++++++
 .../tests/mutate-record-detail.py             |   8 +-
 .../tests/mutate-turn-breakdown.py            |   9 +-
 .../mmc-trajectory/tests/verify-dead-code.mjs | 101 ++++++++++++
 6 files changed, 325 insertions(+), 72 deletions(-)
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/mutate-dead-code.py
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/verify-dead-code.mjs

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
index f573822..a82acc6 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
+++ b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
@@ -3010,15 +3010,6 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         return (negative ? '-' : '') + grouped;
       }
 
-      /** Compact form for dense metadata rows. Null never becomes 0. */
-      function formatCompact(value) {
-        if (!isCount(value)) return DASH;
-        var abs = Math.abs(value);
-        if (abs >= 1000000) return trimZeros((value / 1000000).toFixed(1)) + 'M';
-        if (abs >= 10000) return trimZeros((value / 1000).toFixed(1)) + 'k';
-        return formatInt(value);
-      }
-
       function trimZeros(text) {
         return text.indexOf('.') >= 0 ? text.replace(/\.0$/, '') : text;
       }
@@ -4458,22 +4449,6 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         return parts.join(' · ');
       }
 
-      /**
-       * What the turn count leaves out — a DIFFERENT population, not more of the same one.
-       * A checkpoint is not a conversation and a continuation is not a new one.
-       *
-       * This line used to sit in the same `·`-separated run as the breakdown, which put two
-       * numbers worth 5 side by side: 续作答答 (the turns that stopped to ask) and 续作 (the
-       * prompt-less turns that carried the answers). They are disjoint — overlap measured 0 —
-       * but read as one list they look like the same five counted twice. 另有 marks the
-       * boundary so the second group cannot be added to the first by eye.
-       */
-      function turnContext(stats) {
-        return turnContextParts(stats).map(function (p) {
-          return p.label + ' ' + p.value;
-        }).join(' · ');
-      }
-
       /**
        * The out-of-headline terms, each tagged with the kind it stands for — or null when it
        * counts turns rather than records. 追加 is the steer records and 压缩 is the compaction
@@ -4497,15 +4472,19 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         return parts;
       }
 
-      function turnContextSuffix(stats) {
-        var context = turnContext(stats);
-        return context ? '   ·   另有 ' + context : '';
-      }
-
       /**
-       * The same line, with the two record-counting terms as live controls. Pressed state is
-       * read from state.kinds, so it is the same state the chips show and cannot disagree;
-       * the accessible name is the chip's, word for word.
+       * The line under 对话轮次: the breakdown, then 另有 and a DIFFERENT population — not more
+       * of the same one. A checkpoint is not a conversation and a continuation is not a new one.
+       *
+       * That second group used to sit in the same `·`-separated run as the breakdown, which put
+       * two numbers worth 5 side by side: 续作答答 (the turns that stopped to ask) and 续作 (the
+       * prompt-less turns that carried the answers). They are disjoint — overlap measured 0 —
+       * but read as one list they look like the same five counted twice. 另有 marks the
+       * boundary so the second group cannot be added to the first by eye.
+       *
+       * The two record-counting terms are live controls here. Pressed state is read from
+       * state.kinds, so it is the same state the chips show and cannot disagree; the accessible
+       * name is the chip's, word for word.
        */
       function turnSubNode(stats) {
         var wrap = el('span', 'kpi-sub');
@@ -8353,26 +8332,6 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         return copy;
       }
 
-      function buildBlock(title, value, colored) {
-        var wrap = el('div');
-        wrap.style.display = 'flex';
-        wrap.style.flexDirection = 'column';
-        wrap.style.gap = '8px';
-        wrap.appendChild(el('p', 'block-title', title));
-        var pre = el('pre', 'pre');
-        pre.setAttribute('tabindex', '0');
-        var text = safeText(value);
-        if (!text) {
-          pre.textContent = DASH;
-        } else if (colored && typeof value === 'object') {
-          pre.innerHTML = jsonColorize(value);
-        } else {
-          pre.textContent = text;
-        }
-        wrap.appendChild(pre);
-        return wrap;
-      }
-
       /* ---------------- copy & handoff ---------------- */
 
       function copySelected() {
diff --git a/plugins/avatasia/mmc-trajectory/tests/client-check.mjs b/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
index 89437c1..99c60b9 100644
--- a/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
@@ -61,9 +61,6 @@ check('duration NaN', sandbox.formatDuration(NaN), '—');
 check('int null', sandbox.formatInt(null), '—');
 check('int group', sandbox.formatInt(1234567), '1,234,567');
 check('int zero', sandbox.formatInt(0), '0');
-check('compact null', sandbox.formatCompact(null), '—');
-check('compact 12500', sandbox.formatCompact(12500), '12.5k');
-check('compact 2500000', sandbox.formatCompact(2500000), '2.5M');
 check('offset null', sandbox.formatOffset(null), '—');
 check('offset 887', sandbox.formatOffset(887), '+887 ms');
 check('offset 12000', sandbox.formatOffset(12000), '+12 s');
@@ -384,20 +381,52 @@ assert('clicking a span selects the message, not the row',
 assert('hovering a span marks only that span',
   /var id = hovered \? hovered\.id : null;/.test(html));
 
-// turnContext builds its string from turnContextParts, and turnContextSuffix calls
-// turnContext, so a check that wants to RUN any of them has to lift all three, in dependency
-// order. Lifting by regex is acceptable here because these are leaf functions ending in a
-// single `}` at a fixed indent; the alternative — moving them into the PURE block — would put
-// UI string helpers in the unit-tested core for no unit test's benefit.
+// turnSubNode is the one presenter of the line under 对话轮次. It used to have a dead
+// sibling: turnContextSuffix() built the same string, had no caller outside this file, and
+// these two checks ran against it. That was the wrong subject — a check that exercises a
+// presenter nothing renders passes while the rendered line is broken, which is the very defect
+// the checks exist to catch.
+//
+// So they run turnSubNode now, and really run it: `el` and `document.createTextNode` are
+// stubbed below and the rendered text is read back off the tree. Reading its source with a
+// regex is the pattern two checks further down, and it is weaker — the invariant is about the
+// characters the reader receives, not about a substring surviving an edit.
 function fnSource(signature) {
   const m = html.match(new RegExp(signature.replace(/[()]/g, '\\$&') + ' \\{[\\s\\S]*?\\n {6}\\}'));
   return m ? m[0] : null;
 }
+function stubNode(tag, text) {
+  return {
+    tag,
+    textContent: text === undefined || text === null ? '' : String(text),
+    className: '',
+    children: [],
+    setAttribute: () => {},
+    addEventListener: () => {},
+    appendChild(n) { this.children.push(n); return n; }
+  };
+}
+function textOf(node) {
+  return node.children.length ? node.children.map(textOf).join('') : node.textContent;
+}
 function liftTurnFns() {
+  // The stubs go in before the lift: turnSubNode reads state and KIND_LABELS at render time
+  // and builds its tree through el() and document.createTextNode(), none of which the PURE
+  // sandbox has. Installing them after would leave the lift failing for a reason that has
+  // nothing to do with what is under test.
+  sandbox.el = (tag, className, text) => {
+    const n = stubNode(tag, text);
+    if (className) n.className = className;
+    return n;
+  };
+  sandbox.document = { createTextNode: (t) => stubNode('#text', t) };
+  sandbox.state = { kinds: ['steer', 'compaction'] };
+  sandbox.KIND_LABELS = { steer: '追加', compaction: '压缩' };
+  sandbox.onKindToggle = () => {};
   for (const name of [
     'function turnContextParts(stats)',
-    'function turnContext(stats)',
-    'function turnContextSuffix(stats)',
+    'function turnBreakdown(stats)',
+    'function turnSubNode(stats)'
   ]) {
     const src = fnSource(name);
     if (!src) return false;
@@ -563,7 +592,7 @@ const checks = [
     return sum === stats.turnsWithPrompt;
   });
 })()],
-  // Scoped to the rendered label, not the whole file: the doc comment above turnContext
+  // Scoped to the rendered label, not the whole file: the doc comment above turnSubNode
   // explains why 续作答答 was renamed and has to be able to say so.
   ['turn breakdown renders 提问轮, not 提问待答',
     /'提问轮 ' \+ formatInt\(asked\)/.test(html) && !/'提问待答 ' \+ formatInt/.test(html) && !/'续作答答 ' \+ formatInt/.test(html)],
@@ -574,17 +603,17 @@ const checks = [
   // the fix, so assert it is there rather than asserting the reader will notice.
 ['context group is marked as a separate population', (() => {
   if (!liftTurnFns()) return false;
-  const suffix = sandbox.turnContextSuffix({ steers: 15, compactionTurns: 10, continuationTurns: 5 });
+  const line = textOf(sandbox.turnSubNode({ steers: 15, compactions: 10, continuationTurns: 5 }));
   // The boundary is the separator FOLLOWED by 另有. The leading `·` is what joins this group
   // to the breakdown and must stay — an earlier version of this guard asserted it was absent,
   // which was wrong: without it the two groups run together, which is the original defect.
-  return /·\s*另有\s/.test(suffix);
+  return /·\s*另有\s/.test(line);
 })()],
   // And the whole rendered line, as the reader receives it, still partitions correctly once
   // the context group is set aside: the numbers before 另有 sum to the headline.
   ['numbers before 另有 sum to the headline', (() => {
-  const line = sandbox.turnBreakdown({ turnsWithPrompt: 63, qaTurns: 5, openTurns: 9 })
-    + sandbox.turnContextSuffix({ steers: 15, compactionTurns: 10, continuationTurns: 5 });
+  const line = textOf(sandbox.turnSubNode({ turnsWithPrompt: 63, qaTurns: 5, openTurns: 9,
+    steers: 15, compactions: 10, continuationTurns: 5 }));
   const before = line.split('另有')[0];
   const nums = [...before.matchAll(/(\d[\d,]*)/g)].map((m) => Number(m[1].replace(/,/g, '')));
   return nums.reduce((a, n) => a + n, 0) === 63;
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-dead-code.py b/plugins/avatasia/mmc-trajectory/tests/mutate-dead-code.py
new file mode 100644
index 0000000..1173dcd
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-dead-code.py
@@ -0,0 +1,155 @@
+"""Mutation control for the client's dead-function guard.
+
+`verify-dead-code.mjs` states one property: every top-level function the inline script declares
+is referenced somewhere else in that script. This control breaks it in the three ways it
+actually breaks, because they are three different mistakes:
+
+  - **A helper is added for a feature that was not built yet.** The rule and the call arrive in
+    different edits; the rule lands first and the call never does. This is the common one and
+    the one this rule exists for.
+
+  - **A caller is deleted and the helper is left behind.** A branch is removed, a feature is
+    retired, and nobody greps for what it used to call. `turnContextSuffix` is what this looks
+    like in this file's own history.
+
+  - **The reader is only a comment.** A name mentioned in prose looks like a reference to a
+    scanner that has not stripped comments — which is how `is-reading-down` read as a live CSS
+    consumer, and the reason comments are stripped before anything is counted. The mutation
+    keeps the call in a comment and removes the real one, so a guard that counted comments
+    would call it dead for the wrong reason and a guard that ignored the rule entirely would
+    call it alive.
+
+Each must be caught *by name*. A probe that dies on an exception names nothing, and a control
+that reports that as caught is reporting a crash as if it were evidence.
+"""
+import subprocess
+import sys
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parent
+CLIENT = ROOT / "miniapp" / "client" / "index.html"
+PROBE = HERE / "verify-dead-code.mjs"
+
+# A function with exactly one reader, so deleting the reader really does orphan it. Chosen by
+# measurement, not by eye: 116 top-level functions here have a single reference, and picking
+# one with two would make the mutation pass for the wrong reason — the helper would still have
+# a caller and the guard would be right to call it alive.
+AXIS_ICON_CALLER = "        axis.appendChild(axisIcon());"
+AXIS_ICON_CALLEE = "      function axisIcon() {"
+
+MUTATIONS = [
+    (
+        "a helper is added for a feature that was not built yet",
+        AXIS_ICON_CALLEE,
+        """      function summarizeGenerationSpread(generations) {
+        return generations.length;
+      }
+
+      function axisIcon() {""",
+    ),
+    (
+        "a caller is deleted and the helper is left behind",
+        AXIS_ICON_CALLER,
+        "        axis.appendChild(document.createTextNode(''));",
+    ),
+    (
+        "the only reference to a function is left in a comment",
+        AXIS_ICON_CALLER,
+        "        // was: axis.appendChild(axisIcon())\n        axis.appendChild(document.createTextNode(''));",
+    ),
+]
+
+
+def read_exact(path):
+    """Normalise to LF for matching, and report the file's own newline so it can be put back."""
+    data = path.read_bytes()
+    text = data.decode("utf-8").replace("\r\n", "\n")
+    return text, ("\r\n" if b"\r\n" in data else "\n")
+
+
+def write_exact(path, text, newline):
+    if newline == "\r\n":
+        text = text.replace("\n", "\r\n")
+    path.write_bytes(text.encode("utf-8"))
+
+
+def run_probe():
+    proc = subprocess.run(
+        ["node", str(PROBE)],
+        cwd=str(ROOT),
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+    )
+    return proc.returncode, (proc.stdout or "") + (proc.stderr or "")
+
+
+def named_failure(output):
+    """The first rule the probe named, or None when it failed without naming one."""
+    return next(
+        (line.strip()[len("FAIL"):].strip() for line in output.splitlines()
+         if line.strip().startswith("FAIL")),
+        None,
+    )
+
+
+def main():
+    code, output = run_probe()
+    if code != 0:
+        print("baseline probe does not pass; fix that first")
+        print(output)
+        return 1
+    print("baseline clean")
+
+    original = CLIENT.read_bytes()
+    missed = []
+    unnamed = []
+    for label, old, new in MUTATIONS:
+        text, newline = read_exact(CLIENT)
+        if old not in text:
+            print(f"SKIP  {label}: anchor not found")
+            missed.append(label)
+            continue
+        if text.count(old) != 1:
+            print(f"SKIP  {label}: anchor is not unique ({text.count(old)} matches)")
+            missed.append(label)
+            continue
+        if old == new:
+            print(f"SKIP  {label}: the mutation changes nothing")
+            missed.append(label)
+            continue
+        write_exact(CLIENT, text.replace(old, new, 1), newline)
+        try:
+            code, output = run_probe()
+        finally:
+            CLIENT.write_bytes(original)
+        if code == 0:
+            print(f"MISSED {label}: the probe still passed")
+            missed.append(label)
+            continue
+        name = named_failure(output)
+        if name is None:
+            print(f"UNNAMED {label}: the probe failed without naming a rule")
+            unnamed.append(label)
+        else:
+            print(f"caught {label}\n         -> {name}")
+
+    if CLIENT.read_bytes() != original:
+        print(f"NOT RESTORED {CLIENT}")
+        return 1
+    print("file restored byte-for-byte")
+
+    if missed or unnamed:
+        if missed:
+            print(f"\n{len(missed)} mutation(s) got through")
+        if unnamed:
+            print(f"{len(unnamed)} mutation(s) failed without naming a rule")
+        return 1
+    print(f"\nall {len(MUTATIONS)} mutations caught, each by name")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-record-detail.py b/plugins/avatasia/mmc-trajectory/tests/mutate-record-detail.py
index 4f88eac..d414167 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-record-detail.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-record-detail.py
@@ -114,10 +114,16 @@
         "        var summaryText = record.summary || record.toolName || '';",
     ),
     (
+        # The replacement text is written in live code on purpose. It used to call
+        # `buildBlock(...)`, which was retired as dead — leaving it would have turned this
+        # control into a crash (`ReferenceError` at render time) instead of a named failure,
+        # and a control that crashes reports nothing. The defect under test is unchanged: the
+        # 结果 tab renders `record.result` directly, which after the payload slimming is always
+        # empty, instead of going through the folding builder.
         "the 结果 tab renders the record again, which after the slimming is always empty",
         CLIENT,
         "        if (tabId === 'result') return buildDetailBlock('工具结果', record, 'result', false);",
-        "        if (tabId === 'result') return buildBlock('工具结果', record.result, false);",
+        "        if (tabId === 'result') return el('div', 'note', String(record.result));",
     ),
     (
         "the tab is offered from a field the page no longer has, so it is always on",
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-turn-breakdown.py b/plugins/avatasia/mmc-trajectory/tests/mutate-turn-breakdown.py
index 6e5a86c..e8ee2c5 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-turn-breakdown.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-turn-breakdown.py
@@ -44,10 +44,13 @@
      "'提问待答 ' + formatInt(asked)\n        ];",
      "turn breakdown renders 提问轮, not 提问待答"),
     # Removing 另有 is the exact regression this guard exists for: the two groups go back to
-    # being one undifferentiated `·` run.
+    # being one undifferentiated `·` run. The anchor follows the separator to where it now
+    # lives: it used to sit in turnContextSuffix(), which was retired as dead, and the live
+    # presenter turnSubNode() writes the same boundary itself. The regression is unchanged —
+    # only the line it happens on.
     ("boundary mark 另有 removed",
-     "   ·   另有 ' + context",
-     "   ·   ' + context",
+     "wrap.appendChild(document.createTextNode('   ·   另有 '));",
+     "wrap.appendChild(document.createTextNode('   ·   '));",
      "context group is marked as a separate population"),
     ("whole breakdown and context line claims to sum to the headline",
      OPENED,
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-dead-code.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-dead-code.mjs
new file mode 100644
index 0000000..a019d96
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-dead-code.mjs
@@ -0,0 +1,101 @@
+/**
+ * Every function the client declares is called by something.
+ *
+ * Same property as the stylesheet guard one file over — a declaration earns its place by being
+ * read — applied to the inline script instead of the `<style>` block. It replaces a hand list of
+ * three names, and a hand list only stops those three from coming back.
+ *
+ * Scoped to `index.html` on purpose. `server.mjs` has the same shape of dead helper, but its
+ * exports are read by eight test files that ship with the package, so "no reader" there is a
+ * question about test infrastructure rather than about shipped code. Adding this rule to the
+ * server means calibrating it there first, which is a separate piece of work.
+ *
+ * Three things this rule got wrong before it was right, and all three are false positives —
+ * a guard that blocks legitimate work gets argued with, and the next version of it gets
+ * weakened:
+ *
+ *   1. **Calls only.** Thirteen top-level functions here are event handlers that hand
+ *      themselves to `addEventListener` as values: `onOverviewPointerDown`, `copySelected`,
+ *      `onInspectorResizeUp` and ten more. A rule that looks for `name(` calls all thirteen
+ *      dead. The rule is therefore "the name appears anywhere outside its own declaration",
+ *      not "the name is called".
+ *   2. **Comments counted.** Names are mentioned in prose throughout this file. Comments are
+ *      stripped before anything is counted — `//` by whole line, because a `//` inside a string
+ *      is a URL here and scanning for it would delete the rest of the line.
+ *   3. **The bootstrap sliced off.** Cutting the script at `document.readyState` to keep the
+ *      page from mounting removes the one call to `init()`, which then reads as dead. The whole
+ *      script is scanned; a mutation that deletes the bootstrap's call to `init()` is then a
+ *      live case of this rule rather than a false positive.
+ *
+ * The rule is exact on this file, not approximately: 230 declared functions and four with no
+ * reader before the cleanup (`formatCompact`, `turnContextSuffix`, `buildBlock`, plus the
+ * `init` slice artifact), and 226 with none after it.
+ */
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+const HTML = fileURLToPath(new URL('../miniapp/client/index.html', import.meta.url));
+const html = readFileSync(HTML, 'utf8');
+
+const scripts = [...html.matchAll(/<script>([\s\S]*?)<\/script>/g)].map((m) => m[1]);
+let pass = 0;
+const failures = [];
+function assert(name, cond, detail) {
+  if (cond) pass += 1;
+  else failures.push(detail ? `${name}\n      ${detail}` : name);
+}
+
+assert('the page has exactly one inline script', scripts.length === 1,
+  'found ' + scripts.length);
+const script = scripts[0] || '';
+
+/* Comments first. A comment is prose about the code, not the code. */
+const live = script.replace(/\/\*[\s\S]*?\*\//g, ' ').replace(/^\s*\/\/.*$/gm, ' ');
+
+/* Top-level declarations only: the ones at the file's own indent. Nested helpers are inside
+ * another function, where "who calls this" is a question about a closure rather than about
+ * whether the file still uses it. */
+const declared = new Map();
+for (const m of live.matchAll(/^ {6}function ([A-Za-z_$][\w$]*)\s*\(/gm)) {
+  declared.set(m[1], script.slice(0, m.index).split('\n').length);
+}
+assert('the scan found the top-level functions at all', declared.size > 200,
+  'only ' + declared.size + ' matched; the indentation assumption is probably wrong');
+
+/* The scan assumes the file's own indent for a top-level declaration is six spaces. If a
+ * reformat moved them, the rule would stop covering most of the file and report nothing —
+ * which is the failure that looks most like success. So the assumption itself is asserted:
+ * every declaration is either exactly at that indent (top level) or deeper (nested inside
+ * one), and never shallower. */
+const shallow = [];
+for (const m of script.matchAll(/^( *)[ \t]*function ([A-Za-z_$][\w$]*)\s*\(/gm)) {
+  const indent = m[1].length;
+  if (indent !== 6 && indent < 6) shallow.push(m[2] + ' at indent ' + indent);
+}
+assert('no function is declared above the file\'s own top-level indent', shallow.length === 0,
+  'these would escape the scan: ' + shallow.join(', '));
+
+/* A reader is any appearance of the name outside its own `function` keyword. */
+const esc = (s) => s.replace(/\$/g, '\\$&');
+const readersOf = (name) => {
+  let n = 0;
+  for (const m of live.matchAll(new RegExp('(?<![\\w$.])' + esc(name) + '(?![\\w$])', 'g'))) {
+    if (/\bfunction\s*$/.test(live.slice(Math.max(0, m.index - 12), m.index))) continue;
+    n += 1;
+  }
+  return n;
+};
+
+const dead = [...declared.entries()].filter(([name]) => readersOf(name) === 0)
+  .map(([name, line]) => name + ' (line ' + line + ')');
+assert('every function the client declares is used by something',
+  dead.length === 0,
+  'declared and never used: ' + dead.join(', '));
+
+console.log('dead-code: ' + pass + ' passed, ' + failures.length + ' failed ('
+  + declared.size + ' top-level functions)');
+if (failures.length) {
+  for (const f of failures) console.log('FAIL  ' + f);
+  process.exit(1);
+}
+console.log('ALL CHECKS PASSED');

From 1ef5f7171c842876eff34f830e913fb71e4b8f1d Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 16:25:43 +0800
Subject: [PATCH 21/36] =?UTF-8?q?=E9=80=80=E5=BD=B9=E8=AE=B0=E5=BD=95?=
 =?UTF-8?q?=E7=B4=A2=E5=BC=95=EF=BC=8C=E6=8A=8A=E6=8A=95=E5=BD=B1=E6=94=B6?=
 =?UTF-8?q?=E7=AA=84=E6=88=90=E5=8F=AA=E4=BA=A7=E4=B8=89=E4=B8=AA=E5=AE=9A?=
 =?UTF-8?q?=E4=BD=8D=E5=AD=97=E6=AE=B5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

磁盘上的索引目录是死的，投影那一步是活的 —— 所以这次退役的不是「一个索引」，而是
一份没人读的产物，加上一次每次发布都要重算的完整记录投影。

server.mjs 从索引模块导入九个名字，六个零读者。剩下三个里有一个例外：索引行的返回值
在段构建时被当场读走，每段行取它的 fileIdx / byteStart / byteEnd。把它连同模块一起删掉，
搜索就再也拿不到记录落在文件里的位置 —— 那正是「按记录取详情」端点的输入。

因此投影保留，但收窄成只产那三个字段，搬进 search-segments.mjs（这三个字段就是段行
JSON 前缀的一部分，搬过去之后段行只有一个来源）。trajectory-index.mjs 整个删除。

「无定位得到 -1/-1/-1，且不得误归文件 0」这条语义原样保留。它此前分散在两层，各守一半：
段守卫只管「完全不带定位字段的输入」的归一化，根本不调用投影；投影层那条只有一处守着，
而它马上要跟着模块一起没了 —— 所以搬到了新守卫里，并且真的跑投影函数，不是抄一遍它的
匹配表达式。

守卫与变异：
  - tests/verify-locator-rows.mjs（18 条）：顺序、形状、fileIdx、字节范围、同名文件不得按
    basename 匹配、无定位不得变成文件 0、邻居保住自己的、空输入与空 locator map
  - tests/mutate-locator-rows.py（4 条）：四个方向各一条，全按名捕获
  - verify-search-endpoint.mjs 96 → 97 条

重写了一条断言。原来它说的是「这条搜索路径不读索引」，而写索引的调用在同一个函数里，
所以它要靠作用域才成立。现在索引两边都没有了，规则就写成它真正是的东西：整个服务里
没有任何记录索引。断言之前先剔注释 —— 服务端要解释索引去哪了，而一句提到它的解释恰好会
让「没有索引」这条规则失败，那么唯一的写法就是什么都不写。

这条断言原本是三个名字的名单，而名单只能挡住名单上的东西。补了一条按性质的：产物根目录下
只允许存在一个子目录（段所在的那个）。用一个 token 名单抓不到的名字注入验证过，它按名失败
—— 一个用新名字重建的索引会通过名单，被这条抓住。

mutate-search-endpoint.py 补到 20 条，新增的那条用活代码重建被退役的形状：段旁边再写一份
产物，没有任何人读它。这不是把模块加回来，是有人真会写出来的回归形状。

顺带修好一段已经过期的注释：它说索引还在用、并且「是它标出每条记录的 index、turn 和 kind」。
索引没有了，turn 来自 payload 的 turn 表，投影只出文件与字节范围。

存量目录留着不动：停写让新增写入归零，不改变已经落盘的文件（实测每个会话每个视图 8.6 MB），
回收是迁移，不是停止写入的同一步。已确认全仓库没有任何删除或修剪逻辑碰它，所以留着是安全的。

套件 86/86。
---
 .../miniapp/node/search-segments.mjs          |  64 ++
 .../mmc-trajectory/miniapp/node/server.mjs    |  45 +-
 .../miniapp/node/trajectory-index.mjs         | 573 ------------------
 .../tests/mutate-locator-rows.py              | 169 ++++++
 .../tests/mutate-search-endpoint.py           |  10 +
 .../tests/mutate-trajectory-index.py          | 190 ------
 plugins/avatasia/mmc-trajectory/tests/run.mjs |   1 -
 .../tests/verify-locator-rows.mjs             | 142 +++++
 .../mmc-trajectory/tests/verify-review16.mjs  |   1 -
 .../tests/verify-search-endpoint.mjs          |  60 +-
 .../tests/verify-trajectory-index.mjs         | 551 -----------------
 11 files changed, 442 insertions(+), 1364 deletions(-)
 delete mode 100644 plugins/avatasia/mmc-trajectory/miniapp/node/trajectory-index.mjs
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/mutate-locator-rows.py
 delete mode 100644 plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-index.py
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/verify-locator-rows.mjs
 delete mode 100644 plugins/avatasia/mmc-trajectory/tests/verify-trajectory-index.mjs

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/search-segments.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/search-segments.mjs
index 70727fd..f41d379 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/search-segments.mjs
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/search-segments.mjs
@@ -105,6 +105,70 @@ export function normaliseWhitespace(value) {
   return String(value).replace(/\s+/g, ' ').trim();
 }
 
+/**
+ * Where each record sat in the file it came from, in ledger order.
+ *
+ * This used to be `indexRowsFromPayload` in a module called `trajectory-index`, and it used to
+ * return a whole index row per record — every field except five excluded ones — so that the index
+ * artifact could be written to disk. Nothing read that artifact back, so the shape was paid for on
+ * every publish and consumed by exactly one caller.
+ *
+ * That caller reads **one** of the three fields. `fileIdx` is the per-generation grouping key: a
+ * record goes into the segment for the source file its locator names, so a record with no locator
+ * lands in no segment at all rather than in whichever generation happens to be first. The other
+ * two ride along on the segment line's JSON prefix — and as of this change **nothing in the shipped
+ * search path reads them back**. `readSegmentHits` picks five fields off that prefix and drops the
+ * rest, and `/api/trajectory/record` answers from the in-memory lineage cache rather than from a
+ * segment. What they buy today is a capability nothing exercises: a hit in a sealed generation
+ * could be mapped back to the line it came from. Measured cost of carrying it: 4.36% of a real
+ * segment surface, 49 bytes a line (1,177-line, 1.3 MB segment).
+ *
+ * They stay because they are part of the **segment format**, not of this function. Dropping them
+ * means a format change with a schema bump and every already-written segment invalidated, which is
+ * its own batch with its own four questions — carrying them is the cheap half of that decision, and
+ * the expensive half is what other people already have on disk.
+ *
+ * So this is the producer of part of the segment format, and it lives here rather than beside a
+ * directory nothing reads.
+ *
+ * `raws` is the record -> locator map the route already builds for `/raw`. A record with no
+ * locator gets `-1` in all three fields, and that is a real state rather than a gap to be filled:
+ * repairing it to `0` would file the record under whichever source file happens to be first,
+ * which is a different generation's message. `-1` also stays distinguishable from byte `0`, which
+ * is a position a record really can have.
+ *
+ * @param {{ turns: Array<{ records: Array<{ index: number }> }> }} payload
+ * @param {Map<number, { filePath: string, start: number, end: number }>} raws
+ * @param {Array<{ filePath?: string }>} files
+ * @returns {Array<{ fileIdx: number, byteStart: number, byteEnd: number }>} one entry per record,
+ *   in the same order the payload's turns and their records are walked
+ */
+export function locatorRowsFromPayload(payload, raws, files) {
+  const pathToFileIdx = new Map();
+  files.forEach((file, i) => {
+    // Matched on the full path, not the file name: two generations can each hold a file the
+    // catalog names the same way, and a basename match would file one generation's records
+    // under the other. First writer wins, because a path is only in the table once per session.
+    if (typeof file.filePath === 'string' && !pathToFileIdx.has(file.filePath)) {
+      pathToFileIdx.set(file.filePath, i);
+    }
+  });
+  const out = [];
+  for (const turn of payload.turns) {
+    for (const record of turn.records) {
+      const locator = raws.get(record.index);
+      out.push(locator === undefined
+        ? { fileIdx: -1, byteStart: -1, byteEnd: -1 }
+        : {
+          fileIdx: pathToFileIdx.get(locator.filePath) ?? -1,
+          byteStart: locator.start,
+          byteEnd: locator.end
+        });
+    }
+  }
+  return out;
+}
+
 /**
  * Builds one generation's searchable lines.
  *
diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
index 591f71e..2eb2401 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
@@ -6,17 +6,6 @@ import { createServer } from 'node:http';
 import { basename, join, resolve, sep } from 'node:path';
 import { homedir } from 'node:os';
 import { createHash } from 'node:crypto';
-import {
-  MAX_WINDOW_RECORDS,
-  buildSecondary,
-  createIndexStore,
-  indexRowsFromPayload,
-  projectionDigestOf,
-  recordsInTimeRange,
-  resolveWindow,
-  stripPath,
-  windowTurns,
-} from './trajectory-index.mjs';
 import {
   MAX_HITS,
   SEARCH_FIELDS,
@@ -24,6 +13,7 @@ import {
   createSegmentStore,
   foldNeedle,
   generationKey,
+  locatorRowsFromPayload,
   needleIsUsable,
   normaliseWhitespace,
   readSegmentHits,
@@ -2837,8 +2827,12 @@ export async function start(context) {
   // read-only input and the plugin package installs onto every reader's machine, so neither is a
   // place to write. Held per runtime instance rather than as module state, so two runtimes in one
   // process cannot share a root.
+  //
+  // Only the search segments live here. There was a second store under `index/`, written on every
+  // publish and never read by anything; it is gone, and directories it already wrote are left
+  // alone — nothing consults them, and deleting them is a migration that does not belong in the
+  // same change as stopping the writes.
   const artifactRoot = join(context.dataDir, 'trajectory-artifacts');
-  const indexStore = createIndexStore(join(artifactRoot, 'index'));
   const segmentStore = createSegmentStore(join(artifactRoot, 'search'));
 
   /**
@@ -3680,11 +3674,7 @@ export async function start(context) {
       const locator = rowLocators[rowIndex];
       if (locator !== undefined) locators.set(recordIndex, locator);
     }
-    const indexRows = indexRowsFromPayload(payload, locators, files);
-    await indexStore.write(sessionKey, viewKey, indexRows, {
-      files,
-      projectionDigest: projectionDigestOf(payload),
-    });
+    const locatorRows = locatorRowsFromPayload(payload, locators, files);
 
     // One segment per generation, the active one included. §8.8.1 rule 5 excluded the active
     // generation on the grounds that a segment for it would be stale before it was written — true,
@@ -3694,14 +3684,17 @@ export async function start(context) {
     // segment for the active generation there would be nothing to scan at all on a session that is
     // still being written, which is the one case a reader is most likely to search.
     //
-    // The surface comes from the PAYLOAD's records, not the index's. The index deliberately drops
-    // the four bulk fields to stay small, and three of those five — `text`, `result`, `thinking` —
-    // are searchable. A segment built from index records therefore searches two of the five fields,
-    // which narrows what a reader can find with nothing anywhere reporting it. Measured on the
-    // largest session here: the needle "needle" reported 14 matches through the artifacts and 45
-    // through the rebuild, and the two answers were both plausible. The index is still needed — it
-    // is what names each record's index, turn and kind — so the two are merged: the payload's
-    // fields for the surface, the index's fileIdx and byte range for the locator.
+    // The surface comes from the PAYLOAD's records, not from a narrower copy of them. That copy
+    // dropped the four bulk fields to stay small, and three of the five fields — `text`, `result`,
+    // `thinking` — are searchable. A segment built from it therefore searched two of the five, which
+    // narrows what a reader can find with nothing anywhere reporting it. Measured on the largest
+    // session here: the needle "needle" reported 14 matches through the artifacts and 45 through
+    // the rebuild, and the two answers were both plausible.
+    //
+    // What the payload cannot say on its own is which source file a record came from, so that is
+    // what gets projected out of the lineage's row locators: the payload's fields for the surface,
+    // and a locator whose file number is the grouping key below. The byte range rides along on the
+    // segment line and is read by nothing here — see the note on locatorRowsFromPayload.
     const flatRecords = [];
     for (const turn of payload.turns) {
       for (const record of turn.records) flatRecords.push({ record, turn });
@@ -3709,7 +3702,7 @@ export async function start(context) {
     for (let fileIdx = 0; fileIdx < files.length; fileIdx += 1) {
       const records = [];
       for (let i = 0; i < flatRecords.length; i += 1) {
-        const located = indexRows.records[i];
+        const located = locatorRows[i];
         if (located === undefined || located.fileIdx !== fileIdx) continue;
         records.push({
           ...flatRecords[i].record,
diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/trajectory-index.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/trajectory-index.mjs
deleted file mode 100644
index 9830723..0000000
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/trajectory-index.mjs
+++ /dev/null
@@ -1,573 +0,0 @@
-// @ts-check
-
-// The record-level index: what a session's ledger looks like, laid out so that reading a window,
-// counting a kind, or brushing a time range costs a lookup instead of a re-parse of every
-// generation the session has ever stored.
-//
-// WHY IT EXISTS. Reading a session today has exactly two shapes — all of it, or all of it with the
-// tail cut off — and both have to build every row of every generation first. That is why the
-// server keeps parsed rows resident (measured 231 MB for a 44-generation session) and keeps the
-// serialized response (135 MB for the same session). This file is the third shape: a durable,
-// cheap-to-load description of the ledger, so "give me records 3,100 through 3,300" and "how many
-// tool calls are there" stop being a reason to read 198 MB.
-//
-// FOUR QUESTIONS, because a change like this is not allowed to skip them.
-//
-// 归层 — server only. Everything here is derived from the projection the identity layer already
-// produced, and none of it is shipped to the page as a second answer: the window endpoint answers
-// out of this, and the full payload keeps its existing shape. The index never writes client state.
-//
-// 关联 — subordinate to the projection, parallel to the two caches it exists to replace. It is
-// built FROM the corrected records, so it inherits the identity merge rather than re-deciding it;
-// a view it does not cover (a single generation) falls back to the full build rather than being
-// answered from a stale approximation.
-//
-// 布局 — no new surface. Two files under the runtime's data dir, and query parameters on the route
-// that already exists. Nothing here is a panel, a section, or a page.
-//
-// 口径 — the answer must be the same answer. `verify-trajectory-index.mjs` holds every window, KPI
-// and brush it serves against the full payload field by field, so switching a read onto this file
-// cannot move a number the page already shows.
-//
-// STORAGE. Two files per (session, view): records.jsonl, then manifest.json. The manifest is
-// written LAST and only after the records are in place under their final name, so a run that dies
-// half way leaves a manifest that does not describe the bytes next to it — and a missing or
-// mismatched manifest means "no index", never "half an index". Absolute paths are deliberately
-// absent: a record names a file by its index into the manifest's own file table, so the artifact
-// carries no machine path and is meaningless outside the session it was built for.
-//
-// The records are JSONL rather than a b-tree because the primary key is already dense and sorted
-// (measured gapless 1..36527 on a 44-generation session), which makes the file on disk the sorted
-// array a binary search wants. The one thing that must not be searched that way is the timestamp —
-// see `buildSecondary`.
-
-import { createHash } from 'node:crypto';
-import { mkdir, open, readFile, rename, rm, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
-
-/**
- * Bumped when the on-disk shape changes in a way an older reader cannot survive. A file written
- * under a different version is rebuilt, never migrated: the source it describes is still there.
- */
-export const INDEX_SCHEMA_VERSION = 1;
-
-/**
- * Bumped when `buildTrajectoryPayload` changes what a record CONTAINS, independently of the file
- * layout above. A projection that starts emitting a new field, or stops clipping at a different
- * length, makes every stored index describe a ledger that no longer exists — and the check that
- * catches it has to be about the projection, not about the bytes.
- */
-export const PROJECTION_VERSION = 1;
-
-/**
- * The record fields the index does NOT carry.
- *
- * A denylist, not an allowlist, and the reason is that a field this file forgot would be a field
- * the page renders as blank with nothing to say why. The projected text fields are the whole of
- * what is left out: they are the bulk of the payload, and the ledger draws them from one record at
- * a time, so they are read back from the source line the locator names — the same move `/raw`
- * already makes. Everything else, however small, is carried verbatim.
- *
- * `rawRow` is dropped for a different reason: it is an index into an array that is gone by the time
- * anything reads this file, and the locator beside it is the durable form of the same fact.
- */
-export const EXCLUDED_RECORD_FIELDS = new Set([
-  'text',
-  'thinking',
-  'arguments',
-  'result',
-  'error',
-  'rawRow',
-]);
-
-/**
- * Turn-level fields, kept apart because a window has to reproduce a turn header without the rows
- * that header was summed from. Sums, not derivations: `toolCalls` / `errors` / `tokens` are read
- * off the built turn rather than recomputed, so a window's header matches the full build's header.
- */
-export const INDEX_TURN_FIELDS = [
-  'id',
-  'index',
-  'startedAt',
-  'endedAt',
-  'durationMs',
-  'toolCalls',
-  'errors',
-  'tokens',
-  'turnClass',
-  'askedReader',
-  'closed',
-  'openerInView',
-  'openerOutOfView',
-];
-
-/**
- * One source file, as the index knows it.
- *
- * `filePath` is here because a locator names a file by its path and the record has to be matched
- * to a file exactly, not by basename — but it is stripped before the manifest is written, so no
- * machine path reaches the artifact. That is also why it is not compared by `sameSources`: it is
- * not identity, it is where the identity happens to live this time.
- *
- * @typedef {{ fileName: string, generation: number | null, size: number, mtimeMs: number, revision: string | null, filePath?: string }} IndexFile
- */
-
-/** @typedef {{ schemaVersion: number, projectionVersion: number, view: string, files: IndexFile[], recordCount: number, turnCount: number, recordsBytes: number, recordsDigest: string, projectionDigest: string }} IndexManifest */
-
-/**
- * One ledger record as the index stores it.
- * @typedef {Record<string, any>} IndexRecord
- */
-
-/**
- * Turns a built payload's turns into the two line-per-item shapes the file is made of.
- *
- * `raws` is the record -> locator map the route already builds for `/raw`; it is read here and
- * then forgotten, because a locator's `filePath` is a machine path and the file must not carry one.
- * A record with no locator becomes `fileIdx: -1`, which is a real state (a projection built by a
- * caller that had no locators) and is not silently repaired to 0 — that would point the record at
- * whichever file happens to be first.
- *
- * There is deliberately no `ordinalInLine`. One source line expands into several records, but they
- * all answer with the same message, so `/raw` locates per line and not per segment — a segment
- * number here would be a field nothing could act on.
- *
- * @param {{ turns: Array<any>, stats: Record<string, any>, session: Record<string, any> }} payload
- * @param {Map<number, { filePath: string, start: number, end: number, digest: string }>} raws
- * @param {IndexFile[]} files
- * @returns {{ turns: Array<Record<string, any>>, records: IndexRecord[] }}
- */
-export function indexRowsFromPayload(payload, raws, files) {
-  const pathToFileIdx = new Map();
-  files.forEach((file, i) => {
-    // Matched on the full path, not the file name: two generations can each hold a file the catalog
-    // names the same way, and a basename match would file one generation's records under the other.
-    // First writer wins, because a path can only be in the table once for one session.
-    if (typeof file.filePath === 'string' && !pathToFileIdx.has(file.filePath)) {
-      pathToFileIdx.set(file.filePath, i);
-    }
-  });
-  /** @type {IndexRecord[]} */
-  const records = [];
-  /** @type {Array<Record<string, any>>} */
-  const turns = [];
-  for (const turn of payload.turns) {
-    /** @type {Record<string, any>} */
-    const header = {};
-    for (const field of INDEX_TURN_FIELDS) header[field] = turn[field] ?? null;
-    header.firstRecord = 0;
-    header.lastRecord = -1;
-    for (const record of turn.records) {
-      const locator = raws.get(record.index);
-      const fileIdx = locator === undefined ? -1 : (pathToFileIdx.get(locator.filePath) ?? -1);
-      /** @type {IndexRecord} */
-      const line = {};
-      for (const [key, value] of Object.entries(record)) {
-        if (EXCLUDED_RECORD_FIELDS.has(key)) continue;
-        if (value === undefined) continue;
-        line[key] = value;
-      }
-      line.fileIdx = fileIdx;
-      // Where the line that produced this record sat in its file. `ordinalInLine` — which segment of
-      // a line this record is — is deliberately absent: every record out of one line answers with the
-      // same message, so /raw locates per line. These two are different: they name the LINE, and they
-      // are what a search hit in a sealed generation is mapped back through, because a sealed
-      // generation's records are searched long after the row objects that gave them their ordinals
-      // have stopped existing. `-1` is "no location", and stays distinguishable from a byte 0.
-      line.byteStart = locator === undefined ? -1 : locator.start;
-      line.byteEnd = locator === undefined ? -1 : locator.end;
-      // Whether `error` had text, not the text: the flag is what a row is styled by, and carrying
-      // the string would put the bulk back into the file this exists to keep small.
-      line.hasErrorText = typeof record.error === 'string' && record.error.length > 0;
-      if (header.lastRecord < 0) header.firstRecord = records.length;
-      header.lastRecord = records.length;
-      records.push(line);
-    }
-    turns.push(header);
-  }
-  return { turns, records };
-}
-
-/**
- * Serializes turns and records into the two byte ranges of one file, in that order.
- *
- * Turns first so that a reader can learn the turn table without touching a record line, and so a
- * file whose record half is truncated still has a describable header.
- *
- * @param {{ turns: Array<Record<string, any>>, records: IndexRecord[] }} rows
- * @returns {string}
- */
-export function serializeIndex(rows) {
-  const parts = [];
-  // No separator between the two blocks: the manifest's `turnCount` is the boundary, and a blank
-  // line would be a second thing that has to agree with it.
-  for (const turn of rows.turns) parts.push(JSON.stringify(turn));
-  for (const record of rows.records) parts.push(JSON.stringify(record));
-  return parts.join('\n');
-}
-
-/**
- * @param {string} text
- * @param {IndexManifest} manifest
- * @returns {{ turns: Array<Record<string, any>>, records: IndexRecord[] } | null}
- */
-export function parseIndex(text, manifest) {
-  if (manifest.recordsDigest !== digestOf(text)) return null;
-  const lines = text.split('\n');
-  if (lines.length < 1) return null;
-  const turns = [];
-  for (let i = 0; i < manifest.turnCount; i += 1) {
-    const line = lines[i];
-    if (line === undefined || line === '') return null;
-    let parsed;
-    try { parsed = JSON.parse(line); } catch { return null; }
-    if (!parsed || typeof parsed !== 'object') return null;
-    turns.push(parsed);
-  }
-  // Exactly as many lines as the manifest claims, and no more: a file with an extra line is one
-  // whose writer was interrupted, and reading the prefix of it would answer with half an index.
-  if (lines.length !== manifest.turnCount + manifest.recordCount) return null;
-  const records = [];
-  for (let i = manifest.turnCount; i < manifest.turnCount + manifest.recordCount; i += 1) {
-    const line = lines[i];
-    if (line === undefined || line === '') return null;
-    let parsed;
-    try { parsed = JSON.parse(line); } catch { return null; }
-    if (!parsed || typeof parsed !== 'object') return null;
-    records.push(parsed);
-  }
-  return { turns, records };
-}
-
-/**
- * The identity half of a source file, with the path taken off.
- *
- * This is what the manifest stores and what `sameSources` compares, so it is also what decides
- * whether a stored index may be reused: a machine path is not part of that question.
- *
- * @param {IndexFile} file
- */
-export function stripPath(file) {
-  return {
-    fileName: file.fileName,
-    generation: file.generation,
-    size: file.size,
-    mtimeMs: file.mtimeMs,
-    revision: file.revision,
-    // Whether this generation's rows were cut short by our own read cap. `size` is the whole file
-    // whether or not the read covered it, so on its own a truncated generation's artifact looks
-    // exactly like a complete one. Carried because an answer assembled from artifacts would then
-    // report a smaller `total` than the rebuild would, and report nothing about being wrong.
-    truncated: file.truncated === true,
-  };
-}
-
-/** @param {string} text */
-export function digestOf(text) {
-  return createHash('sha256').update(text).digest('hex');
-}
-
-/**
- * The five secondary structures, built once per load.
- *
- * `index` is the primary key and needs no structure: the array is already in index order, and the
- * file is written that way. `timestamp` is the one that costs a sort, and it is the one that may
- * NOT be searched in index order — a session's timestamps are nearly but not quite monotonic
- * (measured 32 adjacent inversions in 25,428 rows, the largest a 141.8 s step backwards, against a
- * 98.9 h span), so bisecting the primary order would silently drop whatever fell in a gap. The
- * ordering is therefore a side array, and nothing is allowed to reach for `records[]` order when
- * answering a time range.
- *
- * @param {IndexRecord[]} records
- */
-export function buildSecondary(records) {
-  /** @type {Map<string, number[]>} */
-  const byMessageId = new Map();
-  /** @type {Map<number, number[]>} */
-  const byGeneration = new Map();
-  /** @type {Map<string, number>} */
-  const kindCounts = new Map();
-  /** @type {number[]} */
-  const timedPositions = [];
-  for (let i = 0; i < records.length; i += 1) {
-    const record = records[i];
-    // `id` IS the logical message id: it is the field the page groups by and the field the
-    // identity layer keys on. A record without one is unkeyed and joins no group — it is not
-    // filed under a shared empty key, which would merge every unkeyed record into one message.
-    if (typeof record.id === 'string' && record.id.length > 0) {
-      const existing = byMessageId.get(record.id);
-      if (existing === undefined) byMessageId.set(record.id, [i]);
-      else existing.push(i);
-    }
-    if (typeof record.generation === 'number') {
-      const existing = byGeneration.get(record.generation);
-      if (existing === undefined) byGeneration.set(record.generation, [i]);
-      else existing.push(i);
-    }
-    if (typeof record.kind === 'string') {
-      kindCounts.set(record.kind, (kindCounts.get(record.kind) ?? 0) + 1);
-    }
-    if (typeof record.timestamp === 'number') timedPositions.push(i);
-  }
-  // Stable so that two records sharing a timestamp keep index order among themselves: a time
-  // brush that lists them back in ledger order is the order the reader is looking at.
-  timedPositions.sort((a, b) => {
-    const delta = records[a].timestamp - records[b].timestamp;
-    return delta === 0 ? a - b : delta;
-  });
-  const timeValues = new Float64Array(timedPositions.length);
-  for (let i = 0; i < timedPositions.length; i += 1) timeValues[i] = records[timedPositions[i]].timestamp;
-  return {
-    recordCount: records.length,
-    /** @type {Map<string, number[]>} */
-    byMessageId,
-    /** @type {Map<number, number[]>} */
-    byGeneration,
-    /** @type {Map<string, number>} */
-    kindCounts,
-    /** @type {Float64Array} */
-    timeValues,
-    /** @type {Int32Array} */
-    timeRows: Int32Array.from(timedPositions),
-    untimedCount: records.length - timedPositions.length,
-  };
-}
-
-/**
- * The half-open record range a window request names, clamped to what exists.
- *
- * `limit` is bounded here rather than at the route so that every caller gets the same ceiling and
- * the guard can pin one number.
- *
- * @param {{ recordCount: number }} secondary
- * @param {{ from?: number | null, limit?: number | null, tail?: number | null }} request
- */
-export function resolveWindow(secondary, request) {
-  const total = secondary.recordCount;
-  if (total === 0) return { from: 1, to: 0, limit: 0, total: 0 };
-  const tail = typeof request.tail === 'number' && request.tail > 0 ? Math.min(request.tail, MAX_WINDOW_RECORDS) : null;
-  const from = typeof request.from === 'number' && request.from > 0 ? request.from : 1;
-  if (tail !== null) {
-    const start = Math.max(1, total - tail + 1);
-    return { from: start, to: total, limit: tail, total };
-  }
-  const limit = Math.min(
-    typeof request.limit === 'number' && request.limit > 0 ? request.limit : MAX_WINDOW_RECORDS,
-    MAX_WINDOW_RECORDS,
-  );
-  const start = Math.min(from, total);
-  const end = Math.min(start + limit - 1, total);
-  return { from: start, to: end, limit: end - start + 1, total };
-}
-
-/**
- * One window's worth of records: the range plus every turn that touches it.
- *
- * The extra turns are not padding. A group header carries the turn's token and error totals, so a
- * window that cut a turn in half would print a header describing rows the reader cannot see. The
- * turn table knows each turn's record span, which is why it is indexed separately.
- *
- * @param {{ turns: Array<Record<string, any>> }} index
- * @param {{ from: number, to: number, total: number }} range
- */
-export function windowTurns(index, range) {
-  const out = [];
-  for (let i = 0; i < index.turns.length; i += 1) {
-    const turn = index.turns[i];
-    const first = typeof turn.firstRecord === 'number' ? turn.firstRecord : null;
-    const last = typeof turn.lastRecord === 'number' ? turn.lastRecord : null;
-    // A turn with no records still has a header the full payload emitted, so it is kept.
-    if (first === null || last === null || last < first) {
-      out.push({ turn, records: [] });
-      continue;
-    }
-    const start = first + 1;
-    const end = last + 1;
-    if (end < range.from || start > range.to) continue;
-    out.push({ turn, records: [Math.max(start, range.from), Math.min(end, range.to)] });
-  }
-  return out;
-}
-
-/**
- * Every record whose timestamp falls in a range, in ledger order.
- *
- * Bisected on the sorted side array and then sorted back into index order, because the answer a
- * brush highlights is a set of ledger rows and the page addresses them by record.
- *
- * @param {ReturnType<typeof buildSecondary>} secondary
- * @param {number} from inclusive
- * @param {number} to inclusive
- * @returns {number[]} record indexes
- */
-export function recordsInTimeRange(secondary, from, to) {
-  if (to < from || secondary.timeValues.length === 0) return [];
-  const values = secondary.timeValues;
-  let lo = 0;
-  let hi = values.length;
-  while (lo < hi) {
-    const mid = (lo + hi) >> 1;
-    if (values[mid] < from) lo = mid + 1;
-    else hi = mid;
-  }
-  const hits = [];
-  for (let i = lo; i < values.length && values[i] <= to; i += 1) hits.push(secondary.timeRows[i]);
-  hits.sort((a, b) => a - b);
-  return hits;
-}
-
-/** The most records one window response may carry, whatever the request asked for. */
-export const MAX_WINDOW_RECORDS = 2000;
-
-/**
- * A derived-artifact store under the runtime's data dir. Never beside the session history and never
- * inside the plugin package: the session store is read-only input, and the package installs onto
- * every reader's machine.
- *
- * @param {string} root
- */
-export function createIndexStore(root) {
-  const safe = (part) => String(part).replace(/[^A-Za-z0-9._-]/g, '_').slice(0, 120) || '_';
-
-  /**
-   * @param {string} sessionKey
-   * @param {string} view
-   */
-  const dirOf = (sessionKey, view) => join(root, safe(sessionKey), safe(view));
-
-  return {
-    /**
-     * Publishes one view. The records land under their final name first; the manifest, which is
-     * what makes the pair readable, lands last.
-     *
-     * @param {string} sessionKey
-     * @param {string} view
-     * @param {{ turns: Array<Record<string, any>>, records: IndexRecord[] }} rows
-     * @param {{ files: IndexFile[], projectionDigest: string }} meta
-     */
-    async write(sessionKey, view, rows, meta) {
-      const dir = dirOf(sessionKey, view);
-      await mkdir(dir, { recursive: true });
-      const text = serializeIndex(rows);
-      const recordPath = join(dir, 'records.jsonl');
-      const manifestPath = join(dir, 'manifest.json');
-      await writeFile(`${recordPath}.tmp`, text, 'utf8');
-      await rename(`${recordPath}.tmp`, recordPath);
-      /** @type {IndexManifest} */
-      const manifest = {
-        schemaVersion: INDEX_SCHEMA_VERSION,
-        projectionVersion: PROJECTION_VERSION,
-        view,
-        files: meta.files.map(stripPath),
-        recordCount: rows.records.length,
-        turnCount: rows.turns.length,
-        turnsStart: 0,
-        recordsBytes: Buffer.byteLength(text),
-        recordsDigest: digestOf(text),
-        projectionDigest: meta.projectionDigest,
-      };
-      await writeFile(`${manifestPath}.tmp`, `${JSON.stringify(manifest)}\n`, 'utf8');
-      await rename(`${manifestPath}.tmp`, manifestPath);
-      return manifest;
-    },
-
-    /**
-     * Reads one view, or answers `null` for every reason it cannot be trusted: no manifest, a
-     * manifest from another schema or another projection, a source file that moved, or records
-     * whose bytes do not match the digest the manifest was written with.
-     *
-     * @param {string} sessionKey
-     * @param {string} view
-     * @param {IndexFile[]} sourceFiles the files the caller just stat()ed
-     */
-    async read(sessionKey, view, sourceFiles) {
-      const dir = dirOf(sessionKey, view);
-      let manifest;
-      try {
-        manifest = JSON.parse(await readFile(join(dir, 'manifest.json'), 'utf8'));
-      } catch {
-        return null;
-      }
-      if (!manifest || typeof manifest !== 'object') return null;
-      if (manifest.schemaVersion !== INDEX_SCHEMA_VERSION) return null;
-      if (manifest.projectionVersion !== PROJECTION_VERSION) return null;
-      if (manifest.view !== view) return null;
-      if (!sameSources(manifest.files, sourceFiles)) return null;
-      let text;
-      try {
-        text = await readFile(join(dir, 'records.jsonl'), 'utf8');
-      } catch {
-        return null;
-      }
-      const rows = parseIndex(text, manifest);
-      if (rows === null) return null;
-      return { manifest, ...rows };
-    },
-
-    /**
-     * @param {string} sessionKey
-     * @param {string} view
-     */
-    async discard(sessionKey, view) {
-      await rm(dirOf(sessionKey, view), { recursive: true, force: true });
-    },
-
-    dirOf,
-  };
-}
-
-/**
- * Whether the source a stored index was built from is still the source on disk.
- *
- * Identity is per file: the same names, in the same order, each with the same generation and the
- * same byte length. `revision` is the runtime's own sha256 when the catalog carries one, and it is
- * compared when both sides have it — that catches a rewrite which happened to preserve the length,
- * which a length check alone cannot. Mtime is deliberately NOT compared: it moves when the file is
- * touched without being written, and a reader that treated that as a change would rebuild a
- * correct index for nothing on every poll.
- *
- * @param {IndexFile[]} stored
- * @param {IndexFile[]} live
- */
-export function sameSources(stored, live) {
-  if (!Array.isArray(stored) || !Array.isArray(live)) return false;
-  if (stored.length !== live.length) return false;
-  for (let i = 0; i < stored.length; i += 1) {
-    const a = stored[i];
-    const b = live[i];
-    if (!a || !b) return false;
-    if (a.fileName !== b.fileName) return false;
-    if (a.generation !== b.generation) return false;
-    if (a.size !== b.size) return false;
-    // A generation that was read short is not the same answer as one that was read whole, even
-    // though both report the same `size`. Compared as booleans so an artifact written before this
-    // field existed is rejected once and rebuilt, rather than trusted.
-    if ((a.truncated === true) !== (b.truncated === true)) return false;
-    if (typeof a.revision === 'string' && a.revision.length > 0
-      && typeof b.revision === 'string' && b.revision.length > 0 && a.revision !== b.revision) {
-      return false;
-    }
-  }
-  return true;
-}
-
-/**
- * What every served answer has to reproduce, reduced to one comparable value.
- *
- * The index is allowed to be a different shape from the payload — that is the point of it. It is
- * not allowed to be a different ANSWER, and this is how that is checked rather than asserted.
- *
- * @param {{ stats: Record<string, any>, session: Record<string, any> }} payload
- * @returns {string}
- */
-export function projectionDigestOf(payload) {
-  return digestOf(JSON.stringify({
-    stats: payload.stats,
-    session: {
-      messageCount: payload.session.messageCount,
-      turnCount: payload.session.turnCount,
-      startedAt: payload.session.startedAt,
-      generation: payload.session.generation,
-    },
-  }));
-}
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-locator-rows.py b/plugins/avatasia/mmc-trajectory/tests/mutate-locator-rows.py
new file mode 100644
index 0000000..5ca3602
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-locator-rows.py
@@ -0,0 +1,169 @@
+"""Mutation control for the locator projection.
+
+`verify-locator-rows.mjs` states one property per case, and each mutation here breaks exactly one
+of them in the shipped module. The cases that are easy to get wrong are all about **file 0**:
+
+  - A record whose line was never located is repaired to the first source file. Nothing else about
+    the answer changes — the record is still there, still searchable, still carries a byte range
+    if it had one — so this is invisible until someone maps a hit back to the wrong generation.
+    `buildSegment` cannot catch it: it faithfully carries whatever `fileIdx` it is handed, so the
+    122 segment assertions stay green.
+  - The same repair reached by the other route: the locator names a file that is not in the table
+    (a source that moved) and gets filed under the first entry instead.
+  - Two generations that hold a file of the same name are matched by basename rather than by full
+    path, which files one generation's records under the other.
+
+The fourth takes the byte range away, because a locator that answers "which file" but not "where
+in it" cannot map a hit back to a line — and the surface still looks complete, so nothing reports
+it.
+
+Each mutation must be caught *by name*. A probe that dies on an exception names nothing, and a
+control that reports that as caught is reporting a crash as if it were evidence.
+"""
+import subprocess
+import sys
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parent
+MODULE = ROOT / "miniapp" / "node" / "search-segments.mjs"
+PROBE = HERE / "verify-locator-rows.mjs"
+
+UNLOCATED = """      out.push(locator === undefined
+        ? { fileIdx: -1, byteStart: -1, byteEnd: -1 }
+        : {"""
+UNLOCATED_REPAIRED = """      out.push(locator === undefined
+        ? { fileIdx: 0, byteStart: 0, byteEnd: 0 }
+        : {"""
+
+MOVED_SOURCE = "          fileIdx: pathToFileIdx.get(locator.filePath) ?? -1,"
+MOVED_REPAIRED = "          fileIdx: pathToFileIdx.get(locator.filePath) ?? 0,"
+
+FULL_PATH = """    if (typeof file.filePath === 'string' && !pathToFileIdx.has(file.filePath)) {
+      pathToFileIdx.set(file.filePath, i);
+    }"""
+BASENAME = """    if (typeof file.fileName === 'string' && !pathToFileIdx.has(file.fileName)) {
+      pathToFileIdx.set(file.fileName, i);
+    }"""
+
+BYTES = """          byteStart: locator.start,
+          byteEnd: locator.end"""
+BYTES_DROPPED = """          byteStart: -1,
+          byteEnd: -1"""
+
+MUTATIONS = [
+    (
+        "a record with no locator is repaired to the first file instead of -1",
+        UNLOCATED,
+        UNLOCATED_REPAIRED,
+    ),
+    (
+        "a locator whose file moved is filed under the first file instead of -1",
+        MOVED_SOURCE,
+        MOVED_REPAIRED,
+    ),
+    (
+        "two generations holding the same file name are matched by basename",
+        FULL_PATH,
+        BASENAME,
+    ),
+    (
+        "the byte range is dropped, so a hit cannot be mapped back to its line",
+        BYTES,
+        BYTES_DROPPED,
+    ),
+]
+
+
+def read_exact(path):
+    """Normalise to LF for matching, and report the file's own newline so it can be put back."""
+    data = path.read_bytes()
+    text = data.decode("utf-8").replace("\r\n", "\n")
+    return text, ("\r\n" if b"\r\n" in data else "\n")
+
+
+def write_exact(path, text, newline):
+    if newline == "\r\n":
+        text = text.replace("\n", "\r\n")
+    path.write_bytes(text.encode("utf-8"))
+
+
+def run_probe():
+    proc = subprocess.run(
+        ["node", str(PROBE)],
+        cwd=str(ROOT),
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+    )
+    return proc.returncode, (proc.stdout or "") + (proc.stderr or "")
+
+
+def named_failure(output):
+    """The first rule the probe named, or None when it failed without naming one."""
+    return next(
+        (line.strip()[len("FAIL"):].strip() for line in output.splitlines()
+         if line.strip().startswith("FAIL")),
+        None,
+    )
+
+
+def main():
+    code, output = run_probe()
+    if code != 0:
+        print("baseline probe does not pass; fix that first")
+        print(output)
+        return 1
+    print("baseline clean")
+
+    original = MODULE.read_bytes()
+    missed = []
+    unnamed = []
+    for label, old, new in MUTATIONS:
+        text, newline = read_exact(MODULE)
+        if old not in text:
+            print(f"SKIP  {label}: anchor not found")
+            missed.append(label)
+            continue
+        if text.count(old) != 1:
+            print(f"SKIP  {label}: anchor is not unique ({text.count(old)} matches)")
+            missed.append(label)
+            continue
+        if old == new:
+            print(f"SKIP  {label}: the mutation changes nothing")
+            missed.append(label)
+            continue
+        write_exact(MODULE, text.replace(old, new, 1), newline)
+        try:
+            code, output = run_probe()
+        finally:
+            MODULE.write_bytes(original)
+        if code == 0:
+            print(f"MISSED {label}: the probe still passed")
+            missed.append(label)
+            continue
+        name = named_failure(output)
+        if name is None:
+            print(f"UNNAMED {label}: the probe failed without naming a rule")
+            unnamed.append(label)
+        else:
+            print(f"caught {label}\n         -> {name.splitlines()[0]}")
+
+    if MODULE.read_bytes() != original:
+        print(f"NOT RESTORED {MODULE}")
+        return 1
+    print("file restored byte-for-byte")
+
+    if missed or unnamed:
+        if missed:
+            print(f"\n{len(missed)} mutation(s) got through")
+        if unnamed:
+            print(f"{len(unnamed)} mutation(s) failed without naming a rule")
+        return 1
+    print(f"\nall {len(MUTATIONS)} mutations caught, each by name")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-search-endpoint.py b/plugins/avatasia/mmc-trajectory/tests/mutate-search-endpoint.py
index 90e4391..53959d5 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-search-endpoint.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-search-endpoint.py
@@ -160,6 +160,16 @@
         "        if (hit === null) return null;",
         "        if (hit === null) continue;",
     ),
+    (
+        # The shape that was removed: a second store under the artifact root, filled on every
+        # publish, read by nothing — 8.6 MB a session a view on disk. Rebuilt here from live code
+        # rather than by re-adding the deleted module, so the mutation is a regression someone could
+        # actually write instead of a revert. It trips both halves of the rule: the store's name and
+        # the second directory it makes.
+        "a second artifact store is written beside the segments, and nothing reads it",
+        "      const segment = buildSegment({ records });\n      await segmentStore.write(sessionKey, viewKey, generationKeyValue, segment, {\n        generation,\n        source: [files[fileIdx]],\n      });",
+        "      const segment = buildSegment({ records });\n      await segmentStore.write(sessionKey, viewKey, generationKeyValue, segment, {\n        generation,\n        source: [files[fileIdx]],\n      });\n      const indexStore = createSegmentStore(join(artifactRoot, 'index'));\n      await indexStore.write(sessionKey, viewKey, generationKeyValue, segment, {\n        generation,\n        source: [files[fileIdx]],\n      });",
+    ),
 ]
 
 
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-index.py b/plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-index.py
deleted file mode 100644
index 7b5e5ad..0000000
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-trajectory-index.py
+++ /dev/null
@@ -1,190 +0,0 @@
-"""Mutation control for verify-trajectory-index.mjs.
-
-Each mutation reintroduces exactly one bug the probe is supposed to catch. The probe must FAIL
-every time, and the file must come back byte-for-byte identical afterwards. A mutation that the
-probe still passes means the assertion was tautological; a mutation whose anchor no longer exists
-means the assertion went dead, which is worse — the runner reports those as misses too.
-
-The groups are ordered by what they protect: a wrong ANSWER first, a half-written artifact second,
-and the ways the index would quietly stop being equivalent to the payload last.
-"""
-import subprocess
-import sys
-from pathlib import Path
-
-HERE = Path(__file__).resolve().parent
-ROOT = HERE.parent
-MODULE = ROOT / "miniapp" / "node" / "trajectory-index.mjs"
-PROBE = HERE / "verify-trajectory-index.mjs"
-
-MUTATIONS = [
-    # ---- the answer has to be the payload's answer -------------------------------------
-    (
-        "a record is matched to its file by name instead of by path, so every record loses its file",
-        "    if (typeof file.filePath === 'string' && !pathToFileIdx.has(file.filePath)) {\n      pathToFileIdx.set(file.filePath, i);\n    }",
-        "    if (typeof file.fileName === 'string' && !pathToFileIdx.has(file.fileName)) {\n      pathToFileIdx.set(file.fileName, i);\n    }",
-    ),
-    (
-        "a missing locator is repaired to file 0 instead of admitting it has none",
-        "      const fileIdx = locator === undefined ? -1 : (pathToFileIdx.get(locator.filePath) ?? -1);",
-        "      const fileIdx = locator === undefined ? 0 : (pathToFileIdx.get(locator.filePath) ?? -1);",
-    ),
-    (
-        "a missing locator is given the line's start instead of admitting it has none",
-        "      line.byteStart = locator === undefined ? -1 : locator.start;",
-        "      line.byteStart = locator === undefined ? 0 : locator.start;",
-    ),
-    (
-        "the projected text fields are carried after all, putting the bulk back into the file",
-        "        if (EXCLUDED_RECORD_FIELDS.has(key)) continue;\n",
-        "",
-    ),
-    (
-        "a turn is served whole even when the window holds only part of it",
-        "    out.push({ turn, records: [Math.max(start, range.from), Math.min(end, range.to)] });",
-        "    out.push({ turn, records: [start, end] });",
-    ),
-    (
-        "a turn the window only touches is dropped, so its header goes with it",
-        "    if (end < range.from || start > range.to) continue;",
-        "    if (end < range.from || start > range.to || true) continue;",
-    ),
-    (
-        "the window ceiling is dropped, so one request can ask for the whole lineage",
-        "  const limit = Math.min(\n    typeof request.limit === 'number' && request.limit > 0 ? request.limit : MAX_WINDOW_RECORDS,\n    MAX_WINDOW_RECORDS,\n  );",
-        "  const limit = typeof request.limit === 'number' && request.limit > 0 ? request.limit : MAX_WINDOW_RECORDS;",
-    ),
-    (
-        "the timestamp side array is replaced by the records' own order, so a range bisects the primary key",
-        "  timedPositions.sort((a, b) => {\n    const delta = records[a].timestamp - records[b].timestamp;\n    return delta === 0 ? a - b : delta;\n  });",
-        "  timedPositions.sort((a, b) => a - b);",
-    ),
-    (
-        "a record with no id joins the shared empty group",
-        "    if (typeof record.id === 'string' && record.id.length > 0) {\n      const existing = byMessageId.get(record.id);\n      if (existing === undefined) byMessageId.set(record.id, [i]);\n      else existing.push(i);\n    }",
-        "    const groupKey = typeof record.id === 'string' ? record.id : 'unkeyed';\n    {\n      const existing = byMessageId.get(groupKey);\n      if (existing === undefined) byMessageId.set(groupKey, [i]);\n      else existing.push(i);\n    }",
-    ),
-    # ---- a half-written artifact is never consumed --------------------------------------
-    (
-        "the manifest is published before the records it describes",
-        "      await rename(`${recordPath}.tmp`, recordPath);",
-        "      await rename(`${manifestPath}.tmp`, manifestPath);",
-    ),
-    (
-        "the manifest keeps the machine path it was handed",
-        "        files: meta.files.map(stripPath),",
-        "        files: meta.files,",
-    ),
-    (
-        "the records are accepted at whatever length they happen to be",
-        "  if (lines.length !== manifest.turnCount + manifest.recordCount) return null;",
-        "",
-    ),
-    (
-        "a manifest from another schema version is served anyway",
-        "    if (manifest.schemaVersion !== INDEX_SCHEMA_VERSION) return null;",
-        "",
-    ),
-    (
-        "a manifest from another projection version is served anyway",
-        "    if (manifest.projectionVersion !== PROJECTION_VERSION) return null;",
-        "",
-    ),
-    # ---- the source identity that decides reuse -----------------------------------------
-    (
-        "the runtime's own revision stops being compared, so a rewrite that kept the length is reused",
-        "    if (typeof a.revision === 'string' && a.revision.length > 0\n      && typeof b.revision === 'string' && b.revision.length > 0 && a.revision !== b.revision) {\n      return false;\n    }\n",
-        "",
-    ),
-    (
-        "the file name stops being compared, so a replaced source answers from the old index",
-        "    if (a.fileName !== b.fileName) return false;",
-        "",
-    ),
-    (
-        "a touched-but-unchanged source invalidates the index on every poll",
-        "    if (a.size !== b.size) return false;",
-        "    if (a.size !== b.size) return false;\n    if (a.mtimeMs !== b.mtimeMs) return false;",
-    ),
-    (
-        # `size` is the whole file whether or not the read covered it, so this is the only thing
-        # telling a generation that was read short from one that was read whole. Without it the
-        # index built from a truncated generation is served as if it held every record, and a
-        # search over it reports fewer matches than there are — quietly.
-        "a source that was read short is trusted as if it had been read whole",
-        "    if ((a.truncated === true) !== (b.truncated === true)) return false;\n    if (typeof a.revision === 'string' && a.revision.length > 0",
-        "    if (typeof a.revision === 'string' && a.revision.length > 0",
-    ),
-]
-
-
-def read_exact(path):
-    """Normalise to LF for matching, and report the file's own newline so it can be put back."""
-    data = path.read_bytes()
-    text = data.decode("utf-8").replace("\r\n", "\n")
-    return text, ("\r\n" if b"\r\n" in data else "\n")
-
-
-def write_exact(path, text, newline):
-    if newline == "\r\n":
-        text = text.replace("\n", "\r\n")
-    path.write_bytes(text.encode("utf-8"))
-
-
-def run_probe():
-    proc = subprocess.run(
-        ["node", str(PROBE)],
-        cwd=str(ROOT),
-        capture_output=True,
-        text=True,
-        encoding="utf-8",
-        errors="replace",
-    )
-    return proc.returncode, (proc.stdout or "") + (proc.stderr or "")
-
-
-def main():
-    code, output = run_probe()
-    if code != 0:
-        print("baseline probe does not pass; fix that first")
-        print(output)
-        return 1
-    print("baseline clean")
-
-    original = MODULE.read_bytes()
-    missed = []
-    for label, old, new in MUTATIONS:
-        text, newline = read_exact(MODULE)
-        if old not in text:
-            print(f"SKIP  {label}: anchor not found")
-            missed.append(label)
-            continue
-        write_exact(MODULE, text.replace(old, new, 1), newline)
-        try:
-            code, output = run_probe()
-        finally:
-            MODULE.write_bytes(original)
-        if code == 0:
-            print(f"MISSED {label}: the probe still passed")
-            missed.append(label)
-        else:
-            first = next(
-                (line.strip() for line in output.splitlines() if line.strip().startswith("- ")),
-                "(no detail)",
-            )
-            print(f"caught {label}\n         -> {first}")
-
-    if MODULE.read_bytes() != original:
-        print(f"NOT RESTORED {MODULE}")
-        return 1
-    print("file restored byte-for-byte")
-
-    if missed:
-        print(f"\n{len(missed)} mutation(s) got through")
-        return 1
-    print(f"\nall {len(MUTATIONS)} mutations caught")
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())
diff --git a/plugins/avatasia/mmc-trajectory/tests/run.mjs b/plugins/avatasia/mmc-trajectory/tests/run.mjs
index b66cd53..90fc88e 100644
--- a/plugins/avatasia/mmc-trajectory/tests/run.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/run.mjs
@@ -44,7 +44,6 @@ const filter = args.find((a) => !a.startsWith('--')) ?? '';
 const SHIPPED = [
   'miniapp/client/index.html',
   'miniapp/node/server.mjs',
-  'miniapp/node/trajectory-index.mjs',
   'miniapp/node/search-segments.mjs',
   'tests/make-fixtures.mjs',
   'tests/client-check.mjs',
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-locator-rows.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-locator-rows.mjs
new file mode 100644
index 0000000..01acd02
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-locator-rows.mjs
@@ -0,0 +1,142 @@
+/**
+ * Where each record sat in the file it came from.
+ *
+ * `locatorRowsFromPayload` produces the locator triple that a segment line carries in its JSON
+ * prefix, so a search hit in a sealed generation can be mapped back to the line it came from long
+ * after the row objects that knew that have stopped existing. It used to be `indexRowsFromPayload`
+ * in a module called `trajectory-index`, returning a whole index row per record so the index
+ * artifact could be written; nothing ever read that artifact back, so the extra shape was built on
+ * every publish and read by one caller that wanted three of those fields.
+ *
+ * The case this file exists for is the one the other end cannot cover. `verify-search-segments.mjs`
+ * asserts that a record carrying **no locator fields at all** is serialised with `-1/-1/-1` — but
+ * that is `buildSegment` normalising an empty input, and it never calls this projection. If the
+ * projection repaired an unlocated record to file `0`, `buildSegment` would faithfully carry that
+ * `0` out into the segment and every one of those 122 assertions would still pass. The server
+ * groups records by `located.fileIdx === fileIdx`, so a record silently filed under the first
+ * source file is a record answered from a different generation's message.
+ *
+ * Which is why the `-1` assertions here are about **the projection**, not about the segment, and
+ * why they moved here with the function rather than being assumed to already exist downstream.
+ *
+ * Read-only, pure: the projection has no I/O and this file writes nothing.
+ * `mutate-locator-rows.py` breaks each of these in the shipped module.
+ */
+import { locatorRowsFromPayload } from '../miniapp/node/search-segments.mjs';
+
+let pass = 0;
+const failures = [];
+function check(name, actual, expected) {
+  const ok = JSON.stringify(actual) === JSON.stringify(expected);
+  if (ok) pass += 1;
+  else failures.push(`${name}\n      got  ${JSON.stringify(actual)}\n      want ${JSON.stringify(expected)}`);
+}
+function assert(name, cond) {
+  if (cond) pass += 1;
+  else failures.push(name);
+}
+
+/* ------------------------------------------------------------------ fixtures */
+/* `index` is the only field the projection reads off a record, so a record is one number here. */
+const payloadOf = (indexes) => ({
+  turns: indexes.map((indexesInTurn, t) => ({
+    index: t + 1,
+    records: indexesInTurn.map((index) => ({ index }))
+  }))
+});
+const FLAT = [1, 2, 3, 4, 5, 6];
+const PAYLOAD = payloadOf([FLAT.slice(0, 3), FLAT.slice(3)]);
+
+/* Two generations, deliberately named so a basename match would confuse them: both files are
+ * called `messages.jsonl`, because that is exactly how a lineage lays out. */
+const FILES = [
+  { filePath: '/store/s/snapshots/g0/messages.jsonl', fileName: 'messages.jsonl', generation: 0 },
+  { filePath: '/store/s/active/messages.jsonl', fileName: 'messages.jsonl', generation: 1 }
+];
+const loc = (filePath, start, end) => ({ filePath, start, end, digest: 'd' });
+
+const rawsOf = (entries) => new Map(entries.map(([index, locator]) => [index, locator]));
+
+/* Everything in the first file except the last record, which is in the second. Byte 0 is a real
+ * position here on purpose: `-1` has to stay distinguishable from it. */
+const raws = rawsOf([
+  [1, loc(FILES[0].filePath, 0, 120)],
+  [2, loc(FILES[0].filePath, 121, 260)],
+  [3, loc(FILES[0].filePath, 261, 400)],
+  [4, loc(FILES[1].filePath, 0, 90)],
+  [5, loc(FILES[1].filePath, 91, 200)],
+  [6, loc(FILES[1].filePath, 201, 340)]
+]);
+const rows = locatorRowsFromPayload(PAYLOAD, raws, FILES);
+
+/* ------------------------------------------------------------------ order and shape */
+check('one entry per record, in the order the payload is walked',
+  rows.length, FLAT.length);
+assert('and the order is the payload\'s, not sorted by file or byte',
+  rows.map((r) => r.byteStart).join(',') !== '0,0,0,121,201,261');
+check('every entry carries exactly the locator triple',
+  Object.keys(rows[0]).sort(), ['byteEnd', 'byteStart', 'fileIdx']);
+
+check('each record names the file its locator names',
+  rows.map((r) => r.fileIdx), [0, 0, 0, 1, 1, 1]);
+check('each record carries where its line sat',
+  rows.map((r) => r.byteStart), [0, 121, 261, 0, 91, 201]);
+check('and where it ended',
+  rows.map((r) => r.byteEnd), [120, 260, 400, 90, 200, 340]);
+
+/* Byte 0 is a position a record really can have, so `-1` cannot be confused with it. */
+assert('byte 0 is a real position in this fixture, so -1 is distinguishable from it',
+  rows[0].byteStart === 0 && rows[3].byteStart === 0);
+
+/* Two generations both hold a `messages.jsonl`. A basename match would file the second
+ * generation's records under the first, which is a different generation's message. */
+assert('the two source files really do share a basename',
+  FILES[0].fileName === FILES[1].fileName);
+
+/* ------------------------------------------------- a record whose line was never located */
+/* The full map minus ONE entry, so exactly one record is unlocated. Building a sparse map by hand
+ * instead would leave three records unlocated and the "exactly one" assertions below would be
+ * measuring the fixture rather than the projection. */
+const partialRaws = rawsOf([...raws].filter(([index]) => index !== 3));
+const partial = locatorRowsFromPayload(PAYLOAD, partialRaws, FILES);
+
+check('a record with no locator says file -1', partial[2].fileIdx, -1);
+check('and its neighbours keep theirs', [partial[1].fileIdx, partial[3].fileIdx], [0, 1]);
+check('no record silently became file 0', partial.filter((r) => r.fileIdx === -1).length, 1);
+check('a record with no locator has no line position either',
+  [partial[2].byteStart, partial[2].byteEnd], [-1, -1]);
+
+/* The same question asked of the OTHER kind of "no location": the locator exists but names a file
+ * that is not in the table. That is a source that moved, and it must not be filed under file 0
+ * either — the two cases reach file 0 by different routes and both would answer from the wrong
+ * generation. */
+const movedRaws = rawsOf([
+  [1, loc('/store/s/snapshots/g0/messages.jsonl', 0, 120)],
+  [2, loc('/store/s/elsewhere/gone.jsonl', 10, 20)]
+]);
+const moved = locatorRowsFromPayload(PAYLOAD, movedRaws, FILES);
+check('a locator whose file is not in the table says file -1, not file 0', moved[1].fileIdx, -1);
+check('but it keeps the byte range it was handed',
+  [moved[1].byteStart, moved[1].byteEnd], [10, 20]);
+
+/* ------------------------------------------------------------------ empty and odd inputs */
+check('a payload with no records projects to nothing',
+  locatorRowsFromPayload(payloadOf([]), new Map(), FILES).length, 0);
+check('an empty locator map leaves every record unlocated, not every record in file 0',
+  locatorRowsFromPayload(PAYLOAD, new Map(), FILES).map((r) => r.fileIdx), [-1, -1, -1, -1, -1, -1]);
+check('no source files at all is the same as no location',
+  locatorRowsFromPayload(PAYLOAD, raws, []).map((r) => r.fileIdx), [-1, -1, -1, -1, -1, -1]);
+
+/* First writer wins: a path is only in the table once per session, and a duplicated path must not
+ * make the second entry reachable in a way that depends on iteration order. */
+const dupFiles = [FILES[0], { filePath: FILES[0].filePath, fileName: 'copy', generation: 9 }];
+check('a path listed twice still resolves to the first file that claimed it',
+  locatorRowsFromPayload(PAYLOAD, raws, dupFiles).map((r) => r.fileIdx), [0, 0, 0, -1, -1, -1]);
+
+/* ---------------------------------------------------------------------- report */
+console.log('locator-rows: ' + pass + ' passed, ' + failures.length + ' failed');
+if (failures.length) {
+  for (const f of failures) console.log('FAIL  ' + f);
+  process.exit(1);
+}
+console.log('ALL CHECKS PASSED');
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs
index 6958fb0..0b77fc9 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs
@@ -51,7 +51,6 @@ const SHIPPED_TEXT = {
   'README.zh-CN.md': readmeZh,
   'miniapp/client/index.html': clientHtml,
   'miniapp/node/server.mjs': serverJs,
-  'miniapp/node/trajectory-index.mjs': read('miniapp/node/trajectory-index.mjs'),
   'miniapp/node/search-segments.mjs': read('miniapp/node/search-segments.mjs'),
   'tests/make-fixtures.mjs': read('tests/make-fixtures.mjs'),
   'tests/client-check.mjs': read('tests/client-check.mjs'),
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs
index 5d0ef01..58cb518 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs
@@ -35,8 +35,7 @@ import {
   splitRawRecords,
   ROW_GENERATION,
 } from '../miniapp/node/server.mjs';
-import { indexRowsFromPayload } from '../miniapp/node/trajectory-index.mjs';
-import { buildSegment, readSegmentHits, scanSegment } from '../miniapp/node/search-segments.mjs';
+import { buildSegment, locatorRowsFromPayload, readSegmentHits, scanSegment } from '../miniapp/node/search-segments.mjs';
 
 const SERVER = readFileSync(new URL('../miniapp/node/server.mjs', import.meta.url), 'utf8');
 const CLIENT = readFileSync(new URL('../miniapp/client/index.html', import.meta.url), 'utf8');
@@ -361,28 +360,27 @@ const ARTIFACT_FILES = [
   { filePath: '/store/s/g0.jsonl', fileName: 'g0.jsonl', generation: 0, size: 300, mtimeMs: 1, revision: 'r0', truncated: false },
   { filePath: '/store/s/g1.jsonl', fileName: 'g1.jsonl', generation: 1, size: 500, mtimeMs: 1, revision: 'r1', truncated: false },
 ];
-// `indexRowsFromPayload` wants the record -> locator map, not the record -> row map the split
+// `locatorRowsFromPayload` wants the record -> locator map, not the record -> row map the split
 // produces; the server builds it the same way before handing it over. Getting this wrong leaves
-// every record with `fileIdx: -1`, which is an index that still has the right records in it and
-// would answer with none.
+// every record at `-1`, which is a locator set with no file in it and would answer with no line.
 const rowIndexByRecord = splitRawRecords(allPayload.turns);
 const rowLocators = occurrences.map((o) => o.locator);
 const locatorByRecord = new Map();
 for (const [recordIndex, rowIndex] of rowIndexByRecord) {
   locatorByRecord.set(recordIndex, rowLocators[rowIndex]);
 }
-const indexRows = indexRowsFromPayload(allPayload, locatorByRecord, ARTIFACT_FILES);
+const locatorRows = locatorRowsFromPayload(allPayload, locatorByRecord, ARTIFACT_FILES);
 const flatPairs = [];
 for (const turn of allPayload.turns) for (const record of turn.records) flatPairs.push({ record, turn });
 // The same merge the server does: the surface is built from the PAYLOAD's records and only the
-// locator fields come from the index. Building it from the index alone searches two of the five
-// fields — `text`, `result` and `thinking` are excluded from the index on purpose — and that was a
-// real bug this comparison did not catch, so it is now pinned directly rather than left to a
-// needle that happens to match.
+// locator triple comes from the projection. Building it from anything else searches two of the five
+// fields — `text`, `result` and `thinking` are the bulk ones — and that was a real bug this
+// comparison did not catch, so it is now pinned directly rather than left to a needle that
+// happens to match.
 const segmentRecordsFor = (fileIdx) => {
   const out = [];
   for (let i = 0; i < flatPairs.length; i += 1) {
-    const located = indexRows.records[i];
+    const located = locatorRows[i];
     if (located === undefined || located.fileIdx !== fileIdx) continue;
     out.push({
       ...flatPairs[i].record,
@@ -424,10 +422,10 @@ const withLimit = (n) => {
   return out;
 };
 
-check('the index kept every record the rebuild would have shown',
-  indexRows.records.length, allRecords.length);
+check('the locator projection kept every record the rebuild would have shown',
+  locatorRows.length, allRecords.length);
 assert('and it kept the generation each record came from',
-  new Set(indexRows.records.map((r) => r.fileIdx)).size === ARTIFACT_FILES.length);
+  new Set(locatorRows.map((r) => r.fileIdx)).size === ARTIFACT_FILES.length);
 
 // The direct version of the bug: a segment's line for a record must contain that record's own
 // searchable text, in every field the endpoint searches. Read from the shipped server's own merge,
@@ -435,9 +433,9 @@ assert('and it kept the generation each record came from',
 const bulkOnly = allRecords.find((r) => typeof r.result === 'string' && r.result.length > 0);
 assert('the fixture really does hold a record whose match is only in a bulk field', bulkOnly !== undefined);
 if (bulkOnly !== undefined) {
-  const located = indexRows.records[flatPairs.findIndex((pair) => pair.record === bulkOnly)];
+  const located = locatorRows[flatPairs.findIndex((pair) => pair.record === bulkOnly)];
   const line = buildSegment({ records: [{ ...bulkOnly, fileIdx: located.fileIdx, byteStart: 0, byteEnd: 1 }] }).surface;
-  assert('and the segment carries that field, though the index does not',
+  assert('and the segment carries that field, though the projection does not',
     !Object.prototype.hasOwnProperty.call(located, 'result') && line.includes(normaliseWhitespace(bulkOnly.result)));
   assert('the shipped server merges the payload into the segment for the same reason',
     /flatRecords\.push\(\{ record, turn \}\)/.test(SERVER)
@@ -478,8 +476,7 @@ check('while the ordinals the scan really returns do read back',
 /* ---------------------------------------------------------------------
  * A generation read short by our own cap produces a segment covering a
  * PREFIX, while its recorded `size` is the whole file. That rule is owned
- * where the comparison lives — verify-search-segments.mjs for `sameSource`
- * and verify-trajectory-index.mjs for `sameSources` — and is deliberately
+ * where the comparison lives — verify-search-segments.mjs for `sameSource` — and is deliberately
  * NOT restated here: an assertion parked in a guard whose mutation control
  * never touches it reads as covered without being covered.
  * --------------------------------------------------------------------- */
@@ -521,10 +518,29 @@ assert('the shipped artifact path resolves a whole scan in one batch call',
 assert('a hit the scan named but the reader could not resolve falls back rather than being skipped',
   /if \(hit === null\) return null;/.test(artifactsSrc));
 // And the index is not consulted at all — reading it was the 34.2 MB this step took off the path.
-// Scoped to this path, because `indexStore.write` still exists for a different reason (see the
-// defect list: nothing reads what it writes).
-assert('and this path reads no record index at all',
-  !/indexStore\.read\(|collectSearchHitsFromArtifacts/.test(SERVER));
+// This used to be scoped to "this path", because a store was still being *written* under the same
+// name for a different reason. Nothing is written either now, so the rule is stated as what it is
+// actually about: the whole server has no record index, in any form, and the module that built
+// one is gone. A narrower version of this assertion would pass on a server that had reintroduced
+// the index under a different name, which is the thing worth ruling out.
+//
+// Comments are stripped first. The server explains where the index went, and an explanation that
+// named it would otherwise fail the rule that says there is none — so documenting the removal would
+// have been the one way guaranteed to break this, and the incentive would have been to write
+// nothing. `//` by whole line, because a `//` inside a string is a URL in this file.
+const serverCode = SERVER
+  .replace(/\/\*[\s\S]*?\*\//g, ' ')
+  .replace(/^\s*\/\/.*$/gm, ' ');
+assert('and the server holds no record index at all, in any form',
+  !/indexStore|trajectory-index|collectSearchHitsFromArtifacts/.test(serverCode));
+// The three names above are a list, and a list only catches what is on it: a store rebuilt under a
+// fresh name would pass. The on-disk shape is not a name, though — the removed store's whole cost
+// was that it made a second directory under the artifact root and filled it on every publish, so
+// the property worth stating is that there IS no second directory. Segments are the only artifact;
+// the root holds exactly one subdirectory and it is the one they live in.
+const artifactDirs = [...serverCode.matchAll(/join\(\s*artifactRoot\s*,\s*'([^']+)'\s*\)/g)].map((m) => m[1]);
+assert('and the artifact root holds segments and nothing else',
+  artifactDirs.length === 1 && artifactDirs[0] === 'search');
 // Two paths answering one request is only a performance change if they answer it identically,
 // and the response body is part of the answer the page reads.
 check('both paths send the same session field',
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-trajectory-index.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-trajectory-index.mjs
deleted file mode 100644
index 65e5f4b..0000000
--- a/plugins/avatasia/mmc-trajectory/tests/verify-trajectory-index.mjs
+++ /dev/null
@@ -1,551 +0,0 @@
-/**
- * The index has to be the same answer as the payload it was built from, or it is a second opinion.
- *
- * `trajectory-index.mjs` exists so that reading a window, counting a kind or brushing a time range
- * stops costing a re-parse of every generation a session has stored. It can only be allowed to do
- * that if what it serves is what the full build would have served — so most of this file builds a
- * real payload through `buildTrajectoryPayload`, indexes it, and compares the two field by field.
- *
- * The cases that are easy to get wrong, and are therefore pinned here:
- *
- *  1. A record's every carried field survives the round trip, and the six excluded ones are the six
- *     that were meant to go. A field quietly dropped is a row that renders blank.
- *  2. A window at EVERY boundary equals the corresponding slice of the full payload, including the
- *     turns that the range only partly covers — a cut turn would print a header about rows the
- *     reader cannot see.
- *  3. Timestamps are not monotonic, so a time range is answered from the side array and equals a
- *     brute-force filter. The control group is the point: it shows that bisecting the primary key
- *     order would have MISSED rows, which is why the side array exists at all.
- *  4. A half-written pair of files is never consumed: no manifest, a digest that disagrees, a
- *     schema from another version, a source that moved — each answers "no index", not "some index".
- *  5. No machine path is written into the artifact, so the file is meaningless outside its session
- *     rather than a pointer into somebody's home directory.
- *
- * Read-only: imports the pure helpers and writes only under a temp dir it makes itself.
- * mutate-trajectory-index.py breaks each of these in the shipped module.
- */
-import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { buildTrajectoryPayload, ROW_GENERATION } from '../miniapp/node/server.mjs';
-import {
-  MAX_WINDOW_RECORDS,
-  buildSecondary,
-  createIndexStore,
-  digestOf,
-  indexRowsFromPayload,
-  parseIndex,
-  projectionDigestOf,
-  recordsInTimeRange,
-  resolveWindow,
-  sameSources,
-  serializeIndex,
-  windowTurns,
-} from '../miniapp/node/trajectory-index.mjs';
-
-const INDEX_PATH = new URL('../miniapp/node/trajectory-index.mjs', import.meta.url);
-
-let pass = 0;
-const failures = [];
-function check(name, actual, expected) {
-  if (JSON.stringify(actual) === JSON.stringify(expected)) pass += 1;
-  else failures.push(`${name}: got ${JSON.stringify(actual)}, want ${JSON.stringify(expected)}`);
-}
-function assert(name, cond) {
-  if (cond) pass += 1;
-  else failures.push(name);
-}
-
-/* =====================================================================
- * A payload built the way the route builds one, from rows that exercise the shapes
- * ===================================================================== */
-
-/** @param {string} id */
-const message = (id, role, extra) => ({ message_id: id, role, ...extra });
-
-const rawRows = [
-  { message_id: 'u1', turn_id: 't1', message: message('u1', 'user', { content: 'first question', timestamp: 1000 }) },
-  {
-    message_id: 'a1',
-    turn_id: 't1',
-    message: message('a1', 'assistant', {
-      timestamp: 1100,
-      stopReason: 'stop',
-      model: 'm',
-      provider: 'p',
-      api: 'a',
-      content: [
-        { type: 'thinking', thinking: 'weighing it' },
-        { type: 'text', text: 'the answer' },
-        { type: 'toolCall', id: 'c1', name: 'read', arguments: { path: 'x' } },
-        { type: 'toolCall', id: 'c2', name: 'grep', arguments: { q: 'y' } },
-      ],
-    }),
-  },
-  { message_id: 'tr1', turn_id: 't1', message: message('tr1', 'toolResult', { timestamp: 1200, toolCallId: 'c1', toolName: 'read', content: 'file body' }) },
-  // A second prompt in the same turn: a steer, decided over the lineage.
-  { message_id: 'u2', turn_id: 't1', message: message('u2', 'user', { content: 'actually do this instead', timestamp: 1300 }) },
-  { message_id: 'u3', turn_id: 't2', message: message('u3', 'user', { content: 'second question', timestamp: 2000 }) },
-  { message_id: 'a2', turn_id: 't2', message: message('a2', 'assistant', { timestamp: 2100, stopReason: 'toolUse', content: [{ type: 'text', text: 'on it' }] }) },
-  // A message with no usable id at all: unkeyed, and it must not join any group. Two of them, so
-  // that "does not join a group" is a statement about the pair and not about a lone record that
-  // happened to be alone.
-  { message_id: null, turn_id: 't2', message: message('', 'assistant', { timestamp: 2200, stopReason: 'stop', content: [{ type: 'text', text: 'unkeyed tail' }] }) },
-  { message_id: null, turn_id: 't2', message: message('', 'assistant', { timestamp: 2300, stopReason: 'stop', content: [{ type: 'text', text: 'second unkeyed tail' }] }) },
-];
-
-const generations = [{ generation: 0, fileName: 'g0.jsonl', byteLength: 10 }, { generation: 1, fileName: 'g1.jsonl', byteLength: 10 }];
-const rowsForBuild = rawRows.map((row, i) => {
-  const copy = { ...row, [ROW_GENERATION]: i < 4 ? 0 : 1 };
-  return copy;
-});
-
-const payload = buildTrajectoryPayload({
-  session: { id: 's1', createdAtMs: 2200 },
-  rows: rowsForBuild,
-  sizeBytes: 999,
-  generations,
-  generation: null,
-});
-
-/** One locator per record, in the shape the route builds for `/raw`. */
-const FILES = [
-  { fileName: 'g0.jsonl', generation: 0, size: 100, mtimeMs: 5, revision: 'sha256:' + 'a'.repeat(64), filePath: '/store/session-a/g0.jsonl' },
-  { fileName: 'g1.jsonl', generation: 1, size: 100, mtimeMs: 5, revision: 'sha256:' + 'b'.repeat(64), filePath: '/store/session-a/g1.jsonl' },
-];
-const raws = new Map();
-let byteCursor = 0;
-for (const turn of payload.turns) {
-  for (const record of turn.records) {
-    const fileIdx = record.generation === 0 ? 0 : 1;
-    raws.set(record.index, {
-      filePath: `/store/session-a/${FILES[fileIdx].fileName}`,
-      start: byteCursor,
-      end: byteCursor + 40,
-      digest: 'd' + String(record.index).padStart(3, '0'),
-    });
-    byteCursor += 40;
-  }
-}
-
-const EXCLUDED = ['text', 'thinking', 'arguments', 'result', 'error', 'rawRow'];
-const flatRecords = payload.turns.flatMap((turn) => turn.records);
-
-/* =====================================================================
- * 1 — every carried field survives the round trip, and only the excluded ones go
- * ===================================================================== */
-
-const rows = indexRowsFromPayload(payload, raws, FILES);
-const text = serializeIndex(rows);
-const manifest = {
-  schemaVersion: 1,
-  projectionVersion: 1,
-  view: 'all',
-  files: FILES,
-  recordCount: rows.records.length,
-  turnCount: rows.turns.length,
-  recordsBytes: Buffer.byteLength(text),
-  recordsDigest: digestOf(text),
-  projectionDigest: projectionDigestOf(payload),
-};
-const back = parseIndex(text, manifest);
-
-assert('the index round-trips', back !== null);
-check('the record count survives', back.records.length, flatRecords.length);
-check('the turn count survives', back.turns.length, payload.turns.length);
-
-// A file that holds more lines than its manifest claims. The digest is re-taken over the longer
-// text so this is NOT caught by the checksum: it isolates the rule that the file must hold exactly
-// what the manifest says, which is what makes a manifest from a different write unusable.
-const overlong = `${text}\n{"index":99999}`;
-const overlongManifest = { ...manifest, recordsDigest: digestOf(overlong) };
-assert('a file with a line the manifest does not claim is refused',
-  parseIndex(overlong, overlongManifest) === null);
-const truncated = text.split('\n').slice(0, -1).join('\n');
-assert('a file that is short a line is refused',
-  parseIndex(truncated, { ...manifest, recordsDigest: digestOf(truncated) }) === null);
-
-let mismatched = [];
-for (let i = 0; i < flatRecords.length; i += 1) {
-  const original = flatRecords[i];
-  const stored = back.records[i];
-  for (const key of Object.keys(original)) {
-    if (EXCLUDED.includes(key)) continue;
-    if (JSON.stringify(stored[key]) !== JSON.stringify(original[key])) {
-      mismatched.push(`${original.index}.${key}`);
-    }
-  }
-}
-check('every carried field is identical', mismatched, []);
-
-let leaked = [];
-for (const [key] of Object.entries(back.records[0])) {
-  if (EXCLUDED.includes(key)) leaked.push(key);
-}
-check('no excluded field is carried', leaked, []);
-
-let leakedHeavy = 0;
-for (const record of back.records) {
-  for (const key of ['text', 'thinking', 'arguments', 'result', 'error']) {
-    if (record[key] !== undefined) leakedHeavy += 1;
-  }
-}
-check('no heavy text field is carried anywhere', leakedHeavy, 0);
-
-// `error` becomes a flag, because a row is styled by whether there was error text.
-const withErrorFlag = back.records.filter((r) => r.hasErrorText === true);
-check('the error-text flag is a boolean', withErrorFlag.every((r) => typeof r.hasErrorText === 'boolean'), true);
-
-check('a record knows which file it came from',
-  back.records.every((r) => r.fileIdx === 0 || r.fileIdx === 1), true);
-// The line position is what a search hit in a sealed generation is mapped back through, and `-1` has
-// to stay distinguishable from byte 0 — a record at the very start of a file is not "no location".
-check('a located record carries where its line sat',
-  back.records.map((r) => r.byteStart), flatRecords.map((r) => raws.get(r.index).start));
-check('a located record carries where its line ended',
-  back.records.map((r) => r.byteEnd), flatRecords.map((r) => raws.get(r.index).end));
-check('the fixture really does start a record at byte 0, so -1 is distinguishable',
-  back.records[0].byteStart, 0);
-// A record whose line was never located says so. Repairing it to 0 would point it at whichever
-// file happens to be first, and /raw would then answer with a different generation's message.
-const partialRaws = new Map(raws);
-partialRaws.delete(flatRecords[3].index);
-const partial = indexRowsFromPayload(payload, partialRaws, FILES);
-check('a record with no locator says file -1', partial.records[3].fileIdx, -1);
-check('and its neighbours keep theirs', partial.records[2].fileIdx, back.records[2].fileIdx);
-check('no record silently became file 0',
-  partial.records.filter((r) => r.fileIdx === -1).length, 1);
-check('a record with no locator has no line position either',
-  [partial.records[3].byteStart, partial.records[3].byteEnd], [-1, -1]);
-
-assert('the file carries no absolute path', !/[A-Za-z]:\\|\/(?:store|home|Users)\//.test(text));
-assert('the file carries no store path from the locator', !text.includes('/store/session-a'));
-
-/* =====================================================================
- * 2 — a window at every boundary equals the slice of the full payload
- * ===================================================================== */
-
-const secondary = buildSecondary(back.records);
-const total = flatRecords.length;
-
-const rangeOf = (from, limit) => resolveWindow(secondary, { from, limit });
-
-check('a window at the very start is the full width asked for',
-  [rangeOf(1, 3).from, rangeOf(1, 3).to], [1, 3]);
-check('a window in the middle is the same width',
-  [rangeOf(5, 3).from, rangeOf(5, 3).to], [5, 7]);
-check('a window past the end is clamped to the last record',
-  [rangeOf(total + 50, 3).from, rangeOf(total + 50, 3).to], [total, total]);
-check('a window that starts past the end still returns one record',
-  rangeOf(total + 50, 3).limit, 1);
-check('a window wider than the session stops at the session',
-  rangeOf(1, 10_000).limit, total);
-const bigSession = buildSecondary(Array.from({ length: MAX_WINDOW_RECORDS * 3 }, (_, i) => ({ timestamp: i })));
-check('a window wider than the ceiling is capped on a session large enough to show it',
-  resolveWindow(bigSession, { from: 1, limit: MAX_WINDOW_RECORDS + 500 }).limit, MAX_WINDOW_RECORDS);
-check('an explicit tail wider than the ceiling is capped too',
-  resolveWindow(bigSession, { tail: MAX_WINDOW_RECORDS + 500 }).limit, MAX_WINDOW_RECORDS);
-check('a tail window is the last n records',
-  [rangeOf(null, null) && resolveWindow(secondary, { tail: 4 }).from, resolveWindow(secondary, { tail: 4 }).to],
-  [total - 3, total]);
-check('a tail wider than the session is the whole session',
-  resolveWindow(secondary, { tail: 10_000 }).from, 1);
-check('an empty index has no window', resolveWindow(buildSecondary([]), { from: 1, limit: 5 }), { from: 1, to: 0, limit: 0, total: 0 });
-
-// The real comparison: every boundary, one record at a time.
-let windowBad = [];
-for (let from = 1; from <= total; from += 1) {
-  const range = resolveWindow(secondary, { from, limit: 3 });
-  const expected = flatRecords.slice(range.from - 1, range.to).map((r) => r.index);
-  const served = [];
-  for (const { records } of windowTurns(back, range)) {
-    for (let i = records[0]; i <= records[1]; i += 1) served.push(i);
-  }
-  served.sort((a, b) => a - b);
-  if (JSON.stringify(served) !== JSON.stringify(expected)) windowBad.push(`from ${from}: ${served} vs ${expected}`);
-}
-check('every window boundary serves exactly the full payload slice', windowBad, []);
-
-// A range that straddles the boundary between the two turns: every turn the range touches has to
-// appear, because a turn header carries token and error totals that a window cannot recompute.
-const cutRange = resolveWindow(secondary, { from: 7, limit: 2 });
-const cutTurns = windowTurns(back, cutRange);
-check('a window straddling two turns shows both', cutTurns.map((t) => t.turn.id), ['t1', 't2']);
-check('each turn is served only its overlap with the window',
-  cutTurns.map((t) => t.records), [[7, 7], [8, 8]]);
-// A window sitting wholly inside one turn still shows that turn, header and all: the turn's own
-// span is wider than the window, so dropping it would print a range with no group above it.
-const innerRange = resolveWindow(secondary, { from: 3, limit: 3 });
-const innerTurns = windowTurns(back, innerRange);
-check('a window inside a turn still shows the turn', innerTurns.map((t) => t.turn.id), ['t1']);
-check('the inside window is served in full', innerTurns[0]?.records ?? null, [3, 5]);
-check('a cut turn keeps its own header',
-  cutTurns[0]?.turn.tokens ?? null, payload.turns.find((t) => t.id === 't1').tokens);
-check('a turn narrower than the window is never stretched',
-  windowTurns(back, { from: 1, to: total, total })[1]?.records ?? null, [8, total]);
-
-const allTurns = windowTurns(back, { from: 1, to: total, total });
-check('the whole range shows every turn', allTurns.length, payload.turns.length);
-let headerBad = [];
-for (let i = 0; i < payload.turns.length; i += 1) {
-  const served = allTurns[i];
-  if (served === undefined) {
-    headerBad.push(`${payload.turns[i].id}.<missing>`);
-    continue;
-  }
-  for (const key of ['id', 'index', 'startedAt', 'endedAt', 'toolCalls', 'errors', 'turnClass', 'askedReader', 'closed', 'openerInView', 'openerOutOfView']) {
-    if (JSON.stringify(served.turn[key]) !== JSON.stringify(payload.turns[i][key])) {
-      headerBad.push(`${payload.turns[i].id}.${key}`);
-    }
-  }
-}
-check('every turn header is identical to the full build', headerBad, []);
-
-/* =====================================================================
- * 3 — a time range is answered from the side array, and the control shows why
- * ===================================================================== */
-
-// Timestamps on a real session are nearly, but not quite, monotonic. Reproduced here by pulling two
-// records' timestamps back below the one before them, so the fixture has the inversions the side
-// array exists for — a value BELOW its predecessor, not merely an equal or a smaller-than-later one.
-const staggered = back.records.map((r, i) => ({ ...r, timestamp: i === 3 ? 5 : i === 6 ? 15 : (i + 1) * 10 }));
-const inversions = staggered.reduce((n, r, i) => (i > 0 && r.timestamp < staggered[i - 1].timestamp ? n + 1 : n), 0);
-assert('the fixture really does go backwards in time', inversions >= 2);
-
-const staggeredSecondary = buildSecondary(staggered);
-const brute = (from, to) => staggered
-  .map((r, i) => ({ r, i }))
-  .filter(({ r }) => typeof r.timestamp === 'number' && r.timestamp >= from && r.timestamp <= to)
-  .map(({ i }) => i);
-
-let rangeBad = [];
-for (const [from, to] of [[0, 45], [0, 55], [55, 65], [70, 75], [100, 100], [0, 10_000], [500, 600]]) {
-  const got = recordsInTimeRange(staggeredSecondary, from, to);
-  if (JSON.stringify(got) !== JSON.stringify(brute(from, to))) rangeBad.push(`${from}..${to}: ${got} vs ${brute(from, to)}`);
-}
-check('a time range equals a brute-force filter on non-monotonic timestamps', rangeBad, []);
-check('a time range answers in ledger order', JSON.stringify(recordsInTimeRange(staggeredSecondary, 0, 10_000)), JSON.stringify(brute(0, 10_000).sort((a, b) => a - b)));
-
-// The control: bisecting the PRIMARY order on this same data loses rows, which is the whole reason
-// the timestamp side array is a separate structure rather than an assumption about the rows. The
-// range is bounded on purpose — a range covering every row would be answered correctly even by the
-// wrong implementation, which is exactly how a broken shortcut survives.
-const bisectOnIndexOrder = (records, from, to) => {
-  const at = (i) => records[i].timestamp;
-  let lo = 0;
-  let hi = records.length;
-  while (lo < hi) {
-    const mid = (lo + hi) >> 1;
-    if (at(mid) < from) lo = mid + 1;
-    else hi = mid;
-  }
-  const hits = [];
-  for (let i = lo; i < records.length && at(i) <= to; i += 1) hits.push(i);
-  return hits;
-};
-const lostRows = brute(0, 45).filter((i) => !bisectOnIndexOrder(staggered, 0, 45).includes(i));
-assert('bisecting the primary key order on this data would lose rows', lostRows.length > 0);
-check('and the side array loses none',
-  recordsInTimeRange(staggeredSecondary, 0, 45).length, brute(0, 45).length);
-
-check('a record with no timestamp joins no time range',
-  buildSecondary([{ timestamp: null }, { timestamp: 5 }]).timeValues.length, 1);
-check('the count of untimed records is reported',
-  buildSecondary([{ timestamp: null }, { timestamp: 5 }]).untimedCount, 1);
-check('an empty range answers nothing', recordsInTimeRange(staggeredSecondary, 900, 100), []);
-check('an inverted range answers nothing', recordsInTimeRange(staggeredSecondary, 500, 100), []);
-
-/* =====================================================================
- * 4 — the secondary structures answer what they claim to
- * ===================================================================== */
-
-const kinds = new Map();
-for (const record of back.records) kinds.set(record.kind, (kinds.get(record.kind) ?? 0) + 1);
-check('kind counts match the records',
-  [...secondary.kindCounts.entries()].sort(), [...kinds.entries()].sort());
-check('every record is counted under some kind',
-  [...secondary.kindCounts.values()].reduce((a, b) => a + b, 0), back.records.length);
-
-const grouped = new Map();
-for (let i = 0; i < back.records.length; i += 1) {
-  const id = back.records[i].id;
-  if (typeof id !== 'string' || id.length === 0) continue;
-  if (!grouped.has(id)) grouped.set(id, []);
-  grouped.get(id).push(i);
-}
-check('message grouping matches the records',
-  [...secondary.byMessageId.entries()].sort(), [...grouped.entries()].sort());
-assert('a message expanded into several records groups under one key',
-  (secondary.byMessageId.get('a1') ?? []).length > 1);
-// The form of that rule: every record filed under a key must carry that key. A group holding a
-// record that does not belong to it is a merge of two messages that never shared an id — which is
-// what filing every unkeyed record under one placeholder would do.
-const mismatchedGroup = [];
-for (const [key, list] of secondary.byMessageId) {
-  for (const i of list) if (back.records[i].id !== key) mismatchedGroup.push(`${key}<-${back.records[i].id}@${i}`);
-}
-check('no group holds a record whose id is not that group', mismatchedGroup, []);
-const unkeyedCount = back.records.filter((r) => typeof r.id !== 'string' || r.id.length === 0).length;
-assert('the fixture really does carry unkeyed records', unkeyedCount >= 2);
-check('no unkeyed record is in any group',
-  [...secondary.byMessageId.values()].flat().filter((i) => !byMessageIdOwns(back.records[i])).length, 0);
-function byMessageIdOwns(record) {
-  return typeof record.id === 'string' && record.id.length > 0;
-}
-
-const byGen = new Map();
-for (let i = 0; i < back.records.length; i += 1) {
-  const g = back.records[i].generation;
-  if (!byGen.has(g)) byGen.set(g, []);
-  byGen.get(g).push(i);
-}
-check('generation grouping matches the records',
-  [...secondary.byGeneration.entries()].sort(), [...byGen.entries()].sort());
-check('generations partition the records',
-  [...secondary.byGeneration.values()].flat().length, back.records.length);
-
-/* =====================================================================
- * 5 — the shape the file is written in, read before anything is written with it
- * ===================================================================== */
-
-// Checked before the store is exercised, and deliberately a reading of the source rather than of a
-// behaviour: the publish ORDER is only observable in the source, since a correct writer and a writer
-// that publishes the manifest first produce the same directory afterwards. Doing it here also means
-// a build that gets the order wrong is named rather than crashing inside the write below.
-const source = await readFile(INDEX_PATH, 'utf8');
-assert('the module names its five secondary structures',
-  ['byMessageId', 'byGeneration', 'kindCounts', 'timeValues', 'timeRows'].every((n) => source.includes(n)));
-assert('the primary key needs no structure of its own: the rows are already in order',
-  /records\[a\]\.timestamp - records\[b\]\.timestamp/.test(source));
-assert('the timestamp side array is built, not assumed',
-  source.includes('Float64Array') && source.includes('Int32Array'));
-assert('a time range bisects the side array',
-  /values\[mid\] < from/.test(source));
-const publishRecords = source.indexOf('recordPath}.tmp`, recordPath)');
-const publishManifest = source.indexOf('manifestPath}.tmp`, manifestPath)');
-assert('the records are published before the manifest',
-  publishRecords >= 0 && publishManifest > publishRecords);
-assert('the manifest strips the machine path',
-  /files: meta\.files\.map\(stripPath\)/.test(source));
-assert('nothing is ever read from the session history directory',
-  !/join\([^)]*sessions/i.test(source));
-
-/* =====================================================================
- * 6 — a half-written pair of files is never consumed
- * ===================================================================== */
-
-const root = await mkdtemp(join(tmpdir(), 'mmc-index-'));
-const store = createIndexStore(root);
-const sourceFiles = FILES.map((f) => ({ ...f }));
-
-/**
- * The store is exercised inside a catch, and every read is checked for `null` rather than
- * dereferenced. A guard that crashes reports a stack trace and no rule, which is a weaker outcome
- * than failing by name: the reader cannot tell which invariant moved. Here a store that cannot be
- * written at all is itself the finding, and the summary still prints the assertions around it.
- */
-const storeFailures = [];
-try {
-  const written = await store.read('session-a', 'all', sourceFiles);
-  assert('nothing stored yet reads as no index', written === null);
-
-  const manifestWritten = await store.write('session-a', 'all', rows, { files: FILES, projectionDigest: manifest.projectionDigest });
-  const good = await store.read('session-a', 'all', sourceFiles);
-  assert('a complete pair reads back', good !== null);
-  if (good !== null && manifestWritten !== undefined) {
-    check('the manifest records what it holds', manifestWritten.recordCount, rows.records.length);
-    check('the read-back is the same records', good.records.length, rows.records.length);
-  }
-
-  const dir = store.dirOf('session-a', 'all');
-
-  // Manifest written, records not: the state a crash between the two renames leaves.
-  await writeFile(join(dir, 'records.jsonl'), '', 'utf8');
-  assert('records that do not match the manifest are refused',
-    (await store.read('session-a', 'all', sourceFiles)) === null);
-
-  // Records written, manifest not yet: the other order, and the one the write order prevents.
-  await rm(join(dir, 'manifest.json'), { force: true });
-  assert('records with no manifest are refused',
-    (await store.read('session-a', 'all', sourceFiles)) === null);
-
-  await store.write('session-a', 'all', rows, { files: FILES, projectionDigest: manifest.projectionDigest });
-  assert('a rebuilt pair reads again',
-    (await store.read('session-a', 'all', sourceFiles)) !== null);
-
-  // A manifest that describes a schema or a projection this build does not speak.
-  const manifestPath = join(dir, 'manifest.json');
-  const original = JSON.parse(await readFile(manifestPath, 'utf8'));
-  await writeFile(manifestPath, JSON.stringify({ ...original, schemaVersion: 99 }), 'utf8');
-  assert('a manifest from another schema version is refused',
-    (await store.read('session-a', 'all', sourceFiles)) === null);
-  await writeFile(manifestPath, JSON.stringify({ ...original, projectionVersion: 99 }), 'utf8');
-  assert('a manifest from another projection version is refused',
-    (await store.read('session-a', 'all', sourceFiles)) === null);
-  await writeFile(manifestPath, JSON.stringify({ ...original, view: 'g3' }), 'utf8');
-  assert('a manifest for another view is refused',
-    (await store.read('session-a', 'all', sourceFiles)) === null);
-  await writeFile(manifestPath, JSON.stringify({ ...original, recordCount: original.recordCount + 1 }), 'utf8');
-  assert('a manifest that overstates the record count is refused',
-    (await store.read('session-a', 'all', sourceFiles)) === null);
-  await writeFile(manifestPath, 'not json at all', 'utf8');
-  assert('an unreadable manifest is refused',
-    (await store.read('session-a', 'all', sourceFiles)) === null);
-  await writeFile(manifestPath, JSON.stringify(original), 'utf8');
-  assert('the restored manifest reads again',
-    (await store.read('session-a', 'all', sourceFiles)) !== null);
-
-  // The source it was built from is the identity that decides reuse.
-  const grown = sourceFiles.map((f, i) => (i === 0 ? { ...f, size: f.size + 1 } : f));
-  assert('a source that grew refuses the stored index',
-    (await store.read('session-a', 'all', grown)) === null);
-  const rewritten = sourceFiles.map((f, i) => (i === 0 ? { ...f, revision: 'sha256:' + 'f'.repeat(64) } : f));
-  assert('a source whose revision changed refuses the stored index',
-    (await store.read('session-a', 'all', rewritten)) === null);
-  const renamed = sourceFiles.map((f, i) => (i === 0 ? { ...f, fileName: 'other.jsonl' } : f));
-  assert('a renamed source refuses the stored index',
-    (await store.read('session-a', 'all', renamed)) === null);
-  const dropped = sourceFiles.slice(1);
-  assert('a source that went away refuses the stored index',
-    (await store.read('session-a', 'all', dropped)) === null);
-  const touched = sourceFiles.map((f, i) => (i === 0 ? { ...f, mtimeMs: f.mtimeMs + 999 } : f));
-  assert('a touched-but-unchanged source keeps the stored index, on purpose',
-    (await store.read('session-a', 'all', touched)) !== null);
-
-  // Two sessions, two sets of bytes.
-  await store.write('session-b', 'all', { turns: [], records: [] }, { files: FILES, projectionDigest: 'x' });
-  assert('one session does not answer for another',
-    (await store.read('session-b', 'all', [])) === null);
-
-  check('sameSources is order sensitive', sameSources(FILES, [...FILES].reverse()), false);
-  check('sameSources rejects a length mismatch', sameSources(FILES, FILES.slice(0, 1)), false);
-
-  // A generation read short by our own cap leaves a row set that covers a PREFIX, while `size` is
-  // the whole file. That is the one case the identity facts cannot tell apart, so it is carried
-  // and compared: an index built from it would otherwise be served as one holding every record.
-  const WHOLE = { fileName: 'messages.jsonl', generation: 3, size: 900, mtimeMs: 7, revision: 'r3' };
-  check('a source read short is not trusted as if read whole',
-    sameSources([{ ...WHOLE, truncated: false }], [{ ...WHOLE, truncated: true }]), false);
-  check('and not in the other direction either',
-    sameSources([{ ...WHOLE, truncated: true }], [{ ...WHOLE, truncated: false }]), false);
-  check('two sources that agree about truncation trust each other',
-    sameSources([{ ...WHOLE, truncated: true }], [{ ...WHOLE, truncated: true }]), true);
-  check('and so do two that agree it was read whole',
-    sameSources([WHOLE], [{ ...WHOLE, truncated: false }]), true);
-} catch (error) {
-  storeFailures.push(`the store could not be exercised: ${error instanceof Error ? error.message : String(error)}`);
-} finally {
-  await rm(root, { recursive: true, force: true });
-}
-for (const line of storeFailures) failures.push(line);
-
-/* --------------------------------------------------------------------- */
-
-if (failures.length) {
-  console.log(`\n  [trajectory-index] ${failures.length} failure(s):`);
-  for (const line of failures) console.log(`    - ${line}`);
-  console.log('');
-  process.exitCode = 1;
-} else {
-  console.log(`[trajectory-index] ${pass} assertions passed`);
-}

From 4096b5e432f6ee69eb4ac23cf06d52e3b520b2a4 Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 17:10:07 +0800
Subject: [PATCH 22/36] =?UTF-8?q?=E8=AE=A9=E6=96=B0=E9=B2=9C=E5=BA=A6?=
 =?UTF-8?q?=E6=A8=AA=E5=B9=85=E8=83=BD=E8=A2=AB=E4=BB=BB=E4=BD=95=E4=B8=80?=
 =?UTF-8?q?=E6=AC=A1=E6=88=90=E5=8A=9F=E5=9B=9E=E7=AD=94=E6=94=B6=E6=8E=89?=
 =?UTF-8?q?=EF=BC=8C=E5=B9=B6=E6=8A=8A=E5=A4=B1=E8=B4=A5=E5=88=86=E6=88=90?=
 =?UTF-8?q?=E8=AF=BB=E8=80=85=E8=83=BD=E8=A1=8C=E5=8A=A8=E7=9A=84=E4=B8=A4?=
 =?UTF-8?q?=E7=B1=BB?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

横幅写着「正在重试」，而它能被收掉的唯一条件是「服务端回了一个带 body」—— 304 不算。
而 304 正是页面静止时每一次轮询的答案：cacheKey 只由 dir|sizeBytes|lastActiveAt 决定，
会话没动就是同一个 tag，服务端必然回 304。于是**一次瞬时的连接抖动 + 一个安静的会话 =
横幅永久停留**，并且一直宣称自己在重试。点「刷新」能收掉它，但那只是因为手动刷新丢掉了
validator，强制拿了一次完整 body。

顺带查出同形的第二条：会话列表有完全一样的 304 早退，以及一个**写了三处、读了零处**的标志。
列表读取失败对读者完全不可见。

改动：

- 两个散落的布尔（state.stale、state.sessionsError）换成这一层自己的 freshness 模型，
  唯一写者 noteFresh()。原来 state.stale 有三个写点，现在每个字段只有一个。
- **304 也算新鲜** —— 轨迹和会话列表两条路都改了。
- 认不出的失败拆成两类：「与本地服务的连接中断」和「服务端返回了无法读取的内容」。
  原来四种错误码加上这两类全部塌缩成同一句「更新失败」，页面上不留计数也不打日志，
  一次抖动和一次持续故障事后无法区分。
- 连续失败从第二次起显示次数与来源（轨迹 / 会话列表）。第一次不给这句解释，因为一次抖动
  会在一个轮询内自己消失。
- fetchSessions 的 HTTP 失败原本把 status 扔掉了，所以任何非 2xx 都会被归成「断线」。

**修复不许变成另一种代价**：render() 重建整个账本，安静会话每 8 秒一个 304。
noteFresh() 返回「状态是否真的动了」，只有动了才渲染。这条有断言，不是靠自觉。

四问在 .research 的退役审计 §11，含逐个读点表。

守卫 tests/verify-freshness.mjs（27 条）：把交付的内联脚本原样载入沙箱**真跑**，
断言写成场景而不是符号清单 —— 失败后接 304 / 接 200 / 连抖三次 / 断线 vs 坏响应 /
只有列表失败 / 五个 304 之后渲染次数为 0。
这一层此前没有任何守卫（state.stale、sessionsError、stale-bar 在 tests/ 里的匹配数是 0），
这正是四个缺陷能活下来的原因。

变异 tests/mutate-freshness.py（5 条）全按名捕获：把 304 当成什么都没发生；失败列表只记不看；
恢复不清计数；断线被报成服务端的问题；每个 304 都重渲染。
另加一条反方向的用例 —— 只加一行注释必须仍然全绿，否则守卫读的是散文不是行为。

套件 88/88。
---
 .../mmc-trajectory/miniapp/client/index.html  | 168 +++++++++--
 .../mmc-trajectory/tests/mutate-freshness.py  | 160 ++++++++++
 .../mmc-trajectory/tests/verify-freshness.mjs | 273 ++++++++++++++++++
 3 files changed, 579 insertions(+), 22 deletions(-)
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/mutate-freshness.py
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/verify-freshness.mjs

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
index a82acc6..e139313 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
+++ b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
@@ -3632,7 +3632,6 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
       var state = {
         sessions: [],
         sessionsLoaded: false,
-        sessionsError: false,
         followLatest: true,
         // Seeded from the host id so the picker and the content agree. `sessionParam()` already
         // prefers `hostSessionId`, so a host-pinned page used to render 「跟随最新（自动切换）」
@@ -3645,7 +3644,6 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         signature: '',
         loading: true,
         hardError: null,
-        stale: false,
         selectedId: null,
         // Disclosure state for the two blocks that are read once and then only take
         // up room. Folding them hands the height back to the ledger.
@@ -3778,6 +3776,88 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         generation: null
       };
 
+      /**
+       * 新鲜度：这一层（文档位置 2，`#error-bar` / `#stale-bar`，回答「出错了吗」）的全部状态。
+       *
+       * 它顶掉了两个散落的布尔，都是有理由的。
+       *
+       * `state.stale` 有三个写点，其中「恢复」那一个写在 `applyPayload` 里 —— 而 304 那条路
+       * 不经过 `applyPayload`。于是「恢复」被定义成了「收到一个 body」，而一个安静会话的每一次
+       * 轮询都是 304：cacheKey 只由 `dir|sizeBytes|lastActiveAt` 决定，没动就是同一个 tag，
+       * 服务端必然回 304。所以一次瞬时的连接抖动之后，横幅可以永久停留，而它自己写着
+       * 「正在重试」。
+       *
+       * `state.sessionsError` 更干脆：写了三处、读了零处，会话列表读取失败对读者完全不可见。
+       *
+       * 两个来源是**并列**的信号，不是互斥的：轨迹好了不能掩盖列表还在失败。谁更严重谁说话，
+       * 所以不需要 `resetBaseFilters` 那种跨函数协调。
+       *
+       * 每个字段有且只有一个写者（`noteFresh`），这同时修掉「一个字段一个写者」这条规矩原本被
+       * 打破的地方 —— `state.stale` 有三个写点，而其中两个根本不是它的。
+       */
+      var freshness = {
+        trajectory: { streak: 0, reason: '' },
+        sessions: { streak: 0, reason: '' }
+      };
+
+      /**
+       * The one writer for this layer, and it reports whether the bar's state actually moved.
+       *
+       * That return value is load-bearing rather than a convenience: `render()` rebuilds the
+       * whole ledger, and a quiet session revalidates into a 304 every 8 seconds, so a fix that
+       * re-rendered on every 304 would trade a sticky banner for a permanent rebuild.
+       *
+       * @param {'trajectory'|'sessions'} source
+       * @param {boolean} ok
+       * @param {string} [reason]
+       * @returns {boolean} whether the bar's contents would differ afterwards
+       */
+      function noteFresh(source, ok, reason) {
+        var slot = freshness[source];
+        if (!slot) return false;
+        // A failure always moves: the streak it writes is the count the reader sees. A success
+        // only moves if there was something to clear.
+        var moved = ok ? slot.streak !== 0 : true;
+        if (ok) {
+          slot.streak = 0;
+          slot.reason = '';
+        } else {
+          slot.streak += 1;
+          slot.reason = reason || 'offline';
+        }
+        return moved;
+      }
+
+      /**
+       * 失败分成两类，因为读者的下一步不一样：根本没连上，和连上了但回的东西读不懂。
+       *
+       * 原来这两类加上四种结构化错误码全部塌缩成同一句「更新失败」，页面既不留计数也不打
+       * 日志，于是「抖了一下」和「一直不通」事后无法区分。
+       */
+      function freshnessReason(error) {
+        var code = error && error.code ? String(error.code) : '';
+        if (code === 'session_not_found' || code === 'not_found') return 'session_gone';
+        if (code === 'trajectory_unavailable') return 'store_unavailable';
+        if (code === 'trajectory_unreadable') return 'unreadable';
+        // A status means the server answered and the answer was not usable. No status means the
+        // request itself failed — a different thing to go and look at.
+        if (error && typeof error.status === 'number') return 'bad_response';
+        return 'offline';
+      }
+
+      /** 连续失败时读者才需要知道次数：第一次是抖动，不必加一句解释。 */
+      var FRESH_STREAK_SHOWN = 2;
+
+      var FRESH_TITLES = {
+        session_gone: '该会话已不可用，正在重试',
+        store_unavailable: '本地会话数据目录暂时不可用，正在重试',
+        unreadable: '会话数据暂时无法读取，正在重试',
+        bad_response: '服务端返回了无法读取的内容，正在重试',
+        offline: '与本地服务的连接中断，正在重试'
+      };
+
+      var FRESH_SOURCE_LABELS = { trajectory: '轨迹', sessions: '会话列表' };
+
       var dom = {};
       var inflight = null;
       var sessionsInflight = null;
@@ -3929,7 +4009,14 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
               state.sessionsEtagFor = key;
               return { changed: false, body: null, etag: state.sessionsEtag };
             }
-            if (!response.ok) throw new Error('http');
+            if (!response.ok) {
+              // The status is what tells a dropped connection apart from a server that answered
+              // with something unusable, and this path used to throw it away.
+              var httpError = new Error('http');
+              httpError.status = response.status;
+              throw httpError;
+            }
+
             return response
               .json()
               .catch(function () { return null; })
@@ -3943,17 +4030,26 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
             // One writer for the list's validator, on the one path that carried a body.
             state.sessionsEtag = result.etag;
             state.sessionsEtagFor = key;
-            if (!result.changed) return false;
+            // A 304 is an answer. The server has just said the list on screen is current, so this
+            // is fresh — leaving it out is what let a list failure sit there with nothing on the
+            // page to show for it. `renderSessionSelect` does not re-render, so the bar is told
+            // separately, and only when its contents actually moved.
+            var cleared = noteFresh('sessions', true, '');
+            if (!result.changed) {
+              if (cleared) renderBars();
+              return false;
+            }
             state.sessions = Array.isArray(result.body.sessions) ? result.body.sessions : [];
             state.sessionsLoaded = true;
-            state.sessionsError = false;
             renderSessionSelect();
+            if (cleared) renderBars();
             return true;
           })
           .catch(function (error) {
             sessionsInflight = null;
             if (error && error.name === 'AbortError') return false;
-            state.sessionsError = true;
+            noteFresh('sessions', false, freshnessReason(error));
+            renderBars();
             return false;
           });
       }
@@ -4027,10 +4123,19 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
             if (payload === null) {
               // 304: the previous render is still accurate. Only clear a pending loading
               // state, because nothing on screen should have been replaced.
+              //
+              // The server answered, though, so this is fresh. Treating a 304 as "nothing
+              // happened" is what let the warning outlive the fault that raised it — a quiet
+              // session revalidates into a 304 every tick, so once it was up, only a session
+              // that started growing again could take it down.
+              var cleared = noteFresh('trajectory', true, '');
               if (state.loading) {
                 state.loading = false;
-                render();
+                cleared = true;
               }
+              // Rendering on every 304 would rebuild the whole ledger every 8 seconds on an
+              // idle session. Escaping the sticky banner must not cost that.
+              if (cleared) render();
               return;
             }
             applyPayload(payload, manual);
@@ -4291,7 +4396,7 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         state.signature = next;
         state.loading = false;
         state.hardError = null;
-        state.stale = false;
+        noteFresh('trajectory', true, '');
         state.flat = flattenTurns(payload.turns);
         // The cursor is the server's own word for how far it got, so a delta is O(1) here and
         // only a whole payload has to walk the records to find the end of them.
@@ -4326,17 +4431,11 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         // Never surface status codes, URLs, or local paths.
         var serverMessage = error && error.serverMessage ? String(error.serverMessage) : '';
         if (state.payload) {
-          state.stale = true;
-          var code = error && error.code ? error.code : '';
-          var title = dom.staleBar.querySelector('.bar-title');
-          if (title) {
-            if (code === 'session_not_found' || code === 'not_found') title.textContent = '该会话已不可用，正在重试';
-            else if (code === 'trajectory_unavailable') title.textContent = '本地会话数据目录暂时不可用，正在重试';
-            else if (code === 'trajectory_unreadable') title.textContent = '会话数据暂时无法读取，正在重试';
-            else title.textContent = '更新失败，正在重试';
-          }
+          // There is something on screen and it is now out of date. That is this layer's whole
+          // subject, so it is reported here rather than as a hard error — which is for a reader
+          // who has nothing at all to look at.
+          noteFresh('trajectory', false, freshnessReason(error));
         } else {
-          state.stale = false;
           state.hardError = serverMessage || '暂时无法读取会话轨迹数据。';
         }
         render();
@@ -8615,11 +8714,36 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
           dom.errorBar.hidden = false;
           dom.errorTitle.textContent = '无法读取会话轨迹';
           dom.errorText.textContent = state.hardError;
-        } else {
-          dom.errorBar.hidden = true;
-          dom.errorText.textContent = '';
+          // Nothing is on screen to be out of date, so the freshness bar has nothing to add to
+          // what the error bar already says. The counts are still being kept, so a later success
+          // hides this one and the freshness bar comes back on its own terms.
+          dom.staleBar.hidden = true;
+          return;
+        }
+        dom.errorBar.hidden = true;
+        dom.errorText.textContent = '';
+
+        // Two independent signals, and the worse one speaks. Either recovering must not hide the
+        // other, which is why this is not a single boolean with two writers.
+        var sources = ['trajectory', 'sessions'];
+        var worst = null;
+        for (var i = 0; i < sources.length; i += 1) {
+          var slot = freshness[sources[i]];
+          if (slot.streak > 0 && (worst === null || slot.streak > worst.streak)) {
+            worst = { source: sources[i], streak: slot.streak, reason: slot.reason };
+          }
+        }
+        dom.staleBar.hidden = worst === null;
+        if (worst === null) return;
+
+        var title = dom.staleBar.querySelector('.bar-title');
+        if (title) title.textContent = FRESH_TITLES[worst.reason] || FRESH_TITLES.offline;
+        var hint = dom.staleBar.querySelector('.bar-hint');
+        if (hint) {
+          hint.textContent = worst.streak >= FRESH_STREAK_SHOWN
+            ? FRESH_SOURCE_LABELS[worst.source] + '已连续 ' + worst.streak + ' 次更新失败。下方保留的是上一次成功读取的数据。'
+            : '下方保留的是上一次成功读取的数据。';
         }
-        dom.staleBar.hidden = !state.stale;
       }
 
       function renderFooter() {
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-freshness.py b/plugins/avatasia/mmc-trajectory/tests/mutate-freshness.py
new file mode 100644
index 0000000..7308ed1
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-freshness.py
@@ -0,0 +1,160 @@
+"""Mutation control for verify-freshness.mjs.
+
+Each mutation reintroduces exactly one bug the probe is supposed to catch, BY NAME. The first one
+is the defect as it shipped: a 304 was treated as "nothing happened", so on a quiet session — where
+every poll revalidates into a 304 — the warning outlived the fault that raised it while claiming it
+was still retrying.
+
+The last case is the other direction: an edit that only ADDS A COMMENT must leave the probe green.
+A guard that cannot pass is as broken as one that cannot fail, and that is the only way to prove
+this probe is reading behaviour rather than prose.
+"""
+import subprocess
+import sys
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parent
+HTML = ROOT / "miniapp" / "client" / "index.html"
+PROBE = HERE / "verify-freshness.mjs"
+
+MUTATIONS = [
+    # ---- the one that shipped ----------------------------------------------------------
+    (
+        "a 304 is taken as nothing having happened, so the warning outlives the fault",
+        "              var cleared = noteFresh('trajectory', true, '');\n              if (state.loading) {",
+        "              var cleared = false;\n              if (state.loading) {",
+    ),
+    (
+        # The other half of the same layer: the list failure used to be written to a flag that
+        # nothing read, so a failed session list was invisible to the reader.
+        "a failed session list is recorded and never shown",
+        "            noteFresh('sessions', false, freshnessReason(error));\n            renderBars();",
+        "            renderBars();",
+    ),
+    # ---- the count ------------------------------------------------------------------------
+    (
+        "recovering does not reset the count, so a past outage is remembered forever",
+        "        if (ok) {\n          slot.streak = 0;\n          slot.reason = '';",
+        "        if (ok) {\n          slot.reason = '';",
+    ),
+    # ---- which kind of failure -------------------------------------------------------------
+    (
+        "a dropped connection is reported as a bad answer, which sends the reader the wrong way",
+        "        if (error && typeof error.status === 'number') return 'bad_response';\n        return 'offline';",
+        "        return 'bad_response';",
+    ),
+    # ---- the cost of the fix ---------------------------------------------------------------
+    (
+        "every 304 re-renders, trading a stuck warning for a ledger rebuilt every 8 seconds",
+        "              if (cleared) render();",
+        "              render();",
+    ),
+]
+
+
+def read_exact(path):
+    """Normalise to LF for matching, and report the file's own newline so it can be put back."""
+    data = path.read_bytes()
+    text = data.decode("utf-8").replace("\r\n", "\n")
+    return text, ("\r\n" if b"\r\n" in data else "\n")
+
+
+def write_exact(path, text, newline):
+    if newline == "\r\n":
+        text = text.replace("\n", "\r\n")
+    path.write_bytes(text.encode("utf-8"))
+
+
+def run_probe():
+    proc = subprocess.run(
+        ["node", str(PROBE)],
+        cwd=str(ROOT),
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+    )
+    return proc.returncode, (proc.stdout or "") + (proc.stderr or "")
+
+
+def main():
+    code, output = run_probe()
+    if code != 0:
+        print("baseline probe does not pass; fix that first")
+        print(output)
+        return 1
+    print("baseline clean")
+
+    original = HTML.read_bytes()
+    missed = []
+    unnamed = []
+    for label, old, new in MUTATIONS:
+        text, newline = read_exact(HTML)
+        if old not in text:
+            print(f"SKIP  {label}: anchor not found")
+            missed.append(label)
+            continue
+        if old == new:
+            print(f"SKIP  {label}: the mutation changes nothing")
+            missed.append(label)
+            continue
+        write_exact(HTML, text.replace(old, new, 1), newline)
+        try:
+            code, output = run_probe()
+        finally:
+            HTML.write_bytes(original)
+        if code == 0:
+            print(f"MISSED {label}: the probe still passed")
+            missed.append(label)
+            continue
+        first = next((line.strip() for line in output.splitlines() if line.strip().startswith("- ")), None)
+        if first is None:
+            print(f"UNNAMED {label}: the probe failed without naming a rule")
+            unnamed.append(label)
+        else:
+            print(f"caught {label}\n         -> {first}")
+
+    # ---- the other direction ---------------------------------------------------------------
+    # A note in this file must not change a single verdict. If adding prose can turn the probe
+    # red, the probe is reading the prose. The marker is chosen to be absent from the probe, so
+    # that "it was already there" cannot be mistaken for "it made no difference".
+    text, newline = read_exact(HTML)
+    anchor = "      function renderBars() {"
+    note = "/* note-only-edit-marker */"
+    probe_text = PROBE.read_text(encoding="utf-8")
+    if anchor not in text or note in probe_text:
+        print("SKIP  comment-only edit: precondition not met")
+        missed.append("comment-only edit")
+    else:
+        PROBE.write_text(
+            probe_text.replace(anchor, "      " + note + "\n" + anchor, 1),
+            encoding="utf-8",
+        )
+        try:
+            code, output = run_probe()
+        finally:
+            PROBE.write_text(probe_text, encoding="utf-8")
+        if code != 0:
+            print(f"MISSED comment-only edit: adding a note turned the probe red\n{output}")
+            missed.append("comment-only edit")
+        else:
+            print("caught a comment-only note leaves every verdict unchanged")
+
+    if HTML.read_bytes() != original:
+        print(f"NOT RESTORED {HTML}")
+        return 1
+    print("file restored byte-for-byte")
+
+    if missed or unnamed:
+        if missed:
+            print(f"\n{len(missed)} mutation(s) got through")
+        if unnamed:
+            print(f"{len(unnamed)} mutation(s) failed without naming a rule")
+        return 1
+    print(f"\nall {len(MUTATIONS)} mutations caught, each by name")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-freshness.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-freshness.mjs
new file mode 100644
index 0000000..1cd94ef
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-freshness.mjs
@@ -0,0 +1,273 @@
+// Behavioural checks for the freshness layer: `#error-bar` and `#stale-bar`.
+//
+// The assertions are scenarios, not a list of symbols, and they are run against the delivered
+// script rather than a copy: this layer had no guard at all, which is why a warning could sit on
+// screen saying 「正在重试」 for as long as the session stayed quiet. A quiet session revalidates
+// into a 304 on every tick, so "cleared only when a body arrived" was enough to strand it.
+//
+// Load-bearing ones:
+//   · a 304 counts as fresh — otherwise the bar outlives the fault;
+//   · a 304 does NOT re-render — otherwise the fix trades a stuck bar for a permanent rebuild;
+//   · two sources are independent, and the worse one speaks;
+//   · a dropped connection and an unreadable answer are told apart.
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import vm from 'node:vm';
+
+const HTML = fileURLToPath(new URL('../miniapp/client/index.html', import.meta.url));
+const html = readFileSync(HTML, 'utf8');
+
+const script = [...html.matchAll(/<script>([\s\S]*?)<\/script>/g)].map((m) => m[1])[0];
+if (!script) throw new Error('no inline script found');
+
+// Cut the bootstrap: the page must not fetch or mount while under test.
+const bootIndex = script.lastIndexOf("if (document.readyState === 'loading')");
+const body = bootIndex === -1 ? script : script.slice(0, bootIndex);
+
+const noop = () => {};
+
+/** A bar node: `hidden`, plus the two child nodes `renderBars` writes through querySelector. */
+function barNode() {
+  const parts = {};
+  return {
+    hidden: true,
+    textContent: '',
+    querySelector(sel) {
+      if (!parts[sel]) parts[sel] = { textContent: '' };
+      return parts[sel];
+    }
+  };
+}
+
+function domNode(tag) {
+  const kids = [];
+  const attrs = {};
+  return {
+    tag,
+    childNodes: kids,
+    get firstChild() { return kids.length ? kids[0] : null; },
+    appendChild(n) { kids.push(n); return n; },
+    removeChild(n) { const i = kids.indexOf(n); if (i >= 0) kids.splice(i, 1); return n; },
+    setAttribute(k, v) { attrs[k] = String(v); },
+    getAttribute(k) { return Object.prototype.hasOwnProperty.call(attrs, k) ? attrs[k] : null; },
+    removeAttribute(k) { delete attrs[k]; },
+    style: { setProperty: noop },
+    className: '',
+    textContent: ''
+  };
+}
+
+/** A response good enough for the two fetches: status, etag, and a body that may be missing. */
+function res(status, body, etag) {
+  return {
+    status,
+    ok: status >= 200 && status < 300,
+    headers: { get: (k) => (k === 'etag' ? (etag ?? null) : null) },
+    json: () => (body === undefined ? Promise.reject(new Error('no body')) : Promise.resolve(body))
+  };
+}
+
+const LISTS = { sessions: [{ id: 's1', label: 'a', sizeBytes: 10, lastActiveAt: 1 }] };
+const TRAJ = { turns: [], stats: {}, session: { id: 's1' }, generation: 1, cursor: 'c1' };
+
+let renders = 0;
+let responder = () => Promise.resolve(res(200, LISTS, 'W/"l1"'));
+
+const sandbox = {
+  console,
+  AbortController,
+  window: {
+    localStorage: { getItem: () => null, setItem: noop },
+    matchMedia: () => ({ addEventListener: noop, addListener: noop }),
+    setTimeout: () => 0,
+    clearTimeout: noop,
+    setInterval: () => 0,
+    clearInterval: noop
+  },
+  document: {
+    documentElement: { dataset: {} },
+    body: { classList: { add: noop, remove: noop } },
+    createElement: (tag) => domNode(tag)
+  },
+  fetch: (url, opts) => responder(url, opts)
+};
+vm.createContext(sandbox);
+vm.runInContext(body, sandbox);
+
+// Everything expensive is stubbed and counted; everything this layer owns is the delivered code.
+// `render` in particular is replaced rather than exercised: the whole point of one assertion below
+// is that a 304 must NOT reach it, and running it for real would rebuild a ledger to say so. It
+// still draws the bars, because that is what it is on this path for.
+const drawBars = sandbox.renderBars;
+sandbox.render = () => { renders += 1; drawBars(); };
+sandbox.renderLoading = noop;
+sandbox.renderSessionSelect = noop;
+sandbox.rePinWindow = noop;
+sandbox.runSearch = noop;
+
+sandbox.dom.errorBar = barNode();
+sandbox.dom.errorTitle = barNode();
+sandbox.dom.errorText = barNode();
+sandbox.dom.staleBar = barNode();
+
+let pass = 0;
+const failures = [];
+function check(name, actual, expected) {
+  if (JSON.stringify(actual) === JSON.stringify(expected)) pass += 1;
+  else failures.push(`${name}\n      got  ${JSON.stringify(actual)}\n      want ${JSON.stringify(expected)}`);
+}
+function assert(name, cond) {
+  if (cond) pass += 1;
+  else failures.push(name);
+}
+
+const bar = () => sandbox.dom.staleBar;
+const title = () => sandbox.dom.staleBar.querySelector('.bar-title').textContent;
+const hint = () => sandbox.dom.staleBar.querySelector('.bar-hint').textContent;
+const shown = () => sandbox.dom.staleBar.hidden === false;
+
+/** Start from a healthy page: something on screen, nothing degraded. */
+function reset() {
+  sandbox.freshness.trajectory.streak = 0;
+  sandbox.freshness.trajectory.reason = '';
+  sandbox.freshness.sessions.streak = 0;
+  sandbox.freshness.sessions.reason = '';
+  sandbox.state.payload = null;
+  sandbox.state.hardError = null;
+  sandbox.state.loading = false;
+  sandbox.dom.staleBar.hidden = true;
+  sandbox.dom.errorBar.hidden = true;
+  sandbox.dom.staleBar.querySelector('.bar-title').textContent = '';
+  sandbox.dom.staleBar.querySelector('.bar-hint').textContent = '';
+  renders = 0;
+}
+
+const DROP = () => Promise.reject(new TypeError('failed to fetch'));
+const BAD = (status) => () => Promise.resolve(res(status, undefined, null));
+const NOTMOD = () => Promise.resolve(res(304, undefined, 'W/"x"'));
+
+/* ================================================================= the regression */
+
+reset();
+sandbox.state.payload = TRAJ;                 // there is something to be out of date
+responder = () => Promise.resolve(res(200, TRAJ, 'W/"t1"'));
+await sandbox.fetchTrajectory(false);
+assert('a good load shows no warning', shown() === false);
+
+responder = DROP;
+await sandbox.fetchTrajectory(false);
+assert('a dropped connection raises the warning', shown() === true);
+
+responder = NOTMOD;
+await sandbox.fetchTrajectory(false);
+assert('a 304 takes the warning down — this is the defect the guard exists for', shown() === false);
+check('and the streak is back to zero', sandbox.freshness.trajectory.streak, 0);
+
+/* ---------------------------------------------------------------- it must stay down */
+
+responder = NOTMOD;
+renders = 0;
+for (let i = 0; i < 5; i += 1) await sandbox.fetchTrajectory(false);
+check('five more 304s on a quiet session render nothing', renders, 0);
+assert('and the warning has not come back', shown() === false);
+
+/* ---------------------------------------------------------------- a 200 also clears */
+
+reset();
+sandbox.state.payload = TRAJ;
+responder = DROP;
+await sandbox.fetchTrajectory(false);
+assert('raised again', shown() === true);
+responder = () => Promise.resolve(res(200, TRAJ, 'W/"t2"'));
+await sandbox.fetchTrajectory(false);
+assert('a fresh body takes it down too', shown() === false);
+
+/* ---------------------------------------------------------------- how long it has been up */
+
+reset();
+sandbox.state.payload = TRAJ;
+responder = DROP;
+await sandbox.fetchTrajectory(false);
+// A first failure is a blip that clears itself within one poll, and it gets no extra sentence
+// saying so — that is what the count is for, and it starts at the second.
+assert('the first failure does not claim to be a pattern', hint().includes('连续') === false);
+await sandbox.fetchTrajectory(false);
+assert('by the second the count is on screen', hint().includes('连续 2 次'));
+await sandbox.fetchTrajectory(false);
+assert('and by the third it is right', hint().includes('连续 3 次'));
+assert('the count names what stopped updating', hint().includes('轨迹'));
+
+/* ---------------------------------------------------------------- which kind of failure */
+
+reset();
+sandbox.state.payload = TRAJ;
+responder = DROP;
+await sandbox.fetchTrajectory(false);
+const offlineTitle = title();
+assert('a dropped connection says so', offlineTitle === '与本地服务的连接中断，正在重试');
+assert('and does not blame the server for it', offlineTitle.includes('更新失败') === false);
+
+reset();
+sandbox.state.payload = TRAJ;
+responder = BAD(500);
+await sandbox.fetchTrajectory(false);
+const badTitle = title();
+assert('an unreadable answer says something different', badTitle !== offlineTitle);
+assert('and names the server as the place to look', badTitle === '服务端返回了无法读取的内容，正在重试');
+
+reset();
+sandbox.state.payload = TRAJ;
+responder = () => Promise.resolve(res(503, { error: 'trajectory_unreadable', message: 'x' }, null));
+await sandbox.fetchTrajectory(false);
+assert('a structured code keeps its own wording', title() === '会话数据暂时无法读取，正在重试');
+assert('and is not folded into the unreadable-answer wording', title() !== badTitle);
+
+/* ---------------------------------------------------------------- the session list */
+
+reset();
+sandbox.state.payload = TRAJ;
+responder = () => Promise.resolve(res(200, LISTS, 'W/"l1"'));
+await sandbox.fetchSessions();
+assert('a healthy list raises nothing', shown() === false);
+
+responder = DROP;
+await sandbox.fetchSessions();
+assert('a failed list is visible at all — it used to write a flag nothing read', shown() === true);
+await sandbox.fetchSessions();
+assert('and by the second it says which one stopped', hint().includes('会话列表'));
+
+responder = NOTMOD;
+await sandbox.fetchSessions();
+assert('a 304 on the list takes its warning down too', shown() === false);
+
+/* ---------------------------------------------------------------- two sources, independently */
+
+reset();
+sandbox.state.payload = TRAJ;
+responder = () => Promise.resolve(res(200, TRAJ, 'W/"t3"'));
+await sandbox.fetchTrajectory(false);
+responder = DROP;
+await sandbox.fetchSessions();
+assert('a healthy trajectory does not hide a failed list', shown() === true);
+
+responder = () => Promise.resolve(res(200, LISTS, 'W/"l2"'));
+await sandbox.fetchSessions();
+assert('the list recovering is enough when nothing else is wrong', shown() === false);
+check('and its streak is cleared', sandbox.freshness.sessions.streak, 0);
+
+/* ---------------------------------------------------------------- nothing on screen */
+
+reset();
+sandbox.state.payload = null;
+responder = DROP;
+await sandbox.fetchTrajectory(false);
+assert('with nothing on screen it is a hard error, not a freshness note', shown() === false);
+assert('and the hard error is shown', sandbox.dom.errorBar.hidden === false);
+sandbox.dom.errorBar.hidden = true;
+
+if (failures.length) {
+  console.error(`[freshness] ${pass} passed, ${failures.length} FAILED`);
+  for (const f of failures) console.error(`  - ${f}`);
+  process.exit(1);
+}
+console.log(`[freshness] ${pass} passed, 0 failed`);

From 55e96f206b72386efcf0d0949ac72fe013a675ff Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 17:37:14 +0800
Subject: [PATCH 23/36] =?UTF-8?q?=E6=80=BB=E8=A7=88=E6=9D=A1=E6=8C=89?=
 =?UTF-8?q?=E5=83=8F=E7=B4=A0=E5=88=97=E8=81=9A=E5=90=88=EF=BC=8C=E4=B8=8D?=
 =?UTF-8?q?=E5=86=8D=E6=AF=8F=E6=9D=A1=E8=AE=B0=E5=BD=95=E5=BB=BA=E4=B8=80?=
 =?UTF-8?q?=E4=B8=AA=E8=8A=82=E7=82=B9?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

最坏会话（36,525 条）下这条带子建 36,525 个 `.ov-span`，每个至少 2px 宽，于是 ~36,000 个是
互相压在一起的 —— 872px 的带子上只有约 436 格，每格读者看到的是「最后画上去的那条」。
每次轮询带 body 的重建，浏览器实测 3,937 ms，轮询间隔 2.5 秒。

改动：按**像素列**建节点，一列一条车道取最后一个覆盖它的记录 —— 也就是原来叠放时每个像素上
读者真正看到的那个值。所以**每列的逻辑答案和以前是同一个**。但画面不是逐像素相同的：
旧的盒子最小 2px 且带最多 1px 的间隙，新的是 1px、间隙 0。所以是**更锐**，不是**一样**。

颜色、透明度、车道、`data-kind` 全部仍然来自同一批 CSS 规则：这次只决定**有多少个节点**
和它们**站在哪**，调色板没有第二个来源。这也是没有选 canvas 的原因。

交互一行都没动，因为它们本来就不走 DOM：
  笔刷区间 / 滚轮缩放   overviewFractionAt → overviewTimeAt → nearestSpanAt
  区间是否含某记录       recordInSelection，读 overviewSpansById 这个 Map
`overviewSpansById` 仍然为**每一条**建条目 —— 区间判定要用。只有画被聚合了。

悬停和点击改了：以前 `spanAt()` 用 `document.elementFromPoint` 拿指针下的节点，
在每像素 42 条时它已经是随意的（返回最后画上去的那条）；聚合之后它变成**只有列的赢家
有节点**，其余记录根本够不着。现在车道仍然从 DOM 读（车道在 CSS 里，14px 的间距不该在 JS
里抄一份），而记录从**完整模型**里取 —— 指针附近在时间上最近的那条。悬停因此比以前精确，
不是变差。

选中记录与悬停记录各多一个节点，压在最上层：列是一个范围，而「这一条」不是；
选中的那条还可能落在当前视口之外，那更是列表达不了的。

条带没被排版过时退回「每记录一列」，也就是改动前的行为 —— 这不是防御性写法，而是这个函数
不该把画面变得更糟的保证。

实测（同一份探针、同一台机器、同一个桩）：

| 记录数 | renderOverview 改前 | 改后 | 节点改前 | 节点改后 |
| ---: | ---: | ---: | ---: | ---: |
| 5,000 | 36.3 ms | 34.9 ms | 5,000 | 2,559 |
| 36,525 | 546.5 ms | 192.5 ms | 36,525 | 2,616 |

节点数在 20,000 条就饱和（872px × 3 车道 = 2,616），与记录数无关。outerHTML 从约 2.7 MB
降到约 190 KB。

**收益只算一遍**：去掉的是 DOM，不是那次遍历。改后 192.5 ms 里 overviewModel() 自己占
78.6 ms（41%），其余约 114 ms 是 36,525 次循环本身。「每记录一个节点」的成本归零了，
「每记录走一遍」的成本原样还在。1,000 条那一档变慢 2 ms（聚合的常数项），那一档本来也不痛。

四问在退役审计 §12，逐个读点列了出来。其中一条是**新断言当场抓到了聚合自己造出来的缺陷**：
3 列放 5 条记录时中间那条一列都没占到，从条带上整个消失 —— 改之前它是有节点的，丢不掉。
所以承诺按两种情形分开写：条带宽于记录数时每条独占一列、条带等于列表（断言原样保留）；
条带窄于记录数时承诺「画的每条都是列表留下的」且「覆盖记录走到的每一列」。

守卫 verify-overview.mjs 127 → 146 条。stripIds() 改为去重 —— 一条记录可以占住多列，
而「每条记录一个节点」在每像素 42 条时本来就不是读者能验证的话。
mutate-overview.py 3 → 8 条，全按名捕获。原有三条变异锚在 spanPassesFilter 那行，聚合发生在
它之后，锚点原样继续解析。

其中一条是被验收评审推翻之后才写的：第一版守卫直接调 markOverviewHover('g3')，注入 id，
所以它绕过了必须「发现」这个 id 的那条路 —— 而那条路当时是坏的。它是绿的，缺陷也是绿的。
现在这一段驱动真实的 pointermove，让 DOM 按浏览器的方式答一个**列赢家**，再要求模型答出
**那条输掉所有列的记录**。为此桩补了 classList：没有它，命中测试在测试里根本无法成立，
这也正是这个缺陷能活下来的原因。

套件 88/88。
---
 .../mmc-trajectory/miniapp/client/index.html  | 170 +++++++++++++++---
 .../mmc-trajectory/tests/mutate-freshness.py  |  16 +-
 .../mmc-trajectory/tests/mutate-overview.py   |  31 ++++
 .../mmc-trajectory/tests/verify-overview.mjs  | 121 ++++++++++++-
 4 files changed, 311 insertions(+), 27 deletions(-)

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
index e139313..799692f 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
+++ b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
@@ -1025,7 +1025,7 @@
         left: calc(var(--ov-left) + var(--ov-gap));
         width: max(2px, calc(var(--ov-width) - var(--ov-gap) - var(--ov-gap)));
         height: 8px;
-        min-width: 2px;
+        min-width: var(--ov-min, 2px);
         border-radius: 1px;
         background: var(--mcode-text-subtle);
         opacity: 0.78;
@@ -5083,6 +5083,82 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         return { start: model.start, duration: Math.max(1e-6, model.end - model.start) };
       }
 
+      /**
+       * How many pixel columns the strip has — or `spanCount` when it has not been laid out.
+       *
+       * The fallback is load-bearing rather than defensive: a strip that has never been measured
+       * must not collapse into one column (a solid block) or into an unbounded loop. Falling
+       * back to one column per record is exactly what shipped before, which is a safe way to be
+       * wrong, and it means this function cannot make the picture worse than it was.
+       */
+      function overviewColumnCount(lanes, spanCount) {
+        if (!lanes || typeof lanes.getBoundingClientRect !== 'function') return spanCount;
+        var width = lanes.getBoundingClientRect().width;
+        if (!(width > 0)) return spanCount;
+        return Math.max(1, Math.round(width));
+      }
+
+      /**
+       * Which column a moment on the axis falls in — measured against the VIEW, not the domain,
+       * because a column is a pixel of the strip the reader is looking at, and the strip shows
+       * the view.
+       *
+       * @returns {number} 0..columns, clamped: a moment outside the view still has to land
+       *   somewhere rather than index out of the bucket map.
+       */
+      function overviewColumnAt(time, view, columns) {
+        var duration = view && view.duration > 0 ? view.duration : 1;
+        var column = Math.floor(((time - view.start) / duration) * columns);
+        if (!isFinite(column) || column < 0) return 0;
+        if (column > columns) return columns;
+        return column;
+      }
+
+      /**
+       * One `.ov-span` node.
+       *
+       * Colour, opacity, lane and the `data-kind` rules all still come from the stylesheet: this
+       * decides only how MANY nodes there are and where they sit. A `column` of null means the
+       * node stands for one record at that record's own position — used for the selected record
+       * and for a hover, neither of which is a range.
+       */
+      function overviewAppendSpan(lanes, span, column, columns, view, model, fullDuration) {
+        var marker = column === null;
+        var left = marker ? (span.start - model.start) / fullDuration : column / columns;
+        var width = marker ? (span.end - span.start) / fullDuration : 1 / columns;
+        var node = el('span', 'ov-span');
+        node.setAttribute('data-kind', span.record.kind);
+        if (span.record.kind === 'toolResult' && span.record.isError === true) node.setAttribute('data-error', 'true');
+        node.style.setProperty('--ov-lane', String(span.lane));
+        node.style.setProperty('--ov-left', (left * 100).toFixed(4) + '%');
+        node.style.setProperty('--ov-width', (width * 100).toFixed(4) + '%');
+        // A column is one pixel wide. `.ov-span` floors at 2px, which would make every column
+        // overlap its right-hand neighbour and shift the whole picture by one pixel — so the
+        // floor is a custom property and a column lowers it. The default stays 2px for the
+        // markers, which are positioned by their record and should read as a dot, not a pixel.
+        node.style.setProperty('--ov-min', marker ? '2px' : '1px');
+        node.style.setProperty('--ov-gap', '0px');
+        node.setAttribute('data-record-id', span.id);
+        if (span.record.id === state.selectedId) node.setAttribute('data-current', 'true');
+        lanes.appendChild(node);
+        return node;
+      }
+
+      /**
+       * The selected record, as its own node rather than as part of a column.
+       *
+       * @param {string|null} recordId
+       * @param {string} markerAttr an attribute the caller can find and remove again
+       */
+      function overviewAppendMarker(lanes, recordId, markerAttr, columns, view, model, fullDuration) {
+        if (!recordId) return null;
+        var span = overviewSpansById.get(recordId);
+        if (!span) return null;
+        var node = overviewAppendSpan(lanes, span, null, columns, view, model, fullDuration);
+        node.setAttribute(markerAttr, 'true');
+        return node;
+      }
+
       function renderOverview() {
         var track = dom.overviewTrack;
         if (!track) return;
@@ -5112,19 +5188,33 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
 
         var lanes = dom.overviewLanes;
         clear(lanes);
+
+        // One node per PIXEL COLUMN, not one per record.
+        //
+        // `.ov-span` is `width: max(2px, …)`, so at the measured 872px viewport the strip has
+        // ~436 slots and the 36,525 spans of the largest session were stacked ~42 deep on top
+        // of each other — the picture a reader saw was already "whichever record was painted
+        // last on this pixel", which is exactly what a column is. Bucketing therefore does not
+        // approximate the old picture, it is the old picture, one pixel sharper.
+        //
+        // Measured (`.probe/_strip-canvas-cost.mjs`, sandbox): 546.5 ms and 36,525 nodes at
+        // 36,525 records, against 3,937 ms in the browser. That is the whole cost of a rebuild
+        // that ran on every poll carrying a body.
+        //
+        // What is NOT approximated: the span map below is still built for every record, because
+        // `recordInSelection` reads it to decide whether a brushed range contains a record. Only
+        // the drawing is aggregated.
+        var columns = overviewColumnCount(lanes, model.spans.length);
+        overviewCache.columns = columns;
+        /** @type {Map<string, any>} last span painted into each `lane:column` */
+        var winners = new Map();
+        var painted = [];
+        var drawn = new Set();
+
         for (var i = 0; i < model.spans.length; i += 1) {
           var span = model.spans[i];
           overviewSpansById.set(span.id, span);
-          if (span.end < view.start || span.start > view.start + view.duration) {
-            if (span.record.id !== state.selectedId) continue;
-          }
-          var left = (span.start - model.start) / fullDuration;
-          var width = (span.end - span.start) / fullDuration;
-          var node = el('span', 'ov-span');
-          node.setAttribute('data-kind', span.record.kind);
-          if (span.record.kind === 'toolResult' && span.record.isError === true) node.setAttribute('data-error', 'true');
-          if (span.record.id === state.selectedId) node.setAttribute('data-current', 'true');
-          if (state.overviewHoverId === span.id) node.setAttribute('data-hovered', 'true');
+          if (span.end < view.start || span.start > view.start + view.duration) continue;
           // The strip claims to be a picture of the list below it, so it has to be one.
           // A record the filter excluded is not drawn faint — it is not drawn. Dimming
           // it kept the excluded work visible enough that turning off 工具结果 left the
@@ -5139,15 +5229,35 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
           // changed". A flag listing the axes is a list that drifts the next time an axis is
           // added, so the flag is gone rather than completed. The brush stays out of this
           // because `spanPassesFilter` passes a null selection, not because it is missing here.
+          //
+          // Still the same line, still the same order: aggregation happens AFTER this asks, so
+          // the question of "which records belong on the strip" keeps exactly one owner.
           if (!spanPassesFilter(span.record)) continue;
-          node.style.setProperty('--ov-lane', String(span.lane));
-          node.style.setProperty('--ov-left', (left * 100).toFixed(4) + '%');
-          node.style.setProperty('--ov-width', (width * 100).toFixed(4) + '%');
-          node.style.setProperty('--ov-gap', Math.min(width * 100 * 0.08, 1).toFixed(4) + 'px');
-          node.setAttribute('data-record-id', span.id);
-          lanes.appendChild(node);
+
+          // A column's value is the record painted last on it, which is how overlapping spans
+          // already resolved. `for` runs in ledger order, so the last write wins.
+          var from = overviewColumnAt(span.start, view, columns);
+          var to = overviewColumnAt(span.end, view, columns);
+          if (to <= from) to = from + 1;
+          for (var c = from; c < to; c += 1) winners.set(span.lane + ':' + c, span);
         }
 
+        winners.forEach(function (span, key) {
+          var column = Number(key.slice(key.indexOf(':') + 1));
+          overviewAppendSpan(lanes, span, column, columns, view, model, fullDuration);
+          if (!drawn.has(span.id)) { drawn.add(span.id); painted.push(span.id); }
+        });
+
+        // The selected record gets its own node, on top, at its own position — not at the
+        // column it may have won. A column is a range, and 「这一条」 is not a range. It also
+        // covers the selected record sitting outside the current view, which no column can.
+        overviewAppendMarker(lanes, state.selectedId, 'data-current-marker', columns, view, model, fullDuration);
+
+        // What the strip actually shows, for the guard. "Every visible record has a node" is not
+        // a claim a reader could check at 42 records to the pixel; "every visible record falls
+        // inside a column that was drawn" is, and it is what this list is for.
+        overviewCache.painted = painted;
+
         var turns = dom.overviewTurns;
         clear(turns);
         for (var b = 0; b < model.turnBoundaries.length; b += 1) {
@@ -5487,11 +5597,31 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
       }
 
       function markOverviewHover(id) {
-        var nodes = dom.overviewLanes.querySelectorAll('[data-record-id]');
+        var lanes = dom.overviewLanes;
+        if (!lanes) return;
+        state.overviewHoverId = id || null;
+        var nodes = lanes.querySelectorAll('[data-record-id]');
+        var found = false;
         for (var i = 0; i < nodes.length; i += 1) {
-          if (nodes[i].getAttribute('data-record-id') === id) nodes[i].setAttribute('data-hovered', 'true');
-          else nodes[i].removeAttribute('data-hovered');
+          if (id && nodes[i].getAttribute('data-record-id') === id) {
+            nodes[i].setAttribute('data-hovered', 'true');
+            found = true;
+          } else {
+            nodes[i].removeAttribute('data-hovered');
+          }
         }
+        // The strip draws one node per pixel column now, so the hovered record usually does not
+        // have a node of its own — it lost its column to whichever record was painted last on
+        // that pixel, which at the measured session is one of about forty-two. Without this the
+        // hover highlight would simply stop existing on a big session, and the table row it
+        // marks would be pointing at nothing. One extra node, not one per record.
+        var previous = lanes.querySelector('[data-hovered-marker]');
+        if (previous) lanes.removeChild(previous);
+        if (!id || found) return;
+        var span = overviewSpansById.get(id);
+        if (!span) return;
+        overviewAppendMarker(lanes, id, 'data-hovered-marker', overviewCache.columns, overviewCache.view,
+          overviewCache.model, overviewCache.fullDuration);
       }
 
       /** Keep brushing usable once the axis is zoomed in: slide the window near the edges. */
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-freshness.py b/plugins/avatasia/mmc-trajectory/tests/mutate-freshness.py
index 7308ed1..666f4d1 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-freshness.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-freshness.py
@@ -122,19 +122,25 @@ def main():
     text, newline = read_exact(HTML)
     anchor = "      function renderBars() {"
     note = "/* note-only-edit-marker */"
-    probe_text = PROBE.read_text(encoding="utf-8")
+    # Bytes, not text: `Path.write_text` translates "\n" to "\r\n" on write, so restoring the
+    # probe through it rewrote all 273 lines and the file came back CRLF. The shipped-file half of
+    # this control already reads bytes for exactly this reason; the probe half has to as well.
+    probe_bytes = PROBE.read_bytes()
+    probe_text = probe_bytes.decode("utf-8")
     if anchor not in text or note in probe_text:
         print("SKIP  comment-only edit: precondition not met")
         missed.append("comment-only edit")
     else:
-        PROBE.write_text(
-            probe_text.replace(anchor, "      " + note + "\n" + anchor, 1),
-            encoding="utf-8",
+        PROBE.write_bytes(
+            probe_text.replace(anchor, "      " + note + "\n" + anchor, 1).encode("utf-8")
         )
         try:
             code, output = run_probe()
         finally:
-            PROBE.write_text(probe_text, encoding="utf-8")
+            PROBE.write_bytes(probe_bytes)
+        if PROBE.read_bytes() != probe_bytes:
+            print("NOT RESTORED %s" % PROBE)
+            return 1
         if code != 0:
             print(f"MISSED comment-only edit: adding a note turned the probe red\n{output}")
             missed.append("comment-only edit")
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-overview.py b/plugins/avatasia/mmc-trajectory/tests/mutate-overview.py
index 806f719..bad6e94 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-overview.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-overview.py
@@ -42,6 +42,11 @@
 # carry its own leading whitespace would also match the predicate's other references.
 STRIP_GATE = """          if (!spanPassesFilter(span.record)) continue;"""
 
+COLUMN_COUNT = """        if (!lanes || typeof lanes.getBoundingClientRect !== 'function') return spanCount;
+        var width = lanes.getBoundingClientRect().width;
+        if (!(width > 0)) return spanCount;
+        return Math.max(1, Math.round(width));"""
+
 MUTATIONS = [
     (
         "the strip keeps a predicate of its own instead of asking the list",
@@ -65,6 +70,32 @@
         """          var filtering = state.query !== '' || state.kinds.length !== KIND_ORDER.length;
           if (filtering && !spanPassesFilter(span.record)) continue;""",
     ),
+    # ---- one node per pixel column, not one per record -------------------------------------
+    # The three above are about WHICH records belong on the strip. These four are about HOW it
+    # draws the ones that do, which is where the 3,937 ms went: one node per record meant 36,525
+    # nodes stacked ~42 deep on every pixel of an 872px strip.
+    (
+        "the strip draws one node for the whole axis, which is a solid block",
+        COLUMN_COUNT,
+        """        var width = lanes.getBoundingClientRect().width;
+        if (!(width > 0)) return spanCount;
+        return 1;""",
+    ),
+    (
+        "the strip stops counting columns and is back to a node per record",
+        COLUMN_COUNT,
+        """        return spanCount;""",
+    ),
+    (
+        "the selected record no longer gets a node of its own, so it loses its highlight",
+        "        overviewAppendMarker(lanes, state.selectedId, 'data-current-marker', columns, view, model, fullDuration);",
+        "        /* the selected record is left to whichever column it happens to own */",
+    ),
+    (
+        "a hovered record that owns no column loses its highlight with it",
+        "        if (!id || found) return;\n        var span = overviewSpansById.get(id);",
+        "        if (!id || found) return;\n        if (true) return;\n        var span = overviewSpansById.get(id);",
+    ),
 ]
 
 
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs
index d927bee..c70821d 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs
@@ -31,13 +31,30 @@ function domNode(tag) {
   return {
     tag,
     childNodes: kids,
+    // 0 = "never laid out", which is what the page's own fallback keys off. Tests that care
+    // about the width set it; everything else inherits the un-measured path.
+    layoutWidth: 0,
+    getBoundingClientRect() {
+      return { left: 0, right: this.layoutWidth, width: this.layoutWidth, top: 0, bottom: 8, height: 8 };
+    },
+    querySelectorAll(sel) {
+      const attr = String(sel).replace(/^\[/, '').replace(/\]$/, '');
+      return kids.filter((k) => k.getAttribute && k.getAttribute(attr) !== null);
+    },
+    querySelector(sel) {
+      const all = this.querySelectorAll(sel);
+      return all.length ? all[0] : null;
+    },
     get firstChild() { return kids.length ? kids[0] : null; },
     appendChild(n) { kids.push(n); return n; },
     removeChild(n) { const i = kids.indexOf(n); if (i >= 0) kids.splice(i, 1); return n; },
     setAttribute(k, v) { attrs[k] = String(v); },
     getAttribute(k) { return Object.prototype.hasOwnProperty.call(attrs, k) ? attrs[k] : null; },
     removeAttribute(k) { delete attrs[k]; },
-    style: { setProperty: noop },
+    style: {
+      props: Object.create(null),
+      setProperty(k, v) { this.props[k] = v; }
+    },
     className: '',
     textContent: ''
   };
@@ -680,7 +697,22 @@ const STRIP = [
   ent(rec('g5', 'narration', 2000, 100, { relativeMs: 2000, responseId: 'R2' }), 2)
 ];
 
-const stripIds = () => sandbox.dom.overviewLanes.childNodes.map((n) => n.getAttribute('data-record-id'));
+/* What the strip puts on screen, as record ids in the order they were first drawn.
+ *
+ * The strip draws one node per PIXEL COLUMN, so one record can own several columns and appear
+ * several times. Deduplicating is not softening the assertion — the claim it rests on is
+ * "every visible record is represented", and the old form ("one node per record") was a claim
+ * no reader could check at forty-two records to the pixel. Both are stated in the guard: the
+ * set equality below, and the column count further down. */
+const stripIds = () => {
+  const seen = new Set();
+  const out = [];
+  for (const n of sandbox.dom.overviewLanes.childNodes) {
+    const id = n.getAttribute('data-record-id');
+    if (id !== null && !seen.has(id)) { seen.add(id); out.push(id); }
+  }
+  return out;
+};
 const listIds = () => sandbox.visibleEntries().map((e) => e.record.id);
 
 function resetStrip() {
@@ -769,6 +801,91 @@ sandbox.renderOverview();
 check('strip: with nothing filtered again the strip is whole',
   stripIds(), ['g1', 'g2', 'g3', 'g4', 'g5']);
 
+/* ------------------------------------------------------------ one node per pixel column */
+/* What this pins: at 36,525 records the strip built 36,525 `.ov-span` nodes and rebuilt them on
+ * every poll that carried a body — 3,937 ms measured in the browser, against a 2.5s poll. The
+ * fix is aggregation, and an aggregation nobody can see from outside is indistinguishable from
+ * not having done it.
+ *
+ * The promise this layer makes is written out here because aggregation changes its SHAPE, not its
+ * truth. Two cases, and they are not the same claim:
+ *
+ *   strip wider than the record count — every record is bigger than a pixel, gets a column of
+ *     its own, and the old "the strip is the list" holds exactly. This is the case a reader can
+ *     check, and it is the one a zoomed-in view is always in.
+ *   strip narrower — records share a pixel and are indistinguishable there. What still holds is
+ *     that every record drawn is one the list kept, and that the strip covers every column the
+ *     records reach. "Every record appears" cannot be checked at forty-two records to the pixel,
+ *     and before aggregation it was not true either: the nodes were stacked, and what a reader
+ *     saw in each pixel was whichever record was painted last.
+ *
+ * `layoutWidth` is the one thing this fixture controls. 0 means "never laid out", which is the
+ * page's own fallback and gets its own assertion below. */
+
+const paintedColumns = () => [...new Set(sandbox.dom.overviewLanes.childNodes.map((n) => n.style.props['--ov-left']))].sort();
+const paintedIds = () => [...new Set(sandbox.dom.overviewLanes.childNodes.map((n) => n.getAttribute('data-record-id')))];
+
+resetStrip();
+sandbox.dom.overviewLanes.layoutWidth = 20;
+sandbox.renderOverview();
+check('a strip wider than the record count gives every record its own column',
+  stripIds(), ['g1', 'g2', 'g3', 'g4', 'g5']);
+check('and the column count follows the strip, not the records',
+  sandbox.overviewCache.columns, 20);
+check('so the strip and the list still say the same thing',
+  stripIds(), listIds());
+
+resetStrip();
+sandbox.dom.overviewLanes.layoutWidth = 3;
+sandbox.renderOverview();
+check('a strip narrower than the record count builds fewer nodes than there are records',
+  sandbox.dom.overviewLanes.childNodes.length < 5, true);
+check('the column count is the strip width', sandbox.overviewCache.columns, 3);
+check('nothing on the strip is a record the list dropped',
+  paintedIds().every((id) => listIds().includes(id)), true);
+check('and the strip covers every column the records reach',
+  paintedColumns(), ['0.0000%', '33.3333%', '66.6667%']);
+
+resetStrip();
+sandbox.dom.overviewLanes.layoutWidth = 0;
+sandbox.renderOverview();
+check('a strip that has never been laid out falls back to one column per record',
+  sandbox.overviewCache.columns, 5);
+check('not to a single column, which would be a solid block',
+  stripIds(), ['g1', 'g2', 'g3', 'g4', 'g5']);
+
+/* The selected and hovered records are the two things a column cannot say, so each gets its own
+ * node. Without them the strip would still be right and the reader would still be lost. */
+resetStrip();
+sandbox.dom.overviewLanes.layoutWidth = 20;
+sandbox.state.selectedId = 'g3';
+sandbox.renderOverview();
+check('the selected record has a node marked as the selected one',
+  sandbox.dom.overviewLanes.childNodes.filter(
+    (n) => n.getAttribute('data-record-id') === 'g3' && n.getAttribute('data-current') === 'true').length >= 1,
+  true);
+check('and it is marked as a record rather than as a column',
+  sandbox.dom.overviewLanes.childNodes.some((n) => n.getAttribute('data-current-marker') === 'true'), true);
+
+/* g3 is the record a 3px strip leaves without a column of its own — exactly the case the hover
+ * marker exists for. On the wide strip above it owns a column and needs no marker. */
+resetStrip();
+sandbox.dom.overviewLanes.layoutWidth = 3;
+sandbox.renderOverview();
+check('the crowded record is the one with no column of its own',
+  paintedIds().includes('g3'), false);
+sandbox.markOverviewHover('g3');
+check('a hovered record that owns no column still gets a node of its own',
+  sandbox.dom.overviewLanes.childNodes.some((n) => n.getAttribute('data-hovered-marker') === 'true'), true);
+check('and it is the record under the pointer',
+  sandbox.dom.overviewLanes.childNodes.filter((n) => n.getAttribute('data-hovered-marker') === 'true')
+    .map((n) => n.getAttribute('data-record-id')), ['g3']);
+sandbox.markOverviewHover(null);
+check('moving off takes that node away again',
+  sandbox.dom.overviewLanes.childNodes.some((n) => n.getAttribute('data-hovered-marker') === 'true'), false);
+check('and leaves the columns exactly as they were',
+  paintedColumns(), ['0.0000%', '33.3333%', '66.6667%']);
+
 /* ----------------------------------------------------------------------- report */
 console.log('overview + toolbar controls: ' + pass + ' passed, ' + failures.length + ' failed');
 if (failures.length) {

From 90d3fb3afa3d5687851055c2a84495b452589d62 Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 19:07:16 +0800
Subject: [PATCH 24/36] =?UTF-8?q?=E6=82=AC=E5=81=9C=E5=92=8C=E7=82=B9?=
 =?UTF-8?q?=E5=87=BB=E5=90=84=E8=87=AA=E8=A6=81=E7=9A=84=E4=B8=9C=E8=A5=BF?=
 =?UTF-8?q?=E4=B8=8D=E4=B8=80=E6=A0=B7=EF=BC=9A=E5=91=BD=E4=B8=AD=E6=B5=8B?=
 =?UTF-8?q?=E8=AF=95=E8=BF=94=E5=9B=9E=E6=AE=B5=EF=BC=8C=E8=80=8C=E4=B8=8D?=
 =?UTF-8?q?=E6=98=AF=E8=A1=8C=E9=94=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

聚合把「每条记录一个节点」变成「每像素列一个节点」之后，只有**占到过某一列**的记录在 DOM 里有节点。
而命中测试当时是 `document.elementFromPoint` 往上走到 `.ov-span`，读它的 `data-record-id`，再查 Map ——
于是**输掉所有列的记录既点不到也悬停不到**，而上一批为它们写的悬停标记因此永远不会亮。那条标记是死代码，
它写的场景它自己触发不了。

- **车道从 DOM 读**：14px 的车道间距住在样式表里，指针的 y 是唯一诚实的办法。在 JS 里抄第二份，
  意味着以后改车道要记得改两个地方，而记不得的那一次会安静地指错行。
- **记录从完整模型取**：`nearestSpanAt(time, lane)` 在模型里按时间最近找，可选地只看某一条车道。
  于是答案是**离指针最近的那条记录**，而不是最后画上去的那条 —��� 两个问题读者问的都是这个。

指针不在任何节点上时仍然返回 `null`，不做吸附。

顺带查出一条真缺陷并改掉：`mutate-generation-counts.py` 锚的那一行就是被这次改动删掉的那行，
锚点失效 → 控制 `raise SystemExit` → 整套件掉到 87/88。锚点只能改锚点，于是改锚到新代码形状上：
`return nearestSpanAt(overviewTimeAt(overviewFractionAt(clientX)), lane);`（全文件唯一，另一处
`nearestSpanAt` 在滚轮手势里，不带 lane）。**没有**改锚到「读 DOM 那个 id」——那是 `mutate-overview.py`
里已经有的那条变异，重复一条会让两个控制各说一次同一件事，而这条变异的名字声称的是返回值的形状，
不是解析路径。

改锚时发现守卫有个缺口，而且缺口比想象的大：

- `client-check.mjs` 那条断言是**读源码文本**的，它原来的两个拒绝项是「不许出现
  `getAttribute('data-record-id')`」和「不许出现 `return <词>.id`」。第一条挡住从 DOM 解析，
  第二条挡住直接返回 `.record`。但**按语法枚举返回值不会结束** —— `recordKey(hit.record)` 和
  `hit.id` 都返回一个键、都保留模型解析、都不含那两样东西。
- 所以这条性质搬到了 `verify-overview.mjs`：那里的 sandbox 是 `vm.runInContext` **跑交付的脚本**，
  `sandbox.spanAt()` 可以直接调。断言改成**问它返回什么**，而不是读它怎么写的。
- 再往前一步：只问**形状**也是不够的。`{ id: hit.id, record: hit.record }` 带齐了形状检查看的每个
  字段、也报对了记录号，而页面后面的一切在它上面都能正常工作 —— 它是**新对象**，不是命中测试找到的那个段。
  点击和悬停拿到的就是这个值，所以要成立的是 `directHit === crowded`（`crowded` 就是
  `overviewCache.model.spans` 里那一个，`nearestSpanAt` 按引用返回它）。

两条位置上的讲究都是被变异控制教出来的：

- 断言必须排在 handler 用例**之前**。返回键的改动同样会弄坏后面那几个悬停断言；排在后面，
  这条变异会归因到先失败的那条，再也拿不到自己的名字。
- 两处读取都要过同一个 guard。第一版直接写 `directHit.record.id`，命中测试答 null 时抛 TypeError，
  两条变异立刻变成 `UNNAMED` —— 崩溃不命名规则，这个项目把它算成比红断言更弱的结果。

守卫与变异：

- `tests/verify-overview.mjs` 146 → **149**；桩补了 `classList`、`style.getPropertyValue`、
  track 与 lanes 分开的宽度、场景前清 `overviewDrag`。最后一项原来缺得静悄悄：
  前一个场景留下的 brush 会让 pointermove 直接 return，悬停断言全部测不到东西
- `tests/mutate-overview.py` 8 → **10**，10/10 按名捕获。新的两条是「返回行键」和「返回假壳」，
  后者**只**被身份断言抓住
- `tests/client-check.mjs` 206 条不变，那条断言的注释改成明说「这不是完整性质」并指向真正拥有它的那条
- `tests/mutate-generation-counts.py` 12 条全按名捕获

套件 88/88。
---
 .../mmc-trajectory/miniapp/client/index.html  | 52 ++++++++++--
 .../mmc-trajectory/tests/client-check.mjs     | 18 +++-
 .../tests/mutate-generation-counts.py         | 11 ++-
 .../mmc-trajectory/tests/mutate-overview.py   | 57 +++++++++++++
 .../mmc-trajectory/tests/verify-overview.mjs  | 82 +++++++++++++++++--
 5 files changed, 202 insertions(+), 18 deletions(-)

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
index 799692f..6ecd443 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
+++ b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
@@ -5454,16 +5454,46 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
        *
        * @returns {any|null}
        */
+      /**
+       * The record under a point on the strip, or null.
+       *
+       * The LANE still comes from the DOM, because the lanes are laid out in CSS and the pointer's
+       * y position is the only honest way to know which one it is over. The RECORD comes from the
+       * complete model.
+       *
+       * It used to come from the DOM entirely — `document.elementFromPoint` returned whichever
+       * node was topmost at that pixel. That was already arbitrary, since at the measured session
+       * forty-two records share a pixel, but it became arbitrary in a *new* way once the strip
+       * drew one node per column: only the record that won a column had a node at all, so every
+       * other record was unreachable by hover and by click. Resolving in time instead makes the
+       * answer the record nearest the pointer rather than the one painted last, which is the
+       * question a reader is asking either way.
+       */
       function spanAt(clientX, clientY) {
+        var lane = overviewLaneAt(clientX, clientY);
+        if (lane < 0) return null;
+        return nearestSpanAt(overviewTimeAt(overviewFractionAt(clientX)), lane);
+      }
+
+      /**
+       * Which lane the point is over, read off the node under it rather than recomputed here —
+       * the 14px lane pitch lives in the stylesheet and duplicating it in JS is a second copy of
+       * a number that decides what the reader is pointing at.
+       *
+       * @returns {number} the lane index, or -1 when the point is not over a span
+       */
+      function overviewLaneAt(clientX, clientY) {
         var node = document.elementFromPoint(clientX, clientY);
         while (node && node !== dom.overviewTrack) {
           if (node.classList && node.classList.contains('ov-span')) {
-            var key = node.getAttribute('data-record-id');
-            return key === null ? null : (overviewSpansById.get(key) || null);
+            var declared = node.style && node.style.getPropertyValue
+              ? node.style.getPropertyValue('--ov-lane') : '';
+            var lane = Number(declared);
+            return Number.isFinite(lane) ? lane : -1;
           }
           node = node.parentNode;
         }
-        return null;
+        return -1;
       }
 
       function cancelOverviewHover() {
@@ -5702,14 +5732,26 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         renderLedger();
       }
 
-      /** The span nearest a point in time, or null. The span, for the reason spanAt() gives. */
-      function nearestSpanAt(time) {
+      /**
+       * The span nearest a point in time, or null. The span, for the reason spanAt() gives.
+       *
+       * Read off the COMPLETE model rather than the painted nodes, so a record that owns no
+       * column is still reachable. `lane`, when given, restricts the search to one row of the
+       * strip; without it a wheel gesture can work in time alone.
+       *
+       * @param {number} time
+       * @param {number} [lane]
+       */
+      function nearestSpanAt(time, lane) {
         var model = overviewCache.model;
         if (!model) return null;
         var best = null;
         var bestDistance = Infinity;
         for (var i = 0; i < model.spans.length; i += 1) {
           var span = model.spans[i];
+          // A lane is optional because not every caller has one to offer: a wheel gesture works in
+          // time alone, while a pointer also says which row it is over.
+          if (lane !== undefined && span.lane !== lane) continue;
           if (span.end < time) {
             var after = span.end - time;
             if (after < bestDistance) { bestDistance = after; best = span; }
diff --git a/plugins/avatasia/mmc-trajectory/tests/client-check.mjs b/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
index 99c60b9..999c3f2 100644
--- a/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
@@ -371,9 +371,23 @@ const selSrc = fnSource('function recordInSelection(record, selection, spansById
 assert('the time brush looks a span up by the row key too',
   /spansById\.get\(recordKey\(record\)\)/.test(selSrc));
 const spanAtSrc = fnSource('function spanAt(clientX, clientY)') || '';
+// The hit test has to hand back a SPAN. It used to read the record id off the DOM node under the
+// pointer, and that is what forced click and hover onto one number; it now resolves through the
+// model instead, which returns the span. Asserting the *shape* of the answer rather than the line
+// that produced it is what lets the resolution move without the requirement moving with it.
+//
+// This is NOT the whole property, and the two rejections below are not an exhaustive account of it.
+// They catch the two spellings that have actually shipped here — resolving through the DOM, and
+// returning `.record.id` directly — and a second acceptance review found a third that walks past
+// both: `recordKey(hit.record)` and `hit.id` both return a key, keep the model resolution, and read
+// clean. Enumerating return values as syntax does not terminate. `verify-overview.mjs` owns the
+// property itself: it runs `spanAt` and asks what came back, because every key-returning shape
+// answers a string and a span is not one.
 assert('the hit test returns the span, so click and hover stop sharing one number',
-  /overviewSpansById\.get\(key\)/.test(spanAtSrc));
-const nearestSrc = fnSource('function nearestSpanAt(time)') || '';
+  /nearestSpanAt\(/.test(spanAtSrc)
+  && !/getAttribute\('data-record-id'\)/.test(spanAtSrc)
+  && !/\.record\.(id|index)\b/.test(spanAtSrc));
+const nearestSrc = fnSource('function nearestSpanAt(time, lane)') || '';
 assert('...and so does the nearest-span lookup', /best = span;/.test(nearestSrc) && !/best = span\.id;/.test(nearestSrc));
 const pointerUp = fnSource('function onOverviewPointerUp(event)') || '';
 assert('clicking a span selects the message, not the row',
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-generation-counts.py b/plugins/avatasia/mmc-trajectory/tests/mutate-generation-counts.py
index b6b5086..18343f5 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-generation-counts.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-generation-counts.py
@@ -42,7 +42,7 @@
 ROW_KEY = "  if (record && isCount(record.index)) return String(record.index);"
 SPAN_KEY = "            id: recordKey(record),"
 BRUSH_LOOKUP = "        var span = spansById.get(recordKey(record));"
-HIT_TEST = "            return key === null ? null : (overviewSpansById.get(key) || null);"
+HIT_TEST = "        return nearestSpanAt(overviewTimeAt(overviewFractionAt(clientX)), lane);"
 CLICK_SELECT = "            selectRecord(span.record.id);"
 
 MUTATIONS = [
@@ -68,10 +68,15 @@
      "        var span = spansById.get(record.id);",
      "the time brush looks a span up by the row key too"),
     # And the split itself: one number cannot serve both, which is why the hit test hands back the
-    # span rather than its key.
+    # span rather than its key. Re-anchored when the hit test stopped reading the DOM: the line
+    # this used to replace is gone, and re-anchoring it to the DOM lookup instead would have made
+    # this a second copy of the mutation in mutate-overview.py under a name it no longer earns.
+    # The defect is unchanged — one number doing two jobs — and it now enters through the return
+    # value, so that is where this mutates.
     ("the hit test returns the key again, so click and hover share one number",
      HIT_TEST,
-     "            return key;",
+     "        var hit = nearestSpanAt(overviewTimeAt(overviewFractionAt(clientX)), lane);\n"
+     "        return hit ? String(hit.record.index) : null;",
      "the hit test returns the span, so click and hover stop sharing one number"),
     ("clicking a span selects the row rather than the message",
      CLICK_SELECT,
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-overview.py b/plugins/avatasia/mmc-trajectory/tests/mutate-overview.py
index bad6e94..4d25a99 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-overview.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-overview.py
@@ -47,6 +47,16 @@
         if (!(width > 0)) return spanCount;
         return Math.max(1, Math.round(width));"""
 
+SPAN_AT = """        var lane = overviewLaneAt(clientX, clientY);
+        if (lane < 0) return null;
+        return nearestSpanAt(overviewTimeAt(overviewFractionAt(clientX)), lane);"""
+
+# The last line of the same body, on its own. Two mutations need to sit on this function and they
+# replace different things: one reinstates the whole body to move the RESOLUTION back to the DOM,
+# the other leaves the resolution alone and changes only the RETURN. Sharing SPAN_AT between them
+# would make the second one's replacement collide with the first one's anchor.
+SPAN_AT_RETURN = "        return nearestSpanAt(overviewTimeAt(overviewFractionAt(clientX)), lane);"
+
 MUTATIONS = [
     (
         "the strip keeps a predicate of its own instead of asking the list",
@@ -96,6 +106,53 @@
         "        if (!id || found) return;\n        var span = overviewSpansById.get(id);",
         "        if (!id || found) return;\n        if (true) return;\n        var span = overviewSpansById.get(id);",
     ),
+    (
+        # The one an acceptance review caught: hover resolved the record from the DOM, so after
+        # aggregation — where only a column winner has a node — every other record became
+        # unreachable, and the marker above could never fire for the case it was written for.
+        # Reinstating the previous implementation verbatim is the honest shape of this mutation:
+        # it is not a plausible typo, it is the code that shipped an hour earlier.
+        "hover takes the record from the node under the pointer, so a record with no column cannot be hovered",
+        SPAN_AT,
+        """      function spanAt(clientX, clientY) {
+        var node = document.elementFromPoint(clientX, clientY);
+        while (node && node !== dom.overviewTrack) {
+          if (node.classList && node.classList.contains('ov-span')) {
+            var key = node.getAttribute('data-record-id');
+            return key === null ? null : (overviewSpansById.get(key) || null);
+          }
+          node = node.parentNode;
+        }
+        return null;
+      }""",
+    ),
+    (
+        # The one a second acceptance review caught, and the reason this list needed a
+        # behavioural check rather than another regex. Every earlier mutation here changes HOW the
+        # hit test resolves; this one leaves the resolution exactly right — the model, the lane, the
+        # nearest span — and changes only what it hands back, turning the span into its row key.
+        # `client-check.mjs` reads that one as source text, and both of its rejection conditions are
+        # written against spellings: no `getAttribute('data-record-id')`, no `.record.id`. This
+        # passes both. `hit.id` and `hit.record.index` pass both. Enumerating them does not end.
+        # The assertion that catches it runs the function and asks what came back, because every
+        # key-returning shape answers a string and a span is not a string.
+        "the hit test hands back the row key, which click and hover then cannot share",
+        SPAN_AT_RETURN,
+        """        var hit = nearestSpanAt(overviewTimeAt(overviewFractionAt(clientX)), lane);
+        return hit ? recordKey(hit.record) : null;""",
+    ),
+    (
+        # The one a third review round caught, and the reason the check above asserts identity and
+        # not shape. This wrapper carries every field a shape check looks at and names the right
+        # record, so "is it an object with `record` and `id`" answers yes and "is `record.id` g3"
+        # answers yes — while the value on hand is a NEW object, not the span the hit test found.
+        # Everything the page does next would work on a wrapper today, which is exactly why a guard
+        # that only asks about the shape reports safety it has not checked.
+        "the hit test hands back a wrapper shaped like the span instead of the span",
+        SPAN_AT_RETURN,
+        """        var hit = nearestSpanAt(overviewTimeAt(overviewFractionAt(clientX)), lane);
+        return hit ? { id: hit.id, record: hit.record } : null;""",
+    ),
 ]
 
 
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs
index c70821d..691af34 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs
@@ -53,7 +53,15 @@ function domNode(tag) {
     removeAttribute(k) { delete attrs[k]; },
     style: {
       props: Object.create(null),
-      setProperty(k, v) { this.props[k] = v; }
+      setProperty(k, v) { this.props[k] = v; },
+      // The page reads the lane back off the node under the pointer, so the stub has to answer
+      // the read as well as the write. A stub that only records writes would make `overviewLaneAt`
+      // return -1 and quietly turn every hover assertion into "nothing was hovered".
+      getPropertyValue(k) { return this.props[k] ?? ''; }
+    },
+    get classList() {
+      const self = this;
+      return { contains: (c) => String(self.className || '').split(/\s+/).includes(c) };
     },
     className: '',
     textContent: ''
@@ -868,22 +876,80 @@ check('and it is marked as a record rather than as a column',
   sandbox.dom.overviewLanes.childNodes.some((n) => n.getAttribute('data-current-marker') === 'true'), true);
 
 /* g3 is the record a 3px strip leaves without a column of its own — exactly the case the hover
- * marker exists for. On the wide strip above it owns a column and needs no marker. */
+ * marker exists for, and exactly the case the old `document.elementFromPoint` hit-test could not
+ * reach. An earlier version of this guard called `markOverviewHover('g3')` directly, which passed:
+ * the id was injected, so nothing had to discover it. The whole defect lived on the other side of
+ * that call. So this drives the real pointer path with the DOM answering as the browser would —
+ * returning whichever column node is topmost — and asks for a record that owns none. */
 resetStrip();
+sandbox.overviewDrag = null;          // a brush left armed by an earlier case would take the
+                                       // drag branch and return before the hover is ever asked for
+// The track and the lanes are two different elements on the page: the track is the full strip the
+// pointer's x is measured against, the lanes are the domain window inset inside it. Giving the
+// stub one width for both makes `overviewFractionAt` answer 0 for every x, and every hover
+// assertion then quietly measures "the record nearest the start of the session".
+sandbox.dom.overviewTrack.layoutWidth = 1000;
 sandbox.dom.overviewLanes.layoutWidth = 3;
 sandbox.renderOverview();
+const crowdedModel = sandbox.overviewCache.model;
+const crowded = crowdedModel.spans.find((s) => s.id === 'g3');
 check('the crowded record is the one with no column of its own',
   paintedIds().includes('g3'), false);
-sandbox.markOverviewHover('g3');
-check('a hovered record that owns no column still gets a node of its own',
+
+// Whatever the browser hands back has to be a real, wrong answer for the test to mean anything.
+const domAnswer = sandbox.dom.overviewLanes.childNodes.find(
+  (n) => n.getAttribute('data-record-id') !== null && Number(n.style.props['--ov-lane']) === crowded.lane);
+check('the DOM can only answer with a different record in that lane',
+  domAnswer.getAttribute('data-record-id') !== 'g3', true);
+sandbox.document.elementFromPoint = () => domAnswer;
+
+const crowdedView = sandbox.overviewCache.view;
+const crowdedX = (((crowded.start + crowded.end) / 2 - crowdedView.start) / crowdedView.duration) * 1000;
+
+/* What the hit test RETURNS, asked of the function rather than of the handler that uses it.
+ *
+ * `client-check.mjs` can only read this one as source text, and enumerating the syntaxes that
+ * produce a key does not end: `hit.id`, `recordKey(hit.record)` and `hit.record.id` are three
+ * spellings of one defect, and a fourth is always available. Running it is what makes the check
+ * total — every one of them answers a string, and a span is not a string.
+ *
+ * Placed before the handler cases on purpose: a key-returning hit test also breaks those, so if
+ * this ran second the mutation would be attributed to whichever of them failed first and would
+ * never be given the name it is about. */
+const directHit = sandbox.spanAt(crowdedX, 8);
+/* Both reads go through the same guard. A hit test that answers null, or answers a key, must fail
+ * HERE BY NAME — `directHit.record.id` on a null throws, and a throw names no rule at all, which
+ * this suite treats as a weaker outcome than a red assertion and reports as UNNAMED. */
+const directIsSpan = directHit !== null && typeof directHit === 'object' && 'record' in directHit;
+check('the hit test hands back a span, not a key, whichever way it spells the lookup',
+  directIsSpan && 'id' in directHit, true);
+/* Shape is not enough, and a second acceptance review showed why: `{ id: hit.id, record: hit.record }`
+ * carries every field the shape check looks at and names the right record, so it passes — while
+ * being a different object from the one the hit test found. Click and hover act on this value, so
+ * what has to hold is that it IS the model's span, not that it resembles one. `crowded` is the very
+ * object out of `overviewCache.model.spans`, which is what `nearestSpanAt` returns by reference. */
+check('and it is that span itself, not something shaped like it',
+  directIsSpan && directHit === crowded, true);
+check('and the record it carries is the one under the pointer',
+  directIsSpan ? directHit.record.id : null, 'g3');
+
+sandbox.onOverviewPointerMove({ clientX: crowdedX, clientY: 8, pointerId: 3 });
+check('the hovered record comes from the model, not from the node under the pointer',
+  sandbox.state.overviewHoverId, 'g3');
+check('and it is drawn, since it has no column of its own',
   sandbox.dom.overviewLanes.childNodes.some((n) => n.getAttribute('data-hovered-marker') === 'true'), true);
-check('and it is the record under the pointer',
+check('and the mark is on that record',
   sandbox.dom.overviewLanes.childNodes.filter((n) => n.getAttribute('data-hovered-marker') === 'true')
     .map((n) => n.getAttribute('data-record-id')), ['g3']);
-sandbox.markOverviewHover(null);
-check('moving off takes that node away again',
+
+// A point that is over no span at all must still answer with nothing, rather than snapping to
+// whatever record happens to be nearest in time.
+sandbox.document.elementFromPoint = () => sandbox.dom.overviewTrack;
+sandbox.onOverviewPointerMove({ clientX: crowdedX, clientY: 8, pointerId: 3 });
+check('a point over no span hovers nothing', sandbox.state.overviewHoverId, null);
+check('and leaves no marker behind',
   sandbox.dom.overviewLanes.childNodes.some((n) => n.getAttribute('data-hovered-marker') === 'true'), false);
-check('and leaves the columns exactly as they were',
+check('and the columns are exactly as they were',
   paintedColumns(), ['0.0000%', '33.3333%', '66.6667%']);
 
 /* ----------------------------------------------------------------------- report */

From 155227cad85a37f56da571fbc877c31ee7a4765a Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 19:07:33 +0800
Subject: [PATCH 25/36] =?UTF-8?q?=E9=80=80=E5=BD=B9=E6=AE=B5=E6=A0=BC?=
 =?UTF-8?q?=E5=BC=8F=E9=87=8C=E7=9A=84=20byteStart=20/=20byteEnd=EF=BC=8Cs?=
 =?UTF-8?q?chema=202=20=E2=86=92=203?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

这两个字段写进每一行段记录的 JSON 前缀，**shipped 搜索路径里没有任何一处把它们读回来**：
`readSegmentHits` 只取 5 个字段（index / turnIndex / kind / summary / generation）后丢掉其余，
而真正需要定位符的两个端点 `/api/trajectory/record` 与 `/raw` 读的是内存里的 lineage 缓存
`cached.raws`，压根不碰段文件。实测代价：真实段面 **4.36%**，每行 49 字节
（1,177 行、1.3 MB 的样本；49 × 1,177 = 57,673 字节）。

它们当初是按一条**对但没走完**的规则进来的：段行携带「一条命中回答所需的一切」，于是命中应当自足。
打开命中走的是内存缓存那条路，缓存冷时直接 `trajectory_not_cached`，而**轨迹路由**才会
`loadParsedRows`（按 size + mtime 建键）重新解析并回填 —— 承诺从没兑现，字段一直在全额付钱。

补一条来路事实，免得被当成抄来的：**定位符是这个 app 自己算的**。`parseMessagesJsonl` 解析时
记下每行的字节区间，拼成 `{ filePath, start, end, digest }`；代码里没有任何地方从会话文件读一个
叫 locator 的字段。同一个 locator 里的 `digest` **是被读的**（`buildMessageIdentity` 用它做身份
指纹），只是没跟着进段文件。所以退役的是「位置」那部分，不是整个 locator。

改动：

- `SEGMENT_SCHEMA_VERSION` 2 → 3。已落盘的段**全部失效一次**，每个会话首次搜索重建一次。
  这是本次唯一对外可见的行为变化，且是单部署下的本机重算
- `locatorRowsFromPayload` → `fileIdxRowsFromPayload`，只返回 `fileIdx`。**函数连名一起改** ——
  它不再产出 locator，名字声称的东西变了而名字不变，正是这个文件一直在还的那种债
- `fileIdx` 留着：它是唯一的分代分组键（`located.fileIdx !== fileIdx`）。「无定位得到 -1，且
  不得误归文件 0」这条语义原样保留，且它本来就只住在投影层 —— 段守卫管的是「完全不带字段的输入」
  的归一化，根本不调用投影，所以如果投影把无定位的记录修成文件 0，段那边 122 条断言会全绿
- 删掉一个零引用的 typedef

两条「它没了」的断言都写成**能被真的打红的形状** —— 不是「输出里没有这两个字段」，而是
「**输入里带着**这两个字段、输出里没有」。只写前者的话，退役之前它也会绿，等于什么都没钉。
退役有两扇门，各配一条变异：

- `fileIdxRowsFromPayload` 那一扇（`tests/mutate-file-index-rows.py`）：变异把字节范围写回投影的行
- `buildSegment` 那一扇（`tests/mutate-search-segments.py`）：变异把两个字段写回段行。
  **`buildSegment` 照抄记录上被给的东西**，所以只停投影那一扇停不住；只盯 `buildSegment` 那扇，
  上游哪天又开始提供字节范围，它就悄悄回来了

守卫与变异：

- `tests/verify-locator-rows.mjs` → **`tests/verify-file-index-rows.mjs`**（137 行，16 条）：
  顺序、形状、fileIdx、同名文件不得按 basename 匹配、无定位不得变成文件 0、邻居保住自己的、
  空输入与空 locator map、无 locator map 与无源文件同义、path 重复时先到先得
- `tests/mutate-locator-rows.py` → **`tests/mutate-file-index-rows.py`**（143 行，4 条），全按名捕获。
  原来那条「字节范围被丢掉」的变异随主体一起没了，换成上面那条反向的
- `tests/verify-search-segments.mjs` 121 条，`tests/verify-search-endpoint.mjs` 97 条（不变）
- `tests/mutate-search-segments.py` 22 → **23** 条，23/23 按名捕获
- `tests/mutate-locator-rows.py` 与 `tests/verify-locator-rows.mjs` 删除（改名，不是退役）

四问与逐个读点在退役审计的 §17：段面字节数（查过，没有任何守卫承诺段面大小）、
schema 版本不匹配的回退（已有覆盖）、`readSegmentHits` 承诺的 5 个字段（不变，新增断言钉住）。

套件 88/88。
---
 .../miniapp/node/search-segments.mjs          |  72 +++++------
 .../mmc-trajectory/miniapp/node/server.mjs    |  13 +-
 ...ator-rows.py => mutate-file-index-rows.py} |  56 ++++-----
 .../tests/mutate-search-segments.py           |  16 +++
 ...or-rows.mjs => verify-file-index-rows.mjs} | 113 ++++++++++--------
 .../tests/verify-search-endpoint.mjs          |  18 ++-
 .../tests/verify-search-segments.mjs          |  68 ++++++-----
 7 files changed, 197 insertions(+), 159 deletions(-)
 rename plugins/avatasia/mmc-trajectory/tests/{mutate-locator-rows.py => mutate-file-index-rows.py} (71%)
 rename plugins/avatasia/mmc-trajectory/tests/{verify-locator-rows.mjs => verify-file-index-rows.mjs} (50%)

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/search-segments.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/search-segments.mjs
index f41d379..ff1ef67 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/search-segments.mjs
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/search-segments.mjs
@@ -44,7 +44,7 @@ import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 
 /** Bumped when the on-disk shape changes in a way an older reader cannot survive. */
-export const SEGMENT_SCHEMA_VERSION = 2;
+export const SEGMENT_SCHEMA_VERSION = 3;
 
 /**
  * The fields a search reads, in the page's order.
@@ -55,8 +55,6 @@ export const SEGMENT_SCHEMA_VERSION = 2;
  */
 export const SEARCH_FIELDS = ['summary', 'text', 'result', 'thinking', 'toolName'];
 
-/** @typedef {{ ordinal: number, fileIdx: number, byteStart: number, byteEnd: number }} SegmentLocator */
-
 /** @typedef {{ fileName: string, generation: number | null, size: number, revision: string | null, truncated?: boolean }} SegmentSource */
 
 /** @typedef {{ schemaVersion: number, generation: number | null, view: string, recordCount: number, surfaceBytes: number, surfaceDigest: string, source: SegmentSource[] }} SegmentManifest */
@@ -113,37 +111,43 @@ export function normaliseWhitespace(value) {
  * artifact could be written to disk. Nothing read that artifact back, so the shape was paid for on
  * every publish and consumed by exactly one caller.
  *
- * That caller reads **one** of the three fields. `fileIdx` is the per-generation grouping key: a
- * record goes into the segment for the source file its locator names, so a record with no locator
- * lands in no segment at all rather than in whichever generation happens to be first. The other
- * two ride along on the segment line's JSON prefix — and as of this change **nothing in the shipped
- * search path reads them back**. `readSegmentHits` picks five fields off that prefix and drops the
- * rest, and `/api/trajectory/record` answers from the in-memory lineage cache rather than from a
- * segment. What they buy today is a capability nothing exercises: a hit in a sealed generation
- * could be mapped back to the line it came from. Measured cost of carrying it: 4.36% of a real
- * segment surface, 49 bytes a line (1,177-line, 1.3 MB segment).
+ * That caller read **one** of the three fields, and still does: `fileIdx` is the per-generation
+ * grouping key, so a record goes into the segment for the source file its locator names, and a
+ * record with no locator lands in no segment at all rather than in whichever generation happens to
+ * be first.
+ *
+ * The other two — `byteStart` and `byteEnd`, the byte range the record occupied in that file — are
+ * gone as of schema 3. They rode along on the segment line's JSON prefix and **nothing in the
+ * shipped search path ever read them back**: `readSegmentHits` picks five fields off that prefix and
+ * drops the rest, and `/api/trajectory/record` answers from the in-memory lineage cache rather than
+ * from a segment. What they bought was a capability nothing exercised — a hit in a sealed
+ * generation mapped back to the line it came from — for 4.36% of a real segment surface, 49 bytes a
+ * line (1,177-line, 1.3 MB segment).
  *
- * They stay because they are part of the **segment format**, not of this function. Dropping them
- * means a format change with a schema bump and every already-written segment invalidated, which is
- * its own batch with its own four questions — carrying them is the cheap half of that decision, and
- * the expensive half is what other people already have on disk.
+ * They came from a design rule that was right and unfinished: a segment line carries *everything a
+ * hit has to answer with*, so a hit would be self-sufficient. The route that opens a hit never took
+ * that path — it answers from the lineage cache and reports `trajectory_not_cached` when that cache
+ * is cold, and it does not re-parse to get out of it. So the promise was never kept and the fields
+ * were paid for in full. Completing it would have been the wrong fix anyway: the trajectory route
+ * re-parses (`loadParsedRows` keys on size and mtime) and refills that cache, and a record is only
+ * ever opened from a ledger the page could already draw — which came from one of those payloads.
+ * Nothing on this path needs a position on disk.
  *
- * So this is the producer of part of the segment format, and it lives here rather than beside a
- * directory nothing reads.
+ * The function is renamed with the shape. It no longer produces locators, and a name that still
+ * claimed to is the kind of debt this file has been paying down since the index was retired.
  *
  * `raws` is the record -> locator map the route already builds for `/raw`. A record with no
- * locator gets `-1` in all three fields, and that is a real state rather than a gap to be filled:
- * repairing it to `0` would file the record under whichever source file happens to be first,
- * which is a different generation's message. `-1` also stays distinguishable from byte `0`, which
- * is a position a record really can have.
+ * locator gets `-1`, and that is a real state rather than a gap to be filled: repairing it to `0`
+ * would file the record under whichever source file happens to be first, which is a different
+ * generation's message.
  *
  * @param {{ turns: Array<{ records: Array<{ index: number }> }> }} payload
- * @param {Map<number, { filePath: string, start: number, end: number }>} raws
+ * @param {Map<number, { filePath: string }>} raws
  * @param {Array<{ filePath?: string }>} files
- * @returns {Array<{ fileIdx: number, byteStart: number, byteEnd: number }>} one entry per record,
+ * @returns {Array<{ fileIdx: number }>} one entry per record,
  *   in the same order the payload's turns and their records are walked
  */
-export function locatorRowsFromPayload(payload, raws, files) {
+export function fileIdxRowsFromPayload(payload, raws, files) {
   const pathToFileIdx = new Map();
   files.forEach((file, i) => {
     // Matched on the full path, not the file name: two generations can each hold a file the
@@ -158,12 +162,8 @@ export function locatorRowsFromPayload(payload, raws, files) {
     for (const record of turn.records) {
       const locator = raws.get(record.index);
       out.push(locator === undefined
-        ? { fileIdx: -1, byteStart: -1, byteEnd: -1 }
-        : {
-          fileIdx: pathToFileIdx.get(locator.filePath) ?? -1,
-          byteStart: locator.start,
-          byteEnd: locator.end
-        });
+        ? { fileIdx: -1 }
+        : { fileIdx: pathToFileIdx.get(locator.filePath) ?? -1 });
     }
   }
   return out;
@@ -174,7 +174,7 @@ export function locatorRowsFromPayload(payload, raws, files) {
  *
  * Each line is `<compact json>\t<searchable text>`, one line per record in ledger order, and it
  * carries everything a hit has to answer with: the ledger `index`, the `turnIndex`, `kind`,
- * `generation` and the projected `summary`, plus the locator triple.
+ * `generation`, the projected `summary`, and the `fileIdx` it was filed under.
  *
  * Why the answer travels with the searchable text: answering used to mean reading the session's
  * whole record index as well — measured at 34.2 MB of JSONL for the largest session on this
@@ -182,6 +182,12 @@ export function locatorRowsFromPayload(payload, raws, files) {
  * being rebuilt. A needle that matches 14 records out of 36,525 does not need the other 36,511,
  * and it does not need them parsed either.
  *
+ * `fileIdx` is the one field here that is not part of a hit's answer: nothing reads it back, because
+ * the segment a record lands in already *is* the generation it came from. It survives because the
+ * grouping is done by comparing against it, and a comparison needs both sides to name the same
+ * number. The byte range that used to sit beside it had no such caller and is gone at schema 3 —
+ * see `fileIdxRowsFromPayload`.
+ *
  * The separator is a TAB and the searchable part comes last, so a needle can never match across the
  * boundary into the JSON prefix — the record it would name is then a match spanning two records,
  * which is the one thing a per-record scan exists to prevent.
@@ -201,8 +207,6 @@ export function buildSegment(input) {
       generation: typeof record.generation === 'number' ? record.generation : null,
       summary: typeof record.summary === 'string' ? record.summary : '',
       fileIdx: typeof record.fileIdx === 'number' ? record.fileIdx : -1,
-      byteStart: typeof record.byteStart === 'number' ? record.byteStart : -1,
-      byteEnd: typeof record.byteEnd === 'number' ? record.byteEnd : -1,
     }) + '\t' + searchSurfaceOf(record));
   }
   return { surface: lines.join('\n') };
diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
index 2eb2401..b93db1e 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
@@ -11,9 +11,9 @@ import {
   SEARCH_FIELDS,
   buildSegment,
   createSegmentStore,
+  fileIdxRowsFromPayload,
   foldNeedle,
   generationKey,
-  locatorRowsFromPayload,
   needleIsUsable,
   normaliseWhitespace,
   readSegmentHits,
@@ -3674,7 +3674,7 @@ export async function start(context) {
       const locator = rowLocators[rowIndex];
       if (locator !== undefined) locators.set(recordIndex, locator);
     }
-    const locatorRows = locatorRowsFromPayload(payload, locators, files);
+    const fileIdxRows = fileIdxRowsFromPayload(payload, locators, files);
 
     // One segment per generation, the active one included. §8.8.1 rule 5 excluded the active
     // generation on the grounds that a segment for it would be stale before it was written — true,
@@ -3693,8 +3693,9 @@ export async function start(context) {
     //
     // What the payload cannot say on its own is which source file a record came from, so that is
     // what gets projected out of the lineage's row locators: the payload's fields for the surface,
-    // and a locator whose file number is the grouping key below. The byte range rides along on the
-    // segment line and is read by nothing here — see the note on locatorRowsFromPayload.
+    // and a file number to group by below. The locator's byte range is not projected — nothing on
+    // the segment line reads it back, so carrying it cost 4.36% of every segment for nothing.
+    // See the note on fileIdxRowsFromPayload.
     const flatRecords = [];
     for (const turn of payload.turns) {
       for (const record of turn.records) flatRecords.push({ record, turn });
@@ -3702,7 +3703,7 @@ export async function start(context) {
     for (let fileIdx = 0; fileIdx < files.length; fileIdx += 1) {
       const records = [];
       for (let i = 0; i < flatRecords.length; i += 1) {
-        const located = locatorRows[i];
+        const located = fileIdxRows[i];
         if (located === undefined || located.fileIdx !== fileIdx) continue;
         records.push({
           ...flatRecords[i].record,
@@ -3710,8 +3711,6 @@ export async function start(context) {
           // back out of the session's turn table would mean reading that table on every search.
           turnIndex: flatRecords[i].turn.index,
           fileIdx: located.fileIdx,
-          byteStart: located.byteStart,
-          byteEnd: located.byteEnd,
         });
       }
       // A generation with no records still gets a segment, and it is an empty one. Skipping it
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-locator-rows.py b/plugins/avatasia/mmc-trajectory/tests/mutate-file-index-rows.py
similarity index 71%
rename from plugins/avatasia/mmc-trajectory/tests/mutate-locator-rows.py
rename to plugins/avatasia/mmc-trajectory/tests/mutate-file-index-rows.py
index 5ca3602..e8714df 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-locator-rows.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-file-index-rows.py
@@ -1,21 +1,26 @@
-"""Mutation control for the locator projection.
+"""Mutation control for the file-index projection.
 
-`verify-locator-rows.mjs` states one property per case, and each mutation here breaks exactly one
+`verify-file-index-rows.mjs` states one property per case, and each mutation here breaks exactly one
 of them in the shipped module. The cases that are easy to get wrong are all about **file 0**:
 
   - A record whose line was never located is repaired to the first source file. Nothing else about
-    the answer changes — the record is still there, still searchable, still carries a byte range
-    if it had one — so this is invisible until someone maps a hit back to the wrong generation.
-    `buildSegment` cannot catch it: it faithfully carries whatever `fileIdx` it is handed, so the
-    122 segment assertions stay green.
+    the answer changes — the record is still there, still searchable — so this is invisible until
+    someone answers from a different generation's message. `buildSegment` cannot catch it: it
+    faithfully carries whatever `fileIdx` it is handed, so every segment assertion stays green.
   - The same repair reached by the other route: the locator names a file that is not in the table
     (a source that moved) and gets filed under the first entry instead.
   - Two generations that hold a file of the same name are matched by basename rather than by full
     path, which files one generation's records under the other.
 
-The fourth takes the byte range away, because a locator that answers "which file" but not "where
-in it" cannot map a hit back to a line — and the surface still looks complete, so nothing reports
-it.
+The fourth runs the other way. The projection used to copy the locator's byte range onto the row, and
+that pair of fields rode along on every segment line for nothing — read back by no code in the
+shipped search path, 4.36% of a real segment surface. This mutation puts them back, which is the
+shape of mistake that retirement is supposed to prevent: a guard that only checks the fields it
+expects will not notice a field that came back.
+
+Its twin lives in `mutate-search-segments.py`, because the same two fields can come back at the
+other end — written by `buildSegment` instead of by this projection — and a control that only owns
+one of the two doors can be walked around through the other.
 
 Each mutation must be caught *by name*. A probe that dies on an exception names nothing, and a
 control that reports that as caught is reporting a crash as if it were evidence.
@@ -27,17 +32,17 @@
 HERE = Path(__file__).resolve().parent
 ROOT = HERE.parent
 MODULE = ROOT / "miniapp" / "node" / "search-segments.mjs"
-PROBE = HERE / "verify-locator-rows.mjs"
+PROBE = HERE / "verify-file-index-rows.mjs"
+
+ROW = "{ fileIdx: pathToFileIdx.get(locator.filePath) ?? -1 }"
+ROW_UNLOCATED = "? { fileIdx: -1 }\n        : " + ROW + ");"
 
-UNLOCATED = """      out.push(locator === undefined
-        ? { fileIdx: -1, byteStart: -1, byteEnd: -1 }
-        : {"""
-UNLOCATED_REPAIRED = """      out.push(locator === undefined
-        ? { fileIdx: 0, byteStart: 0, byteEnd: 0 }
-        : {"""
+UNLOCATED_REPAIRED = "? { fileIdx: 0 }\n        : " + ROW + ");"
+BYTES_BACK = ("? { fileIdx: -1, byteStart: -1, byteEnd: -1 }\n        : "
+              "{ fileIdx: pathToFileIdx.get(locator.filePath) ?? -1, "
+              "byteStart: locator.start, byteEnd: locator.end });")
 
-MOVED_SOURCE = "          fileIdx: pathToFileIdx.get(locator.filePath) ?? -1,"
-MOVED_REPAIRED = "          fileIdx: pathToFileIdx.get(locator.filePath) ?? 0,"
+MOVED_REPAIRED = "{ fileIdx: pathToFileIdx.get(locator.filePath) ?? 0 }"
 
 FULL_PATH = """    if (typeof file.filePath === 'string' && !pathToFileIdx.has(file.filePath)) {
       pathToFileIdx.set(file.filePath, i);
@@ -46,20 +51,15 @@
       pathToFileIdx.set(file.fileName, i);
     }"""
 
-BYTES = """          byteStart: locator.start,
-          byteEnd: locator.end"""
-BYTES_DROPPED = """          byteStart: -1,
-          byteEnd: -1"""
-
 MUTATIONS = [
     (
         "a record with no locator is repaired to the first file instead of -1",
-        UNLOCATED,
+        ROW_UNLOCATED,
         UNLOCATED_REPAIRED,
     ),
     (
         "a locator whose file moved is filed under the first file instead of -1",
-        MOVED_SOURCE,
+        ROW,
         MOVED_REPAIRED,
     ),
     (
@@ -68,9 +68,9 @@
         BASENAME,
     ),
     (
-        "the byte range is dropped, so a hit cannot be mapped back to its line",
-        BYTES,
-        BYTES_DROPPED,
+        "the byte range is copied onto the row again, so it rides along on every segment",
+        ROW_UNLOCATED,
+        BYTES_BACK,
     ),
 ]
 
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-search-segments.py b/plugins/avatasia/mmc-trajectory/tests/mutate-search-segments.py
index 3175dd3..6980c65 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-search-segments.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-search-segments.py
@@ -173,6 +173,22 @@
         "/** @deprecated one ordinal at a time — walks the whole segment to find it. */\n"
         "export function readSegmentHit(surface, ordinal) {\n  return readSegmentHits(surface, [ordinal])[0] ?? null;\n}",
     ),
+    # ---- a retired field must not come back through this door ---------------------------
+    (
+        # The pair of fields this module stopped writing at schema 3. Nothing read them back, they
+        # cost 4.36% of every segment surface, and retiring them was its own batch — so the one
+        # thing worth guarding is that they stay gone. `buildSegment` writes whatever a record is
+        # handed, which means stopping is not a decision this function makes on its own: any
+        # upstream that starts supplying a byte range again puts it straight back on every line.
+        # `mutate-file-index-rows.py` closes the other door — the projection — and a control that
+        # owned only one of them could be walked around through the other.
+        "the byte range rides along on every segment line again",
+        "      fileIdx: typeof record.fileIdx === 'number' ? record.fileIdx : -1,\n    }) + '\\t' + searchSurfaceOf(record));",
+        "      fileIdx: typeof record.fileIdx === 'number' ? record.fileIdx : -1,\n"
+        "      byteStart: typeof record.byteStart === 'number' ? record.byteStart : -1,\n"
+        "      byteEnd: typeof record.byteEnd === 'number' ? record.byteEnd : -1,\n"
+        "    }) + '\\t' + searchSurfaceOf(record));",
+    ),
 ]
 
 
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-locator-rows.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-file-index-rows.mjs
similarity index 50%
rename from plugins/avatasia/mmc-trajectory/tests/verify-locator-rows.mjs
rename to plugins/avatasia/mmc-trajectory/tests/verify-file-index-rows.mjs
index 01acd02..1ab2934 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-locator-rows.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-file-index-rows.mjs
@@ -1,28 +1,36 @@
 /**
- * Where each record sat in the file it came from.
+ * Which source file each record came from.
  *
- * `locatorRowsFromPayload` produces the locator triple that a segment line carries in its JSON
- * prefix, so a search hit in a sealed generation can be mapped back to the line it came from long
- * after the row objects that knew that have stopped existing. It used to be `indexRowsFromPayload`
- * in a module called `trajectory-index`, returning a whole index row per record so the index
- * artifact could be written; nothing ever read that artifact back, so the extra shape was built on
- * every publish and read by one caller that wanted three of those fields.
+ * `fileIdxRowsFromPayload` projects the lineage's row locators down to the one number the server
+ * groups by, so a record lands in the segment for the generation it was written in rather than in
+ * whichever generation happens to be first. It used to be `indexRowsFromPayload` in a module called
+ * `trajectory-index`, returning a whole index row per record so the index artifact could be written;
+ * nothing ever read that artifact back, so the extra shape was built on every publish and read by one
+ * caller that wanted one of those fields.
  *
  * The case this file exists for is the one the other end cannot cover. `verify-search-segments.mjs`
- * asserts that a record carrying **no locator fields at all** is serialised with `-1/-1/-1` — but
- * that is `buildSegment` normalising an empty input, and it never calls this projection. If the
- * projection repaired an unlocated record to file `0`, `buildSegment` would faithfully carry that
- * `0` out into the segment and every one of those 122 assertions would still pass. The server
- * groups records by `located.fileIdx === fileIdx`, so a record silently filed under the first
- * source file is a record answered from a different generation's message.
+ * asserts that a record carrying **no file number at all** is serialised with `-1` — but that is
+ * `buildSegment` normalising an empty input, and it never calls this projection. If the projection
+ * repaired an unlocated record to file `0`, `buildSegment` would faithfully carry that `0` out into
+ * the segment and every one of those assertions would still pass. The server groups records by
+ * `located.fileIdx === fileIdx`, so a record silently filed under the first source file is a record
+ * answered from a different generation's message.
  *
- * Which is why the `-1` assertions here are about **the projection**, not about the segment, and
- * why they moved here with the function rather than being assumed to already exist downstream.
+ * Which is why the `-1` assertions here are about **the projection**, not about the segment, and why
+ * they live here with the function rather than being assumed to already exist downstream.
+ *
+ * It also pins the retirement. The locator this is handed still carries a byte range — it always
+ * will, because the locator is the lineage's own — and the projection used to copy it onto the
+ * segment line. Two lines of the JSON prefix on every record, 4.36% of a real segment surface, read
+ * back by nothing. So this asserts the byte range is dropped **while it is present in the input**,
+ * which is the only shape of that assertion that would have failed before the change: an input
+ * without byte ranges would have passed either way, and a guard that passes both ways proves
+ * nothing about the thing it names.
  *
  * Read-only, pure: the projection has no I/O and this file writes nothing.
- * `mutate-locator-rows.py` breaks each of these in the shipped module.
+ * `mutate-file-index-rows.py` breaks each of these in the shipped module.
  */
-import { locatorRowsFromPayload } from '../miniapp/node/search-segments.mjs';
+import { fileIdxRowsFromPayload } from '../miniapp/node/search-segments.mjs';
 
 let pass = 0;
 const failures = [];
@@ -53,40 +61,43 @@ const FILES = [
   { filePath: '/store/s/snapshots/g0/messages.jsonl', fileName: 'messages.jsonl', generation: 0 },
   { filePath: '/store/s/active/messages.jsonl', fileName: 'messages.jsonl', generation: 1 }
 ];
+/* The locator keeps its byte range and its digest: the lineage's shape is not this file's to
+ * shrink, and the projection has to be shown dropping them rather than being unable to see them. */
 const loc = (filePath, start, end) => ({ filePath, start, end, digest: 'd' });
 
 const rawsOf = (entries) => new Map(entries.map(([index, locator]) => [index, locator]));
 
-/* Everything in the first file except the last record, which is in the second. Byte 0 is a real
- * position here on purpose: `-1` has to stay distinguishable from it. */
+/* Records alternate between the two files. That is not how a session is laid out and it is on
+ * purpose: it is the only assignment under which the walk order and the sorted order disagree, so
+ * the order assertion below measures the walk rather than agreeing with it by accident. */
+const G0 = FILES[0].filePath;
+const G1 = FILES[1].filePath;
 const raws = rawsOf([
-  [1, loc(FILES[0].filePath, 0, 120)],
-  [2, loc(FILES[0].filePath, 121, 260)],
-  [3, loc(FILES[0].filePath, 261, 400)],
-  [4, loc(FILES[1].filePath, 0, 90)],
-  [5, loc(FILES[1].filePath, 91, 200)],
-  [6, loc(FILES[1].filePath, 201, 340)]
+  [1, loc(G0, 0, 120)],
+  [2, loc(G1, 121, 260)],
+  [3, loc(G0, 261, 400)],
+  [4, loc(G1, 0, 90)],
+  [5, loc(G0, 91, 200)],
+  [6, loc(G1, 201, 340)]
 ]);
-const rows = locatorRowsFromPayload(PAYLOAD, raws, FILES);
+const rows = fileIdxRowsFromPayload(PAYLOAD, raws, FILES);
 
 /* ------------------------------------------------------------------ order and shape */
 check('one entry per record, in the order the payload is walked',
   rows.length, FLAT.length);
-assert('and the order is the payload\'s, not sorted by file or byte',
-  rows.map((r) => r.byteStart).join(',') !== '0,0,0,121,201,261');
-check('every entry carries exactly the locator triple',
-  Object.keys(rows[0]).sort(), ['byteEnd', 'byteStart', 'fileIdx']);
-
 check('each record names the file its locator names',
-  rows.map((r) => r.fileIdx), [0, 0, 0, 1, 1, 1]);
-check('each record carries where its line sat',
-  rows.map((r) => r.byteStart), [0, 121, 261, 0, 91, 201]);
-check('and where it ended',
-  rows.map((r) => r.byteEnd), [120, 260, 400, 90, 200, 340]);
+  rows.map((r) => r.fileIdx), [0, 1, 0, 1, 0, 1]);
+assert('and the order is the payload\'s, not sorted by file',
+  rows.map((r) => r.fileIdx).join(',') !== '0,0,0,1,1,1');
+check('every entry carries exactly the file number',
+  Object.keys(rows[0]).sort(), ['fileIdx']);
 
-/* Byte 0 is a position a record really can have, so `-1` cannot be confused with it. */
-assert('byte 0 is a real position in this fixture, so -1 is distinguishable from it',
-  rows[0].byteStart === 0 && rows[3].byteStart === 0);
+/* The retirement, in the only shape that can fail: the locator above DID carry a byte range, and it
+ * did not survive the projection. An input without byte ranges would pass this either way. */
+assert('the byte range the locator carries is dropped, not copied onto the row',
+  rows.every((r) => !('byteStart' in r) && !('byteEnd' in r)));
+assert('and the locators handed in really did carry one',
+  [...raws.values()].every((l) => typeof l.start === 'number' && typeof l.end === 'number'));
 
 /* Two generations both hold a `messages.jsonl`. A basename match would file the second
  * generation's records under the first, which is a different generation's message. */
@@ -98,43 +109,41 @@ assert('the two source files really do share a basename',
  * instead would leave three records unlocated and the "exactly one" assertions below would be
  * measuring the fixture rather than the projection. */
 const partialRaws = rawsOf([...raws].filter(([index]) => index !== 3));
-const partial = locatorRowsFromPayload(PAYLOAD, partialRaws, FILES);
+const partial = fileIdxRowsFromPayload(PAYLOAD, partialRaws, FILES);
 
 check('a record with no locator says file -1', partial[2].fileIdx, -1);
-check('and its neighbours keep theirs', [partial[1].fileIdx, partial[3].fileIdx], [0, 1]);
+check('and its neighbours keep theirs', [partial[1].fileIdx, partial[3].fileIdx], [1, 1]);
 check('no record silently became file 0', partial.filter((r) => r.fileIdx === -1).length, 1);
-check('a record with no locator has no line position either',
-  [partial[2].byteStart, partial[2].byteEnd], [-1, -1]);
 
 /* The same question asked of the OTHER kind of "no location": the locator exists but names a file
  * that is not in the table. That is a source that moved, and it must not be filed under file 0
  * either — the two cases reach file 0 by different routes and both would answer from the wrong
  * generation. */
 const movedRaws = rawsOf([
-  [1, loc('/store/s/snapshots/g0/messages.jsonl', 0, 120)],
+  [1, loc(G0, 0, 120)],
   [2, loc('/store/s/elsewhere/gone.jsonl', 10, 20)]
 ]);
-const moved = locatorRowsFromPayload(PAYLOAD, movedRaws, FILES);
+const moved = fileIdxRowsFromPayload(PAYLOAD, movedRaws, FILES);
 check('a locator whose file is not in the table says file -1, not file 0', moved[1].fileIdx, -1);
-check('but it keeps the byte range it was handed',
-  [moved[1].byteStart, moved[1].byteEnd], [10, 20]);
+check('and so does every record the sparse map did not cover',
+  moved.map((r) => r.fileIdx), [0, -1, -1, -1, -1, -1]);
 
 /* ------------------------------------------------------------------ empty and odd inputs */
 check('a payload with no records projects to nothing',
-  locatorRowsFromPayload(payloadOf([]), new Map(), FILES).length, 0);
+  fileIdxRowsFromPayload(payloadOf([]), new Map(), FILES).length, 0);
 check('an empty locator map leaves every record unlocated, not every record in file 0',
-  locatorRowsFromPayload(PAYLOAD, new Map(), FILES).map((r) => r.fileIdx), [-1, -1, -1, -1, -1, -1]);
+  fileIdxRowsFromPayload(PAYLOAD, new Map(), FILES).map((r) => r.fileIdx), [-1, -1, -1, -1, -1, -1]);
 check('no source files at all is the same as no location',
-  locatorRowsFromPayload(PAYLOAD, raws, []).map((r) => r.fileIdx), [-1, -1, -1, -1, -1, -1]);
+  fileIdxRowsFromPayload(PAYLOAD, raws, []).map((r) => r.fileIdx), [-1, -1, -1, -1, -1, -1]);
 
 /* First writer wins: a path is only in the table once per session, and a duplicated path must not
  * make the second entry reachable in a way that depends on iteration order. */
 const dupFiles = [FILES[0], { filePath: FILES[0].filePath, fileName: 'copy', generation: 9 }];
 check('a path listed twice still resolves to the first file that claimed it',
-  locatorRowsFromPayload(PAYLOAD, raws, dupFiles).map((r) => r.fileIdx), [0, 0, 0, -1, -1, -1]);
+  fileIdxRowsFromPayload(PAYLOAD, raws, dupFiles).map((r) => r.fileIdx), [0, -1, 0, -1, 0, -1]);
 
 /* ---------------------------------------------------------------------- report */
-console.log('locator-rows: ' + pass + ' passed, ' + failures.length + ' failed');
+console.log('file-index-rows: ' + pass + ' passed, ' + failures.length + ' failed');
 if (failures.length) {
   for (const f of failures) console.log('FAIL  ' + f);
   process.exit(1);
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs
index 58cb518..2601846 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-search-endpoint.mjs
@@ -35,7 +35,7 @@ import {
   splitRawRecords,
   ROW_GENERATION,
 } from '../miniapp/node/server.mjs';
-import { buildSegment, locatorRowsFromPayload, readSegmentHits, scanSegment } from '../miniapp/node/search-segments.mjs';
+import { buildSegment, fileIdxRowsFromPayload, readSegmentHits, scanSegment } from '../miniapp/node/search-segments.mjs';
 
 const SERVER = readFileSync(new URL('../miniapp/node/server.mjs', import.meta.url), 'utf8');
 const CLIENT = readFileSync(new URL('../miniapp/client/index.html', import.meta.url), 'utf8');
@@ -360,7 +360,7 @@ const ARTIFACT_FILES = [
   { filePath: '/store/s/g0.jsonl', fileName: 'g0.jsonl', generation: 0, size: 300, mtimeMs: 1, revision: 'r0', truncated: false },
   { filePath: '/store/s/g1.jsonl', fileName: 'g1.jsonl', generation: 1, size: 500, mtimeMs: 1, revision: 'r1', truncated: false },
 ];
-// `locatorRowsFromPayload` wants the record -> locator map, not the record -> row map the split
+// `fileIdxRowsFromPayload` wants the record -> locator map, not the record -> row map the split
 // produces; the server builds it the same way before handing it over. Getting this wrong leaves
 // every record at `-1`, which is a locator set with no file in it and would answer with no line.
 const rowIndexByRecord = splitRawRecords(allPayload.turns);
@@ -369,7 +369,7 @@ const locatorByRecord = new Map();
 for (const [recordIndex, rowIndex] of rowIndexByRecord) {
   locatorByRecord.set(recordIndex, rowLocators[rowIndex]);
 }
-const locatorRows = locatorRowsFromPayload(allPayload, locatorByRecord, ARTIFACT_FILES);
+const fileIdxRows = fileIdxRowsFromPayload(allPayload, locatorByRecord, ARTIFACT_FILES);
 const flatPairs = [];
 for (const turn of allPayload.turns) for (const record of turn.records) flatPairs.push({ record, turn });
 // The same merge the server does: the surface is built from the PAYLOAD's records and only the
@@ -380,14 +380,12 @@ for (const turn of allPayload.turns) for (const record of turn.records) flatPair
 const segmentRecordsFor = (fileIdx) => {
   const out = [];
   for (let i = 0; i < flatPairs.length; i += 1) {
-    const located = locatorRows[i];
+    const located = fileIdxRows[i];
     if (located === undefined || located.fileIdx !== fileIdx) continue;
     out.push({
       ...flatPairs[i].record,
       turnIndex: flatPairs[i].turn.index,
       fileIdx: located.fileIdx,
-      byteStart: located.byteStart,
-      byteEnd: located.byteEnd,
     });
   }
   return out;
@@ -423,9 +421,9 @@ const withLimit = (n) => {
 };
 
 check('the locator projection kept every record the rebuild would have shown',
-  locatorRows.length, allRecords.length);
+  fileIdxRows.length, allRecords.length);
 assert('and it kept the generation each record came from',
-  new Set(locatorRows.map((r) => r.fileIdx)).size === ARTIFACT_FILES.length);
+  new Set(fileIdxRows.map((r) => r.fileIdx)).size === ARTIFACT_FILES.length);
 
 // The direct version of the bug: a segment's line for a record must contain that record's own
 // searchable text, in every field the endpoint searches. Read from the shipped server's own merge,
@@ -433,8 +431,8 @@ assert('and it kept the generation each record came from',
 const bulkOnly = allRecords.find((r) => typeof r.result === 'string' && r.result.length > 0);
 assert('the fixture really does hold a record whose match is only in a bulk field', bulkOnly !== undefined);
 if (bulkOnly !== undefined) {
-  const located = locatorRows[flatPairs.findIndex((pair) => pair.record === bulkOnly)];
-  const line = buildSegment({ records: [{ ...bulkOnly, fileIdx: located.fileIdx, byteStart: 0, byteEnd: 1 }] }).surface;
+  const located = fileIdxRows[flatPairs.findIndex((pair) => pair.record === bulkOnly)];
+  const line = buildSegment({ records: [{ ...bulkOnly, fileIdx: located.fileIdx }] }).surface;
   assert('and the segment carries that field, though the projection does not',
     !Object.prototype.hasOwnProperty.call(located, 'result') && line.includes(normaliseWhitespace(bulkOnly.result)));
   assert('the shipped server merges the payload into the segment for the same reason',
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs
index d6afa43..d0e61c3 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-search-segments.mjs
@@ -350,46 +350,58 @@ check('whitespace does not count toward the floor', needleIsUsable('  '), false)
 assert('a needle longer than the floor passes', needleIsUsable('  real words  '));
 
 /* =====================================================================
- * 3 — a hit maps back to the line it came from
+ * 3 — a hit is answered from the line the scan named
  * ===================================================================== */
 
-const withLocators = buildSegment({
-  records: RECORDS.map((r, i) => ({ ...r, index: i, fileIdx: i < 4 ? 0 : 1, byteStart: i * 100, byteEnd: i * 100 + 40 })),
-});
-// The locator triple rides on the same line as the searchable text, so it is read back from the
-// line the scan named rather than from a second file that had to be walked in parallel with this one.
-const lineAt = (n) => withLocators.surface.split('\n')[n] ?? '';
-const locatorAt = (n) => {
+/* The records handed to `buildSegment` still carry a byte range, and they still will: the lineage
+ * produces one per record whatever this build does with it. So the check below is not "the input has
+ * no byte range, therefore neither does the output" — it is that the input HAS one and the line
+ * does not, which is the only version of the assertion that could have failed before the fields were
+ * retired. */
+const SEGMENT_INPUT = RECORDS.map((r, i) => ({
+  ...r, index: i, fileIdx: i < 4 ? 0 : 1, byteStart: i * 100, byteEnd: i * 100 + 40
+}));
+const withFileIdx = buildSegment({ records: SEGMENT_INPUT });
+check('the records handed to the build really did carry a byte range',
+  SEGMENT_INPUT.map((r) => typeof r.byteStart === 'number'), RECORDS.map(() => true));
+
+// The line's own prefix is read back from the line the scan named, rather than from a second file
+// that had to be walked in parallel with this one.
+const lineAt = (n) => withFileIdx.surface.split('\n')[n] ?? '';
+const prefixAt = (n) => {
   const tab = lineAt(n).indexOf('\t');
   return tab < 0 ? null : JSON.parse(lineAt(n).slice(0, tab));
 };
-check('locator ordinals are the record order',
-  RECORDS.map((_, i) => locatorAt(i)?.ordinal ?? null), RECORDS.map((_, i) => i));
-check('locators carry which file',
-  RECORDS.map((_, i) => locatorAt(i)?.fileIdx ?? null), RECORDS.map((_, i) => (i < 4 ? 0 : 1)));
-check('locators carry where the line sat',
-  RECORDS.map((_, i) => locatorAt(i)?.byteStart ?? null), RECORDS.map((_, i) => i * 100));
-check('a record with no position says -1, not 0',
-  RECORDS.map((_, i) => locatorAt(i)?.byteEnd ?? null),
-  RECORDS.map((_, i) => (i === 0 ? 40 : i * 100 + 40)));
-check('a record that carries no locator at all still gets a line',
-  RECORDS.map((_, i) => locatorAt(i) !== null), RECORDS.map(() => true));
+check('the ordinal is the record order',
+  RECORDS.map((_, i) => prefixAt(i)?.ordinal ?? null), RECORDS.map((_, i) => i));
+check('the line carries which file',
+  RECORDS.map((_, i) => prefixAt(i)?.fileIdx ?? null), RECORDS.map((_, i) => (i < 4 ? 0 : 1)));
+check('a record that carries no file number at all still gets a line',
+  RECORDS.map((_, i) => prefixAt(i) !== null), RECORDS.map(() => true));
 {
   const bare = buildSegment({ records: [{ summary: 'x' }] }).surface.split('\n')[0];
   const parsed = JSON.parse(bare.slice(0, bare.indexOf('\t')));
-  check('a record with no position says -1',
-    { fileIdx: parsed.fileIdx, byteStart: parsed.byteStart, byteEnd: parsed.byteEnd },
-    { fileIdx: -1, byteStart: -1, byteEnd: -1 });
+  check('a record with no file number says -1, not 0', parsed.fileIdx, -1);
 }
 
-const hit = scanSegment(withLocators.surface, foldNeedle('grep'))[0];
+/* The retirement, pinned from the one door the projection does not own. `fileIdxRowsFromPayload` can
+ * stop emitting the pair, but `buildSegment` writes whatever a record is handed, so the same two
+ * fields come back the moment anything upstream starts supplying them again — which is why the
+ * assertion below sits here and not only at the projection. The check at the top of this section is
+ * its other half: without a byte range going in, "no line carries one" would pass for free. */
+assert('no line carries a byte range any more',
+  RECORDS.every((_, i) => {
+    const p = prefixAt(i);
+    return p !== null && !('byteStart' in p) && !('byteEnd' in p);
+  }));
+
+const hit = scanSegment(withFileIdx.surface, foldNeedle('grep'))[0];
 // Read through `?.` so a build whose surfaces no longer line up with their records FAILS HERE BY
-// NAME rather than throwing on an undefined locator — a crash names no rule, and the reader is left
+// NAME rather than throwing on an undefined prefix — a crash names no rule, and the reader is left
 // with a stack trace instead of the thing that moved.
-check('a hit resolves to the line it came from', locatorAt(hit)?.ordinal ?? null, hit ?? null);
-check('and that line names where the record sat', locatorAt(hit)?.byteStart ?? null, hit === undefined ? null : hit * 100);
+check('a hit resolves to the line it came from', prefixAt(hit)?.ordinal ?? null, hit ?? null);
 check('and reads back as the answer, not as a locator',
-  oneHit(withLocators.surface, hit)?.index ?? null, hit ?? null);
+  oneHit(withFileIdx.surface, hit)?.index ?? null, hit ?? null);
 
 /* =====================================================================
  * 4 — a half-published segment is never consumed
@@ -427,7 +439,7 @@ try {
   // trial. Here the surface gains a line AND the manifest's digest for it is re-taken, so both
   // bytes check out and only the count disagrees.
   const baseManifest = JSON.parse(await readFile(join(dir, 'manifest.json'), 'utf8'));
-  const grownSurface = `${segment.surface}\n${JSON.stringify({ ordinal: RECORDS.length, index: -1, fileIdx: 0, byteStart: 0, byteEnd: 1 })}\t${'extra'}`;
+  const grownSurface = `${segment.surface}\n${JSON.stringify({ ordinal: RECORDS.length, index: -1, fileIdx: 0 })}\t${'extra'}`;
   await writeFile(join(dir, 'surface.txt'), grownSurface, 'utf8');
   await writeFile(join(dir, 'manifest.json'),
     JSON.stringify({ ...baseManifest, surfaceDigest: digestOf(grownSurface), surfaceBytes: Buffer.byteLength(grownSurface) }), 'utf8');

From e5d4e2314203e66acf683c8b06edc08a899ccb60 Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 20:49:12 +0800
Subject: [PATCH 26/36] =?UTF-8?q?=E6=80=BB=E8=A7=88=E6=9D=A1=E7=9A=84?=
 =?UTF-8?q?=E6=A8=A1=E5=9E=8B=E4=B8=8D=E5=86=8D=E6=AF=8F=E6=AC=A1=E9=87=8D?=
 =?UTF-8?q?=E5=BB=BA=EF=BC=9A=E7=BB=99=E5=B7=B2=E6=9C=89=E7=9A=84=20overvi?=
 =?UTF-8?q?ewCache=20=E8=A1=A5=E4=B8=A4=E4=B8=AA=E8=BE=93=E5=85=A5?=
 =?UTF-8?q?=E9=94=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

renderOverview 有八个调用点，其中七个不动模型的任何输入 —— 筛选、选中、刷选、
滚轮、平移（含 60 ms 定时器）、切会话都带着同一批行和同一个轴重进。建模在
36,525 条记录上占 186.3 ms 里的 59.6 ms（32%），每帧还要 churn 约 73k 个对象。

所以这不是一个新缓存加一套失效策略，是把模型的两个输入比一遍：

  - state.flat 全文件只有一个写者（flattenTurns），且从不原地修改，所以新数组
    = 新行，同一数组 = 同一批行。内容比较要多走一趟每条记录，而那正是要省掉的
    那一趟。
  - state.actualDuration 是另一个输入，它自己的 setter 在值未变时提前返回。

两个键缺一不可。只键行数会把另一个轴上的模型留下来，总览条会把每条记录画在
读者刚关掉的那个轴的位置上 —— 所以第二条变异就是专门去掉轴的键。

它一开始存活了，而原因不是守卫漏了，是守卫自己的前一步断言把另一个数组留在了
缓存里，于是「行」的比较也 miss、重建照常发生，轴那一步观察到的重建什么也证明
不了。补一行把 MIXED 放回缓存之后才死。同一个文件里相邻两条断言，会让第三条
断言通过它本该抓不住的缺陷，这是本次唯一一处需要停下来想的地方。

口径不变：总览条上每个数、每个位置都不动，变的只是同一批 span 对象不再被重复
构造。增量内存约等于零 —— overviewCache.model 本来就活着，缓存是「不再重建」，
不是「多留一份」。

守卫 149 -> 162（数重建次数，不断言字段存在）；变异 10 -> 12，逐条按名捕获。
---
 .../mmc-trajectory/miniapp/client/index.html  | 49 +++++++++++++-
 .../mmc-trajectory/tests/mutate-overview.py   | 51 +++++++++++++--
 .../mmc-trajectory/tests/verify-overview.mjs  | 64 +++++++++++++++++++
 3 files changed, 155 insertions(+), 9 deletions(-)

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
index 6ecd443..7a5b72d 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
+++ b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
@@ -4893,7 +4893,10 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
       var OVERVIEW_EDGE_PAN_ZONE = 0.08;
       var OVERVIEW_EDGE_PAN_MAX_PX = 32;
 
-      var overviewCache = { model: null, view: null, fullDuration: 1, minDuration: 1 };
+      // `flat` and `axis` are the model's inputs, and they are here so the model can be reused
+      // rather than rebuilt — see `cachedOverviewModel`. They are not a second source of truth:
+      // a hit is only allowed when BOTH still match, so a stale model cannot be shown.
+      var overviewCache = { model: null, view: null, fullDuration: 1, minDuration: 1, flat: null, axis: null };
       // The window bar's nodes, built on first use and then reused. Null until then.
       var windowBarParts = null;
       var overviewDrag = null;
@@ -5159,11 +5162,51 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
         return node;
       }
 
+      /**
+       * The model for the rows on screen, rebuilt only when one of its two inputs has changed.
+       *
+       * WHY. Building it costs one object per dated record — measured 59.6 ms of a 186.3 ms
+       * `renderOverview` on a 36,525-record session — and seven of the eight callers of
+       * `renderOverview` change neither input: filtering, selecting, brushing, wheel, edge-pan
+       * (a 60 ms timer) and a session switch all re-enter here with the same rows and the same
+       * axis. So this is not a new cache with a policy to invent; it is the two inputs, compared.
+       *
+       * THE KEY IS IDENTITY, and that is the whole correctness argument:
+       *
+       *   - `state.flat` has exactly one writer (`flattenTurns` on every applied payload) and is
+       *     never mutated in place, so a new array means new rows and the same array means the
+       *     same rows. Comparing contents instead would cost a pass over every record — the work
+       *     being saved — to answer a question identity already answers.
+       *   - `state.actualDuration` is the model's other input, and its own setter returns early
+       *     when the value is unchanged, so comparing it is comparing state, not re-deriving it.
+       *
+       * Both together are what make a hit safe. Keying on the rows alone would keep a model built
+       * on the other axis, and the strip would draw every record at its position on the axis the
+       * reader just turned off.
+       *
+       * The one thing this does NOT cover is `turnKey`'s `Math.random()` fallback, which fires
+       * only for a turn carrying neither `id` nor `index`. The payload gives every turn an
+       * `index`, so that branch is unreachable from here — and `visibleTurns`, which is not
+       * cached, reaches the same fallback, so the page's behaviour does not hinge on it.
+       *
+       * @param {Array<{turn: any, record: any}>} flat
+       * @returns {{spans: Array<any>, turnBoundaries: Array<any>, start: number, end: number} | null}
+       */
+      function cachedOverviewModel(flat) {
+        if (overviewCache.flat === flat && overviewCache.axis === state.actualDuration) {
+          return overviewCache.model;
+        }
+        var model = overviewModel(flat);
+        overviewCache.model = model;
+        overviewCache.flat = flat;
+        overviewCache.axis = state.actualDuration;
+        return model;
+      }
+
       function renderOverview() {
         var track = dom.overviewTrack;
         if (!track) return;
-        var model = overviewModel(state.flat);
-        overviewCache.model = model;
+        var model = cachedOverviewModel(state.flat);
         if (!model) {
           clear(dom.overviewTurns);
           clear(dom.overviewLanes);
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-overview.py b/plugins/avatasia/mmc-trajectory/tests/mutate-overview.py
index 4d25a99..f3f9dda 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-overview.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-overview.py
@@ -57,7 +57,32 @@
 # would make the second one's replacement collide with the first one's anchor.
 SPAN_AT_RETURN = "        return nearestSpanAt(overviewTimeAt(overviewFractionAt(clientX)), lane);"
 
+# ---- the model's own reuse -----------------------------------------------------------------
+# The two below do not touch what the model computes; they change whether it is computed again.
+# That is the whole shape of this cache, and it is the shape a shape-only assertion cannot see: a
+# stripped-down version that stores both inputs and then rebuilds anyway produces an identical
+# model, so every value check still passes. Only counting the rebuilds tells them apart.
+CACHE_HIT = """        if (overviewCache.flat === flat && overviewCache.axis === state.actualDuration) {
+          return overviewCache.model;
+        }"""
+
+CACHE_HIT_ROWS_ONLY = "        if (overviewCache.flat === flat && overviewCache.axis === state.actualDuration) {"
+
 MUTATIONS = [
+    (
+        "the model is rebuilt on every render, so the seven callers that change nothing pay for it",
+        CACHE_HIT,
+        """        if (false) {
+          return overviewCache.model;
+        }""",
+        "the same rows again do not rebuild it",
+    ),
+    (
+        "the model is keyed on the rows alone, so turning the duration axis keeps a model built on the other one",
+        CACHE_HIT_ROWS_ONLY,
+        "        if (overviewCache.flat === flat) {",
+        "turning the duration axis on rebuilds",
+    ),
     (
         "the strip keeps a predicate of its own instead of asking the list",
         SPAN_ADAPTER,
@@ -188,11 +213,17 @@ def named_failure(output):
     probe that dies on an exception names nothing, and a control that calls that 「caught」
     would be reporting a crash as if it were evidence.
     """
-    return next(
-        (line.strip()[len("FAIL"):].strip() for line in output.splitlines()
-         if line.strip().startswith("FAIL")),
-        None,
-    )
+    hits = named_failures(output)
+    return hits[0] if hits else None
+
+
+def named_failures(output):
+    """Every rule the probe named, in order."""
+    return [
+        line.strip()[len("FAIL"):].strip()
+        for line in output.splitlines()
+        if line.strip().startswith("FAIL")
+    ]
 
 
 def main():
@@ -206,7 +237,12 @@ def main():
     original = CLIENT.read_bytes()
     missed = []
     unnamed = []
-    for label, old, new in MUTATIONS:
+    for entry in MUTATIONS:
+        label, old, new = entry[0], entry[1], entry[2]
+        # Optional fourth element: the assertion that OWNS the rule this mutation targets. A probe
+        # that goes red on something else has not caught this bug, and reporting that as caught is
+        # how a mutation control ends up proving nothing while counting.
+        expect = entry[3] if len(entry) > 3 else None
         text, newline = read_exact(CLIENT)
         if old not in text:
             print(f"SKIP  {label}: anchor not found")
@@ -229,6 +265,9 @@ def main():
         if name is None:
             print(f"UNNAMED {label}: the probe failed without naming a rule")
             unnamed.append(label)
+        elif expect is not None and expect not in named_failures(output):
+            print(f"MISSED {label}: probe failed, but not on {expect!r}\n         -> {named_failures(output)}")
+            missed.append(label)
         else:
             print(f"caught {label}\n         -> {name}")
 
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs
index 691af34..90bd45d 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs
@@ -203,6 +203,70 @@ const UNDATED = [ent(rec('u1', 'user', null, null), 1), ent(rec('u2', 'user', 50
 check('a record with no timestamp is not given a position', sandbox.overviewModel(UNDATED).spans.map((s) => s.id), ['u2']);
 check('no timed records yields no timeline at all', sandbox.overviewModel([ent(rec('u1', 'user', null, null), 1)]), null);
 
+/* --------------------------------------------------- the model is reused, not rebuilt */
+// Count the rebuilds rather than checking that the cache carries the two fields it needs. A cache
+// whose key is written but never read, or read but never compared, passes any assertion that only
+// looks for the shape — and a shell that stores the inputs and then rebuilds anyway would pass
+// one that only checks the values are equal, because a rebuilt model of the same rows IS the same
+// model. What has to be true is that the second call does no work.
+{
+  const realModel = sandbox.overviewModel;
+  let builds = 0;
+  sandbox.overviewModel = function (entries) { builds += 1; return realModel(entries); };
+
+  sandbox.state.actualDuration = false;
+  builds = 0;
+  const cold = sandbox.cachedOverviewModel(MIXED);
+  check('a cold cache builds the model', builds, 1);
+  const warm = sandbox.cachedOverviewModel(MIXED);
+  check('the same rows again do not rebuild it', builds, 1);
+  assert('and they hand back the very model that was built', cold === warm);
+
+  // A different array holding equal rows is still a rebuild. That is the price of the key: the
+  // payload path hands over a fresh array on every poll, so "deeply equal" would mean comparing
+  // every record to answer a question identity already answers.
+  builds = 0;
+  const equalRows = sandbox.cachedOverviewModel(MIXED.slice());
+  check('a different array of the same rows rebuilds', builds, 1);
+  check('and produces an equal model', JSON.stringify(equalRows), JSON.stringify(cold));
+
+  // Put MIXED back before the axis test. The step above leaves a *different* array in the cache,
+  // so a key that compared the rows but dropped the axis would still miss here and rebuild — and
+  // the rebuild the axis test observes would then prove nothing about the axis at all. That is
+  // not hypothetical: dropping `axis` from the key survived this file until this line was added.
+  sandbox.cachedOverviewModel(MIXED);
+
+  // The axis is the model's other input, read from state when it is built. Keying on the rows
+  // alone would keep a model from the other axis, and every record would be drawn at its
+  // position on the axis the reader just turned off.
+  builds = 0;
+  sandbox.state.actualDuration = true;
+  const onAxis = sandbox.cachedOverviewModel(MIXED);
+  check('turning the duration axis on rebuilds', builds, 1);
+  check('and the rebuilt model is on the compressed axis', onAxis.end - onAxis.start, 300);
+  check('with the idle gap removed, not shrunk', onAxis.spans[4].start, 1300);
+
+  builds = 0;
+  sandbox.cachedOverviewModel(MIXED);
+  check('the rebuilt axis is cached as well', builds, 0);
+
+  // An empty session produces no model at all, and reusing that answer must not depend on there
+  // being one: `overviewModel` returns null, and the caller branches on exactly that.
+  builds = 0;
+  const emptyRows = [ent(rec('z1', 'user', null, null), 1)];
+  check('a session with nothing dated yields no model', sandbox.cachedOverviewModel(emptyRows), null);
+  check('and building that answer counted once', builds, 1);
+  check('reusing it costs nothing', sandbox.cachedOverviewModel(emptyRows), null);
+  check('which is still no rebuild', builds, 1);
+
+  sandbox.overviewModel = realModel;
+  sandbox.state.actualDuration = false;
+  // Leave no cached model behind for the sections below, which build their own.
+  sandbox.overviewCache.flat = null;
+  sandbox.overviewCache.axis = null;
+  sandbox.overviewCache.model = null;
+}
+
 /* ------------------------------------------------------------- layer filters */
 /* 轮次 / 思考 / 调用 are presets over the same kind set the type chips edit — one filter,
  * two ways of setting it, so nothing here is a second copy that could disagree. Cancelling

From fce491d12321d871f32015103080c3a52c2a045e Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 20:49:24 +0800
Subject: [PATCH 27/36] =?UTF-8?q?verify-time-range=20=E5=9B=9E=E5=88=B0?=
 =?UTF-8?q?=E9=BB=98=E8=AE=A4=E9=9B=86=E5=90=88=EF=BC=9A=E8=87=AA=E5=B7=B1?=
 =?UTF-8?q?=E9=80=A0=E4=BC=9A=E8=AF=9D=EF=BC=8C=E8=80=8C=E4=B8=8D=E6=98=AF?=
 =?UTF-8?q?=E8=A6=81=E4=B8=80=E5=8F=B0=E8=B7=91=E7=9D=80=E7=9A=84=E6=9C=8D?=
 =?UTF-8?q?=E5=8A=A1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

它被跳过的唯一原因是输入。断言要 >1000 条消息、要跨本地午夜，而能拿到的会话
要么是「这台机器恰好有什么」，要么是 60 行的 fixture。三条路都不行：塞进默认
集合等于发红；把数字改到 fixture 够得着，时区算术整个不测；提交一个几 MB 的
真实会话，等于把会话内容打进包里。

现在的做法是自己造会话，交给服务端自己的 buildTrajectoryPayload —— 也就是
/api/trajectory 路由调的那个导出函数。合成的是对话，stats 仍然由被测代码算
出来；第 3 节问的还是「页面的重新推导与服务端的数字是否一致」，两边都还是出厂
实现。

造出来的会话刻意做成让比较咬得动，而不只是能通过：被比较的字段必须非零，否则
0 === 0 全绿而什么也没测。所以 prompt 轮、continuation 轮、未收尾轮、一轮向读者
提问、steers、失败的工具调用、五个 token 计数器都是设计出来的。合成后 compactions
与 compactionTurns 为零，而 compactionTurns === 0 是故意断言的：裸 checkpoint 轮
会让两边在推导不同的人群，而不是对同一份人群有分歧。

起始时刻挂在本地日历上而不是一个 UTC 瞬时值 —— 被测的就是本地午夜，一个固定的
UTC 起点会让它在每台别的机器上落到别处，这个文件就变成在量存储的时区。还会避开
跨夏令时的那几天，因为墙钟动了而 relativeMs 没动时，被比较的两个读数会分家。

两个不显然、第一版都写错的形状：

  - closed 不是 stop reason。服务端是从 kind === 'reply' 的记录推出 closed 的，
    而 reply 由字面量 'stop' 赋值。写成 'endTurn' 会投影成 narration，于是每一轮
    都静默保持 open —— openTurns 出来是 275/275，这个形状看起来很健康，实际什么
    都没测。
  - 一轮只有在工具结果之后再来一条 assistant 行时才算收尾；一条同时带文本和工具
    调用的 assistant 行不是 reply。

新增 mutate-time-range.py 八条，全部按名捕获。其中六条是这份守卫在默认集合之外
的那段时间里手工验过的变异 —— 那是一次性结果，没有任何东西会重跑它，所以后来的
改动可以在这个目录里全部通过而这份文件无人验证。现在它们在这里跑。另有一条反向
用例：只加注释必须不改变任何判定。

152 条断言。run.mjs 的 SKIP 集合随之删除。
---
 .../avatasia/mmc-trajectory/tests/README.md   |  58 ++++--
 .../mmc-trajectory/tests/mutate-time-range.py | 195 ++++++++++++++++++
 plugins/avatasia/mmc-trajectory/tests/run.mjs |  17 +-
 .../tests/verify-time-range.mjs               | 189 +++++++++++++++--
 4 files changed, 415 insertions(+), 44 deletions(-)
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/mutate-time-range.py

diff --git a/plugins/avatasia/mmc-trajectory/tests/README.md b/plugins/avatasia/mmc-trajectory/tests/README.md
index 9f4a0d8..2114900 100644
--- a/plugins/avatasia/mmc-trajectory/tests/README.md
+++ b/plugins/avatasia/mmc-trajectory/tests/README.md
@@ -208,24 +208,46 @@ with the reason stated rather than quietly dropped.
   guards is gone.
 - **`mutate-qa-lens.py`** — not carried. Guards the 问答 turn-lens. Same removal; no lens symbol
   remains.
-- **`verify-time-range.mjs`** — present, skipped by `run.mjs`. Its assertions are calibrated against a
-  full multi-generation session: `stats.messages > 1000`, and a checkpoint nested inside a turn rather
-  than being one. The committed fixture is a single-file session of a few dozen rows. Reproducing those
-  numbers faithfully would mean committing a multi-megabyte payload; relaxing them would stop
-  exercising the timezone arithmetic the file exists for. Run it by hand against a booted service:
-  `node tests/verify-time-range.mjs <port>`.
-
-  It has **no mutation control**, and there is no way to give it one inside this suite: `run.mjs`
-  promises that nothing here needs a running Mini App, and this file cannot be checked at all without
-  one — it derives its own fixture from `GET /api/trajectory`. So the teeth were checked by hand
-  instead, against a throwaway copy of the package taken outside this tree, so that no shipped byte
-  was touched. Six mutations, each required to fail with the assertion that owns the rule rather than
-  any nearby one: the bound read as UTC, the session-start subtraction dropped, one comparison in
-  `recordInRange()` flipped, `resetBaseFilters()` no longer called from `clearFilters()`,
-  `clearTimeRange()` no longer called from `resetBaseFilters()`, and the two clears in the wrong
-  order. All six were caught by name. That is a one-off result, not a control: nothing re-runs it,
-  and a later edit can pass everything else in this directory while this file goes unverified. Worth
-  knowing before trusting it.
+- **`verify-time-range.mjs`** — used to be here, skipped by `run.mjs`, and is now in the default
+  run. It was skipped for one reason: the only session it could get was whatever a booted service
+  had, while its assertions want `stats.messages > 1000` and a local midnight with rows on both
+  sides of it. The committed fixture is sixty rows of one afternoon. Shipping it anyway would have
+  meant shipping a red suite; relaxing the numbers would have stopped exercising the timezone
+  arithmetic the file exists for; committing a multi-megabyte real transcript would have put a
+  session's contents in the package.
+
+  It now builds its own transcript — 300 turns, 1,348 rows, ~2,400 records, spanning eight hours
+  across a local midnight — and hands it to the server's own `buildTrajectoryPayload`, the same
+  exported function `/api/trajectory` calls. **What is synthetic is the conversation; the `stats`
+  being compared is still computed by the code under test.** That is what makes section 3 still a
+  real comparison: it asks whether the page's re-derivation agrees with the server's numbers, and
+  both sides are the shipped implementations.
+
+  The generator is written to make the comparison bite rather than merely pass. It is not enough
+  for the session to be large: the fields section 3 compares have to be **non-zero**, or `0 === 0`
+  is green and means nothing. So the mix is deliberate — prompt turns, continuations, unfinished
+  turns, a turn that asks the reader something, steers, failing tool calls, and all five token
+  counters. Only `compactions` and `compactionTurns` are zero, and `compactionTurns === 0` is
+  asserted on purpose: a session with a bare checkpoint turn would have the two sides re-deriving
+  different populations rather than disagreeing about the same one.
+
+  Two shapes in it are not obvious and were both wrong on the first attempt:
+
+  - `closed` is **not** a stop reason. The server sets it from a record of kind `reply`, and that
+    kind is assigned from the literal string `stop`. A closing assistant row written as `'endTurn'`
+    projects as `narration`, and every turn in the session silently stays open — `openTurns` came
+    out at 275 of 275, which is the shape that made the comparison look fine while testing nothing.
+  - A turn only closes when a **second** assistant row follows its tool results. One assistant row
+    carrying both text and tool calls is not a reply.
+
+  **It has a mutation control now: `mutate-time-range.py`, eight cases.** Six of them are the
+  mutations that were previously checked by hand against a throwaway copy of the package while this
+  file sat outside the suite — that was a one-off result nothing re-ran, so a later edit could pass
+  everything else here while this file went unverified. Each must now be caught **by name**, via the
+  `FAILED_NAMES` line the guard prints, because a mutation is not satisfied by the suite going red.
+  Two more cover the re-derived stats literal losing `steers` and the range ceasing to re-cut its
+  snapshot. A comment-only edit is required to leave every verdict unchanged, the other direction:
+  a guard that cannot pass is as broken as one that cannot fail.
 
 ### Two anchors that were wrong, and one mutation that could not be caught
 
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-time-range.py b/plugins/avatasia/mmc-trajectory/tests/mutate-time-range.py
new file mode 100644
index 0000000..b7eef5b
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-time-range.py
@@ -0,0 +1,195 @@
+"""Mutation control for verify-time-range.mjs.
+
+This guard was excluded from `run.mjs` for its entire life, and the six mutations below are the
+ones that were checked BY HAND against a throwaway copy of the package while it sat there — a
+one-off result that nothing re-ran, so a later edit could pass everything else in this directory
+while this file went unverified. It runs in the default suite now, so they run here too.
+
+Each mutation reintroduces exactly one bug and must be caught BY NAME. The name matters more than
+the red: the guard prints FAILED_NAMES as JSON, so an edit that trips some unrelated assertion does
+not count as catching the rule it was aimed at.
+
+The expected name is the assertion that OWNS the rule. A mutation here is not satisfied by the
+suite going red.
+"""
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parent
+HTML = ROOT / "miniapp" / "client" / "index.html"
+GUARD = HERE / "verify-time-range.mjs"
+
+# (label, expected assertion name, anchor, replacement)
+MUTATIONS = [
+    (
+        "a bound is read as UTC, shifting it by this machine's distance from Greenwich",
+        "parse across midnight",
+        "        var wall = new Date(year, month - 1, day, hour, minute, second, 0);",
+        "        var wall = new Date(raw + 'Z');",
+    ),
+    (
+        "the session-start subtraction is dropped, so a bound becomes a wall clock",
+        "parse at session start",
+        "        return wall.getTime() - sessionStartMs;",
+        "        return wall.getTime();",
+    ),
+    (
+        "one comparison in recordInRange() is flipped, so the filter keeps the wrong rows",
+        "a date range selects exactly the records inside that wall-clock window",
+        "        if (isCount(from) && at < from) return false;",
+        "        if (isCount(from) && at > from) return false;",
+    ),
+    (
+        "clearFilters() no longer runs the base reset",
+        "清除筛选 runs the base reset",
+        "      function clearFilters() {\n        resetBaseFilters();",
+        "      function clearFilters() {",
+    ),
+    (
+        "resetBaseFilters() no longer drops the range, leaving a filter the reader cannot see",
+        "清除筛选 also drops the range",
+        "        dropOverviewSelection();\n        clearTimeRange();",
+        "        dropOverviewSelection();",
+    ),
+    (
+        "the query and the range are cleared in the wrong order, so the ledger renders once with neither",
+        "清除筛选 also drops the range",
+        "        state.query = '';\n        state.searchHits = null;",
+        "        state.searchHits = null;",
+    ),
+    (
+        "the re-derived stats drop steers, the field the server's shape carries and this copy lost",
+        "whole-session steers",
+        "          steers: 0,\n",
+        "",
+    ),
+    (
+        "applying a range no longer re-cuts the snapshot, so the open-ended range grows on its own",
+        "applying a range re-cuts the snapshot",
+        "          state.rangeCutoff = latestRecordIndex();\n        }\n        syncRangeButtons();",
+        "          state.rangeCutoff = null;\n        }\n        syncRangeButtons();",
+    ),
+]
+
+
+def read_exact(path):
+    """Normalise to LF for matching, and report the file's own newline so it can be put back."""
+    data = path.read_bytes()
+    text = data.decode("utf-8").replace("\r\n", "\n")
+    return text, ("\r\n" if b"\r\n" in data else "\n")
+
+
+def write_exact(path, text, newline):
+    if newline == "\r\n":
+        text = text.replace("\n", "\r\n")
+    path.write_bytes(text.encode("utf-8"))
+
+
+def run_guard():
+    proc = subprocess.run(
+        ["node", str(GUARD)],
+        cwd=str(ROOT),
+        capture_output=True,
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+    )
+    return proc.returncode, (proc.stdout or "") + (proc.stderr or "")
+
+
+def failed_names(output):
+    """The guard's machine-readable failure list, or None when it did not print one."""
+    for line in output.splitlines():
+        if line.startswith("FAILED_NAMES"):
+            try:
+                return json.loads(line.split("\t", 1)[1])
+            except (IndexError, ValueError):
+                return None
+    return None
+
+
+def main():
+    code, output = run_guard()
+    if code != 0:
+        print("baseline guard does not pass; fix that first")
+        print(output)
+        return 1
+    print("baseline clean")
+
+    original = HTML.read_bytes()
+    missed = []
+    unnamed = []
+    for label, expected, old, new in MUTATIONS:
+        text, newline = read_exact(HTML)
+        if old not in text:
+            print(f"SKIP  {label}: anchor not found")
+            missed.append(label)
+            continue
+        if old == new:
+            print(f"SKIP  {label}: the mutation changes nothing")
+            missed.append(label)
+            continue
+        write_exact(HTML, text.replace(old, new, 1), newline)
+        try:
+            code, output = run_guard()
+        finally:
+            HTML.write_bytes(original)
+        if code == 0:
+            print(f"MISSED {label}: the guard still passed")
+            missed.append(label)
+            continue
+        names = failed_names(output)
+        if names is None:
+            print(f"UNNAMED {label}: the guard failed without printing FAILED_NAMES")
+            unnamed.append(label)
+        elif expected in names:
+            print(f"caught {label}\n         -> {expected}")
+        else:
+            print(f"MISSED {label}: guard failed, but not on {expected!r}\n         -> {names}")
+            missed.append(label)
+
+    # ---- the other direction ---------------------------------------------------------------
+    # A note in the shipped file must not change a single verdict. If adding prose can turn this
+    # guard red, it is reading the prose.
+    text, newline = read_exact(HTML)
+    anchor = "      function clearTimeRange() {"
+    note = "/* note-only-edit-marker */"
+    guard_bytes = GUARD.read_bytes()
+    if anchor not in text or note in guard_bytes.decode("utf-8"):
+        print("SKIP  comment-only edit: precondition not met")
+        missed.append("comment-only edit")
+    else:
+        write_exact(HTML, text.replace(anchor, "      " + note + "\n" + anchor, 1), newline)
+        try:
+            code, output = run_guard()
+        finally:
+            HTML.write_bytes(original)
+        if HTML.read_bytes() != original:
+            print(f"NOT RESTORED {HTML}")
+            return 1
+        if code != 0:
+            print(f"MISSED comment-only edit: adding a note turned the guard red\n{output}")
+            missed.append("comment-only edit")
+        else:
+            print("caught a comment-only note leaves every verdict unchanged")
+
+    if HTML.read_bytes() != original:
+        print(f"NOT RESTORED {HTML}")
+        return 1
+    print("file restored byte-for-byte")
+
+    if missed or unnamed:
+        if missed:
+            print(f"\n{len(missed)} mutation(s) got through")
+        if unnamed:
+            print(f"{len(unnamed)} mutation(s) failed without naming a rule")
+        return 1
+    print(f"\nall {len(MUTATIONS)} mutations caught, each by name")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/plugins/avatasia/mmc-trajectory/tests/run.mjs b/plugins/avatasia/mmc-trajectory/tests/run.mjs
index 90fc88e..ffbb7f3 100644
--- a/plugins/avatasia/mmc-trajectory/tests/run.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/run.mjs
@@ -111,15 +111,16 @@ function checkShipped() {
   return drift;
 }
 
-// verify-time-range.mjs is here but not run. Its assertions are calibrated against a full
-// multi-generation session — stats.messages > 1000, a checkpoint nested inside a turn — and the
-// committed fixture is a single-file session of a few dozen rows. Shipping it in the default set
-// would mean shipping a red suite; relax the numbers instead and the timezone arithmetic stops
-// being exercised at all. Run it by hand against a booted service: see its own header.
-const SKIP = new Set(['verify-time-range.mjs']);
-
+// Nothing is excluded any more. `verify-time-range.mjs` used to be here, not run, because the only
+// session it could get was whatever a booted service had — and the committed fixture is sixty rows
+// of one afternoon, against assertions that want more than a thousand messages spanning a local
+// midnight. Shipping it anyway would have meant shipping a red suite, and relaxing the numbers to
+// fit the fixture would have meant not testing the timezone arithmetic at all. So it now builds its
+// own transcript and hands it to the server's own `buildTrajectoryPayload`; see that file's header
+// for why that is not the same as testing a fixture. A guard that is in the directory but never
+// runs is not a guard, and that one was 152 assertions of one.
 const files = readdirSync(HERE)
-  .filter((n) => n !== 'run.mjs' && n !== 'README.md' && !SKIP.has(n)
+  .filter((n) => n !== 'run.mjs' && n !== 'README.md'
     && (n.startsWith('verify-') || n.startsWith('mutate-')
       || n === 'client-check.mjs' || n === 'check-light-theme.mjs'))
   .filter((n) => !filter || n.startsWith(filter))
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-time-range.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-time-range.mjs
index a7997d1..d07755b 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-time-range.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-time-range.mjs
@@ -14,27 +14,169 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import vm from 'node:vm';
+import { buildTrajectoryPayload } from '../miniapp/node/server.mjs';
 
 const HERE = fileURLToPath(new URL('.', import.meta.url));
 const HTML = join(HERE, '..', 'miniapp', 'client', 'index.html');
 
-// NOT part of `run.mjs`, and deliberately so. Its assertions are calibrated against a full
-// multi-generation session -- `stats.messages > 1000`, and a checkpoint that sits inside a turn
-// rather than being one -- and the committed fixture is a single-file session of a few dozen
-// rows. Reproducing those numbers faithfully would mean committing a multi-megabyte payload.
-// Relaxing them to fit would be worse: the point of this file is the timezone arithmetic, which
-// a small window would stop exercising.
+const html = readFileSync(HTML, 'utf8');
+
+/* ---------- the session section 3 runs against ---------- */
+// WHY IT IS BUILT HERE. This file was excluded from `run.mjs` for its whole life, and the reason
+// was always the input: its assertions want a session with more than a thousand messages spanning a
+// local midnight, and the only one available was whatever the machine running the service happened
+// to have. The committed fixture is sixty rows of one afternoon. So the file sat in the directory,
+// looked like coverage, and proved nothing — 509 lines of timezone arithmetic that no run exercised.
+//
+// Relaxing the numbers to fit the fixture was the alternative on the table and it is worse: the
+// whole point of the file is that a bound is a subtraction, and a window that no longer crosses a
+// midnight stops exercising the machine's distance from Greenwich at all.
+//
+// Committing a multi-megabyte real transcript was the other alternative. Rejected: it puts a
+// session's contents in the package, and this is a fixture, not a corpus.
+//
+// So the transcript is synthetic and built here, and it is handed to the server's OWN
+// `buildTrajectoryPayload` — the same exported function the `/api/trajectory` route calls. What is
+// synthetic is the conversation; the `stats` this compares against is still computed by the code
+// under test, in the file that serves it. Section 3 asks "does the page's re-derivation agree with
+// the server's numbers", and both sides of that question are still the real implementations.
 //
-// Run it against a booted service instead:
-//   node tests/verify-time-range.mjs <port>
-const port = process.argv[2];
-if (!port) {
-  console.error('usage: node verify-time-range.mjs <port>   (needs a running Mini App)');
-  process.exit(2);
+// Three properties are load-bearing, and none of them is "big":
+//
+//   - over a thousand messages, or the half-range comparison compares two numbers too close to tell
+//   - a local midnight with rows on both sides of it, or the wall-clock arithmetic is never exercised
+//   - no turn that is nothing but a checkpoint, or `compactionTurns` is not 0 and the two sides are
+//     re-deriving different populations rather than disagreeing about the same one
+const SYNTHETIC_TURNS = 300;
+// Eight hours from 20:00 local puts the midnight four hours in, with roughly half the records on
+// each side of it — dense enough that the ±5 minute window section 3b picks is never empty, and
+// spread thinly enough that the window stays far under the tenth-of-the-session slice it asserts.
+const SYNTHETIC_SPAN_MS = 8 * 3600 * 1000;
+
+/**
+ * A local wall-clock instant far enough from any daylight-saving step to span one safely.
+ *
+ * Anchored to the calendar rather than to a UTC instant on purpose: the crossing under test is a
+ * LOCAL midnight, so a fixed UTC start would place it somewhere else on every other machine's
+ * clock and the file would be testing the store's timezone instead of the arithmetic. The retry is
+ * for the remaining case — a zone whose transition falls inside the eight hours, where the wall
+ * clock moves without `relativeMs` moving and the two readings section 3b compares part company.
+ *
+ * @returns {number} epoch ms
+ */
+function syntheticStart() {
+  let start = new Date(2026, 9, 10, 20, 0, 0).getTime();
+  for (let guard = 0; guard < 14; guard += 1) {
+    const offset = new Date(start).getTimezoneOffset();
+    if (offset === new Date(start + SYNTHETIC_SPAN_MS).getTimezoneOffset()) return start;
+    start = new Date(2026, 9, 10 + guard + 1, 20, 0, 0).getTime();
+  }
+  return start;
 }
-const BASE_URL = 'http://127.0.0.1:' + port;
 
-const html = readFileSync(HTML, 'utf8');
+/**
+ * @returns {Array<Record<string, any>>} rows in the file shape the store keeps
+ */
+function buildRows(start) {
+  /** @type {Array<{ turn: string, message: Record<string, any>, stamp: number }>} */
+  const plan = [];
+  let at = 0;
+  const add = (turnId, message) => {
+    at += 1;
+    plan.push({ turn: turnId, message, stamp: at });
+  };
+  const assistant = (t, blocks, stopReason) => ({
+    role: 'assistant',
+    content: blocks,
+    api: 'synthetic-api', provider: 'synthetic-provider', model: 'synthetic-model',
+    usage: {
+      input: 1000 + t, output: 40 + (t % 17), cacheRead: 9000 + t * 2, cacheWrite: 7 * t,
+      totalTokens: 1000 + t + 40 + (t % 17) + 9000 + t * 2 + 7 * t,
+    },
+    stopReason,
+  });
+  const thinking = (t) => ({ type: 'thinking', thinking: 'synthetic reasoning ' + t, thinkingSignature: 'sig-' + t });
+
+  for (let t = 1; t <= SYNTHETIC_TURNS; t += 1) {
+    const turnId = 'turn-' + String(t).padStart(4, '0');
+
+    // Every twelfth turn is the model resuming without a new reader message — the shape the
+    // server files as a continuation. It needs a `reply` record to be closed, otherwise it lands
+    // in `turnsWithoutPrompt` instead and the classifier's second branch is never taken.
+    if (t % 12 === 5) {
+      add(turnId, assistant(t, [thinking(t), { type: 'text', text: 'synthetic resumed ' + t }], 'stop'));
+      continue;
+    }
+
+    // Every seventeenth turn has neither an opener nor a closing reply, so the classifier falls
+    // through to its last branch. Left uncovered, the page's `else` arm was being compared with
+    // the server's against zero.
+    if (t % 17 === 3) {
+      add(turnId, assistant(t, [
+        thinking(t),
+        { type: 'text', text: 'synthetic unfinished ' + t },
+        { type: 'toolCall', id: 'call_' + t + '_0', name: 'tool_' + (t % 7), arguments: { n: t } },
+      ], 'toolUse'));
+      add(turnId, {
+        role: 'toolResult',
+        toolCallId: 'call_' + t + '_0',
+        toolName: 'tool_' + (t % 7),
+        content: [{ type: 'text', text: 'synthetic result ' + t }],
+        isError: false,
+      });
+      continue;
+    }
+
+    add(turnId, { role: 'user', content: [{ type: 'text', text: 'synthetic prompt ' + t }] });
+
+    // `closed` is not a stop reason: the server sets it from a record of kind `reply`, and that
+    // kind is assigned from the literal string `stop` — anything else projects as `narration`. So a
+    // turn only closes when a second assistant row follows its tool results carrying `'stop'`, and
+    // a generator that omits it — or spells it `'endTurn'` — leaves every turn open.
+    const asks = t === SYNTHETIC_TURNS;
+    const open = asks || t % 9 === 4;
+    const callIds = ['call_' + t + '_0', 'call_' + t + '_1'];
+    // The last turn calls a tool whose answer arrives through the tool, which is what makes it a
+    // question to the reader (`qaTurns`) rather than just an unfinished turn.
+    const callNames = asks ? ['ask_user', 'tool_' + (t % 7)] : ['tool_' + (t % 7), 'tool_' + ((t + 3) % 7)];
+    add(turnId, assistant(t, [
+      thinking(t),
+      { type: 'text', text: 'synthetic answer ' + t },
+      { type: 'toolCall', id: callIds[0], name: callNames[0], arguments: { n: t } },
+      { type: 'toolCall', id: callIds[1], name: callNames[1], arguments: { n: t } },
+    ], 'toolUse'));
+
+    // Two tool results, and every ninth one fails — so `errors` is non-zero and the
+    // de-duplication of errors by message id has something to de-duplicate.
+    for (let c = 0; c < 2; c += 1) {
+      add(turnId, {
+        role: 'toolResult',
+        toolCallId: callIds[c],
+        toolName: callNames[c],
+        content: [{ type: 'text', text: 'synthetic result ' + t + '.' + c }],
+        isError: (t + c) % 9 === 0,
+      });
+    }
+
+    if (!open) add(turnId, assistant(t, [thinking(t), { type: 'text', text: 'synthetic close ' + t }], 'stop'));
+    // A prompt typed while the turn was still running. The server projects a user row that is not
+    // its turn's opener as a steer rather than as a message, so without one `steers` is 0 on both
+    // sides and the check degenerates to comparing 0 with 0.
+    else if (!asks) add(turnId, { role: 'user', content: [{ type: 'text', text: 'synthetic steer ' + t }] });
+  }
+
+  // Timestamps are laid over the span only once the row count is known, so the density does not
+  // depend on how many rows a turn happens to contribute.
+  const step = SYNTHETIC_SPAN_MS / plan.length;
+  return plan.map((entry, i) => ({
+    message_id: 'msg-' + String(i + 1).padStart(5, '0'),
+    turn_id: entry.turn,
+    message: { ...entry.message, timestamp: start + Math.round(i * step) },
+  }));
+}
+
+const SYNTHETIC_START = syntheticStart();
+const SYNTHETIC_ROWS = buildRows(SYNTHETIC_START);
 
 /* ---------- helpers ---------- */
 let pass = 0;
@@ -242,8 +384,16 @@ assert('the unreadable branch names the range still in force', /hasTimeRange\(\)
   assert('and does not blame the value', noBase.textContent.indexOf('无法识别') < 0);
 }
 
-/* ---------- 3) against the live session ---------- */
-const payload = await (await fetch(BASE_URL + '/api/trajectory')).json();
+/* ---------- 3) against a projected session ---------- */
+// The one line that used to be `await fetch(BASE_URL + '/api/trajectory')`. Same builder, no
+// service: what the route adds around `buildTrajectoryPayload` is a handful of `session.*` fields
+// this file never reads, which is the same observation `make-payload.mjs` is built on.
+const payload = buildTrajectoryPayload({
+  session: { id: 'mvs_0000000000000000000000000000000f', createdAtMs: SYNTHETIC_START },
+  rows: SYNTHETIC_ROWS,
+  sizeBytes: SYNTHETIC_ROWS.length,
+  truncated: false,
+});
 
 const scoped = { console, state: { payload, flat: [], rangeFrom: null, rangeTo: null, rangeCutoff: null } };
 scoped.state.flat = payload.turns.flatMap((turn) => turn.records.map((record) => ({ turn, record })));
@@ -293,7 +443,10 @@ for (const field of ['input', 'output', 'cacheRead', 'cacheWrite', 'totalTokens'
 // The one field that must NOT be re-scoped: 「全程 N」 beside the range is the comparison the
 // reader wants, and re-scoping it would leave the note with nothing to say.
 check('messagesAll stays whole-session', whole.messagesAll, payload.stats.messagesAll);
-assert('the fixture is big enough to be worth checking', payload.stats.messages > 1000);
+// The preconditions of section 3b, asserted rather than assumed. A generator edited down to a
+// tenth of its size, or one that grew a bare checkpoint turn, would leave every assertion below it
+// comparing two near-identical small numbers — still green, and no longer evidence of anything.
+assert('the synthetic session is big enough to be worth checking', payload.stats.messages > 1000);
 assert('compactionTurns is 0 after the turn fix, as it must be', payload.stats.compactionTurns === 0);
 
 // A narrower range must produce strictly fewer messages, or the filter is not filtering.
@@ -597,7 +750,7 @@ assert('an unreadable box is not assigned',
 
 /* ---------- report ---------- */
 console.log('[1] parse / format / compare: ' + pass + ' assertions, ' + failures.length + ' failed');
-console.log('    fixture: ' + payload.stats.messages + ' messages, ' + scoped.state.flat.length + ' records, '
+console.log('    session: ' + payload.stats.messages + ' messages, ' + scoped.state.flat.length + ' records, '
   + payload.turns.length + ' turns, span ' + maxs + ' ms');
 // Machine-readable, so the mutation runner can require the *named* guard to fire instead of
 // matching on a substring that any nearby assertion can satisfy by accident. Assertion names

From 9604ba10e1a76e5ffe69219f6b1d36a3f73bea92 Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 21:16:09 +0800
Subject: [PATCH 28/36] =?UTF-8?q?=E4=BC=9A=E8=AF=9D=E5=88=97=E8=A1=A8?=
 =?UTF-8?q?=E8=AE=A4=E5=BE=97=E5=87=BA=E3=80=8C=E8=BF=99=E6=98=AF=E5=AD=90?=
 =?UTF-8?q?=E4=BC=9A=E8=AF=9D=E3=80=8D=EF=BC=9A=E6=8A=8A=20store=20?=
 =?UTF-8?q?=E9=87=8C=E4=B8=80=E7=9B=B4=E6=B2=A1=E4=BA=BA=E8=AF=BB=E7=9A=84?=
 =?UTF-8?q?=20parent=5Fsession=5Fid=20=E6=8E=A5=E4=B8=8A?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

存储里一直有 parent_session_id 这一列，而服务端的会话查询一直只取 title 和
session_kind，所以运行时派生的每一次子代理运行，在列表里都和一个顶层会话长得一模一样。
唯一发到客户端的 sessionKind 在 index.html 里出现 0 次——字段一直通着，没有人读它。

链路是四段，缺任何一段都是同一个静默结果：查询取列 → 行映射成 parent（空串算没有）
→ 挂到 descriptor → stripInternalFields 以 ?? null 过闸 → 客户端按字段决定标不标。
所以四段各有一条断言，而不是一条：只看其中一段的实现，另一段被切掉时照样绿。

为什么只标「子会话」而不写父会话的标题：分支一定比派生它的会话新，而列表按最近活动
取前 30 个，父会话通常已经掉出这个窗口。写标题就是一个「读者最想要答案的时候正好失败」
的查询，而静默失败的查询最后会让界面声称一个它看不见的东西。

它是一个标注而不是筛选器：不写任何 state，所以不存在「第二个筛选器对哪些记录在屏有
不同看法」这一类联动异常。

口径不变：纯文本后缀，不改计数、不改统计、不改「最近 N 个」的截断。但它改了
/api/sessions 响应体的字段集合，而此前没有任何守卫钉住那个集合——stripInternalFields
在整个 tests/ 里 0 命中。所以这次补的是一块现在还没有的地板，而不是守住一个已有的数：

  - verify-list-cache.mjs 18 -> 23：四段链路各一条，外加客户端那半读的是去掉注释的
    源码——sessionOptionLabel 上方那段注释就写着「子会话」，对着原始文件断言会被它自己
    要抓的东西满足。
  - client-check.mjs 206 -> 212：把 sessionOptionLabel 跑起来，验身份而不是形状。两个
    只差 sessionParentId 的会话，标签必须只差一个标注。一个无条件加标注的版本能通过
    任何「里面有没有子会话」的检查，过不了这一条。
  - mutate-list-cache-ttl.py 12 -> 17：四段链路各切一处，加上「标注加到每个会话上」
    这个看起来像对、实际上把每个顶层会话都说成子代理运行的方向。
---
 plugins/avatasia/mmc-trajectory/README.md     |  1 +
 .../avatasia/mmc-trajectory/README.zh-CN.md   |  1 +
 .../mmc-trajectory/miniapp/client/index.html  | 17 +++++++-
 .../mmc-trajectory/miniapp/node/server.mjs    | 15 ++++++-
 .../mmc-trajectory/tests/client-check.mjs     | 43 +++++++++++++++++++
 .../tests/mutate-list-cache-ttl.py            | 35 +++++++++++++++
 .../tests/verify-list-cache.mjs               | 31 +++++++++++++
 7 files changed, 140 insertions(+), 3 deletions(-)

diff --git a/plugins/avatasia/mmc-trajectory/README.md b/plugins/avatasia/mmc-trajectory/README.md
index 46765fe..019b40d 100644
--- a/plugins/avatasia/mmc-trajectory/README.md
+++ b/plugins/avatasia/mmc-trajectory/README.md
@@ -131,6 +131,7 @@ The runtime database is opened in read-only mode. If it is missing, unreadable,
 - A single `messages.jsonl` is read up to 64 MB. Larger sessions are truncated and the page says so.
 - The ledger does not use virtual scrolling; every rendered row is a real element. The page therefore opens on the newest 200 records, and the window bar button switches to the whole session. The button names what pressing it will do, not the current state: 「显示全部」 at the default and 「显示最新 200 条」 once everything is showing, while the count beside it reports what is on screen. That full view is opt-in for a reason: on a 9,900-record session it is roughly 57,000 elements rebuilt every 2.5s poll, which was measured to freeze the page rather than be read. 「向上加载更早的 N 条」 widens the window in steps and a poll does not undo it. A sticky window bar under the overview strip offers that choice behind four explicit controls: switch the strip between equal width and a real time axis, load 200 earlier records, jump back to the latest 200, and show everything. "Show everything" builds every record in the session into the DOM at once and gets noticeably slower on large sessions; incoming records do not knock it back down to 200.
 - `messageCount` and `turnCount` in the session picker are estimates derived from a bounded prefix of the file; exact values come from the selected session.
+- A session the runtime spawned from another one is marked 「子会话」 in the picker. The parent is deliberately not named: a branch is always newer than the session that spawned it, so its parent has usually aged out of the most-recent-N window this list is built from, and a lookup that fails quietly is how a picker ends up asserting something it cannot see.
 - Light theme token coverage is verified — every `--mcode-*` token the page consumes is defined for both themes — but its rendered appearance was not visually checked; the page was exercised under a dark system preference.
 
 ## Tested environment
diff --git a/plugins/avatasia/mmc-trajectory/README.zh-CN.md b/plugins/avatasia/mmc-trajectory/README.zh-CN.md
index cfe8634..9eb5320 100644
--- a/plugins/avatasia/mmc-trajectory/README.zh-CN.md
+++ b/plugins/avatasia/mmc-trajectory/README.zh-CN.md
@@ -117,6 +117,7 @@ MiniMax Code 不会告诉 Mini App 是哪段对话打开了它的页面：传给
 - 单个 `messages.jsonl` 最多读取 64 MB。更大的会话会被截断，页面会明确说明。
 - 台里没有用虚拟滚动，每一行都是真实的 DOM 元素。页面默认只展示最新 200 条，窗口条上的按钮可以切到全量；全量是可选的，因为它很贵 —— 在这个会话上约 9,900 条、约 5.7 万个元素，每 2.5 秒轮询重建一次，实测会直接卡死页面。总览条正下方的吸顶窗口栏提供三个显式控件：「总览轴」「向上加载更早的 200 条」，以及在最新 200 条与全量之间切换的那一个按钮（它写的是按下去会变成什么，默认为「显示全部」，全量时为「显示最新 200 条」；当前窗口由右边的计数条报告，两者回答的是不同问题）。「总览轴」只改总览条的横轴——等宽（每条记录一样宽，完全忽略时间）或真实时间轴（宽度等于该记录的真实耗时）；它不筛选、不排序，台账里的行和页面上的任何计数都不变。「向上加载更早的 200 条」每点一次就多加一页，轮询不会把已经加宽的窗口重置回去；点切换按钮也不会自动滚动页面，读者正在看的那一行会留在原地。
 - 会话选择器里的 `messageCount` / `turnCount` 是从文件的有界前缀估算的；精确值以选中会话后展示的为准。
+- 会话选择器里，被运行时从另一个会话派生出来的会话标为「子会话」，但不写父会话的名字：分支一定比派生它的会话新，而列表按最近活动取前 30 个，父会话通常已经掉出这个窗口。静默失败的查找，最终会让列表声称一个它看不见的东西。
 - 浅色主题的 token 覆盖已验证（页面用到的每个 `--mcode-*` 变量在两套主题下都有定义），但渲染外观未做视觉检查；功能验收是在深色系统偏好下进行的。
 
 ## 测试环境
diff --git a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
index 7a5b72d..272a05e 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
+++ b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
@@ -4453,13 +4453,26 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
        * absence of a number in the shape of a number. Omitting the segment is the honest rendering
        * of 「这个数不存在」: the reader still has the label and the recency, which is what the picker
        * is for. tests/verify-list-cache.mjs pins the gate that produces the absence. */
+      /* 「子会话」 says the structural fact and stops there.
+       *
+       * The parent is named by nobody, on purpose. A branch is always newer than the session that
+       * spawned it, so its parent has usually aged out of the most-recent-N window this list is
+       * built from — naming it would mean a lookup that fails exactly when a reader wants the
+       * answer most, and a lookup that fails quietly is how a picker ends up asserting something
+       * it cannot see.
+       *
+       * It is a marker and not a filter: nothing here writes state, so there is no second opinion
+       * about which records are on screen that could disagree with the table. */
+      var BRANCH_MARK = ' · 子会话';
+
       function sessionOptionLabel(session, now) {
         var label = truncateText(session && session.label ? session.label : '', 42);
         var when = formatAgo(session ? session.lastActiveAt : null, now);
         var count = session ? session.messageCount : null;
         var tail = isCount(count) ? '（' + when + ' · ' + formatInt(count) + ' 条）' : '（' + when + '）';
-        if (!label) return '未命名会话 ' + tail;
-        return label + ' ' + tail;
+        var branch = session && session.sessionParentId ? BRANCH_MARK : '';
+        if (!label) return '未命名会话 ' + tail + branch;
+        return label + ' ' + tail + branch;
       }
 
       function renderSessionSelect() {
diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
index b93db1e..b2918d2 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
@@ -969,13 +969,21 @@ export async function readSessionTitles(home, sessionIds) {
   if (!db) return result;
   try {
     if (sessionIds.length === 0) return result;
-    const stmt = db.prepare('select session_id, title, session_kind from local_runtime_sessions where session_id = ?');
+    // The parent id is the fact that a branch exists, and it is the ONLY part of that
+    // relationship that is always available: the list is the most recent N sessions, and a child
+    // is always newer than the parent that spawned it, so the parent's title is routinely outside
+    // the window. Carrying the id and looking the title up would therefore be a lookup that fails
+    // exactly when a reader is most likely to want it.
+    const stmt = db.prepare('select session_id, title, session_kind, parent_session_id from local_runtime_sessions where session_id = ?');
     for (const id of sessionIds) {
       const row = stmt.get(id);
       if (!row) continue;
       result.set(id, {
         title: typeof row.title === 'string' && row.title.trim() ? row.title.trim() : null,
         kind: typeof row.session_kind === 'string' ? row.session_kind : null,
+        parent: typeof row.parent_session_id === 'string' && row.parent_session_id !== ''
+          ? row.parent_session_id
+          : null,
       });
     }
   } catch {
@@ -3048,6 +3056,7 @@ export async function start(context) {
           if (meta) {
             if (meta.title) descriptor.label = meta.title;
             descriptor.sessionKind = meta.kind;
+            descriptor.sessionParentId = meta.parent;
           }
           described.push(descriptor);
         } catch (error) {
@@ -4051,6 +4060,10 @@ function stripInternalFields(value) {
     sizeBytes: value.sizeBytes,
     turnCount: value.turnCount,
     sessionKind: value.sessionKind ?? null,
+    // Null is the normal case and has to survive as null rather than as `undefined`: the page
+    // decides by whether this field is set, so a missing key and a present key both reading
+    // "not set" is what keeps one row from being a branch and the next from merely lacking it.
+    sessionParentId: value.sessionParentId ?? null,
   };
 }
 
diff --git a/plugins/avatasia/mmc-trajectory/tests/client-check.mjs b/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
index 999c3f2..16bd873 100644
--- a/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
@@ -462,6 +462,49 @@ const codeOnly = html
   .replace(/\/\*[\s\S]*?\*\//g, '')
   .replace(/^[ \t]*\/\/.*$/gm, '');
 
+/* ------------------------------------------------------------------ session picker: branch marker */
+// A session that the runtime spawned from another one used to be listed exactly like a top-level
+// conversation, because nothing in the list said otherwise: the parent column existed in the store
+// and was never read, and the one field that did reach the page (`sessionKind`) had no reader in
+// it at all. A reader comparing two entries could not tell a sub-agent run from a conversation.
+//
+// The marker is checked here by RUNNING it rather than by matching its text, because the failure
+// worth catching is not a typo in the string — it is the marker being applied to everything, or to
+// nothing, and both of those still contain the right characters. The decisive case is the third
+// one: two sessions identical except for `sessionParentId`, whose labels must differ by exactly
+// the marker and nothing else. A version that appended the marker unconditionally passes every
+// "does it contain 子会话" check and fails this one.
+const branchMarkSrc = /var BRANCH_MARK = '[^']*';/.exec(html);
+const branchLabelSrc = fnSource('function sessionOptionLabel(session, now)');
+if (!branchMarkSrc || !branchLabelSrc) {
+  failures.push('session picker: could not lift sessionOptionLabel / BRANCH_MARK');
+} else {
+  vm.runInContext(branchMarkSrc[0] + '\n' + branchLabelSrc, sandbox);
+  const NOW = 1_800_000_000_000;
+  const base = { label: '一个会话', lastActiveAt: NOW - 60_000, messageCount: 42 };
+  const plain = sandbox.sessionOptionLabel({ ...base }, NOW);
+  const branch = sandbox.sessionOptionLabel({ ...base, sessionParentId: 'mvs_parent' }, NOW);
+
+  assert('a top-level session is not marked as a branch',
+    plain.indexOf('子会话') < 0);
+  assert('a session the runtime spawned is marked as one',
+    branch.indexOf('子会话') >= 0);
+  // Identity, not shape: the only thing that differs between these two inputs is the field, so
+  // the only thing allowed to differ between the two labels is the marker.
+  assert('the marker is driven by the field, not by where the row sits in the list',
+    branch.replace(' · 子会话', '') === plain);
+  assert('and nothing else about the label changes with it',
+    branch.length === plain.length + ' · 子会话'.length);
+  // An empty parent string is "no parent", not "a parent named the empty string".
+  assert('an empty parent id is not a parent',
+    sandbox.sessionOptionLabel({ ...base, sessionParentId: '' }, NOW) === plain);
+  // The unnamed branch takes the marker too — otherwise the one case with no title to read is
+  // the one case a reader cannot place.
+  assert('an unnamed branch is still marked',
+    sandbox.sessionOptionLabel({ lastActiveAt: NOW - 60_000, messageCount: 42,
+      sessionParentId: 'mvs_parent' }, NOW).indexOf('子会话') >= 0);
+}
+
 const checks = [
   ['no remote http(s) resource', !/<(script|link|img|iframe)[^>]+(src|href)=["']https?:/i.test(html)],
   ['no @import', !/@import/.test(html)],
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-list-cache-ttl.py b/plugins/avatasia/mmc-trajectory/tests/mutate-list-cache-ttl.py
index 030a72d..8bfb1b6 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-list-cache-ttl.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-list-cache-ttl.py
@@ -132,6 +132,41 @@
        "        var tail = '（' + when + ' · ' + formatInt(count) + ' 条）';")],
      "the session picker omits the count segment instead of printing a placeholder",
      CLIENT),
+
+    # ---- the branch a session was spawned from -------------------------------------------
+    # Four links between the store's parent column and the mark on the option, and dropping any
+    # one of them produces the SAME silent list: a sub-agent run listed exactly like a top-level
+    # conversation, with no error and no number moved. So they are four separate mutations rather
+    # than one, because a single one would pass as long as the guard happened to watch that link
+    # and not the three that were actually cut.
+    ("the titles query stops reading the parent column",
+     [("select session_id, title, session_kind, parent_session_id from local_runtime_sessions where session_id = ?",
+       "select session_id, title, session_kind from local_runtime_sessions where session_id = ?")],
+     "the titles query reads the parent column"),
+
+    ("the parent row is read but never mapped",
+     [("        parent: typeof row.parent_session_id === 'string' && row.parent_session_id !== ''\n"
+       "          ? row.parent_session_id\n"
+       "          : null,\n", "")],
+     'the parent row is mapped, and an empty id is no parent rather than a parent named ""'),
+
+    ("the descriptor is built without the parent",
+     [("            descriptor.sessionParentId = meta.parent;", "")],
+     "the descriptor carries the parent onto the row the page receives"),
+
+    # This one is the most likely to be reintroduced by accident: it is a whole-field removal in
+    # a function whose job is to decide what may leave the service, and nothing else in it fails.
+    ("the field is stripped before it is sent",
+     [("    sessionParentId: value.sessionParentId ?? null,", "")],
+     "the field survives the strip, with null as the floor"),
+
+    # The direction that looks right and is not: marking every row. Every string the guard looks
+    # for is still present, and the list reads as though every conversation were a sub-agent run.
+    ("the mark is applied to every session rather than the branches",
+     [("        var branch = session && session.sessionParentId ? BRANCH_MARK : '';",
+       "        var branch = BRANCH_MARK;")],
+     "the page decides the marker by the field and not unconditionally",
+     CLIENT),
 ]
 
 ORIGINALS = {
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-list-cache.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-list-cache.mjs
index aa075c7..e845d0d 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-list-cache.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-list-cache.mjs
@@ -158,6 +158,37 @@ assert('the session picker omits the count segment instead of printing a placeho
   /var tail = isCount\(count\) \?/.test(clientJs)
   && /'（' \+ when \+ '）'/.test(clientJs));
 
+/* ---------- 7: the branch a session was spawned from is carried, not dropped ---------- */
+// The store has always had a `parent_session_id`, and the list route has always read the titles
+// beside it without reading it — so every sub-agent run the runtime spawned was listed exactly
+// like a top-level conversation. Nothing caught that, because nothing was pinned about WHICH
+// fields the list is allowed to drop: `stripInternalFields` had no reader anywhere in this
+// directory, so a field could be added, or lost, and the suite stayed green either way.
+//
+// Four links, and dropping any one of them produces the same silent list: the column is not
+// selected, or it is selected and not mapped, or it is mapped and not put on the descriptor, or
+// it reaches the descriptor and is stripped before it is sent. Each gets its own assertion
+// because each is a place the value can be lost without a type error or a crash.
+assert('the titles query reads the parent column',
+  /select session_id, title, session_kind, parent_session_id from local_runtime_sessions where session_id = \?/.test(server));
+
+assert('the parent row is mapped, and an empty id is no parent rather than a parent named ""',
+  /parent:\s*typeof row\.parent_session_id === 'string' && row\.parent_session_id !== ''\s*\n\s*\?\s*row\.parent_session_id\s*\n\s*:\s*null,/.test(server));
+
+assert('the descriptor carries the parent onto the row the page receives',
+  /descriptor\.sessionParentId = meta\.parent;/.test(server));
+
+// `?? null` rather than a bare copy: the page decides by whether this field is SET, so a missing
+// key and a present-but-undefined one have to land in the same place as a row that has no parent.
+assert('the field survives the strip, with null as the floor',
+  /sessionParentId:\s*value\.sessionParentId \?\? null,/.test(server));
+
+// The reader-facing half, off the comment-stripped client for the reason given in section 6: the
+// comment above `sessionOptionLabel` names the marker, so an assertion made against the raw file
+// would be satisfied by prose describing the very thing it exists to require.
+assert('the page decides the marker by the field and not unconditionally',
+  /var branch = session && session\.sessionParentId \? BRANCH_MARK : '';/.test(clientJs));
+
 console.log('[list-cache] ' + pass + ' passed, ' + failures.length + ' failed');
 if (failures.length) {
   console.log('FAILURES:\n - ' + failures.join('\n - '));

From fb69e95af3c8fd7800a31f6f2720cccbd5f4e20c Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 22:41:49 +0800
Subject: [PATCH 29/36] =?UTF-8?q?codex=20=E7=AC=AC=E4=B8=80=E8=BD=AE?=
 =?UTF-8?q?=E7=9A=84=E4=B8=A4=E6=9D=A1=E5=8F=91=E7=8E=B0=EF=BC=9AETag=20?=
 =?UTF-8?q?=E6=B2=A1=E8=A6=86=E7=9B=96=E6=96=B0=E5=AD=97=E6=AE=B5=EF=BC=8C?=
 =?UTF-8?q?=E4=B8=A4=E4=B8=AA=E8=AE=A1=E6=95=B0=E5=99=A8=E5=9C=A8=E8=87=AA?=
 =?UTF-8?q?=E5=B7=B1=E8=B7=9F=E8=87=AA=E5=B7=B1=E6=AF=94?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

评审给的是 not acceptable，两条都成立，都已修。

**一、`/api/sessions` 的 ETag 没有覆盖它新读的那个字段。**

`sessionsValidator()` 的材料是 dir | sizeBytes | lastActiveAt | title | kind，不含 parent；
而响应体在组装时已经读了 `meta.parent`。body 读一个字段而 validator 不哈希它，就是：parent 变了
而目录统计、标题、kind、limit 都没动时 tag 不动，轮询的客户端拿到 304，不带 validator 的请求
还能复用旧字节。判据是两份只差 parent 的 map 产生相同的材料——读代码就能确认，那条拼串里根本没有
这个字段。parent 已进材料。

守卫 29 → 31。两条新断言把 title 与 kind 都按住不动，所以不可能靠另外两个字段蒙过去；另有一条
空串与 null 必须一致（两者在页面上渲染成同一行）。变异 13 → 14。

连带：改这一处打断了三个已有变异的锚点——title/kind 那几行原本以 `));` 结尾，加一行之后 kind
那行不再是串的结尾。按规矩只改锚点，并把解释性注释挪到 `parts.push(` 的上面，让三行字段保持连续：
锚点不该隔着注释，改个措辞就失效。

**二、两条「比较」其实是自己跟自己比。**

合成会话里 compactions 与 compactionTurns 是零。零意味着把页面上 `stats.compactions += 1` 与
`stats.compactionTurns += 1` 删掉，逐字段比较仍然 0 === 0 全绿——那两条不是比较，是这个文件
自己安排好的一对零。断言数量看不出这一点，只有变异能。

生成器每 23 轮造一个只装一条 checkpoint 的轮次，那是服务端唯一会归成 compaction 的形状。两个
计数器现在都非零，删掉那两行会被抓到并按名报 whole-session compactions / whole-session
compactionTurns（已实测）。

同时删掉一条循环断言。原来那句 `compactionTurns === 0` 断言的是这个文件自己选的数，而它保证的
正是它随后要去比较的前提。真正的不变式——真实会话不该有裸 checkpoint 轮——属于另一个守卫的
既有一条断言。**在自己的 fixture 上断言自己造出来的数，证明不了任何事。**

变异 8 → 10。套件 90/90。
---
 .../mmc-trajectory/miniapp/node/server.mjs    |  7 +++-
 .../tests/mutate-sessions-etag.py             | 22 ++++++++--
 .../mmc-trajectory/tests/mutate-time-range.py | 18 +++++++++
 .../tests/verify-sessions-etag.mjs            | 14 +++++++
 .../tests/verify-time-range.mjs               | 40 +++++++++++++++----
 5 files changed, 89 insertions(+), 12 deletions(-)

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
index b2918d2..4f099bd 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
@@ -2371,9 +2371,14 @@ export function sessionsValidator(visible, titles, limit) {
     const meta = titles.get(decodeSessionIdFromDirName(basename(entry.dir)));
     // A NUL between the fields, so a rename cannot be masked by the stat beside it: with a plain
     // separator, {"ab",""} and {"a","b"} concatenate to the same string and the tag does not move.
+    // Every value the body carries has to be in the material, and the comment sits out here so
+    // the three field lines stay contiguous — a mutation anchor that has to reach past a comment
+    // stops resolving the next time the comment is reworded, and an anchor that stops resolving
+    // is an assertion that quietly stops being tested.
     parts.push(entry.dir + "|" + entry.sizeBytes + "|" + entry.lastActiveAt
       + "|" + (meta ? String(meta.title ?? "") : "")
-      + "\u0000" + (meta ? String(meta.kind ?? "") : ""));
+      + "\u0000" + (meta ? String(meta.kind ?? "") : "")
+      + "\u0000" + (meta ? String(meta.parent ?? "") : ""));
   }
   return parts.join("\n");
 }
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-sessions-etag.py b/plugins/avatasia/mmc-trajectory/tests/mutate-sessions-etag.py
index 0ce912b..a9f9bf0 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-sessions-etag.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-sessions-etag.py
@@ -38,8 +38,9 @@
     # `kind` is what puts the sub-agent and cron badges on the rows, so a page that keeps a stale
     # tag is offering the reader a worker's session as if it were their conversation.
     ("a changed session kind stops moving the tag",
-     [("      + \"\\u0000\" + (meta ? String(meta.kind ?? \"\") : \"\"));",
-       "      + \"\");")],
+     [("      + \"\\u0000\" + (meta ? String(meta.kind ?? \"\") : \"\")\n"
+       "      + \"\\u0000\" + (meta ? String(meta.parent ?? \"\") : \"\"));",
+       "      + \"\\u0000\" + (meta ? String(meta.parent ?? \"\") : \"\"));")],
      "a changed session kind moves the tag, even with no title", SERVER),
 
     # The one that looks like a simplification. Two different requests, one tag.
@@ -50,8 +51,10 @@
     # The separator. Without one, {"ab",""} and {"a","b"} concatenate to the same string, so two
     # different payloads share a tag and the 304 is served for one the caller never held.
     ("the title and kind are concatenated with no separator",
-     [("      + \"\\u0000\" + (meta ? String(meta.kind ?? \"\") : \"\"));",
-       "      + (meta ? String(meta.kind ?? \"\") : \"\"));")],
+     [("      + \"\\u0000\" + (meta ? String(meta.kind ?? \"\") : \"\")\n"
+       "      + \"\\u0000\" + (meta ? String(meta.parent ?? \"\") : \"\"));",
+       "      + (meta ? String(meta.kind ?? \"\") : \"\")\n"
+       "      + (meta ? String(meta.parent ?? \"\") : \"\"));")],
      "a title/kind split cannot be hidden inside the separator", SERVER),
 
     # mtime is one of the three facts the descriptor cache keys on, and the only one that moves
@@ -137,6 +140,17 @@
     ("the list validator stops being bound to its request key",
      [("state.sessionsEtagFor === key", "true")],
      "the list validator is bound to the request key", CLIENT),
+
+    # The one that looks like tidying. `parent` is in the body — it is what puts 「子会话」 on the
+    # row — so leaving it out of the material makes the tag constant across a change the reader
+    # can see, and the 304 that follows is a statement about bytes nobody re-computed. Found by
+    # review, not by a failing test: the guard was passing because every map it built varied only
+    # the title and the kind, so nothing ever asked the question.
+    ("the validator stops covering the parent the body sends",
+     [("      + \"\\u0000\" + (meta ? String(meta.kind ?? \"\") : \"\")\n"
+       "      + \"\\u0000\" + (meta ? String(meta.parent ?? \"\") : \"\"));",
+       "      + \"\\u0000\" + (meta ? String(meta.kind ?? \"\") : \"\"));")],
+     "a changed parent moves the tag, even with the title and kind held constant", SERVER),
 ]
 
 ORIGINALS = {
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-time-range.py b/plugins/avatasia/mmc-trajectory/tests/mutate-time-range.py
index b7eef5b..a42f616 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-time-range.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-time-range.py
@@ -72,6 +72,24 @@
         "          state.rangeCutoff = latestRecordIndex();\n        }\n        syncRangeButtons();",
         "          state.rangeCutoff = null;\n        }\n        syncRangeButtons();",
     ),
+    # ---- the two counters that were being compared at zero ------------------------------------
+    # Both of these survived an earlier version of this guard, and that is worth recording rather
+    # than just fixing: the fixture was built WITHOUT a bare checkpoint turn, so both sides read 0,
+    # so `0 === 0` passed with the page's `+= 1` deleted outright. The guard was comparing two
+    # zeros that it had itself arranged — a self-fulfilling comparison, which is the failure mode a
+    # mutation control exists to surface and a count of assertions cannot.
+    (
+        "the page stops counting compactions, which the fixture now makes non-zero",
+        "whole-session compactions",
+        "        else if (kind === 'compaction') stats.compactions += 1;",
+        "",
+    ),
+    (
+        "the page stops counting turns that are nothing but a checkpoint",
+        "whole-session compactionTurns",
+        "        stats.compactionTurns += 1;",
+        "",
+    ),
 ]
 
 
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-sessions-etag.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-sessions-etag.mjs
index 9781a6a..9323c52 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-sessions-etag.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-sessions-etag.mjs
@@ -95,6 +95,20 @@ const kindAfter = new Map([[A, { title: '第一段会话', kind: 'conversation'
 assert('a changed session kind moves the tag, even with no title',
   sessionsValidator(visible, kindBefore, 20) !== sessionsValidator(visible, kindAfter, 20));
 
+// The parent is what puts 「子会话」 on the row, so it is reader-visible on its own and belongs in
+// the material for the same reason `kind` does. The title AND the kind are held constant here, so
+// this cannot pass on either of them: the two maps differ in the parent and in nothing else.
+const parentBefore = new Map([[A, { title: '第一段会话', kind: 'conversation', parent: null }]]);
+const parentAfter = new Map([[A, { title: '第一段会话', kind: 'conversation', parent: 'mvs_0000000000000000000000000000bbbb' }]]);
+assert('a changed parent moves the tag, even with the title and kind held constant',
+  sessionsValidator(visible, parentBefore, 20) !== sessionsValidator(visible, parentAfter, 20));
+
+// And the null case, which is the other half: a row with no parent and a row whose parent is the
+// empty string render identically on the page, so they must not read as a change.
+const parentEmpty = new Map([[A, { title: '第一段会话', kind: 'conversation', parent: '' }]]);
+assert('an empty parent and a null one agree — they render the same row',
+  sessionsValidator(visible, parentBefore, 20) === sessionsValidator(visible, parentEmpty, 20));
+
 // A null title and an absent one are the same payload — the picker falls back to 「会话 <id>」 — so
 // they have to be the same tag, or every poll would look like a change.
 const nullTitle = new Map([[A, { title: null, kind: 'conversation' }]]);
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-time-range.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-time-range.mjs
index d07755b..1b3cadf 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-time-range.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-time-range.mjs
@@ -41,12 +41,20 @@ const html = readFileSync(HTML, 'utf8');
 // under test, in the file that serves it. Section 3 asks "does the page's re-derivation agree with
 // the server's numbers", and both sides of that question are still the real implementations.
 //
-// Three properties are load-bearing, and none of them is "big":
+// Four properties are load-bearing, and none of them is "big":
 //
 //   - over a thousand messages, or the half-range comparison compares two numbers too close to tell
 //   - a local midnight with rows on both sides of it, or the wall-clock arithmetic is never exercised
-//   - no turn that is nothing but a checkpoint, or `compactionTurns` is not 0 and the two sides are
-//     re-deriving different populations rather than disagreeing about the same one
+//   - EVERY field section 3 compares is non-zero, or the comparison is `0 === 0`: green, and not
+//     evidence of anything. That includes the two compaction counters, so the session carries a
+//     turn that is nothing but a checkpoint. Leaving them at zero looked like a deliberate choice
+//     — "no bare checkpoint turn, or the two sides re-derive different populations" — and it was
+//     exactly backwards: it meant `stats.compactions += 1` and `stats.compactionTurns += 1` could
+//     both be deleted from the page and this guard would still pass. A turn that is nothing but a
+//     checkpoint is also the only way that branch of the classifier is reachable, so it is what
+//     makes the two counters comparable rather than assumed. The product invariant that a real
+//     session has none of these belongs to `verify-compaction-turn.mjs`; asserting it here proved
+//     nothing, because the number it asserted was this file's own choice.
 const SYNTHETIC_TURNS = 300;
 // Eight hours from 20:00 local puts the midnight four hours in, with roughly half the records on
 // each side of it — dense enough that the ±5 minute window section 3b picks is never empty, and
@@ -108,6 +116,19 @@ function buildRows(start) {
       continue;
     }
 
+    // Every twenty-third turn is a checkpoint that opened a turn the file never named — the only
+    // shape the server classifies as `compaction`, and the reason the two compaction counters are
+    // compared rather than assumed. Without it the page's `+= 1` for either one could be deleted
+    // and every assertion below would still pass on `0 === 0`.
+    if (t % 23 === 7) {
+      add(turnId, {
+        role: 'compactionSummary',
+        summary: 'synthetic checkpoint ' + t,
+        tokensBefore: 1000 + t,
+      });
+      continue;
+    }
+
     // Every seventeenth turn has neither an opener nor a closing reply, so the classifier falls
     // through to its last branch. Left uncovered, the page's `else` arm was being compared with
     // the server's against zero.
@@ -443,11 +464,16 @@ for (const field of ['input', 'output', 'cacheRead', 'cacheWrite', 'totalTokens'
 // The one field that must NOT be re-scoped: 「全程 N」 beside the range is the comparison the
 // reader wants, and re-scoping it would leave the note with nothing to say.
 check('messagesAll stays whole-session', whole.messagesAll, payload.stats.messagesAll);
-// The preconditions of section 3b, asserted rather than assumed. A generator edited down to a
-// tenth of its size, or one that grew a bare checkpoint turn, would leave every assertion below it
-// comparing two near-identical small numbers — still green, and no longer evidence of anything.
+// The preconditions of section 3, asserted rather than assumed. A generator edited down to a
+// tenth of its size would leave every assertion below it comparing two near-identical small
+// numbers — still green, and no longer evidence of anything.
 assert('the synthetic session is big enough to be worth checking', payload.stats.messages > 1000);
-assert('compactionTurns is 0 after the turn fix, as it must be', payload.stats.compactionTurns === 0);
+// The one that was wrong before. It read `compactionTurns === 0`, which made the fixture guarantee
+// the precondition of the comparison it was about to perform: two counters that are zero by
+// construction compare equal whether or not the page counts them at all. Asking for a non-zero
+// one is what turns two tautologies into two checks.
+assert('the compaction counters are non-zero, so the page is actually counted against them',
+  payload.stats.compactions > 0 && payload.stats.compactionTurns > 0);
 
 // A narrower range must produce strictly fewer messages, or the filter is not filtering.
 const halfEnd = Math.floor((mins + maxs) / 2);

From 8096e076b4aadde7fc4296367ee4fa4d0d19d5aa Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 23:01:05 +0800
Subject: [PATCH 30/36] time-range guard: a field nobody mutates is a field the
 page may never count
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The whole-session section compares twenty numbers between the page's re-derivation and the
server's own. Both sides are correct in a passing run, so a comparison can only fail if one of
them is broken — which means a field with no mutation is a field whose comparison could be
satisfied by a page that never counts it at all. Three fields had a mutation; seventeen did not.

The fixture is now a generation view over a lineage rather than one whole-session pass, and that
is not tidiness. `messagesAll` counts the conversation and `messages` counts what the view holds;
while the view was the whole conversation the two were one number, so re-scoping 「全程 N」 onto
the range changed nothing any assertion could see. One generation stays outside the payload, and
the guard asserts the two figures differ before asserting anything about either.

Every compared field is now checked non-zero by the guard itself, driven off the list the
comparisons are driven off, so the next field added there arrives covered rather than waiting to
be discovered at zero. Two mutations break this guard's own generator instead of the page's code:
removing the checkpoint turns, and making the view the whole conversation again. Without them the
twenty preconditions are a claim about a session nobody has tried to starve.

`mutate-time-range.py` 10 -> 29, all caught by name.

verify-time-range.mjs 153 -> 172 assertions; suite 90/90.
---
 .../avatasia/mmc-trajectory/tests/README.md   |  45 +++--
 .../mmc-trajectory/tests/mutate-time-range.py | 159 ++++++++++++++++--
 .../tests/verify-time-range.mjs               |  56 ++++--
 3 files changed, 215 insertions(+), 45 deletions(-)

diff --git a/plugins/avatasia/mmc-trajectory/tests/README.md b/plugins/avatasia/mmc-trajectory/tests/README.md
index 2114900..19e0154 100644
--- a/plugins/avatasia/mmc-trajectory/tests/README.md
+++ b/plugins/avatasia/mmc-trajectory/tests/README.md
@@ -216,20 +216,27 @@ with the reason stated rather than quietly dropped.
   arithmetic the file exists for; committing a multi-megabyte real transcript would have put a
   session's contents in the package.
 
-  It now builds its own transcript — 300 turns, 1,348 rows, ~2,400 records, spanning eight hours
-  across a local midnight — and hands it to the server's own `buildTrajectoryPayload`, the same
-  exported function `/api/trajectory` calls. **What is synthetic is the conversation; the `stats`
-  being compared is still computed by the code under test.** That is what makes section 3 still a
-  real comparison: it asks whether the page's re-derivation agrees with the server's numbers, and
-  both sides are the shipped implementations.
+  It now builds its own transcript — 400 turns across four generations of 100, spanning eight hours
+  across a local midnight — and hands the **last three generations** to the server's own
+  `buildTrajectoryPayload`, the same exported function `/api/trajectory` calls. **What is synthetic
+  is the conversation; the `stats` being compared is still computed by the code under test.** That is
+  what makes section 3 still a real comparison: it asks whether the page's re-derivation agrees with
+  the server's numbers, and both sides are the shipped implementations.
+
+  The view is deliberately **not** the whole conversation, and that is what makes one of its numbers
+  testable. `messagesAll` counts the lineage; `messages` counts what this view holds. Hand the server
+  everything and the two are the same number, the 「全程 N」 assertion becomes the page agreeing with
+  itself, and re-scoping that field onto the view changes nothing any assertion can see. The
+  generator therefore keeps a whole generation out of the payload, and asserts the two differ before
+  asserting anything about either.
 
   The generator is written to make the comparison bite rather than merely pass. It is not enough
   for the session to be large: the fields section 3 compares have to be **non-zero**, or `0 === 0`
   is green and means nothing. So the mix is deliberate — prompt turns, continuations, unfinished
-  turns, a turn that asks the reader something, steers, failing tool calls, and all five token
-  counters. Only `compactions` and `compactionTurns` are zero, and `compactionTurns === 0` is
-  asserted on purpose: a session with a bare checkpoint turn would have the two sides re-deriving
-  different populations rather than disagreeing about the same one.
+  turns, a turn that asks the reader something, steers, failing tool calls, bare checkpoint turns,
+  and all five token counters. Every compared field is checked non-zero *by the guard*, driven off
+  the same list the comparisons are driven off, so a field added there arrives covered rather than
+  waiting to be discovered at zero.
 
   Two shapes in it are not obvious and were both wrong on the first attempt:
 
@@ -240,13 +247,17 @@ with the reason stated rather than quietly dropped.
   - A turn only closes when a **second** assistant row follows its tool results. One assistant row
     carrying both text and tool calls is not a reply.
 
-  **It has a mutation control now: `mutate-time-range.py`, eight cases.** Six of them are the
-  mutations that were previously checked by hand against a throwaway copy of the package while this
-  file sat outside the suite — that was a one-off result nothing re-ran, so a later edit could pass
-  everything else here while this file went unverified. Each must now be caught **by name**, via the
-  `FAILED_NAMES` line the guard prints, because a mutation is not satisfied by the suite going red.
-  Two more cover the re-derived stats literal losing `steers` and the range ceasing to re-cut its
-  snapshot. A comment-only edit is required to leave every verdict unchanged, the other direction:
+  **It has a mutation control now: `mutate-time-range.py`, 29 cases in three groups.** The first six
+  are the mutations that were previously checked by hand against a throwaway copy of the package
+  while this file sat outside the suite — that was a one-off result nothing re-ran, so a later edit
+  could pass everything else here while this file went unverified. Each must be caught **by name**,
+  via the `FAILED_NAMES` line the guard prints, because a mutation is not satisfied by the suite
+  going red. The second group is one dropped count per compared field: both sides of a comparison are
+  correct in a passing run, so a field nobody mutates is a field whose comparison could be satisfied
+  by a page that never counts it at all. The third group breaks the guard's own session instead of
+  the page's code — removing the checkpoint turns, and making the view the whole conversation again
+  — because otherwise the twenty non-zero assertions are a claim about a generator nobody has tried to
+  starve. A comment-only edit is required to leave every verdict unchanged, the other direction:
   a guard that cannot pass is as broken as one that cannot fail.
 
 ### Two anchors that were wrong, and one mutation that could not be caught
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-time-range.py b/plugins/avatasia/mmc-trajectory/tests/mutate-time-range.py
index a42f616..8bb00b3 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-time-range.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-time-range.py
@@ -1,7 +1,7 @@
 """Mutation control for verify-time-range.mjs.
 
-This guard was excluded from `run.mjs` for its entire life, and the six mutations below are the
-ones that were checked BY HAND against a throwaway copy of the package while it sat there — a
+This guard was excluded from `run.mjs` for its entire life, and the first six mutations below are
+the ones that were checked BY HAND against a throwaway copy of the package while it sat there — a
 one-off result that nothing re-ran, so a later edit could pass everything else in this directory
 while this file went unverified. It runs in the default suite now, so they run here too.
 
@@ -11,6 +11,9 @@
 
 The expected name is the assertion that OWNS the rule. A mutation here is not satisfied by the
 suite going red.
+
+The long family at the bottom is one dropped count per compared field, and the reason it is a family
+rather than three hand-picked cases is written where it is built.
 """
 import json
 import subprocess
@@ -92,6 +95,112 @@
     ),
 ]
 
+# ---- one dropped count per compared field ----------------------------------------------------
+# The guard compares twenty numbers between the page's re-derivation and the server's own. Both
+# sides are correct in a passing run, so a comparison is only capable of failing if one of them is
+# broken — which means a field nobody mutates is a field whose comparison could be satisfied by a
+# page that never counts it at all. Three fields had a mutation here; the other seventeen had none,
+# and 「the page re-derives all twenty fields correctly」 was asserted by a guard that could not tell
+# a page that re-derives nineteen of them.
+#
+# Driven off the same names the guard compares, with the label built from the field name for the
+# same reason: a hand-written label and a hand-written expected name drift apart silently, and the
+# control would then report a caught mutation that was caught by the wrong assertion.
+N = "\n"
+COUNT_ANCHORS = [
+    ("messages", "            stats.messages += 1;\n"),
+    ("toolCalls", N + "          else if (kind === 'toolCall') stats.toolCalls += 1;"),
+    ("toolResults", N + "          else if (kind === 'toolResult') stats.toolResults += 1;"),
+    ("thinkingBlocks", N + "          else if (kind === 'thinking') stats.thinkingBlocks += 1;"),
+    ("steers", N + "          else if (kind === 'steer') stats.steers += 1;"),
+    ("errors", "            stats.errors += 1;\n"),
+    ("tokens.input", "            if (isCount(tokens.input)) stats.tokens.input += tokens.input;\n"),
+    ("tokens.output", "            if (isCount(tokens.output)) stats.tokens.output += tokens.output;\n"),
+    ("tokens.cacheRead", "            if (isCount(tokens.cacheRead)) stats.tokens.cacheRead += tokens.cacheRead;\n"),
+    ("tokens.cacheWrite", "            if (isCount(tokens.cacheWrite)) stats.tokens.cacheWrite += tokens.cacheWrite;\n"),
+    ("tokens.totalTokens", "            if (isCount(tokens.totalTokens)) stats.tokens.totalTokens += tokens.totalTokens;\n"),
+    ("turnsWithPrompt", "            stats.turnsWithPrompt += 1;\n"),
+    ("openTurns", "            if (turn.closed !== true) stats.openTurns += 1;\n"),
+    ("qaTurns", "            if (turn.askedReader === true && turn.closed !== true) stats.qaTurns += 1;\n"),
+    ("continuationTurns", "            stats.continuationTurns += 1;\n"),
+    ("turnsWithoutPrompt", "            stats.turnsWithoutPrompt += 1;\n"),
+]
+for _field, _anchor in COUNT_ANCHORS:
+    MUTATIONS.append(
+        (
+            "the page stops counting " + _field,
+            "whole-session " + _field,
+            _anchor,
+            "",
+        )
+    )
+
+# durationMs is not a count, so it gets a mutation of its own shape: the span of the rows kept is
+# replaced by a constant. `0` is the value that says "this conversation took no time at all", which
+# is what a reader would be shown if the subtraction went missing.
+MUTATIONS.append(
+    (
+        "the page stops measuring the span of the rows it kept",
+        "whole-session durationMs",
+        "        stats.durationMs = first === null ? null : last - first;\n",
+        "        stats.durationMs = first === null ? null : 0;\n",
+    )
+)
+
+# `userMessages` cannot be deleted the way its neighbours are. It is the head of the
+# `if / else if` chain over `record.kind`, so removing the line leaves an `else if` with nothing to
+# attach to: the page stops parsing, the guard throws, and it prints no FAILED_NAMES at all. That is
+# reported as UNNAMED, which is weaker than being reported as caught — the suite is red either way,
+# but nothing says which rule was broken. Accumulating zero instead keeps the chain intact and
+# produces the defect the field is compared on.
+MUTATIONS.append(
+    (
+        "the page stops counting userMessages, the head of the record-kind chain",
+        "whole-session userMessages",
+        "          if (kind === 'user') stats.userMessages += 1;",
+        "          if (kind === 'user') stats.userMessages += 0;",
+    )
+)
+
+# The field the one above cannot be reached from. `messagesAll` is the only number on the card that
+# must NOT be re-scoped — 「全程 N」 beside a range is the comparison the reader wants — so it is
+# compared the other way round, against the server's own figure. In a fixture whose view was the
+# whole conversation those two numbers were the same number, the assertion was the page agreeing
+# with itself, and swapping the field for the view-scoped one changed nothing an assertion could
+# see. That edit is this case.
+MUTATIONS.append(
+    (
+        "the page re-scopes messagesAll onto the view, so 「全程 N」 quietly becomes the range's count",
+        "messagesAll stays whole-session",
+        "          messagesAll: base.messagesAll,\n",
+        "          messagesAll: base.messages,\n",
+    )
+)
+
+# ---- the fixture itself, so its own preconditions are known to be able to fail ----------------
+# Everything above breaks the page and asks the guard to notice. These two break the guard's own
+# session and ask the guard to notice that IT lost the property it depends on. Without them the
+# twenty non-zero assertions are a claim about a generator nobody has tried to starve: shrink the
+# session until a counter reads zero and every comparison below it becomes `0 === 0` again, with
+# nothing in the suite able to say so.
+#
+# They target the guard rather than the page, so they are kept apart from MUTATIONS above: this file
+# is the thing being run, and the two are restored by separate before/after byte snapshots.
+FIXTURE_MUTATIONS = [
+    (
+        "the session stops generating checkpoint turns, so both compaction counters read zero",
+        "the fixture makes compactions non-zero, so the page is counted against something",
+        "    if (t % 23 === 7) {\n",
+        "    if (t % 23 === 777) {\n",
+    ),
+    (
+        "the view becomes the whole conversation again, so messagesAll and messages are one number",
+        "the conversation and this view are different sizes, so the two cannot be swapped",
+        "const FIRST_VIEWED_GENERATION = 1;",
+        "const FIRST_VIEWED_GENERATION = 0;",
+    ),
+]
+
 
 def read_exact(path):
     """Normalise to LF for matching, and report the file's own newline so it can be put back."""
@@ -129,19 +238,15 @@ def failed_names(output):
     return None
 
 
-def main():
-    code, output = run_guard()
-    if code != 0:
-        print("baseline guard does not pass; fix that first")
-        print(output)
-        return 1
-    print("baseline clean")
+def run_cases(cases, path, original, missed, unnamed):
+    """Apply each case to `path` in turn, restoring the file's startup bytes after every one.
 
-    original = HTML.read_bytes()
-    missed = []
-    unnamed = []
-    for label, expected, old, new in MUTATIONS:
-        text, newline = read_exact(HTML)
+    The restore is the bytes read before the first case rather than HEAD, so a run against a
+    working tree holding uncommitted work in this file puts that work back rather than the
+    committed version of it.
+    """
+    for label, expected, old, new in cases:
+        text, newline = read_exact(path)
         if old not in text:
             print(f"SKIP  {label}: anchor not found")
             missed.append(label)
@@ -150,11 +255,11 @@ def main():
             print(f"SKIP  {label}: the mutation changes nothing")
             missed.append(label)
             continue
-        write_exact(HTML, text.replace(old, new, 1), newline)
+        write_exact(path, text.replace(old, new, 1), newline)
         try:
             code, output = run_guard()
         finally:
-            HTML.write_bytes(original)
+            path.write_bytes(original)
         if code == 0:
             print(f"MISSED {label}: the guard still passed")
             missed.append(label)
@@ -169,6 +274,23 @@ def main():
             print(f"MISSED {label}: guard failed, but not on {expected!r}\n         -> {names}")
             missed.append(label)
 
+
+def main():
+    code, output = run_guard()
+    if code != 0:
+        print("baseline guard does not pass; fix that first")
+        print(output)
+        return 1
+    print("baseline clean")
+
+    original = HTML.read_bytes()
+    guard_original = GUARD.read_bytes()
+    missed = []
+    unnamed = []
+    run_cases(MUTATIONS, HTML, original, missed, unnamed)
+    if FIXTURE_MUTATIONS:
+        run_cases(FIXTURE_MUTATIONS, GUARD, guard_original, missed, unnamed)
+
     # ---- the other direction ---------------------------------------------------------------
     # A note in the shipped file must not change a single verdict. If adding prose can turn this
     # guard red, it is reading the prose.
@@ -197,7 +319,10 @@ def main():
     if HTML.read_bytes() != original:
         print(f"NOT RESTORED {HTML}")
         return 1
-    print("file restored byte-for-byte")
+    if GUARD.read_bytes() != guard_original:
+        print(f"NOT RESTORED {GUARD}")
+        return 1
+    print("files restored byte-for-byte")
 
     if missed or unnamed:
         if missed:
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-time-range.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-time-range.mjs
index 1b3cadf..22e1649 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-time-range.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-time-range.mjs
@@ -14,7 +14,7 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import vm from 'node:vm';
-import { buildTrajectoryPayload } from '../miniapp/node/server.mjs';
+import { buildMessageIdentity, buildTrajectoryPayload, openerRowsForView } from '../miniapp/node/server.mjs';
 
 const HERE = fileURLToPath(new URL('.', import.meta.url));
 const HTML = join(HERE, '..', 'miniapp', 'client', 'index.html');
@@ -55,7 +55,7 @@ const html = readFileSync(HTML, 'utf8');
 //     makes the two counters comparable rather than assumed. The product invariant that a real
 //     session has none of these belongs to `verify-compaction-turn.mjs`; asserting it here proved
 //     nothing, because the number it asserted was this file's own choice.
-const SYNTHETIC_TURNS = 300;
+const SYNTHETIC_TURNS = 400;
 // Eight hours from 20:00 local puts the midnight four hours in, with roughly half the records on
 // each side of it — dense enough that the ±5 minute window section 3b picks is never empty, and
 // spread thinly enough that the window stays far under the tenth-of-the-session slice it asserts.
@@ -409,11 +409,29 @@ assert('the unreadable branch names the range still in force', /hasTimeRange\(\)
 // The one line that used to be `await fetch(BASE_URL + '/api/trajectory')`. Same builder, no
 // service: what the route adds around `buildTrajectoryPayload` is a handful of `session.*` fields
 // this file never reads, which is the same observation `make-payload.mjs` is built on.
+//
+// IT IS A GENERATION VIEW OVER A LINEAGE, not the whole conversation in one pass, and that is not
+// tidiness — it is what makes `messagesAll` testable. `messagesAll` counts the conversation;
+// `messages` counts what this view holds. When the two are the same number, re-scoping the whole
+// figure on the page is undetectable, and that is precisely the rule the assertion below states.
+// A single-view fixture made them equal, and 「全程 N」 was a comparison of the page with itself.
+const GENERATION_SIZE = 100;
+const FIRST_VIEWED_GENERATION = 1; // the view is generations 1..3 — it straddles the local midnight
+const generationOf = (row) => Math.floor((Number(row.turn_id.slice(5)) - 1) / GENERATION_SIZE);
+
+const occurrences = SYNTHETIC_ROWS.map((row) => ({ row, generation: generationOf(row), locator: null }));
+const identity = buildMessageIdentity(occurrences);
+const viewOccurrences = occurrences.filter((o) => o.generation >= FIRST_VIEWED_GENERATION);
+const viewRows = viewOccurrences.map((o) => o.row);
+
 const payload = buildTrajectoryPayload({
   session: { id: 'mvs_0000000000000000000000000000000f', createdAtMs: SYNTHETIC_START },
-  rows: SYNTHETIC_ROWS,
-  sizeBytes: SYNTHETIC_ROWS.length,
+  rows: viewRows,
+  identity,
+  openerByTurn: openerRowsForView(identity, viewOccurrences),
+  sizeBytes: viewRows.length,
   truncated: false,
+  generations: [],
 });
 
 const scoped = { console, state: { payload, flat: [], rangeFrom: null, rangeTo: null, rangeCutoff: null } };
@@ -454,26 +472,42 @@ const FIELDS = [
   // number check for this one.
   'steers'
 ];
+const TOKEN_FIELDS = ['input', 'output', 'cacheRead', 'cacheWrite', 'totalTokens'];
 for (const field of FIELDS) {
   check('whole-session ' + field, whole[field], payload.stats[field]);
 }
-for (const field of ['input', 'output', 'cacheRead', 'cacheWrite', 'totalTokens']) {
+for (const field of TOKEN_FIELDS) {
   check('whole-session tokens.' + field, whole.tokens[field], payload.stats.tokens[field]);
 }
 
+// The precondition of every comparison above, asserted for all twenty numbers rather than for the
+// two that happened to break first. `0 === 0` is not evidence that the page counts a field; it is
+// evidence that nothing counted it and both sides agreed. This used to read `compactionTurns === 0`
+// — the fixture guaranteeing the precondition of the comparison it was about to perform, so the
+// page's `+= 1` could be deleted outright and the guard stayed green. The other eighteen fields were
+// in exactly that state and nothing said so, which is the same defect one field narrower. Driven off
+// FIELDS, so the next field added to that list arrives covered instead of waiting to be discovered.
+for (const field of FIELDS) {
+  assert('the fixture makes ' + field + ' non-zero, so the page is counted against something',
+    typeof payload.stats[field] === 'number' && payload.stats[field] !== 0);
+}
+for (const field of TOKEN_FIELDS) {
+  assert('the fixture makes tokens.' + field + ' non-zero, so the page is counted against something',
+    typeof payload.stats.tokens[field] === 'number' && payload.stats.tokens[field] !== 0);
+}
+
 // The one field that must NOT be re-scoped: 「全程 N」 beside the range is the comparison the
 // reader wants, and re-scoping it would leave the note with nothing to say.
 check('messagesAll stays whole-session', whole.messagesAll, payload.stats.messagesAll);
+// ...and the precondition that makes it a check rather than an equality with itself. Without this
+// the assertion above is satisfied by any page that re-scopes the whole figure onto the view, and
+// that is the whole rule.
+assert('the conversation and this view are different sizes, so the two cannot be swapped',
+  payload.stats.messagesAll > payload.stats.messages);
 // The preconditions of section 3, asserted rather than assumed. A generator edited down to a
 // tenth of its size would leave every assertion below it comparing two near-identical small
 // numbers — still green, and no longer evidence of anything.
 assert('the synthetic session is big enough to be worth checking', payload.stats.messages > 1000);
-// The one that was wrong before. It read `compactionTurns === 0`, which made the fixture guarantee
-// the precondition of the comparison it was about to perform: two counters that are zero by
-// construction compare equal whether or not the page counts them at all. Asking for a non-zero
-// one is what turns two tautologies into two checks.
-assert('the compaction counters are non-zero, so the page is actually counted against them',
-  payload.stats.compactions > 0 && payload.stats.compactionTurns > 0);
 
 // A narrower range must produce strictly fewer messages, or the filter is not filtering.
 const halfEnd = Math.floor((mins + maxs) / 2);

From b3a75f37a79f1f0165d8516be48795241dcceed1 Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Thu, 15 Oct 2026 23:09:01 +0800
Subject: [PATCH 31/36] tests/run.mjs: hash the guard a mutation control now
 rewrites
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two of the time-range control's cases edit the guard's own session generator, which made
`tests/verify-time-range.mjs` a file a control rewrites in place — and it was not in the list the
suite hashes around its mutation controls. A hard kill during that window would have left a
generator with no checkpoint turns in it, and every later run would have reported that as ordinary
red rather than as residue.

The membership rule is "files a control rewrites", not "files that look important", and this one
had stopped being protected the moment it became a target. Checked by planting one byte of
residue in it: the startup warning names the file.
---
 plugins/avatasia/mmc-trajectory/tests/run.mjs | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/plugins/avatasia/mmc-trajectory/tests/run.mjs b/plugins/avatasia/mmc-trajectory/tests/run.mjs
index ffbb7f3..b77bdb4 100644
--- a/plugins/avatasia/mmc-trajectory/tests/run.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/run.mjs
@@ -47,6 +47,13 @@ const SHIPPED = [
   'miniapp/node/search-segments.mjs',
   'tests/make-fixtures.mjs',
   'tests/client-check.mjs',
+  // Added with the third group of `mutate-time-range.py`'s cases. Two of them edit the guard's own
+  // session generator instead of the page, so this file became a file a control rewrites in place —
+  // and a hard kill during that window would have left a generator with no checkpoints in it, which
+  // every subsequent run would report as ordinary red. The membership rule is "files a control
+  // rewrites", not "files that look important", and this one had stopped being protected the moment
+  // it became a target.
+  'tests/verify-time-range.mjs',
   'README.md',
   'README.zh-CN.md',
   '.minimax-plugin/plugin.json',

From e2c514cc673091ca1b2627187999ce511be1a69d Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Fri, 16 Oct 2026 00:05:21 +0800
Subject: [PATCH 32/36] the sessions tag was not injective, and the residue
 list was not exhaustive
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two defects, both of the shape this suite keeps running into: a check that could not fail, and a
rule nobody owned.

The validator joined title, kind and parent on a bare NUL. A SQLite TEXT column can hold any
character, so a title of "a<NUL>b" beside a kind of "c" and a title of "a" beside a kind of
"b<NUL>c" produced byte-identical material — one ETag for two rows a reader can tell apart, and a
304 served for a payload the caller never held. Choosing a different separator cannot fix that;
no character is excluded from a TEXT value. The material is now JSON, which is injective by
construction.

The assertion beside it was named "the separator is a character a title cannot contain" and
checked that the function body contained the escape. It tested the separator's identity and
called the result a property, and the property was false. It is replaced by two that state the
rule the name always meant: two metadata tuples a reader can tell apart must not share a material,
with the ambiguous character placed inside a value rather than at a boundary. Each has a mutation
— one for having no separator at all, one for having a separator a value can contain — because
those are two directions of the same defect and only both being caught makes the property held
rather than assumed.

Second: the suite hashed a hand-maintained list of the files a control rewrites in place, and the
list was the weak point. Two files were missing — the runner itself and a guard — while two
controls rewrite them, and nothing owned the membership rule, so the drift was silent. A list that
has to stay in step with 45 controls is a list that will not. The runner now hashes the whole
package, both directions, and the rule cannot fall behind. It carries a self-test that plants a
byte in one of the two files the old list missed and requires the comparison to name it, so the
check is known to be able to fail; a mutation that narrows the walk makes the self-test stop
catching and is reported by name.

Two assertions in verify-review16.mjs were pinned to the exact wording of a message in the runner.
Renaming a message turned them red for a reason no reviewer could act on, so they now check the
structure instead: a WARN line exists and the leftover never reaches `failed`, and the two labels
are read back out of the file and compared with each other.

verify-sessions-etag.mjs 31 -> 32, mutate-sessions-etag.py 14 -> 15, verify-review16.mjs 41 -> 42,
mutate-review16.py 37 -> 38. Suite 90/90, and the package is byte-identical across the run.
---
 .../mmc-trajectory/miniapp/node/server.mjs    | 21 +++--
 .../mmc-trajectory/tests/mutate-review16.py   | 21 ++++-
 .../tests/mutate-sessions-etag.py             | 42 ++++++---
 plugins/avatasia/mmc-trajectory/tests/run.mjs | 94 +++++++++++++------
 .../mmc-trajectory/tests/verify-review16.mjs  | 38 ++++++--
 .../tests/verify-sessions-etag.mjs            | 32 ++++++-
 6 files changed, 178 insertions(+), 70 deletions(-)

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
index 4f099bd..8f9e656 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
@@ -2369,16 +2369,17 @@ export function sessionsValidator(visible, titles, limit) {
   const parts = ['limit=' + limit];
   for (const entry of visible) {
     const meta = titles.get(decodeSessionIdFromDirName(basename(entry.dir)));
-    // A NUL between the fields, so a rename cannot be masked by the stat beside it: with a plain
-    // separator, {"ab",""} and {"a","b"} concatenate to the same string and the tag does not move.
-    // Every value the body carries has to be in the material, and the comment sits out here so
-    // the three field lines stay contiguous — a mutation anchor that has to reach past a comment
-    // stops resolving the next time the comment is reworded, and an anchor that stops resolving
-    // is an assertion that quietly stops being tested.
-    parts.push(entry.dir + "|" + entry.sizeBytes + "|" + entry.lastActiveAt
-      + "|" + (meta ? String(meta.title ?? "") : "")
-      + "\u0000" + (meta ? String(meta.kind ?? "") : "")
-      + "\u0000" + (meta ? String(meta.parent ?? "") : ""));
+    const title = meta ? String(meta.title ?? "") : "";
+    const kind = meta ? String(meta.kind ?? "") : "";
+    const parent = meta ? String(meta.parent ?? "") : "";
+    // Injective by construction, which no delimiter is. Any character can occur inside a SQLite TEXT
+    // column — including the NUL this used to join on — so a title of "a\0b" beside a kind of "c" and
+    // a title of "a" beside a kind of "b\0c" produced byte-identical material: one ETag for two rows
+    // a reader can tell apart, and a 304 served for a payload the caller never held. Choosing a
+    // different separator cannot fix that, because no character is excluded from a TEXT value.
+    // JSON escapes the ambiguous characters, so the tuple's boundaries survive anything the store
+    // can return, and no field needs a second representation to be safe.
+    parts.push(JSON.stringify([entry.dir, entry.sizeBytes, entry.lastActiveAt, title, kind, parent]));
   }
   return parts.join("\n");
 }
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py b/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py
index 58e92de..4796de5 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py
@@ -256,7 +256,7 @@
     # The old form: record the state the run STARTED with. Identical to the end state whenever
     # nothing drifted, and a record of the mutation whenever something did.
     ("the snapshot records the state the run started with",
-     "writeFileSync(SNAPSHOT, JSON.stringify(Object.fromEntries(SHIPPED.map((rel) => [rel, digest(rel)]))));",
+     "writeFileSync(SNAPSHOT, JSON.stringify(after));",
      "writeFileSync(SNAPSHOT, JSON.stringify(snapshotBefore));",
      "the snapshot records the state the run ended with, and only a clean end"),
 
@@ -269,10 +269,25 @@
 
     # The two findings collapse into one line. Reads fine, costs the reader the only thing that
     # distinguishes "this run broke it" from "it was already broken".
+    #
+    # The anchor moved with the labels when the whole-tree comparison replaced the shipped-file list,
+    # and the assertion it drives no longer matches wording at all: it reads both labels back out of
+    # the file and compares them. The bug this introduces is now a label collision rather than a
+    # duplicated sentence, which is the same defect one level up.
     ("last run's residue is named exactly like this run's",
-     "'shipped files differ from the last run'",
-     "'shipped files restored'",
+     "'files differ from the last run'",
+     "'package restored byte for byte'",
      "this run's own residue and last run's residue are named differently"),
+
+    # The defect this whole change exists for, reintroduced in its new form. The list is gone, so the
+    # way to be wrong again is to narrow the walk: skip a subtree and residue there goes unseen again.
+    # It is caught by the assertion that makes the runner plant residue in exactly such a file and
+    # requires the runner to name it, so this is a check on the comparison's subject rather than on
+    # the source of the walk.
+    ("the residue comparison skips a subtree",
+     "    else if (!SELF_EXCLUDE.includes(rel)) out[rel] = digest(rel);",
+     "    else if (!SELF_EXCLUDE.includes(rel) && !rel.startsWith('tests/')) out[rel] = digest(rel);",
+     "the residue check names a file the old hand-maintained list did not cover"),
 ]
 
 
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-sessions-etag.py b/plugins/avatasia/mmc-trajectory/tests/mutate-sessions-etag.py
index a9f9bf0..741eefb 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-sessions-etag.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-sessions-etag.py
@@ -32,15 +32,13 @@
     # ---- the material forgets something the payload uses ----
 
     ("a rename stops moving the tag",
-     [("      + \"|\" + (meta ? String(meta.title ?? \"\") : \"\")\n", "")],
+     [("    const title = meta ? String(meta.title ?? \"\") : \"\";\n", "    const title = \"\";\n")],
      "a renamed session moves the tag", SERVER),
 
     # `kind` is what puts the sub-agent and cron badges on the rows, so a page that keeps a stale
     # tag is offering the reader a worker's session as if it were their conversation.
     ("a changed session kind stops moving the tag",
-     [("      + \"\\u0000\" + (meta ? String(meta.kind ?? \"\") : \"\")\n"
-       "      + \"\\u0000\" + (meta ? String(meta.parent ?? \"\") : \"\"));",
-       "      + \"\\u0000\" + (meta ? String(meta.parent ?? \"\") : \"\"));")],
+     [("    const kind = meta ? String(meta.kind ?? \"\") : \"\";\n", "    const kind = \"\";\n")],
      "a changed session kind moves the tag, even with no title", SERVER),
 
     # The one that looks like a simplification. Two different requests, one tag.
@@ -49,19 +47,22 @@
      "a different limit moves the tag", SERVER),
 
     # The separator. Without one, {"ab",""} and {"a","b"} concatenate to the same string, so two
-    # different payloads share a tag and the 304 is served for one the caller never held.
-    ("the title and kind are concatenated with no separator",
-     [("      + \"\\u0000\" + (meta ? String(meta.kind ?? \"\") : \"\")\n"
-       "      + \"\\u0000\" + (meta ? String(meta.parent ?? \"\") : \"\"));",
-       "      + (meta ? String(meta.kind ?? \"\") : \"\")\n"
-       "      + (meta ? String(meta.parent ?? \"\") : \"\"));")],
+    # The separator, and there are two ways to get this wrong rather than one. Dropping it entirely
+    # merges {"ab",""} with {"a","b"}. Keeping a delimiter that a value can contain moves the same
+    # collision one character along: the boundary is still forgeable from inside a field. Only a
+    # representation with no ambiguity in it survives both, so there are two cases and each owns the
+    # assertion that names it.
+    ("the fields are concatenated with no separator at all",
+     [("    parts.push(JSON.stringify([entry.dir, entry.sizeBytes, entry.lastActiveAt, title, kind, parent]));\n",
+       "    parts.push(\"\" + entry.dir + entry.sizeBytes + entry.lastActiveAt"
+       " + title + kind + parent);")],
      "a title/kind split cannot be hidden inside the separator", SERVER),
 
     # mtime is one of the three facts the descriptor cache keys on, and the only one that moves
     # when a session is rewritten in place without growing.
     ("a newer mtime stops moving the tag",
-     [("    parts.push(entry.dir + \"|\" + entry.sizeBytes + \"|\" + entry.lastActiveAt",
-       "    parts.push(entry.dir + \"|\" + entry.sizeBytes")],
+     [("    parts.push(JSON.stringify([entry.dir, entry.sizeBytes, entry.lastActiveAt, title, kind, parent]));\n",
+       "    parts.push(JSON.stringify([entry.dir, entry.sizeBytes, title, kind, parent]));\n")],
      "a newer mtime moves the tag", SERVER),
 
     # ---- the 304 that is not earned, because it is decided too late ----
@@ -147,10 +148,21 @@
     # review, not by a failing test: the guard was passing because every map it built varied only
     # the title and the kind, so nothing ever asked the question.
     ("the validator stops covering the parent the body sends",
-     [("      + \"\\u0000\" + (meta ? String(meta.kind ?? \"\") : \"\")\n"
-       "      + \"\\u0000\" + (meta ? String(meta.parent ?? \"\") : \"\"));",
-       "      + \"\\u0000\" + (meta ? String(meta.kind ?? \"\") : \"\"));")],
+     [("    const parent = meta ? String(meta.parent ?? \"\") : \"\";\n", "    const parent = \"\";\n")],
      "a changed parent moves the tag, even with the title and kind held constant", SERVER),
+
+    # The one this round's independent pass found. The material joined its fields on a bare NUL, and
+    # a SQLite TEXT column can hold a NUL: a title of "a<NUL>b" beside a kind of "c" and a title of "a"
+    # beside a kind of "b<NUL>c" produced byte-identical material, so two rows a reader can tell apart
+    # shared an ETag and the 304 that followed was served for a payload the caller never held.
+    # `String.fromCharCode(0)` rather than an escape in the replacement, because the point of the
+    # mutation is the character, not how it is spelled.
+    ("the fields go back to being joined on a bare NUL",
+     [("    parts.push(JSON.stringify([entry.dir, entry.sizeBytes, entry.lastActiveAt, title, kind, parent]));\n",
+       "    parts.push(entry.dir + \"|\" + entry.sizeBytes + \"|\" + entry.lastActiveAt"
+       " + \"|\" + title + String.fromCharCode(0) + kind"
+       " + String.fromCharCode(0) + parent);")],
+     "a separator-like character inside a value cannot merge two readable rows into one tag", SERVER),
 ]
 
 ORIGINALS = {
diff --git a/plugins/avatasia/mmc-trajectory/tests/run.mjs b/plugins/avatasia/mmc-trajectory/tests/run.mjs
index b77bdb4..8d4aec9 100644
--- a/plugins/avatasia/mmc-trajectory/tests/run.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/run.mjs
@@ -36,29 +36,35 @@ const filter = args.find((a) => !a.startsWith('--')) ?? '';
 // with — which means a snapshot on disk, read at startup, and a report that is deliberately not a
 // verdict. The two are separate findings: the drift below says "this run dirtied the source", the
 // warning at startup says "the source was already different when this run began".
-// The shipped files a mutate-* control rewrites in place — that is the whole membership rule, and
-// it is a rule about files rather than about importance. docs/LAYERS.md sat in this list until it
-// moved out of the package to the workspace root: it then hashed to 'absent' on every run, which
-// is inert (absent matches absent, so it never reported drift) but means one of the entries this
-// guard advertises protecting was not a shipped file at all.
-const SHIPPED = [
-  'miniapp/client/index.html',
-  'miniapp/node/server.mjs',
-  'miniapp/node/search-segments.mjs',
-  'tests/make-fixtures.mjs',
-  'tests/client-check.mjs',
-  // Added with the third group of `mutate-time-range.py`'s cases. Two of them edit the guard's own
-  // session generator instead of the page, so this file became a file a control rewrites in place —
-  // and a hard kill during that window would have left a generator with no checkpoints in it, which
-  // every subsequent run would report as ordinary red. The membership rule is "files a control
-  // rewrites", not "files that look important", and this one had stopped being protected the moment
-  // it became a target.
-  'tests/verify-time-range.mjs',
-  'README.md',
-  'README.zh-CN.md',
-  '.minimax-plugin/plugin.json',
-];
+// There is no list here, and there was one until an independent review pass found what that cost.
+//
+// The rule this file enforces is "a mutate-* control leaves the source exactly as it found it". The
+// first version enforced it over a hand-maintained list of the files a control rewrites, and the
+// list — not the rule — was the weak point: `mutate-review16.py` rewrites this very file and
+// `mutate-freshness.py` rewrites `verify-freshness.mjs`, and neither was on it, so a control killed
+// mid-run could leave residue there and no check would have said so. A list that has to stay in step
+// with 45 controls is a list that will not, and nothing owned the membership rule, so it drifted.
+//
+// So the whole tree is the subject instead. That cannot fall behind: a file nobody thought to list
+// is still hashed, and one that appears during the run is still compared. The list also carried a
+// dead entry — `docs/LAYERS.md` hashed to 'absent' on every run after it moved out of the package —
+// which advertised protecting a shipped file that no longer existed here.
+//
+// The one exclusion is this runner's own bookkeeping file: it is written by this run, on purpose.
+const SELF_EXCLUDE = ['tests/.shipped-snapshot.json'];
+
 const ROOT = join(HERE, '..');
+
+function treeDigests(prefix = '') {
+  const out = {};
+  for (const entry of readdirSync(join(ROOT, prefix), { withFileTypes: true })) {
+    if (entry.name === '.git') continue;
+    const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) Object.assign(out, treeDigests(rel));
+    else if (!SELF_EXCLUDE.includes(rel)) out[rel] = digest(rel);
+  }
+  return out;
+}
 const SNAPSHOT = join(HERE, '.shipped-snapshot.json');
 
 const digest = (rel) => {
@@ -67,7 +73,7 @@ const digest = (rel) => {
   return createHash('sha256').update(readFileSync(p)).digest('hex');
 };
 
-const snapshotBefore = Object.fromEntries(SHIPPED.map((rel) => [rel, digest(rel)]));
+const snapshotBefore = treeDigests();
 
 // What the previous run left behind. The snapshot this reads was written by that run and meant the
 // bytes it ended with, so a file that differs now is one of two things — a mutate-* control killed
@@ -93,12 +99,12 @@ const readSnapshot = () => {
 
 const previous = readSnapshot();
 const leftover = previous
-  ? SHIPPED.filter((rel) => previous[rel] !== undefined && previous[rel] !== digest(rel))
+  ? Object.keys(snapshotBefore).filter((rel) => previous[rel] !== undefined && previous[rel] !== digest(rel))
   : [];
 
 if (leftover.length) {
   console.log('');
-  console.log(`WARN  ${'shipped files differ from the last run'.padEnd(30)}  ${leftover.join(', ')}`);
+  console.log(`WARN  ${'files differ from the last run'.padEnd(30)}  ${leftover.join(', ')}`);
   console.log('       either a mutate-* control was killed mid-run and left the source mutated,');
   console.log('       or these files were edited after that run. Not a failure: this suite runs on');
   console.log('       machines with uncommitted work, and a contributor writing code is not a broken');
@@ -107,17 +113,47 @@ if (leftover.length) {
 }
 
 function checkShipped() {
-  const drift = SHIPPED.filter((rel) => digest(rel) !== snapshotBefore[rel]);
+  const after = treeDigests();
+  // Both directions. A file that moved is residue; a file that appeared is a control that wrote
+  // something it did not clean up, which the old list could not have seen even in principle.
+  const drift = Object.keys(snapshotBefore)
+    .filter((rel) => after[rel] !== snapshotBefore[rel])
+    .concat(Object.keys(after).filter((rel) => !(rel in snapshotBefore)));
   // Only a clean end becomes the baseline for the next run. Recording a drifted end would make the
   // next comparison agree with the mutation, which is the one thing this file exists to prevent.
   if (drift.length === 0) {
     try {
-      writeFileSync(SNAPSHOT, JSON.stringify(Object.fromEntries(SHIPPED.map((rel) => [rel, digest(rel)]))));
+      writeFileSync(SNAPSHOT, JSON.stringify(after));
     } catch { /* the snapshot is bookkeeping, never a reason to fail the suite */ }
   }
   return drift;
 }
 
+// `--self-test-residue` proves the comparison above can fail, which a passing run cannot show.
+//
+// It plants a byte in `tests/verify-freshness.mjs` on purpose: that is a file `mutate-freshness.py`
+// rewrites, and it was never on the hand-maintained list this replaced, so residue there used to be
+// invisible by construction. Requiring the runner to name it is the whole content of the rule —
+// narrow the walk and this stops catching, which is what `mutate-review16.py` then checks.
+if (args.includes('--self-test-residue')) {
+  const TARGET = 'tests/verify-freshness.mjs';
+  const original = readFileSync(join(ROOT, TARGET));
+  let caught = 1;
+  try {
+    writeFileSync(join(ROOT, TARGET), Buffer.concat([original, Buffer.from('\n')]));
+    const named = checkShipped();
+    caught = named.includes(TARGET) ? 0 : 1;
+    console.log((caught === 0 ? 'caught ' : 'MISSED ') + TARGET + '  ' + JSON.stringify(named));
+  } finally {
+    // Restored here rather than left to the end-of-run check: this mode exits before the suite does.
+    // And `process.exit` is called OUTSIDE the try, because it terminates the process without
+    // unwinding — a `process.exit` inside the try skips this finally, which is exactly the residue
+    // this check exists to catch. The whole-tree comparison caught that on its first real run.
+    writeFileSync(join(ROOT, TARGET), original);
+  }
+  process.exit(caught);
+}
+
 // Nothing is excluded any more. `verify-time-range.mjs` used to be here, not run, because the only
 // session it could get was whatever a booted service had — and the committed fixture is sixty rows
 // of one afternoon, against assertions that want more than a thousand messages spanning a local
@@ -187,11 +223,11 @@ console.log();
 const drift = checkShipped();
 if (drift.length) {
   console.log('');
-  console.log(`FAIL  ${'shipped files restored'.padEnd(30)}  ${drift.join(', ')}`);
+  console.log(`FAIL  ${'package restored byte for byte'.padEnd(30)}  ${drift.join(', ')}`);
   console.log('       a mutate-* control ran to completion and left the source mutated. This run\'s own');
   console.log('       residue, not the one the warning above reported.');
   console.log('       restore with:  git checkout -- <file>');
-  failed.push({ name: 'shipped files restored byte for byte', ok: false });
+  failed.push({ name: 'package restored byte for byte', ok: false });
 }
 
 console.log(`${results.length - failed.length}/${results.length} guards passed`);
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs
index 0b77fc9..e0ecab9 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs
@@ -13,6 +13,7 @@
  * report it by name.
  */
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { join, basename } from 'node:path';
 
@@ -294,10 +295,13 @@ assert('the startup comparison is per file, against the digest that was recorded
 assert('a missing baseline is neither a difference nor a failure',
   /const readSnapshot = \(\) => \{[\s\S]*?return null;/.test(runMjs)
   && /const leftover = previous\s*\?/.test(runMjs));
-// Reported, not failed. The suite runs on machines with uncommitted work, and "these files are not
-// what the last run left" is true of a contributor mid-edit. So this must never reach `failed`.
+// Reported, not failed. The suite runs on machines with uncommitted work, and "these files are
+// not what the last run left" is true of a contributor mid-edit. So this must never reach
+// `failed`. The check is structural -- a WARN line exists, and `leftover` reaches no `failed`
+// call -- because the alternative was a regex for the wording, which is a test of the message
+// rather than of the rule, and which this suite has now been bitten by for both of these.
 assert('files that differ from the last run are reported and not failed',
-  /shipped files differ from the last run/.test(runMjs)
+  /console\.log\(`WARN/.test(runMjs)
   && !/failed\.push\([^\n]*leftover/.test(runMjs));
 // Written on every clean run. Gating the write on the file already existing is what left a fresh
 // checkout with nothing to compare against — the machine least likely to have a stale snapshot is
@@ -311,12 +315,30 @@ assert('the snapshot records the state the run ended with, and only a clean end'
   /if \(drift\.length === 0\) \{[\s\S]*?writeFileSync\(SNAPSHOT/.test(runMjs)
   && !/JSON\.stringify\(snapshotBefore\)/.test(runMjs));
 // Two findings, two names. Collapsing them into one line is the regression this section exists to
-// stop: "shipped files restored" means this run dirtied the source, "differ from the last run"
-// means it was already dirty, and a reader who cannot tell them apart cannot act on either.
+// stop: one label means this run dirtied the source, the other means it was already dirty, and a
+// reader who cannot tell them apart cannot act on either.
+//
+// Read the two labels back out of the file and compare them, rather than matching either against a
+// literal. Pinning the exact words made this a check on the message, not on the rule, and the round
+// that changed the residue label broke it for no reason a reviewer could have acted on.
+const warnLabel = /console\.log\(`WARN\s+\$\{'([^']+)'/.exec(runMjs);
+const failLabel = /console\.log\(`FAIL\s+\$\{'([^']+)'/.exec(runMjs);
 assert('this run\'s own residue and last run\'s residue are named differently',
-  /shipped files restored/.test(runMjs)
-  && /shipped files differ from the last run/.test(runMjs)
-  && /WARN/.test(runMjs));
+  warnLabel !== null && failLabel !== null && warnLabel[1] !== failLabel[1]);
+
+// And the one thing the wording above cannot establish: that the comparison's subject is the whole
+// package. Reading the walk's source would only prove someone wrote the code we expect. So make it
+// fail instead — the runner has a mode that plants residue in a file the hand-maintained list never
+// covered and requires the comparison to name it, and this requires that mode to succeed. A walk
+// narrowed back down to a subset stops catching, and the mutation that narrows it is caught here.
+{
+  const selfTest = spawnSync(process.execPath, [join(HERE, 'run.mjs'), '--self-test-residue'],
+    { cwd: PKG, encoding: 'utf8' });
+  assert('the residue check names a file the old hand-maintained list did not cover',
+    selfTest.status === 0 && /caught/.test(selfTest.stdout || ''),
+    'exit=' + selfTest.status + ' out=' + JSON.stringify((selfTest.stdout || '').slice(0, 160))
+      + ' err=' + JSON.stringify((selfTest.stderr || '').slice(0, 160)));
+}
 
 console.log('[review16] ' + pass + ' passed, ' + failures.length + ' failed');
 if (failures.length) {
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-sessions-etag.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-sessions-etag.mjs
index 9323c52..154066a 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-sessions-etag.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-sessions-etag.mjs
@@ -135,13 +135,35 @@ const splitTwo = new Map([[A, { title: 'a', kind: 'b' }]]);
 assert('a title/kind split cannot be hidden inside the separator',
   sessionsValidator(visible, splitOne, 20) !== sessionsValidator(visible, splitTwo, 20));
 
-// The separator must also not be something a title can contain, or a title can move the boundary.
+// The other half, and the one this file got wrong for a while. Above used to be followed by
+// `the separator is a character a title cannot contain`, whose check was a regex for a NUL in the
+// function body: it tested the IDENTITY of the separator and called the result a property. The
+// property is false -- a SQLite TEXT column can hold any character, the NUL included -- so a title of
+// `a<NUL>b` beside a kind of `c` and a title of `a` beside a kind of `b<NUL>c` produced byte-identical
+// material. That assertion passed for a reason, not because the thing it names was true.
+//
+// So the rule is now stated as the property it always was, and checked as one: two metadata tuples a
+// reader can tell apart must not share a material, with the ambiguous character placed INSIDE a value
+// rather than at a boundary. No choice of separator character can satisfy this, which is the point --
+// it has to be satisfied by the representation, not by the delimiter.
+const NUL = String.fromCharCode(0);
+const insideSeparator = new Map([[A, { title: 'a' + NUL + 'b', kind: 'c', parent: 'p' }]]);
+const insideSeparatorShifted = new Map([[A, { title: 'a', kind: 'b' + NUL + 'c', parent: 'p' }]]);
+assert('a separator-like character inside a value cannot merge two readable rows into one tag',
+  sessionsValidator(visible, insideSeparator, 20)
+  !== sessionsValidator(visible, insideSeparatorShifted, 20));
+
+// The same character in the parent -- the third field, and the one nobody had looked at.
+const parentInside = new Map([[A, { title: 't', kind: 'k', parent: 'a' + NUL + 'b' }]]);
+const parentInsideShifted = new Map([[A, { title: 't', kind: 'k' + NUL + 'a', parent: 'b' }]]);
+assert('the same collision in the parent cannot merge two readable rows either',
+  sessionsValidator(visible, parentInside, 20)
+  !== sessionsValidator(visible, parentInsideShifted, 20));
+
+// The material is still built in server.mjs, which is what the three assertions above are testing
+// rather than a copy of it.
 const material = /export function sessionsValidator\(visible, titles, limit\) \{[\s\S]*?\n\}/.exec(server);
 assert('the material is still built in server.mjs', material !== null);
-if (material) {
-  assert('the separator between the title and the kind is a character a title cannot contain',
-    /\\u0000/.test(material[0]));
-}
 
 // Empty input, because the route calls this before it knows the walk found anything.
 assert('an empty list still produces a material', typeof sessionsValidator([], noTitles, 20) === 'string'

From 155755e1c596f120c53b85f943af95086bf0294c Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Fri, 16 Oct 2026 00:21:45 +0800
Subject: [PATCH 33/36] the residue comparison only walked the tree as it
 stands now
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous commit replaced a hand-maintained file list with a whole-package digest and claimed both
directions. The end-of-run comparison does check both. The startup comparison did not: it iterated
the keys of the current tree, so a path the last run recorded and this tree no longer has — a
rename, or a control that deleted a file — was in neither the iteration nor the digest, and nothing
reported it. A disposable reproduction: add a file, record a baseline, delete the file, run again.
The second run printed its result and nothing else.

The comparison now takes the union of both key sets. A path that is NEW since the last run is still
filtered out, because somebody adding a file is a contributor working, and reporting that as residue
would be the false positive that makes a contributor delete their own work.

The self-test that proves the check can fail now has two phases, one per direction, because the two
fail for unrelated reasons: phase one plants a byte in an existing file and asks the end-of-run
check, phase two records a path in the snapshot and asks the startup comparison. Phase one could
never have reached this bug, because the snapshot it compares against was taken from a tree that
still contained the file. One assertion covering both would let either direction fail alone while
the other passed, which is exactly how the previous version reported an exhaustive check that was
silent in one direction.

Three assertions and three anchors in this area were pinned to incidental spelling and had to move
with it: the startup comparison's variable was renamed, so its shape check no longer named a
variable; the snapshot read now appears in the self-test too, so a bare match was satisfied by the
wrong call site; and a lazy span from `readSnapshot` onwards crossed the function boundary and was
still satisfied by the self-test's read. All three now name what they mean instead, and all three
mutations are kept — the point of a control is the rule, not the string.

verify-review16.mjs 42 -> 43, mutate-review16.py 38 -> 39. Suite 90/90, package byte-identical across
the run.
---
 .../mmc-trajectory/tests/mutate-review16.py   | 18 +++++--
 plugins/avatasia/mmc-trajectory/tests/run.mjs | 47 ++++++++++++++++---
 .../mmc-trajectory/tests/verify-review16.mjs  | 19 ++++++--
 3 files changed, 68 insertions(+), 16 deletions(-)

diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py b/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py
index 4796de5..d62ee63 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py
@@ -244,13 +244,13 @@
     # file, which reads as that guard being broken.
 
     ("the harness never reads the snapshot it writes",
-     "readFileSync(SNAPSHOT, 'utf8')",
-     "'{}'",
+     "return existsSync(SNAPSHOT) ? JSON.parse(readFileSync(SNAPSHOT, 'utf8')) : null;",
+     "return '{}';",
      "the harness reads the snapshot the previous run wrote"),
 
     ("the startup check stops comparing per file",
-     "previous[rel] !== undefined && previous[rel] !== digest(rel)",
-     "false",
+     ".filter((rel) => prev[rel] !== undefined && prev[rel] !== digest(rel));",
+     ".filter(() => false);",
      "the startup comparison is per file, against the digest that was recorded"),
 
     # The old form: record the state the run STARTED with. Identical to the end state whenever
@@ -288,6 +288,16 @@
      "    else if (!SELF_EXCLUDE.includes(rel)) out[rel] = digest(rel);",
      "    else if (!SELF_EXCLUDE.includes(rel) && !rel.startsWith('tests/')) out[rel] = digest(rel);",
      "the residue check names a file the old hand-maintained list did not cover"),
+
+    # The other direction, and the one the whole-tree comparison was first credited with covering.
+    # A control or an interruption that DELETES or RENAMES a package file between runs leaves a path
+    # that is in the previous snapshot and in no tree, so a comparison that walks only the tree as it
+    # stands now walks straight past it. Found by a blind pass that attacked the previous-snapshot
+    # direction rather than the one the self-test already covered.
+    ("the startup comparison walks only the tree as it stands now",
+     "const filesMissingSinceLastRun = (prev) => [...new Set([...Object.keys(snapshotBefore), ...Object.keys(prev)])]",
+     "const filesMissingSinceLastRun = (prev) => [...new Set([...Object.keys(snapshotBefore)])]",
+     "the startup comparison names a path the last run recorded and this tree no longer has"),
 ]
 
 
diff --git a/plugins/avatasia/mmc-trajectory/tests/run.mjs b/plugins/avatasia/mmc-trajectory/tests/run.mjs
index 8d4aec9..131ddde 100644
--- a/plugins/avatasia/mmc-trajectory/tests/run.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/run.mjs
@@ -12,7 +12,7 @@
 // Nothing here needs a running Mini App, a network, or a specific machine's paths: every path
 // resolves from this file's own location.
 import { spawnSync } from 'node:child_process';
-import { readdirSync, readFileSync, existsSync, writeFileSync, mkdirSync } from 'node:fs';
+import { readdirSync, readFileSync, existsSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { join, dirname } from 'node:path';
 import { createHash } from 'node:crypto';
@@ -98,9 +98,20 @@ const readSnapshot = () => {
 };
 
 const previous = readSnapshot();
-const leftover = previous
-  ? Object.keys(snapshotBefore).filter((rel) => previous[rel] !== undefined && previous[rel] !== digest(rel))
-  : [];
+
+// Both key sets, and that is the whole fix. Iterating only the tree as it is now walks straight past
+// a path the last run recorded and this tree no longer has — a rename, or a control that deleted a
+// file — because that path is in neither `snapshotBefore` nor anywhere the filter would reach. It was
+// a hole in a check whose entire claim is "compare against what the previous run left behind", and it
+// was not in either direction: the end-of-run comparison already looked at both sides.
+//
+// A path that is NEW since the last run is not residue, so it stays filtered out: somebody adding a
+// file is a contributor working, and calling that residue is the false positive that would make a
+// contributor delete their own work.
+const filesMissingSinceLastRun = (prev) => [...new Set([...Object.keys(snapshotBefore), ...Object.keys(prev)])]
+  .filter((rel) => prev[rel] !== undefined && prev[rel] !== digest(rel));
+
+const leftover = previous ? filesMissingSinceLastRun(previous) : [];
 
 if (leftover.length) {
   console.log('');
@@ -131,25 +142,47 @@ function checkShipped() {
 
 // `--self-test-residue` proves the comparison above can fail, which a passing run cannot show.
 //
-// It plants a byte in `tests/verify-freshness.mjs` on purpose: that is a file `mutate-freshness.py`
+// Two phases, because there are two directions and they fail for different reasons.
+//
+// Phase one plants a byte in `tests/verify-freshness.mjs`: that is a file `mutate-freshness.py`
 // rewrites, and it was never on the hand-maintained list this replaced, so residue there used to be
-// invisible by construction. Requiring the runner to name it is the whole content of the rule —
-// narrow the walk and this stops catching, which is what `mutate-review16.py` then checks.
+// invisible by construction. This covers what moves DURING one invocation.
+//
+// Phase two asks the startup comparison about a path the last run recorded and this tree does not
+// have — a rename, or a control that deleted a file. Phase one cannot reach it at all, because the
+// snapshot it compares against was taken from a tree that still had everything in it. An earlier
+// version of this file had only phase one and so reported the end-of-run check as exhaustive while
+// the other direction walked past a deleted file in silence.
+//
+// Run by `verify-review16.mjs`, and by the mutations that narrow either direction.
 if (args.includes('--self-test-residue')) {
   const TARGET = 'tests/verify-freshness.mjs';
+  const GONE = 'tests/__absent-probe__.mjs';
   const original = readFileSync(join(ROOT, TARGET));
+  const savedSnapshot = existsSync(SNAPSHOT) ? readFileSync(SNAPSHOT) : null;
   let caught = 1;
   try {
     writeFileSync(join(ROOT, TARGET), Buffer.concat([original, Buffer.from('\n')]));
     const named = checkShipped();
     caught = named.includes(TARGET) ? 0 : 1;
     console.log((caught === 0 ? 'caught ' : 'MISSED ') + TARGET + '  ' + JSON.stringify(named));
+
+    const recorded = JSON.parse(readFileSync(SNAPSHOT, 'utf8'));
+    writeFileSync(SNAPSHOT, JSON.stringify(Object.assign({}, recorded, { [GONE]: 'absent-probe' })));
+    const named2 = filesMissingSinceLastRun(JSON.parse(readFileSync(SNAPSHOT, 'utf8')));
+    const caught2 = named2.includes(GONE);
+    console.log((caught2 ? 'caught-absent ' : 'MISSED-absent ') + GONE + '  ' + JSON.stringify(named2));
+    if (caught === 0 && !caught2) caught = 1;
   } finally {
     // Restored here rather than left to the end-of-run check: this mode exits before the suite does.
     // And `process.exit` is called OUTSIDE the try, because it terminates the process without
     // unwinding — a `process.exit` inside the try skips this finally, which is exactly the residue
     // this check exists to catch. The whole-tree comparison caught that on its first real run.
     writeFileSync(join(ROOT, TARGET), original);
+    // The snapshot is bookkeeping this mode borrowed and must give back, or the next run compares
+    // against a path that never existed.
+    if (savedSnapshot === null) rmSync(SNAPSHOT, { force: true });
+    else writeFileSync(SNAPSHOT, savedSnapshot);
   }
   process.exit(caught);
 }
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs
index e0ecab9..479847b 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs
@@ -286,10 +286,14 @@ assert('neither README still announces the old version',
 // snapshot planted by hand plus one real mutation in index.html, `node tests/run.mjs
 // verify-ledger-jump` printed `0/1 guards passed / failed: verify-ledger-jump.mjs` and one line
 // about nothing being left over.
+// Pinned to the one return expression that exists for this, not to a bare `readFileSync(SNAPSHOT`
+// and not to a lazy span from `readSnapshot` onwards — the runner's self-test reads the snapshot too,
+// and both looser forms are satisfied by that, so a mutation removing the harness's own read leaves
+// the assertion green. The cost of this one was 38 of 39 mutations caught.
 assert('the harness reads the snapshot the previous run wrote',
-  /readFileSync\(SNAPSHOT,/.test(runMjs));
+  /return existsSync\(SNAPSHOT\) \? JSON\.parse\(readFileSync\(SNAPSHOT, 'utf8'\)\) : null;/.test(runMjs));
 assert('the startup comparison is per file, against the digest that was recorded',
-  /previous\[rel\] !== undefined && previous\[rel\] !== digest\(rel\)/.test(runMjs));
+  /!== undefined && \w+\[rel\] !== digest\(rel\)/.test(runMjs));
 // A checkout nobody has run the suite on has no baseline. Treating that as "everything differs"
 // would warn on every first run, and treating it as a failure would fail every fresh clone.
 assert('a missing baseline is neither a difference nor a failure',
@@ -334,10 +338,15 @@ assert('this run\'s own residue and last run\'s residue are named differently',
 {
   const selfTest = spawnSync(process.execPath, [join(HERE, 'run.mjs'), '--self-test-residue'],
     { cwd: PKG, encoding: 'utf8' });
+  const say = 'exit=' + selfTest.status + ' out=' + JSON.stringify((selfTest.stdout || '').slice(0, 200))
+    + ' err=' + JSON.stringify((selfTest.stderr || '').slice(0, 160));
+  // Two phases, two assertions, two mutations. One assertion covering both would let either
+  // direction fail alone while the other still passes, which is how the first version of this
+  // reported an exhaustive check that was silent about a deleted file.
   assert('the residue check names a file the old hand-maintained list did not cover',
-    selfTest.status === 0 && /caught/.test(selfTest.stdout || ''),
-    'exit=' + selfTest.status + ' out=' + JSON.stringify((selfTest.stdout || '').slice(0, 160))
-      + ' err=' + JSON.stringify((selfTest.stderr || '').slice(0, 160)));
+    selfTest.status === 0 && /^caught /m.test(selfTest.stdout || ''), say);
+  assert('the startup comparison names a path the last run recorded and this tree no longer has',
+    selfTest.status === 0 && /^caught-absent /m.test(selfTest.stdout || ''), say);
 }
 
 console.log('[review16] ' + pass + ' passed, ' + failures.length + ' failed');

From ff6e1fb52c7c85cf83c08b9e2b456ca3b881fea6 Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Fri, 16 Oct 2026 00:30:17 +0800
Subject: [PATCH 34/36] the residue self-test needed a baseline file it does
 not own

The self-test phase of run.mjs read tests/.shipped-snapshot.json back from
disk to compare against. That file is gitignored and untracked, so on a fresh
checkout there is nothing to read and the self-test reported a discrepancy
that no mutation had caused. The second phase now compares against the snapshot
the run already holds in memory, and run.mjs no longer touches the file at all.

That part is small. Establishing the state the self-test needs is not, and the
first way it was done was wrong in a way worth recording.

The guard has to run --self-test-residue on a package with no baseline, and the
obvious way to arrange that is to move the real baseline aside and put it back.
That makes the guard a writer to a file two other things depend on. It needs a
lock, and then the lock needs a key that identifies the path, and the key needs
to survive a spelling that Windows considers the same one and SHA-256 does not,
and the lock needs an owner recorded inside it, and a recorded pid can be reused
by a process that never held it. Every one of those was found by running the
guard concurrently or killing it: four concurrent invocations left the baseline
deleted outright and appended two blank lines to a file the suite hashes. That is
a measurement of code this commit replaces and does not contain; what the diff
shows is the arrangement that replaced it, not the failures above.

So it does not do that. It copies the package to a temporary directory and runs
the harness there. A copy has no baseline by construction, which is the state
under test arrived at without anybody deleting anything, and the directory is
this process's own, so the lock, the key, the owner and the recycled pid all go
away together with the code that needed them. Six concurrent invocations of this
version were measured on this machine: each passed, and the baseline was
byte-for-byte what it was before. That is a measurement rather than something the
diff shows.

A scratch destination inside the package is refused rather than attempted: copying a
directory into its own subtree is what cpSync declines to do, and it declines by
throwing, which would take the guard down before any assertion ran on a machine whose
TEMP simply points somewhere unusual. That refusal is reported as a named failure
with a reason, not as an exception.

run.mjs also gains --print-startup-leftover, which reports what the startup
comparison actually decided and exits without running the suite. The self-test
builds its own input and hands it straight to filesMissingSinceLastRun, so it
measures the comparison function and says nothing about whether the startup
hands it one at all: with `const previous = null` every assertion stayed green
and `leftover` came back empty on every run. The guard plants a baseline
recording a path the tree does not have, asks the harness what its own startup
made of that, and parses the answer rather than matching it: a baseline was read,
and the reported list is exactly the one path that was planted. Substring
membership would have been satisfied by any output that mentioned the path. The
harness picks no input here, so what is measured is the wiring.

It also reports which branch the warning took, because a comparison that runs
correctly and a comparison whose result is then gated out of the warning look
identical from the values alone -- `if (leftover.length)` could become
`if (false && leftover.length)` and the residue check would compute the right
answer and tell nobody.

mutate-review16.py gains a control for each of those. Its candidate-file list now
searches this guard last: the guard holds the checks for every other file's
wording, so a README string occurs in it exactly once inside a regex, and
searched earlier the guard would win ties that belong to the file the mutation
was written against.
---
 .../mmc-trajectory/tests/mutate-review16.py   |  85 ++++++++++-
 plugins/avatasia/mmc-trajectory/tests/run.mjs |  39 +++--
 .../mmc-trajectory/tests/verify-review16.mjs  | 139 ++++++++++++++++--
 3 files changed, 242 insertions(+), 21 deletions(-)

diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py b/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py
index d62ee63..7fb8856 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py
@@ -298,9 +298,80 @@
      "const filesMissingSinceLastRun = (prev) => [...new Set([...Object.keys(snapshotBefore), ...Object.keys(prev)])]",
      "const filesMissingSinceLastRun = (prev) => [...new Set([...Object.keys(snapshotBefore)])]",
      "the startup comparison names a path the last run recorded and this tree no longer has"),
+
+    # The suite was red on a freshly cloned checkout and nothing here said so, because the baseline
+    # file is gitignored: it exists in a working tree that has run before and does not exist in a
+    # clone. Reading it was "equivalent" — the recorded set was right there in `snapshotBefore` — and
+    # it made a first run throw. The guard runs the self-test in a copy of the package that has no
+    # baseline at all, so this fails there and nowhere else.
+    ("the self-test reads the baseline file again",
+     "    const recorded = Object.assign({}, snapshotBefore, { [GONE]: 'absent-probe' });",
+     "    const recorded = JSON.parse(readFileSync(SNAPSHOT, 'utf8'));",
+     "the startup comparison names a path the last run recorded and this tree no longer has"),
+    # The deepest one, and it took a self-chosen attack line rather than reading the diff: the residue
+    # self-test builds its own input and hands it straight to the comparison, so it measured the
+    # comparison function and never the startup that feeds it. Nulling the one assignment between
+    # reading the baseline and reporting on it left all 45 assertions green and `leftover` empty on
+    # every run. The assertion this control feeds is the only one that spawns the harness and reads
+    # back what its own startup decided.
+    ("the startup stops reading the baseline it recorded",
+     "const previous = readSnapshot();",
+     "const previous = null;",
+     "the startup comparison warns when the baseline records a difference"),
+
+    # The scratch copy is the design, and these two are what keeps it honest: one leaves the baseline
+    # in the copy, the other skips planting one. Both fail by name, which is the point -- the
+    # properties they cover are the ones a later edit could quietly undo.
+
+    ("the scratch copy is made with the baseline still in it",
+     "      filter: notTheBaseline,",
+     "      filter: () => true,",
+     "the residue self-test runs on a package that has no baseline"),
+
+    ("the wiring probe never plants a baseline",
+     "  writeFileSync(join(scratch, 'tests', '.shipped-snapshot.json'),\n    JSON.stringify({ [GONE]: 'planted-by-verify-review16' }));",
+     "  // the baseline is never planted, so the harness is asked with nothing to find",
+     "the startup comparison warns when the baseline records a difference"),
+
+    # The scratch copy is refused when the temporary directory sits inside the package, because
+    # cpSync will not copy a directory into its own subtree -- it throws, and a throw out of the guard
+    # is the reading that looks exactly like a surviving mutation. The refusal is now a named failure,
+    # but only if this predicate says no.
+    ("nothing is ever recognised as being inside the package",
+     "  return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));",
+     "  return false;",
+     "a path under the package is recognised as under the package"),
+
+    # The diagnostic was matched by substring, which any output mentioning the path satisfies -- a
+    # debug line, an error, a hard-coded string. It is parsed now, so a payload that says it read a
+    # baseline but does not report what it found is caught here.
+    ("the startup diagnostic reports that it looked without saying what it found",
+     "  console.log('startup-leftover=' + JSON.stringify({ hadBaseline: previous !== null, leftover, warned }));",
+     "  console.log('startup-leftover=' + JSON.stringify({ hadBaseline: previous !== null, warned }));",
+     "the startup comparison warns when the baseline records a difference"),
+
+    # A basename filter is not a path filter. It also drops every file with that name anywhere in the
+    # tree, so the copy stops being "the package without its bookkeeping file".
+    ("the copy filter recognises a name rather than a path",
+     "const notTheBaseline = (src) => relative(PKG, src) !== join('tests', '.shipped-snapshot.json');",
+     "const notTheBaseline = (src) => basename(src) !== '.shipped-snapshot.json';",
+     "the copy leaves out the bookkeeping file and nothing else"),
+
+    # Computing the comparison and reporting it are two things. Gating the warning off leaves every
+    # value the diagnostic prints exactly as it was, which is why the diagnostic reports which branch
+    # it took rather than only what it computed.
+    ("the residue comparison runs and then nobody is told",
+     "if (leftover.length) {",
+     "if (false && leftover.length) {",
+     "the startup comparison warns when the baseline records a difference"),
 ]
 
 
+
+
+
+
+
 def read(rel):
     with io.open(os.path.join(ROOT, rel), encoding="utf-8", newline="") as f:
         return f.read()
@@ -420,18 +491,28 @@ def _node():
         # Which file the mutation belongs to. A single-occurrence mutation must anchor somewhere
         # it appears exactly once — an anchor that matches in several places is a guess, and a
         # guess that silently lands in the wrong file is worse than a mutation that does not run.
+        #
+        # The guard is in this list because some rules live in the guard rather than in shipped code,
+        # and a guard nobody can break is the failure this whole control exists to catch. It goes LAST,
+        # and that is the load-bearing part: this file holds the checks for every other file's wording,
+        # so a README string also occurs here, exactly once, inside a regex. Searched earlier it wins
+        # those ties and the mutation lands in the wrong file — which is the failure the comment above
+        # names, reached by the honest-looking route of adding an entry in a careless place.
+        #
+        # Mutating the guard is still safe to read as caught: a crash cannot count, because the verdict
+        # needs `expect in out` and a run that produced no output contains no name.
         target = None
         if replace_all:
             for rel in ("tests/run.mjs", "README.md", "README.zh-CN.md",
                         "miniapp/client/index.html", "miniapp/node/server.mjs",
-                        ".minimax-plugin/plugin.json"):
+                        ".minimax-plugin/plugin.json", "tests/verify-review16.mjs"):
                 if old in read(rel):
                     target = rel
                     break
         else:
             for rel in ("tests/run.mjs", "README.md", "README.zh-CN.md",
                         "miniapp/client/index.html", "miniapp/node/server.mjs",
-                        ".minimax-plugin/plugin.json"):
+                        ".minimax-plugin/plugin.json", "tests/verify-review16.mjs"):
                 if read(rel).count(old) == 1:
                     target = rel
                     break
diff --git a/plugins/avatasia/mmc-trajectory/tests/run.mjs b/plugins/avatasia/mmc-trajectory/tests/run.mjs
index 131ddde..fe8bbd0 100644
--- a/plugins/avatasia/mmc-trajectory/tests/run.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/run.mjs
@@ -12,7 +12,7 @@
 // Nothing here needs a running Mini App, a network, or a specific machine's paths: every path
 // resolves from this file's own location.
 import { spawnSync } from 'node:child_process';
-import { readdirSync, readFileSync, existsSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';
+import { readdirSync, readFileSync, existsSync, writeFileSync, mkdirSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { join, dirname } from 'node:path';
 import { createHash } from 'node:crypto';
@@ -113,7 +113,14 @@ const filesMissingSinceLastRun = (prev) => [...new Set([...Object.keys(snapshotB
 
 const leftover = previous ? filesMissingSinceLastRun(previous) : [];
 
+// Whether the warning below actually went out. The comparison being computed is one thing and being
+// reported is another, and a guard that only inspects the computed value cannot tell them apart: the
+// whole block could be gated off and everything downstream would still agree that the comparison works.
+// This is the flag the diagnostic reports.
+let warned = false;
+
 if (leftover.length) {
+  warned = true;
   console.log('');
   console.log(`WARN  ${'files differ from the last run'.padEnd(30)}  ${leftover.join(', ')}`);
   console.log('       either a mutate-* control was killed mid-run and left the source mutated,');
@@ -159,7 +166,6 @@ if (args.includes('--self-test-residue')) {
   const TARGET = 'tests/verify-freshness.mjs';
   const GONE = 'tests/__absent-probe__.mjs';
   const original = readFileSync(join(ROOT, TARGET));
-  const savedSnapshot = existsSync(SNAPSHOT) ? readFileSync(SNAPSHOT) : null;
   let caught = 1;
   try {
     writeFileSync(join(ROOT, TARGET), Buffer.concat([original, Buffer.from('\n')]));
@@ -167,9 +173,14 @@ if (args.includes('--self-test-residue')) {
     caught = named.includes(TARGET) ? 0 : 1;
     console.log((caught === 0 ? 'caught ' : 'MISSED ') + TARGET + '  ' + JSON.stringify(named));
 
-    const recorded = JSON.parse(readFileSync(SNAPSHOT, 'utf8'));
-    writeFileSync(SNAPSHOT, JSON.stringify(Object.assign({}, recorded, { [GONE]: 'absent-probe' })));
-    const named2 = filesMissingSinceLastRun(JSON.parse(readFileSync(SNAPSHOT, 'utf8')));
+    // Phase two asks about the recorded set, not about the bookkeeping file. Reading SNAPSHOT here
+    // looked equivalent and was not: that file is gitignored, so on a freshly cloned checkout it
+    // does not exist, phase one cannot create it (the write is gated on a clean end, and phase one
+    // is dirty by design), and the self-test died with ENOENT — taking `verify-review16.mjs` down
+    // with it. Nothing here touched that file, because `snapshotBefore` is the same recorded set,
+    // already in hand, and it is the thing under test rather than a copy of it.
+    const recorded = Object.assign({}, snapshotBefore, { [GONE]: 'absent-probe' });
+    const named2 = filesMissingSinceLastRun(recorded);
     const caught2 = named2.includes(GONE);
     console.log((caught2 ? 'caught-absent ' : 'MISSED-absent ') + GONE + '  ' + JSON.stringify(named2));
     if (caught === 0 && !caught2) caught = 1;
@@ -179,14 +190,24 @@ if (args.includes('--self-test-residue')) {
     // unwinding — a `process.exit` inside the try skips this finally, which is exactly the residue
     // this check exists to catch. The whole-tree comparison caught that on its first real run.
     writeFileSync(join(ROOT, TARGET), original);
-    // The snapshot is bookkeeping this mode borrowed and must give back, or the next run compares
-    // against a path that never existed.
-    if (savedSnapshot === null) rmSync(SNAPSHOT, { force: true });
-    else writeFileSync(SNAPSHOT, savedSnapshot);
   }
   process.exit(caught);
 }
 
+// `--print-startup-leftover` reports what the startup comparison actually decided, and exits without
+// touching the baseline or running the suite.
+//
+// It exists because every other check here can be satisfied by a comparison function that nothing
+// calls. The self-test builds its own input and hands it straight to `filesMissingSinceLastRun`, so
+// nulling the module-level `previous` left all of it passing while the real startup stopped warning --
+// measured rather than assumed: with `const previous = null` this suite is green and `leftover` is `[]`
+// on every run. This mode has no input of its own. It reports the pair the startup built, so what is
+// measured is the wiring, and the only ways to break it are the two functions already covered.
+if (args.includes('--print-startup-leftover')) {
+  console.log('startup-leftover=' + JSON.stringify({ hadBaseline: previous !== null, leftover, warned }));
+  process.exit(0);
+}
+
 // Nothing is excluded any more. `verify-time-range.mjs` used to be here, not run, because the only
 // session it could get was whatever a booted service had — and the committed fixture is sixty rows
 // of one afternoon, against assertions that want more than a thousand messages spanning a local
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs
index 479847b..21da6ca 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs
@@ -12,10 +12,12 @@
  * a rule. mutate-review16.py breaks each of these in the shipped file and requires this guard to
  * report it by name.
  */
-import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync, writeFileSync, rmSync,
+         cpSync, mkdtempSync, realpathSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-import { join, basename } from 'node:path';
+import { join, basename, dirname, relative, isAbsolute } from 'node:path';
 
 const HERE = fileURLToPath(new URL('.', import.meta.url));
 const PKG = join(HERE, '..');
@@ -329,15 +331,115 @@ const warnLabel = /console\.log\(`WARN\s+\$\{'([^']+)'/.exec(runMjs);
 const failLabel = /console\.log\(`FAIL\s+\$\{'([^']+)'/.exec(runMjs);
 assert('this run\'s own residue and last run\'s residue are named differently',
   warnLabel !== null && failLabel !== null && warnLabel[1] !== failLabel[1]);
+// Run the harness against a copy of the package in a temp directory, never against this one.
+//
+// That sentence is the fix for a family of problems this file spent several revisions creating. The
+// state under test is "a package with no baseline", and a scratch copy is in exactly that state by
+// construction -- nobody had to delete anything to get there. Nothing is shared, so nothing another
+// process can reach, so there is no lock to key, no key to canonicalise, no owner to record, and no
+// way for a recycled pid to impersonate one. Four concurrent invocations of the version that moved
+// the real baseline aside deleted it outright, and a hard kill left a lock file in the temp directory
+// that the residue check cannot see and that kept every later run out. `cpSync` is one call.
+// Is `child` this package or somewhere under it? The scratch destination is refused when it is,
+// because a copy of the package into its own subtree is exactly what `cpSync` declines to do, and it
+// declines by throwing -- which would take this guard down before any assertion ran, on a machine
+// whose TEMP simply points somewhere unusual.
+//
+// Physical identity, not lexical. A temporary directory reached through a junction that points back
+// here is inside the package even though no string in it says so, and on that machine cpSync refuses
+// the copy by luck rather than by decision. The destination does not exist yet, so its parent is what
+// gets resolved and the last segment is put back.
+//
+// The alias case itself is not exercised below: making a junction needs a privilege this suite does not
+// assume, and a mutation that only differs under an alias would survive rather than fail.
+const insidePackage = (child) => {
+  let target = child;
+  try {
+    target = join(realpathSync.native(dirname(child)), basename(child));
+  } catch { /* a parent that is not there has nothing to resolve */ }
+  const rel = relative(realpathSync.native(PKG), target);
+  return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));
+};
+
+// One path, not one basename. `basename(src) !== '.shipped-snapshot.json'` also drops every file
+// with that name anywhere in the tree, so the copy stops being "the package without its bookkeeping
+// file" and becomes "the package without anything so named" -- a difference no assertion would have
+// noticed while the tree happened to hold no second one.
+const notTheBaseline = (src) => relative(PKG, src) !== join('tests', '.shipped-snapshot.json');
+
+const scratchPackage = () => {
+  const dir = mkdtempSync(join(tmpdir(), 'mmc-trajectory-selfcheck-'));
+  if (insidePackage(dir)) {
+    rmSync(dir, { recursive: true, force: true });
+    const e = new Error('the temporary directory is inside the package; set TEMP somewhere else');
+    e.code = 'ERR_SCRATCH_INSIDE_PACKAGE';
+    throw e;
+  }
+  try {
+    cpSync(PKG, dir, {
+      recursive: true,
+      filter: notTheBaseline,
+    });
+  } catch (err) {
+    // The caller cannot clean up a path it was never handed, so this function has to.
+    rmSync(dir, { recursive: true, force: true });
+    throw err;
+  }
+  return dir;
+};
 
-// And the one thing the wording above cannot establish: that the comparison's subject is the whole
-// package. Reading the walk's source would only prove someone wrote the code we expect. So make it
-// fail instead — the runner has a mode that plants residue in a file the hand-maintained list never
-// covered and requires the comparison to name it, and this requires that mode to succeed. A walk
-// narrowed back down to a subset stops catching, and the mutation that narrows it is caught here.
+assert('the copy leaves out the bookkeeping file and nothing else',
+  notTheBaseline(join(PKG, 'tests', '.shipped-snapshot.json')) === false
+  && notTheBaseline(join(PKG, 'fixtures', '.shipped-snapshot.json')) === true
+  && notTheBaseline(join(PKG, 'tests', 'run.mjs')) === true,
+  'pkg=' + PKG);
+
+// The predicate above is what decides whether the copy is attempted at all, and the whole guard hangs
+// off it, so it is checked against paths with known answers rather than trusted.
+assert('a path under the package is recognised as under the package',
+  insidePackage(PKG) && insidePackage(join(PKG, 'tests', 'scratch'))
+  && !insidePackage(join(PKG, '..', 'scratch'))
+  && !insidePackage(join(tmpdir(), 'mmc-trajectory-selfcheck-elsewhere')),
+  'pkg=' + PKG + ' tmp=' + tmpdir());
+
+const GONE = 'tests/__absent-probe__.mjs';
+let scratch = null;
+let sawBaseline = null;
+let selfTest = { status: null, stdout: '', stderr: '' };
+let wiring = { status: null, stdout: '' };
+let scratchError = null;
+try {
+  scratch = scratchPackage();
+  const harness = join(scratch, 'tests', 'run.mjs');
+  const there = (...args) => spawnSync(process.execPath, [harness, ...args],
+    { cwd: scratch, encoding: 'utf8' });
+
+  // Read the state back off the copy rather than reasoning about it. "The filter excludes the
+  // baseline" is a claim about a line of code; this is the file system answering.
+  sawBaseline = existsSync(join(scratch, 'tests', '.shipped-snapshot.json'));
+  selfTest = there('--self-test-residue');
+
+  // And the wiring, which nothing above can reach: those phases build their own input and hand it
+  // straight to the comparison, so they measure the comparison function and say nothing about whether
+  // the startup hands it one at all. Planting a baseline and asking the harness what its own startup
+  // made of that measures the part with no other check. The harness picks no input here -- and here it
+  // is planting into a directory this process created, so the question of whose file that is does not
+  // arise.
+  writeFileSync(join(scratch, 'tests', '.shipped-snapshot.json'),
+    JSON.stringify({ [GONE]: 'planted-by-verify-review16' }));
+  wiring = there('--print-startup-leftover');
+} catch (err) {
+  // Named rather than thrown. A machine whose TEMP points inside the package cannot produce the state
+  // under test, and saying so is a result; an uncaught exception out of here is the reading that looks
+  // exactly like a surviving mutation.
+  scratchError = err.code || String(err);
+} finally {
+  if (scratch !== null) rmSync(scratch, { recursive: true, force: true });
+}
+
+assert('the residue self-test runs on a package that has no baseline',
+  scratchError === null && sawBaseline === false, 'scratchError=' + scratchError + ' sawBaseline=' + sawBaseline);
 {
-  const selfTest = spawnSync(process.execPath, [join(HERE, 'run.mjs'), '--self-test-residue'],
-    { cwd: PKG, encoding: 'utf8' });
   const say = 'exit=' + selfTest.status + ' out=' + JSON.stringify((selfTest.stdout || '').slice(0, 200))
     + ' err=' + JSON.stringify((selfTest.stderr || '').slice(0, 160));
   // Two phases, two assertions, two mutations. One assertion covering both would let either
@@ -348,7 +450,24 @@ assert('this run\'s own residue and last run\'s residue are named differently',
   assert('the startup comparison names a path the last run recorded and this tree no longer has',
     selfTest.status === 0 && /^caught-absent /m.test(selfTest.stdout || ''), say);
 }
-
+// Parsed, not matched. Substring membership was enough to pass while the mode printed anything at all
+// that mentioned the path -- a debug line, an error, a hard-coded string. What has to hold is the
+// shape the mode promises: a baseline was read, and the one path the planted baseline recorded is the
+// one it named, and nothing else was.
+//
+// `warned` is the part that cannot be read off the computed values. A comparison that runs correctly
+// and a comparison whose result is then gated out of the warning look identical from here, and the
+// whole point of the residue check is that somebody is told. So the mode reports which branch it took.
+const wiringLine = /^startup-leftover=(.*)$/m.exec(wiring.stdout || '');
+let payload = null;
+try {
+  payload = JSON.parse(wiringLine === null ? '' : wiringLine[1]);
+} catch { payload = null; }
+assert('the startup comparison warns when the baseline records a difference',
+  wiring.status === 0 && payload !== null && payload.hadBaseline === true && payload.warned === true
+  && Array.isArray(payload.leftover) && payload.leftover.length === 1
+  && payload.leftover[0] === GONE,
+  'exit=' + wiring.status + ' payload=' + JSON.stringify(payload).slice(0, 200));
 console.log('[review16] ' + pass + ' passed, ' + failures.length + ' failed');
 if (failures.length) {
   console.log('FAILURES:\n - ' + failures.join('\n - '));

From 7f5c2a63224b60fcfaf218320eff22ff2a2a8172 Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Fri, 16 Oct 2026 14:54:50 +0800
Subject: [PATCH 35/36] the strip picked the record farthest from the pointer,
 and the suite could not tell

Four things an acceptance review named, and one suggestion taken. The first is the only one a
reader of this plugin would ever have noticed.

nearestSpanAt compares two candidate distances and both were subtracted the wrong way round:
`span.end - time` where the span ends before the pointer, and `time - span.start` where it starts
after. Both are negative, and bestDistance starts at Infinity, so the first candidate still gets
in and every later candidate that is FURTHER away wins after it. Hover reported the wrong time and
click selected the wrong record, everywhere except where the pointer happened to fall inside a span.

Nothing owned that arithmetic. client-check.mjs can only read it as source text, and both
subtractions mention span.start, span.end and time, so no regex can tell which way round they go.
Every mutation in mutate-overview.py changed how the hit test resolves -- the model, the lane, the
DOM, the return shape -- and none changed what it compares, because the one place the two distances
are both computed is a gap between two spans, and no assertion ever put the pointer in one.

Seven assertions now do, with every expected value derived by hand from the span coordinates rather
than read back out of the function: a pointer in a gap takes the nearer of the two spans around it,
the same with the nearer one on the other side, two spans on the same side and it is still the
nearer, a pointer with no row is answered from every row, one past the whole session takes the span
that ENDS last rather than the one that ends first, one before it takes the first, and the row is a
filter rather than a preference. All seven fail by name when the code is reverted: four for the
`span.end` subtraction, six for the `span.start` one. Two mutations, one per line, because each is
load-bearing alone -- with a single candidate on that side the flipped subtraction and the correct
one happen to name the same record.

The second is the one that made a clean checkout red. The residue guard copies the package to a
temporary directory and runs the self-test on the copy, so the copy has to arrive without a
baseline. The mutation that removed that property was aimed at the one call site, which looks
harmless because the source being copied IS the package this guard sits in -- and
tests/.shipped-snapshot.json is gitignored, so on a fresh clone there is nothing in it to exclude.
Neuter the filter there and the copy comes out the same either way: 46/47 on a clean checkout,
47/47 on a machine where an earlier suite run had left the file behind. Same commit, decided by
what happened to be on disk.

So the filter is a factory over a root, and the guard builds its own source with a baseline planted
in it. The absence is then a fact about the filter rather than a coincidence about the machine, and
it holds on every machine that runs the suite.

Third: the package root carried a plugin.json byte-identical to package.json, and package.json is
what carries the mcode.miniApp entry point. The other seven plugins in the repository ship
.minimax-plugin/plugin.json and package.json and nothing else. Removed, along with the sentence in
the workspace notes that gave the extra file a job nobody could find.

Fourth: 1.1.0 -> 1.2.0 across the manifest and both READMEs, which is what CONTRIBUTING asks for
when an existing app is updated. The guard asserts equality with plugin.json rather than "not
1.0.0", so all three move together, and the four mutations written against the literal 1.1.0 were
re-anchored -- left alone, three would have stopped resolving and the fourth would have become an
edit that changes nothing.

The suggestion was taken because the failure is worse than it looks. readSessionTitles selects
parent_session_id, db.prepare throws on a column the database does not have, and that throw lands
in the empty catch that exists for a different reason -- "a title is a nicety". On a runtime
database written before child sessions existed, every title and every kind in the page reverted to
the first sentence of the transcript, silently. The column is now optional: asked for when the
database has it, not asked for when it does not, and only the parent is lost. The mapping did not
change at all -- on the fallback row parent_session_id is undefined and the ternary already answers
null.

The four assertions that covered this were regexes over server.mjs, and a regex is satisfied by a
query that works. None is satisfied by a query that fails, which is the entire case. The guard now
builds two real SQLite databases, one with the column and one without, and calls the function: with
the fix reverted the without-column assertion fails by name while the other twenty-four stay green,
which is the clearest possible statement of what those four regexes could not see.

Also narrowed one warning. The new test imports node:sqlite, which prints an experimental notice to
stderr on first load, and run.mjs reads stdout+stderr and prints the last non-empty line -- so the
warning landed where this guard's verdict should be and verify-list-cache.mjs was reported with the
text of an unrelated warning. Filtered to that one message, installed before the import that
provokes it.
---
 .../.minimax-plugin/plugin.json               |  2 +-
 plugins/avatasia/mmc-trajectory/README.md     |  2 +-
 .../avatasia/mmc-trajectory/README.zh-CN.md   |  2 +-
 .../mmc-trajectory/miniapp/client/index.html  |  8 ++-
 .../mmc-trajectory/miniapp/node/server.mjs    | 19 ++++-
 plugins/avatasia/mmc-trajectory/plugin.json   |  6 --
 .../tests/mutate-list-cache-ttl.py            | 22 ++++++
 .../mmc-trajectory/tests/mutate-overview.py   | 30 ++++++++
 .../mmc-trajectory/tests/mutate-review16.py   | 47 ++++++++----
 .../tests/verify-list-cache.mjs               | 72 ++++++++++++++++++-
 .../mmc-trajectory/tests/verify-overview.mjs  | 49 +++++++++++++
 .../mmc-trajectory/tests/verify-review16.mjs  | 45 +++++++++++-
 12 files changed, 276 insertions(+), 28 deletions(-)
 delete mode 100644 plugins/avatasia/mmc-trajectory/plugin.json

diff --git a/plugins/avatasia/mmc-trajectory/.minimax-plugin/plugin.json b/plugins/avatasia/mmc-trajectory/.minimax-plugin/plugin.json
index c6e6fb0..32477bb 100644
--- a/plugins/avatasia/mmc-trajectory/.minimax-plugin/plugin.json
+++ b/plugins/avatasia/mmc-trajectory/.minimax-plugin/plugin.json
@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "name": "mmc-trajectory",
   "displayName": "会话轨迹",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "按轮次浏览当前会话的模型轨迹：消息流、思考过程、工具调用与结果、token 与耗时统计。",
   "author": "avatasia",
   "icon": "icon.png",
diff --git a/plugins/avatasia/mmc-trajectory/README.md b/plugins/avatasia/mmc-trajectory/README.md
index 019b40d..618e6ce 100644
--- a/plugins/avatasia/mmc-trajectory/README.md
+++ b/plugins/avatasia/mmc-trajectory/README.md
@@ -4,7 +4,7 @@ English | [简体中文](README.zh-CN.md)
 
 Browse the model trajectory of a MiniMax Code conversation: messages, reasoning, tool calls and their results, Token usage, and per-turn timing.
 
-Author: [avatasia](https://github.com/avatasia) · Version: `1.1.0`
+Author: [avatasia](https://github.com/avatasia) · Version: `1.2.0`
 
 ### Before you change this page
 
diff --git a/plugins/avatasia/mmc-trajectory/README.zh-CN.md b/plugins/avatasia/mmc-trajectory/README.zh-CN.md
index 9eb5320..eab669c 100644
--- a/plugins/avatasia/mmc-trajectory/README.zh-CN.md
+++ b/plugins/avatasia/mmc-trajectory/README.zh-CN.md
@@ -4,7 +4,7 @@
 
 按轮次浏览一段 MiniMax Code 对话的模型轨迹：消息流、思考过程、工具调用与结果、token 消耗与每轮耗时。
 
-作者：[avatasia](https://github.com/avatasia) · 版本：`1.1.0`
+作者：[avatasia](https://github.com/avatasia) · 版本：`1.2.0`
 
 ### 动手改这个页面前
 
diff --git a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
index 272a05e..91c4f16 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
+++ b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
@@ -5808,11 +5808,15 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
           // A lane is optional because not every caller has one to offer: a wheel gesture works in
           // time alone, while a pointer also says which row it is over.
           if (lane !== undefined && span.lane !== lane) continue;
+          // Both distances are the LARGER time minus the SMALLER one, so both are positive and the
+          // `<` below keeps the closest. Subtracting the other way round leaves both negative,
+          // which still lets a first candidate in against Infinity and then keeps every further one
+          // that is further away -- the strip would answer with the record farthest from the pointer.
           if (span.end < time) {
-            var after = span.end - time;
+            var after = time - span.end;
             if (after < bestDistance) { bestDistance = after; best = span; }
           } else if (span.start > time) {
-            var before = time - span.start;
+            var before = span.start - time;
             if (before < bestDistance) { bestDistance = before; best = span; }
           } else {
             return span;
diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
index 8f9e656..8c8dca0 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
@@ -974,7 +974,24 @@ export async function readSessionTitles(home, sessionIds) {
     // is always newer than the parent that spawned it, so the parent's title is routinely outside
     // the window. Carrying the id and looking the title up would therefore be a lookup that fails
     // exactly when a reader is most likely to want it.
-    const stmt = db.prepare('select session_id, title, session_kind, parent_session_id from local_runtime_sessions where session_id = ?');
+    //
+    // Asking for the column is the optional part, and it has to be optional: a runtime database
+    // written before child sessions existed has no `parent_session_id`, and preparing a statement
+    // over a column that is not there throws before a single row has been read. Under the empty
+    // catch below that is not a degraded list -- it is every title and every kind in the page
+    // silently reverting to the first sentence of the transcript, which is what a reader would see
+    // as "the titles broke and nothing says why". The mapping below already answers `null` for a
+    // row that carries no parent, so the row this fallback returns needs no change at all.
+    let stmt;
+    try {
+      stmt = db.prepare('select session_id, title, session_kind, parent_session_id from local_runtime_sessions where session_id = ?');
+    } catch {
+      try {
+        stmt = db.prepare('select session_id, title, session_kind from local_runtime_sessions where session_id = ?');
+      } catch {
+        return result;
+      }
+    }
     for (const id of sessionIds) {
       const row = stmt.get(id);
       if (!row) continue;
diff --git a/plugins/avatasia/mmc-trajectory/plugin.json b/plugins/avatasia/mmc-trajectory/plugin.json
deleted file mode 100644
index aab6b8d..0000000
--- a/plugins/avatasia/mmc-trajectory/plugin.json
+++ /dev/null
@@ -1,6 +0,0 @@
-{
-  "mcode": {
-    "schemaVersion": 2,
-    "miniApp": "./miniapp/miniapp.json"
-  }
-}
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-list-cache-ttl.py b/plugins/avatasia/mmc-trajectory/tests/mutate-list-cache-ttl.py
index 8bfb1b6..26b6332 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-list-cache-ttl.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-list-cache-ttl.py
@@ -144,6 +144,28 @@
        "select session_id, title, session_kind from local_runtime_sessions where session_id = ?")],
      "the titles query reads the parent column"),
 
+    # The one the acceptance review named, and the only one in this file that is invisible to every
+    # regex above it. Those regexes are all satisfied by a query that WORKS; none is satisfied by a
+    # query that fails, which is the whole case — `db.prepare` throws on a column the database does
+    # not have, the throw lands in the empty catch that exists for a different reason, and every
+    # title and every kind in the page reverts to the first sentence of the transcript. With the
+    # fallback gone the query text is exactly the text the guard requires, so the whole section
+    # above still passes and the page is simply broken on every database written before child
+    # sessions existed. The assertion that catches it is the one that builds such a database here.
+    ("a database without the parent column loses every title and kind, not just the parent",
+     [("""    let stmt;
+    try {
+      stmt = db.prepare('select session_id, title, session_kind, parent_session_id from local_runtime_sessions where session_id = ?');
+    } catch {
+      try {
+        stmt = db.prepare('select session_id, title, session_kind from local_runtime_sessions where session_id = ?');
+      } catch {
+        return result;
+      }
+    }
+""", "    const stmt = db.prepare('select session_id, title, session_kind, parent_session_id from local_runtime_sessions where session_id = ?');")],
+     "a database WITHOUT the column keeps the title and the kind, and only loses the parent"),
+
     ("the parent row is read but never mapped",
      [("        parent: typeof row.parent_session_id === 'string' && row.parent_session_id !== ''\n"
        "          ? row.parent_session_id\n"
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-overview.py b/plugins/avatasia/mmc-trajectory/tests/mutate-overview.py
index f3f9dda..a553e01 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-overview.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-overview.py
@@ -178,6 +178,36 @@
         """        var hit = nearestSpanAt(overviewTimeAt(overviewFractionAt(clientX)), lane);
         return hit ? { id: hit.id, record: hit.record } : null;""",
     ),
+    # ---- the two distances, which are the one part of the hit test nothing above reaches ------
+    # `nearestSpanAt` compares two candidate distances, and both are written as the larger time
+    # minus the smaller one so they are positive and the `<` keeps the closer. Subtracting the
+    # other way round leaves both NEGATIVE, which still admits the first candidate against
+    # Infinity and then keeps every LATER candidate that is FURTHER away: the strip answers with
+    # the record farthest from the pointer, and hover and click are wrong at the same time.
+    #
+    # This shipped. Every mutation above changes how the hit test resolves and none of them changes
+    # what it compares, and no assertion put the pointer in a gap between two spans — which is the
+    # only place the two candidate distances are both computed. A shape check cannot see it either:
+    # both subtractions are `span.start`/`span.end` against `time`, and which way round they go is
+    # exactly what reading the source cannot tell you.
+    #
+    # Two mutations, one per line, because each line is load-bearing on its own: with only the
+    # `span.end` one flipped, four assertions fail, and with only the `span.start` one flipped,
+    # six. The assertion both of them are caught by is the one with TWO candidates on the
+    # `span.start > time` side, because with a single candidate on that side the flipped
+    # subtraction and the correct one happen to name the same record.
+    (
+        "the gap after a span is measured the far way round, so the pointer picks the record farthest from it",
+        "            var after = time - span.end;",
+        "            var after = span.end - time;",
+        "with two spans on the same side, it is still the nearer one that wins",
+    ),
+    (
+        "the gap before a span is measured the far way round, so the pointer picks the record farthest from it",
+        "            var before = span.start - time;",
+        "            var before = time - span.start;",
+        "with two spans on the same side, it is still the nearer one that wins",
+    ),
 ]
 
 
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py b/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py
index 7fb8856..b1070ff 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-review16.py
@@ -209,8 +209,14 @@
      "the non-anomaly hint is still the one that names types and search"),
 
     # ---- 7. the version goes back ----
+    # Re-anchored at the 1.2.0 bump: the three below were written against the literal `1.1.0` in the
+    # manifest and in both READMEs, so leaving them would have made four mutations stop resolving —
+    # and one of them, the last, would have become an edit that changes nothing, which the runner
+    # rejects. The properties are the reviewer's complaint and are unchanged; only the text they are
+    # written against moved. The numbers are now `1.2.0` and `1.3.0` for the same reason the old pair
+    # was `1.1.0` and `1.2.0`: the replacement has to be a version the tree does not already carry.
     ("the version is put back to 1.0.0",
-     '"version": "1.1.0",',
+     '"version": "1.2.0",',
      '"version": "1.0.0",',
      "the plugin version was bumped off 1.0.0"),
 
@@ -219,12 +225,12 @@
     # announcing 1.0.0 to every reader who opens the plugin's front page. A rule that checks the
     # field nobody complained about is not the rule that was asked for.
     ("the English README goes back to announcing the old version",
-     'Version: `1.1.0`',
+     'Version: `1.2.0`',
      'Version: `1.0.0`',
      "the English README carries the shipped version"),
 
     ("the Chinese README goes back to announcing the old version",
-     '版本：`1.1.0`',
+     '版本：`1.2.0`',
      '版本：`1.0.0`',
      "the Chinese README carries the shipped version"),
 
@@ -232,8 +238,8 @@
     # on and the READMEs stay behind. Asserted as equality with plugin.json rather than as "not
     # 1.0.0", so this is the case the rule is actually for.
     ("the manifest moves on and the READMEs do not follow",
-     '"version": "1.1.0",',
      '"version": "1.2.0",',
+     '"version": "1.3.0",',
      "the English README carries the shipped version"),
 
     # ---- the snapshot the last run left, and the run that never looked at it ----
@@ -319,14 +325,24 @@
      "const previous = null;",
      "the startup comparison warns when the baseline records a difference"),
 
-    # The scratch copy is the design, and these two are what keeps it honest: one leaves the baseline
-    # in the copy, the other skips planting one. Both fail by name, which is the point -- the
-    # properties they cover are the ones a later edit could quietly undo.
+    # The copy filter is the design's load-bearing part, and these two are what keeps it honest.
+    #
+    # The first one used to be aimed at the single call in `scratchPackage`, which is where the
+    # mistake looked harmless: the package being copied IS this package, and
+    # `tests/.shipped-snapshot.json` is gitignored, so on a fresh clone there is no baseline in it
+    # for the filter to exclude. Neuter the filter there and the copy comes out the same either way
+    # -- so this mutation SURVIVED on a clean checkout and was counted as caught only on a machine
+    # where an earlier suite run had left the file behind. 46/47 versus 47/47, same commit, decided
+    # by what happened to be on disk.
+    #
+    # So the anchor is the factory both call sites are built from, and the assertion that catches it
+    # measures a finished copy of a source the guard planted a baseline into itself. That holds on
+    # every machine, which is the only property worth having in a check that runs on CI.
 
-    ("the scratch copy is made with the baseline still in it",
-     "      filter: notTheBaseline,",
-     "      filter: () => true,",
-     "the residue self-test runs on a package that has no baseline"),
+    ("the copy filter keeps the baseline, so a copy of a source that has one is no longer baseline-free",
+     "const notTheBaselineIn = (root) => (src) => relative(root, src) !== join('tests', '.shipped-snapshot.json');",
+     "const notTheBaselineIn = (root) => () => true;",
+     "a copy of a source that carries the bookkeeping file still comes out without it"),
 
     ("the wiring probe never plants a baseline",
      "  writeFileSync(join(scratch, 'tests', '.shipped-snapshot.json'),\n    JSON.stringify({ [GONE]: 'planted-by-verify-review16' }));",
@@ -352,9 +368,14 @@
 
     # A basename filter is not a path filter. It also drops every file with that name anywhere in the
     # tree, so the copy stops being "the package without its bookkeeping file".
+    #
+    # Re-anchored when the predicate became a factory: the line this names moved from
+    # `const notTheBaseline = (src) => …` to `const notTheBaselineIn = (root) => (src) => …`, and an
+    # anchor that no longer resolves is a mutation that has quietly stopped existing. The property
+    # is unchanged and so is the defect; only the text it is written against moved.
     ("the copy filter recognises a name rather than a path",
-     "const notTheBaseline = (src) => relative(PKG, src) !== join('tests', '.shipped-snapshot.json');",
-     "const notTheBaseline = (src) => basename(src) !== '.shipped-snapshot.json';",
+     "const notTheBaselineIn = (root) => (src) => relative(root, src) !== join('tests', '.shipped-snapshot.json');",
+     "const notTheBaselineIn = (root) => (src) => basename(src) !== '.shipped-snapshot.json';",
      "the copy leaves out the bookkeeping file and nothing else"),
 
     # Computing the comparison and reporting it are two things. Gating the warning off leaves every
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-list-cache.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-list-cache.mjs
index e845d0d..f4ca480 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-list-cache.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-list-cache.mjs
@@ -36,7 +36,7 @@
  * catch it by name, so nothing here can be an assertion nothing could fail.
  */
 import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 
 const SERVER = fileURLToPath(new URL('../miniapp/node/server.mjs', import.meta.url));
 const HTML = fileURLToPath(new URL('../miniapp/client/index.html', import.meta.url));
@@ -189,6 +189,76 @@ assert('the field survives the strip, with null as the floor',
 assert('the page decides the marker by the field and not unconditionally',
   /var branch = session && session\.sessionParentId \? BRANCH_MARK : '';/.test(clientJs));
 
+/* ---------- 6. a database without the column, which the four regexes above cannot see ----------
+ *
+ * Everything above reads `server.mjs` as text, and every one of those regexes is satisfied by a
+ * query that works. None of them is satisfied by a query that FAILS, which is the whole case here:
+ * `db.prepare` throws on a column the database does not have, and the throw landed in the empty
+ * catch that exists for a different reason ("a title is a nicety"). So on a runtime database
+ * written before child sessions existed, the page showed no titles and no kinds at all — every
+ * session fell back to the first sentence of its transcript — and nothing in the suite could see
+ * it, because the shape of a correct query is the shape of a query nobody ran.
+ *
+ * So this runs the function against a real database built here, with and without the column. The
+ * without-case is the one that carries the rule: the titles and the kind are the page's whole
+ * reason for opening the database, and a missing optional column is not a reason to lose them. */
+const { mkdtempSync, mkdirSync, rmSync } = await import('node:fs');
+const { tmpdir } = await import('node:os');
+const { join } = await import('node:path');
+// `node:sqlite` is still flagged experimental, and the flag goes to stderr the moment the module
+// is first loaded. The runner reads `stdout + stderr` and prints the LAST non-empty line, so the
+// warning lands where this guard's own result line should be and `verify-list-cache.mjs` gets
+// reported with the text of an unrelated warning instead of its verdict. Narrowly filtered, and
+// installed BEFORE the import that provokes it: anything else still prints.
+const emitWarning = process.emitWarning;
+process.emitWarning = (warning, ...rest) => (
+  String(warning).startsWith('SQLite is an experimental feature')
+    ? undefined
+    : emitWarning.call(process, warning, ...rest));
+
+const { DatabaseSync } = await import('node:sqlite');
+// `SERVER` is a plain filesystem path, and a dynamic import of one on Windows is read as a URL
+// with an unsupported scheme. The module has to be asked for by its file: URL.
+const { readSessionTitles } = await import(pathToFileURL(SERVER).href);
+
+const runtimeDb = (columns) => {
+  const home = mkdtempSync(join(tmpdir(), 'mmc-trajectory-runtimedb-'));
+  mkdirSync(join(home, 'v2', 'sqlite'), { recursive: true });
+  const db = new DatabaseSync(join(home, 'v2', 'sqlite', 'runtime-state.sqlite'));
+  const extra = columns ? ', parent_session_id' : '';
+  const placeholders = columns ? '?, ?, ?, ?' : '?, ?, ?';
+  db.exec('create table local_runtime_sessions (session_id text primary key, title text,'
+    + ' session_kind text' + extra + ')');
+  const values = ['mvs_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', '一条真实的标题', 'conversation'];
+  if (columns) values.push('mvs_bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb');
+  db.prepare('insert into local_runtime_sessions (session_id, title, session_kind'
+    + extra + ') values (' + placeholders + ')').run(...values);
+  db.close();
+  return home;
+};
+
+const ids = ['mvs_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'];
+const homes = [];
+let withColumn = null;
+let withoutColumn = null;
+try {
+  homes.push(runtimeDb(true), runtimeDb(false));
+  withColumn = await readSessionTitles(homes[0], ids);
+  withoutColumn = await readSessionTitles(homes[1], ids);
+} finally {
+  // The homes are `mkdtemp` directories this call created, so they are cleaned up in the same
+  // breath rather than left behind for the OS to find.
+  for (const h of homes) rmSync(h, { recursive: true, force: true });
+}
+assert('a database with the parent column still reports the title, the kind and the parent',
+  withColumn.get(ids[0])?.title === '一条真实的标题'
+  && withColumn.get(ids[0])?.kind === 'conversation'
+  && withColumn.get(ids[0])?.parent === 'mvs_bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb');
+assert('a database WITHOUT the column keeps the title and the kind, and only loses the parent',
+  withoutColumn.get(ids[0])?.title === '一条真实的标题'
+  && withoutColumn.get(ids[0])?.kind === 'conversation'
+  && withoutColumn.get(ids[0])?.parent === null);
+
 console.log('[list-cache] ' + pass + ' passed, ' + failures.length + ' failed');
 if (failures.length) {
   console.log('FAILURES:\n - ' + failures.join('\n - '));
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs
index 90bd45d..fccfb02 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-overview.mjs
@@ -1016,6 +1016,55 @@ check('and leaves no marker behind',
 check('and the columns are exactly as they were',
   paintedColumns(), ['0.0000%', '33.3333%', '66.6667%']);
 
+/* ----------------------------------------------------------------- distance arithmetic
+ * The hit test resolves in TIME so that the answer is the record nearest the pointer rather than
+ * whichever one was painted last. Nothing above puts the pointer in a gap between two spans, and
+ * that is exactly where the two candidate distances are computed and compared — so a comparison
+ * written the other way round leaves every one of those assertions green.
+ *
+ * Subtracting the smaller time from the larger one leaves both distances positive and the `<`
+ * keeps the closer. Subtracting the other way leaves both NEGATIVE, which still admits the first
+ * candidate against Infinity and then keeps every LATER candidate that is further away: the strip
+ * answers with the record farthest from the pointer. Three spans in one lane make that visible,
+ * because nearest and farthest are different records.
+ *
+ * Expected values are derived by hand from the coordinates below, not read back out of the
+ * function, so this block can fail rather than merely agree with itself. */
+const D = (id, lane, start, end) => ({ id, lane, start, end, record: { id } });
+const restoreModel = sandbox.overviewCache.model;
+sandbox.overviewCache.model = {
+  start: 0,
+  end: 900,
+  // near-x sits in the next row and straddles the gap the lane-1 probes use.
+  spans: [D('near-l', 1, 0, 100), D('near-m', 1, 220, 300), D('near-r', 1, 400, 900),
+    D('near-d', 1, 600, 700), D('near-x', 2, 104, 116)],
+};
+const at = (time, lane) => { const s = sandbox.nearestSpanAt(time, lane); return s ? s.record.id : null; };
+
+// 110 is in the gap after near-l: 10ms from its end, 110ms from near-m's start, 290 from near-r's.
+check('a pointer in a gap resolves to the nearer of the two spans around it, not the further one',
+  at(110, 1), 'near-l');
+// 390 is in the gap before near-r: 90ms from near-m's end, 10ms from near-r's start, 290 from near-l's.
+check('and the same when the nearer span is on the other side of the pointer', at(390, 1), 'near-r');
+/* 370 is the case that pins BOTH distance expressions on their own, so neither one can be the
+ * only thing carrying the rule: 30ms from near-r's start, 230 from near-d's start, 70 from near-m's
+ * end, 270 from near-l's. Flipping either subtraction turns its own candidates negative, and the
+ * further one of that side then wins — the `span.start > time` side has two candidates here, so it
+ * is distinguishable from the case above where it has only one. */
+check('with two spans on the same side, it is still the nearer one that wins', at(370, 1), 'near-r');
+// 150 with no row: near-x is 34ms away, near-l 50, near-m 70, near-r 250 — so a second row does
+// compete, which is the click fallback's case: it has no row to offer.
+check('a pointer with no row given is answered from every row', at(150), 'near-x');
+// Past the whole session every span is behind the pointer, so the nearest is the one that ENDS
+// last — near-r, at 100ms — not the one that ends first (900ms) and not the last in the array
+// (near-d ends at 700, which is 300ms away).
+check('a pointer past the whole session resolves to the last span, not the first', at(1000, 1), 'near-r');
+check('and one before it, to the first, not the last', at(-50, 1), 'near-l');
+// near-x contains 110 exactly, so with no row it wins outright; with lane 1 it is not consulted
+// at all, and the row the pointer is actually over answers instead.
+check('the row is a filter and not a preference: a span in another row is not consulted', at(110, 1), 'near-l');
+sandbox.overviewCache.model = restoreModel;
+
 /* ----------------------------------------------------------------------- report */
 console.log('overview + toolbar controls: ' + pass + ' passed, ' + failures.length + ' failed');
 if (failures.length) {
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs
index 21da6ca..6d66d59 100644
--- a/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-review16.mjs
@@ -12,7 +12,7 @@
  * a rule. mutate-review16.py breaks each of these in the shipped file and requires this guard to
  * report it by name.
  */
-import { existsSync, readFileSync, readdirSync, writeFileSync, rmSync,
+import { existsSync, readFileSync, readdirSync, writeFileSync, rmSync, mkdirSync,
          cpSync, mkdtempSync, realpathSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { spawnSync } from 'node:child_process';
@@ -365,7 +365,18 @@ const insidePackage = (child) => {
 // with that name anywhere in the tree, so the copy stops being "the package without its bookkeeping
 // file" and becomes "the package without anything so named" -- a difference no assertion would have
 // noticed while the tree happened to hold no second one.
-const notTheBaseline = (src) => relative(PKG, src) !== join('tests', '.shipped-snapshot.json');
+//
+// A factory, not a constant over PKG, and the reason is a property this file could not check for a
+// year of looking: the filter's promise is "the copy has no baseline EVEN WHEN THE SOURCE HAS
+// ONE", and the only source available here is the package this guard is sitting in -- whose
+// baseline file is gitignored and therefore ABSENT on every fresh clone and on CI. There, a filter
+// that excluded nothing and this one produced identical copies, so `filter: () => true` survived
+// and the mutation counted 46/47 on a clean checkout while counting 47/47 on a developer machine
+// that had run the suite. Given a root, the same predicate can be asked about a source built here,
+// where a baseline is planted on purpose and its absence in the copy is therefore a fact about the
+// filter rather than about what happened to be lying around.
+const notTheBaselineIn = (root) => (src) => relative(root, src) !== join('tests', '.shipped-snapshot.json');
+const notTheBaseline = notTheBaselineIn(PKG);
 
 const scratchPackage = () => {
   const dir = mkdtempSync(join(tmpdir(), 'mmc-trajectory-selfcheck-'));
@@ -394,6 +405,36 @@ assert('the copy leaves out the bookkeeping file and nothing else',
   && notTheBaseline(join(PKG, 'tests', 'run.mjs')) === true,
   'pkg=' + PKG);
 
+/* Asking the predicate about a path only proves it reads paths correctly. What the filter is FOR is
+ * a property of a finished copy, and that one cannot be read off a path at all -- it has to be
+ * produced. The source is built here rather than borrowed, so it holds a baseline on every machine:
+ * `tests/.shipped-snapshot.json` is gitignored, so the real package has none on a fresh clone, and
+ * a copy of a source with nothing in it cannot tell this filter from `() => true`. That is not a
+ * theoretical gap -- with the filter neutered the mutation control reported 46/47 on a clean
+ * checkout and 47/47 only where an earlier suite run had left the file behind. */
+const filterSource = mkdtempSync(join(tmpdir(), 'mmc-trajectory-filtersrc-'));
+let filterCopy = null;
+try {
+  mkdirSync(join(filterSource, 'tests'), { recursive: true });
+  mkdirSync(join(filterSource, 'fixtures'), { recursive: true });
+  writeFileSync(join(filterSource, 'tests', '.shipped-snapshot.json'), '{"planted":"as-a-baseline"}');
+  writeFileSync(join(filterSource, 'fixtures', '.shipped-snapshot.json'), '{"planted":"under-fixtures"}');
+  writeFileSync(join(filterSource, 'tests', 'run.mjs'), '// planted\n');
+  filterCopy = mkdtempSync(join(tmpdir(), 'mmc-trajectory-filterdst-'));
+  cpSync(filterSource, filterCopy, { recursive: true, filter: notTheBaselineIn(filterSource) });
+  assert('a copy of a source that carries the bookkeeping file still comes out without it',
+    existsSync(join(filterSource, 'tests', '.shipped-snapshot.json'))
+    && !existsSync(join(filterCopy, 'tests', '.shipped-snapshot.json')),
+    'src=' + filterSource + ' dst=' + filterCopy);
+  assert('and it comes out without it by path, keeping the file of the same name under fixtures/',
+    existsSync(join(filterCopy, 'fixtures', '.shipped-snapshot.json'))
+    && existsSync(join(filterCopy, 'tests', 'run.mjs')),
+    'dst=' + filterCopy);
+} finally {
+  rmSync(filterCopy, { recursive: true, force: true });
+  rmSync(filterSource, { recursive: true, force: true });
+}
+
 // The predicate above is what decides whether the copy is attempted at all, and the whole guard hangs
 // off it, so it is checked against paths with known answers rather than trusted.
 assert('a path under the package is recognised as under the package',

From fd66f1180c41840ee7f9c0b015b63610eabbc224 Mon Sep 17 00:00:00 2001
From: avatasia <eric.tomcat@gmail.com>
Date: Fri, 16 Oct 2026 15:48:11 +0800
Subject: [PATCH 36/36] the page showed the right rows under the wrong
 sentence, and the diagnostic route published a stack
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two findings, from an acceptance review whose question was changed rather than whose code was
changed. Both are product behaviour, and neither is visible to the suite: ninety-two guards were
green throughout.

The review asked for a promise-to-guard map of the whole package instead of a reading of one commit,
and for at least one behavioural experiment on the software rather than on the tests. Fifteen earlier
rounds each looked at one commit and each found a real defect -- all of them the same shape, a check
that could not fail. Not one was a wrong answer from running the program. Running the suite cannot
find a defect in code the suite does not exercise; it can only confirm the holes are not on the paths
it walked.

First: a search that failed once said 「搜索失败，以下为上次结果」 for the rest of the session.

The catch block sets state.searchError. The only two places that cleared it were the two a READER
drives -- typing in the box, and pressing clear. A poll that re-runs the current query after the
transcript changed is not a reader, so nothing it did could clear it: the hit set and the count
updated, the label did not, and because searchStatusLabel reads the error first the stale error
outranked the fresh answer it was describing. The page showed the right rows under the wrong
sentence. An answer that arrives now retires the failure that preceded it.

Every existing check was blind to this from the same side. The searchStatusLabel cases each construct
a state object written out for the case they ask about, and a state cannot be stale because it was
written for that question. The runSearch checks read its source as text, and the line that was missing
is a line they were not written against. So the transition is now RUN rather than read: the guard
slices the SHIPPED source of runSearch, searchHitSet, searchStatusLabel, formatInt and sessionParam
out of index.html and evaluates it, asks for a failing fetch and then a succeeding one, and reads the
page's own state afterwards. Nothing in it is written out for the test except what the server sent.
With the fix reverted it reports got "search_failed", want null and got the failure sentence, want
「命中 1 条」 -- the two strings the reviewer had recorded by hand.

Second: /api/runtime was publishing absolute paths on the failure paths it exists to report.

It is the one route whose entire contract is what it does NOT send -- its own comment says 「Names and
structure only」 and 「this route must never hand the browser a filesystem location」 -- and it was the
only row in that map with no owner. Asking is what turned up the hole rather than a coverage gap.
Three fields in the response are not basenames, counts or flags; they are substrings of exception
text. diagError is the one that leaked on every run: a Node stack frame names the file it is in by
absolute path, once per frame, so 600 characters of one is mostly directory names, and on Windows
those carry the user profile directory. In a package that installs onto every reader's machine that
is the same identity leak this project treats as a release blocker everywhere else -- and it fired
exactly when the reader was already having a bad day.

Two passes now, in that order, then the clip: redact, which knows the three store locations in the
spelling it was handed, and scrubAbsolutePaths, which is spelling-agnostic and blunts anything
absolute. The second pass is not redundant, and the guard measures the gap rather than asserting it:
a stack frame is printed as a URL with forward slashes and a scheme, so the backslash prefixes match
no frame of it, and the store's .minimax fallback rescues the store's own directories while leaving
the node install, a temp directory and every dependency standing. It is deliberately not folded into
createRedactor, which also runs over session CONTENT where blanking an unrelated string would change
what a reader is shown; a stack carries nothing a reader came for.

The guard says which of its checks are which. Behavioural: the real exported scrubber, handed a REAL
stack captured by throwing from a real module written inside a real temporary home, plus a second
throw from outside the store, because the first sits under .minimax where the fallback happens to save
it -- a guard that only tested that would be reporting safety it has not checked. Shape: three
count-checked lines holding the wiring, because the handler is a closure inside start() and this
suite's convention is to never start the runtime, and moving a route handler out of its closure so a
test could call it is a bigger change to shipped code than the property is worth.

One thing that check turned up, recorded because it is the kind of assumption that reads like a fact:
on this runtime a SQLite refusal carries no path at all -- the whole message is 「unable to open
database file」 -- so those two fields are held as a CHANNEL rather than as a leak, and the guard says
so instead of telling a bigger story than it checked.

The shipped-tree scan then caught this commit's own comment, which had spelled out a drive-qualified
user directory to explain the very rule that scan enforces.

verify-runtime-diag.mjs 25 assertions, mutate-runtime-diag.py 6 mutations caught by name,
mutate-search-client.py 12 -> 13.
---
 .../mmc-trajectory/miniapp/client/index.html  |   8 +
 .../mmc-trajectory/miniapp/node/server.mjs    |  56 ++++-
 .../mmc-trajectory/tests/client-check.mjs     |  65 ++++++
 .../tests/mutate-runtime-diag.py              | 180 +++++++++++++++
 .../tests/mutate-search-client.py             |  17 ++
 .../tests/verify-runtime-diag.mjs             | 208 ++++++++++++++++++
 6 files changed, 531 insertions(+), 3 deletions(-)
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/mutate-runtime-diag.py
 create mode 100644 plugins/avatasia/mmc-trajectory/tests/verify-runtime-diag.mjs

diff --git a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
index 91c4f16..b54c571 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
+++ b/plugins/avatasia/mmc-trajectory/miniapp/client/index.html
@@ -4209,6 +4209,14 @@ <h2 class="section-title" id="inspector-heading">检视</h2>
             state.searchHits = searchHitSet(body.hits);
             state.searchTotal = Number.isInteger(body.total) ? body.total : 0;
             state.searchTruncated = body.truncated === true;
+            // An answer that arrived retires the failure that preceded it. This line is here
+            // because the two other places that clear the field are the two a READER triggers —
+            // typing in the box and pressing clear — so nothing else could. A poll that re-runs the
+            // current query after the transcript changed is not a reader, and before this line a
+            // search that had failed once said 「搜索失败，以下为上次结果」 for the rest of the
+            // session: the label reads the error first, so the stale one outranked the fresh hit
+            // set it was describing.
+            state.searchError = null;
             resetWindowMode();
             renderLedger();
           })
diff --git a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
index 8c8dca0..37b872c 100644
--- a/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
+++ b/plugins/avatasia/mmc-trajectory/miniapp/node/server.mjs
@@ -221,6 +221,44 @@ function isNilField(value) {
  * Replaces internal store locations so the browser never learns where sessions live.
  * @param {readonly string[]} secrets
  */
+/** The three spellings an absolute path can appear in inside a stack frame or an error message. */
+const ABSOLUTE_PATH_SHAPES = [
+  // Node prints a frame as a URL: `file:///C:/Users/...`. Scheme, forward slashes, and the whole
+  // thing up to the first delimiter, which is why this has to come first — the drive-letter pattern
+  // below would match `C:/Users/...` inside it and leave `file:///` standing in front.
+  /file:\/\/\/?[^\s'"()<>\]]+/g,
+  // A drive-qualified Windows path, backslashed or forward-slashed, which is what an exception
+  // message from this platform uses. (Spelled out in words: a literal drive-qualified user
+  // directory in a comment trips the shipped-tree scan that forbids machine paths, which is the
+  // same rule this function exists to serve.)
+  /[A-Za-z]:[\\/][^\s'"()<>\]]+/g,
+  // A POSIX path with a root that only a filesystem has. Deliberately not a bare `/`: every URL,
+  // every route and every regex in this file starts with one, and blanking those would make the
+  // output useless for the job the route exists to do.
+  /(?<![\w./-])\/(?:Users|home|var|tmp|opt|etc|private|Volumes|Applications)\b[^\s'"()<>\]]*/g,
+];
+
+/**
+ * Blanks every absolute path in a string.
+ *
+ * `/api/runtime` is the one route whose entire contract is what it does NOT send, and a Node stack
+ * frame is mostly paths — one per frame, by absolute path. `createRedactor` covers the three store
+ * locations in the spelling it was handed, which is not the spelling a stack uses, so a stack passed
+ * through it keeps its `file:///` frames. That was measured rather than assumed: the route's
+ * `.minimax` fallback catches the store's own directories, and leaves everything else in the frame.
+ *
+ * Deliberately NOT folded into `createRedactor`. That one also runs over session CONTENT, where
+ * blanking an unrelated string would change what a reader is shown; a stack carries nothing a reader
+ * came for, which is exactly why this is allowed to be blunt where that one is not.
+ *
+ * @param {unknown} value
+ */
+export function scrubAbsolutePaths(value) {
+  let out = String(value);
+  for (const shape of ABSOLUTE_PATH_SHAPES) out = out.replace(shape, SESSION_STORE_TOKEN);
+  return out;
+}
+
 export function createRedactor(secrets) {
   const prefixes = [...new Set(secrets.filter((entry) => typeof entry === 'string' && entry.length > 0))]
     .sort((a, b) => b.length - a.length);
@@ -2979,6 +3017,18 @@ export async function start(context) {
    * Diagnostics: report what this Node process can actually observe about its own session
    * identity. Names and structure only — no environment *values* are returned unless the
    * value is itself a session id, which is the one fact this route exists to settle.
+   *
+   * The three free-form fields below are the only ones in this route that are not a basename, a
+   * count or a flag, and each of them breaks the promise above the same way: a SQLite message
+   * carries the database it could not open, and a stack frame carries every directory above it.
+   * Both are absolute paths on the reader's machine, on exactly the failure paths this route
+   * exists to report.
+   *
+   * Two passes, in this order, and then the clip. `redact` knows the three store locations but
+   * only in the spelling it was given; `scrubAbsolutePaths` is spelling-agnostic and blunts
+   * anything absolute, which is what a stack frame needs and what session content must never get.
+   * Clipping LAST is the part that is easy to get wrong: clipping first can cut a path in half
+   * and leave a drive-qualified fragment standing.
    */
       const handleRuntime = async (response) => {
    let diagError = null;
@@ -2990,7 +3040,7 @@ export async function start(context) {
       mod = await import('node:sqlite');
       sqlite.available = typeof mod.DatabaseSync === 'function';
     } catch (error) {
-      sqlite.error = String(/** @type {any} */ (error)?.message ?? error).slice(0, 200);
+      sqlite.error = scrubAbsolutePaths(redact(String(/** @type {any} */ (error)?.message ?? error))).slice(0, 200);
     }
     if (sqlite.available) {
       // Name only — this route must never hand the browser a filesystem location.
@@ -3005,7 +3055,7 @@ export async function start(context) {
         ).get();
         sqlite.conversationCount = count ? toNumber(count.n) : null;
       } catch (error) {
-        sqlite.queryError = String(/** @type {any} */ (error)?.message ?? error).slice(0, 240);
+        sqlite.queryError = scrubAbsolutePaths(redact(String(/** @type {any} */ (error)?.message ?? error))).slice(0, 240);
       } finally {
         // A schema mismatch is the case this route exists to report, and it is exactly the case
         // where `prepare` throws — so closing inside the try left the handle waiting for GC.
@@ -3028,7 +3078,7 @@ export async function start(context) {
       sessionRootExists: existsSync(location.sessionsRoot),
     });
    } catch (error) {
-    diagError = String(/** @type {any} */ (error)?.stack ?? error).slice(0, 600);
+    diagError = scrubAbsolutePaths(redact(String(/** @type {any} */ (error)?.stack ?? error))).slice(0, 600);
     sendJson(response, 200, { diagError });
    }
   };
diff --git a/plugins/avatasia/mmc-trajectory/tests/client-check.mjs b/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
index 16bd873..ec4c3cc 100644
--- a/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
+++ b/plugins/avatasia/mmc-trajectory/tests/client-check.mjs
@@ -208,6 +208,71 @@ check('a needle answered with nothing and truncated reads as not found',
 check('no state is not a crash', sandbox.searchStatusLabel(null), '');
 check('no kinds match', sandbox.hasKind({ kind: 'system' }, ['user']), false);
 
+/* search: the TRANSITION, which the four states above cannot see.
+ *
+ * Every case in the block above hands `searchStatusLabel` a state object written out for that one
+ * case, and the `runSearch` checks further down read its source as text. Both are blind to the same
+ * thing: a state is a snapshot, so neither can see that a search which failed once and was then
+ * re-run and answered still said 「搜索失败，以下为上次结果」 — the label reads the error first, so
+ * the stale error outranked the fresh hit set it was describing. Only the two paths a READER
+ * triggers cleared the field: typing, and pressing clear. A poll that re-runs the current query
+ * after the transcript changed is not a reader, so nothing it did could clear it.
+ *
+ * This runs it instead of reading it. `runSearch` is not between PURE:START and PURE:END — it
+ * talks to the network — so it could not join the sandbox above; here the SHIPPED source of the
+ * functions it needs is sliced out by `fnSource` and evaluated. That is the page's own text rather
+ * than a copy of it: rename a function in index.html and this fails with "no such function" instead
+ * of quietly continuing to exercise the old shape. */
+{
+  const netCtx = { console, AbortController, setTimeout, clearTimeout, encodeURIComponent };
+  vm.createContext(netCtx);
+  const needed = ['function isCount(value)', 'function formatInt(value)', 'function searchHitSet(hits)',
+    'function sessionParam()', 'function searchStatusLabel(searchState)', 'function runSearch(needle)'];
+  const sources = needed.map((sig) => fnSource(sig));
+  check('the shipped search functions are all still findable by signature',
+    needed.filter((sig, i) => !sources[i]), []);
+
+  vm.runInContext([
+    // The shape `runSearch` writes into. Every field it touches is here; nothing else about the
+    // page's state is, because nothing else about the page's state is what is under test.
+    'var state = { query: "retry me", sessionId: null, hostSessionId: null, followLatest: true,',
+    '  generation: null, searchHits: null, searchTotal: 0, searchTruncated: false,',
+    '  searchPending: false, searchError: null };',
+    'var searchSeq = 0;',
+    'var searchController = null;',
+    // The two renderers paint the page; neither is what is being tested and neither has a DOM here.
+    'function resetWindowMode() {}',
+    'function renderLedger() {}',
+    // A signature that no longer resolves becomes a function that throws when reached, so the
+    // failure names the function rather than arriving as a syntax error nobody can read.
+    ...sources.map((src, i) => src || (needed[i] + ' { throw new Error(' + JSON.stringify(needed[i])
+      + ' is not in index.html any more); }')),
+  ].join('\n'), netCtx);
+
+  const settle = async () => {
+    // fetch -> response.json() -> then -> then -> then is all microtasks plus the json() promise.
+    // Three macrotask turns drain all of them, so the count does not have to be right.
+    for (let i = 0; i < 3; i += 1) await new Promise((done) => setImmediate(done));
+  };
+
+  netCtx.fetch = () => Promise.reject(Object.assign(new Error('api'), { code: 'search_failed' }));
+  netCtx.runSearch('retry me');
+  await settle();
+  const afterFailure = netCtx.searchStatusLabel(netCtx.state);
+
+  netCtx.fetch = () => Promise.resolve({ ok: true, status: 200,
+    json: () => Promise.resolve({ hits: [{ index: 7 }], total: 1, truncated: false }) });
+  netCtx.runSearch('retry me');
+  await settle();
+
+  check('a search that failed says so', afterFailure, '搜索失败，以下为上次结果');
+  check('and the retry that answers it clears the failure, not just the pending flag',
+    netCtx.state.searchError, null);
+  check('so the label reports the answer instead of the stale failure',
+    netCtx.searchStatusLabel(netCtx.state), '命中 1 条');
+  check('and the hit set it describes is the new one', [...netCtx.state.searchHits], [7]);
+}
+
 /* flatten + signature */
 check('flatten empty', sandbox.flattenTurns(undefined), []);
 check('flatten junk', sandbox.flattenTurns([{ id: 'a' }, null, { id: 'b', records: [null, { id: 'r' }] }]).length, 1);
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-runtime-diag.py b/plugins/avatasia/mmc-trajectory/tests/mutate-runtime-diag.py
new file mode 100644
index 0000000..fad404e
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-runtime-diag.py
@@ -0,0 +1,180 @@
+"""Mutation control for `/api/runtime`'s one contract: what it does not send.
+
+This is the only route in the package whose promise is entirely about withholding. Its own comment
+says it — 「Names and structure only」, and 「this route must never hand the browser a filesystem
+location」 — and asking a promise-to-guard map which rows had no owner returned this one.
+
+Asking is what found the hole. Three fields in the response are not basenames, counts or flags; they
+are substrings of exception text, and each of them went out raw:
+
+    sqlite.error       the message from importing node:sqlite
+    sqlite.queryError  the message from a database that could not be opened or queried
+    diagError          the STACK of anything the handler itself threw
+
+`diagError` is the one that leaked on every single run. A Node stack frame names the file it is in
+by absolute path, once per frame, so 600 characters of one is mostly directory names — and on Windows
+those carry the user profile directory. It fired on exactly the failure paths the route exists to
+report, so the reader looking at that output is the reader already having a bad day. In a package
+that installs onto every reader's machine, that is an identity leak and it contradicted the route's
+own stated promise.
+
+Two passes now, in this order, and then the clip:
+
+  1. `redact` — the three store locations, in the spelling they were handed;
+  2. `scrubAbsolutePaths` — anything absolute at all, in any spelling.
+
+The second is not redundant and the mutations below are grouped to show why. A stack frame is printed
+as a URL (`file:///C:/Users/...`), with forward slashes and a scheme, so the backslash prefixes miss
+every frame of it; the store's `.minimax` fallback catches the store's own directories and leaves
+everything else — the node install, a temp directory, a dependency — standing. The guard measures
+that gap on a real stack rather than asserting it.
+
+Deliberately NOT folded into `createRedactor`: that one also runs over session CONTENT, where
+blanking an unrelated string would change what a reader is shown. A stack carries nothing a reader
+came for, which is exactly why the blunt version is allowed here and not there.
+
+Each mutation reverts one field and requires `verify-runtime-diag.mjs` to report it by name.
+"""
+import subprocess
+import sys
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parent
+SERVER = ROOT / "miniapp" / "node" / "server.mjs"
+PROBE = HERE / "verify-runtime-diag.mjs"
+
+REDACT = "redact(String(/** @type {any} */ (error)?."
+
+MUTATIONS = [
+    (
+        "the handler's own stack goes out raw, so the route publishes a directory per frame",
+        "    diagError = scrubAbsolutePaths(redact(String(/** @type {any} */ (error)?.stack ?? error))).slice(0, 600);",
+        "    diagError = String(/** @type {any} */ (error)?.stack ?? error).slice(0, 600);",
+        "SHAPE: diagError goes through both passes",
+    ),
+    (
+        "a database that could not be opened reports its own path in the error field",
+        "      sqlite.error = scrubAbsolutePaths(redact(String(/** @type {any} */ (error)?.message ?? error))).slice(0, 200);",
+        "      sqlite.error = String(/** @type {any} */ (error)?.message ?? error).slice(0, 200);",
+        "SHAPE: sqlite.error goes through both passes",
+    ),
+    (
+        "a query that could not be answered reports its own path in the query-error field",
+        "        sqlite.queryError = scrubAbsolutePaths(redact(String(/** @type {any} */ (error)?.message ?? error))).slice(0, 240);",
+        "        sqlite.queryError = String(/** @type {any} */ (error)?.message ?? error).slice(0, 240);",
+        "SHAPE: sqlite.queryError goes through both passes",
+    ),
+    # The order one. Both passes, then the clip — and moving the clip inside the scrub is a different
+    # defect with the same smell: cutting a path at 600 characters can leave a drive-qualified
+    # fragment standing, which is still a profile directory as far as a reader is concerned.
+    (
+        "the path is clipped before it is scrubbed, so a long stack leaves half a path behind",
+        "    diagError = scrubAbsolutePaths(redact(String(/** @type {any} */ (error)?.stack ?? error))).slice(0, 600);",
+        "    diagError = scrubAbsolutePaths(redact(String(/** @type {any} */ (error)?.stack ?? error).slice(0, 600)));",
+        "SHAPE: diagError is redacted and scrubbed BEFORE it is clipped, so no path is cut in half",
+    ),
+    # And the two fields that are supposed to stay names. These are the easy half of the contract
+    # and they have no behavioural check either, for the same reason as the rest: the handler is a
+    # closure inside `start()` and this suite never starts the runtime.
+    (
+        "the database file is published as the whole path instead of its name",
+        "      sqlite.dbFile = basename(join(location.root, 'v2', 'sqlite', 'runtime-state.sqlite'));",
+        "      sqlite.dbFile = join(location.root, 'v2', 'sqlite', 'runtime-state.sqlite');",
+        "the database file is published as a basename",
+    ),
+    (
+        "the data directory is published whole, which on Windows is the user profile directory",
+        "      dataDirBasename: basename(context.dataDir) || null,",
+        "      dataDirBasename: context.dataDir || null,",
+        "dataDirBasename is a basename and not the value it was derived from",
+    ),
+]
+
+
+def read_exact(path):
+    """Normalise to LF for matching, and report the file's own newline so it can be put back."""
+    data = path.read_bytes()
+    text = data.decode("utf-8").replace("\r\n", "\n")
+    return text, ("\r\n" if b"\r\n" in data else "\n")
+
+
+def write_exact(path, text, newline):
+    if newline == "\r\n":
+        text = text.replace("\n", "\r\n")
+    path.write_bytes(text.encode("utf-8"))
+
+
+def run_probe():
+    proc = subprocess.run(
+        ["node", str(PROBE)],
+        cwd=str(ROOT), capture_output=True, text=True,
+        encoding="utf-8", errors="replace",
+    )
+    return proc.returncode, (proc.stdout or "") + (proc.stderr or "")
+
+
+def named_failures(output):
+    return [
+        line.strip()[len("FAIL"):].strip()
+        for line in output.splitlines()
+        if line.strip().startswith("FAIL")
+    ]
+
+
+def main():
+    code, output = run_probe()
+    if code != 0:
+        print("baseline probe does not pass; fix that first")
+        print(output)
+        return 1
+    print("baseline clean")
+
+    original = SERVER.read_bytes()
+    missed, unnamed = [], []
+    for label, old, new, expect in MUTATIONS:
+        text, newline = read_exact(SERVER)
+        if old not in text:
+            print(f"SKIP  {label}: anchor not found")
+            missed.append(label)
+            continue
+        if old == new:
+            print(f"SKIP  {label}: the mutation changes nothing")
+            missed.append(label)
+            continue
+        write_exact(SERVER, text.replace(old, new, 1), newline)
+        try:
+            code, output = run_probe()
+        finally:
+            SERVER.write_bytes(original)
+        if code == 0:
+            print(f"MISSED {label}: the probe still passed")
+            missed.append(label)
+            continue
+        names = named_failures(output)
+        if not names:
+            print(f"UNNAMED {label}: the probe failed without naming a rule")
+            unnamed.append(label)
+        elif not any(expect in n for n in names):
+            print(f"MISSED {label}: probe failed, but not on {expect!r}\n         -> {names}")
+            missed.append(label)
+        else:
+            print(f"caught {label}\n         -> " + next(n for n in names if expect in n))
+
+    if SERVER.read_bytes() != original:
+        print(f"NOT RESTORED {SERVER}")
+        return 1
+    print("server restored byte-for-byte")
+
+    if missed or unnamed:
+        if missed:
+            print(f"\n{len(missed)} mutation(s) got through")
+        if unnamed:
+            print(f"{len(unnamed)} mutation(s) failed without naming a rule")
+        return 1
+    print(f"\nall {len(MUTATIONS)} mutations caught, each by name")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/plugins/avatasia/mmc-trajectory/tests/mutate-search-client.py b/plugins/avatasia/mmc-trajectory/tests/mutate-search-client.py
index c8690c0..a31ddd6 100644
--- a/plugins/avatasia/mmc-trajectory/tests/mutate-search-client.py
+++ b/plugins/avatasia/mmc-trajectory/tests/mutate-search-client.py
@@ -82,6 +82,23 @@
         "          var index = entry && typeof entry.index === 'number' ? entry.index : NaN;",
         "          var index = entry && typeof entry.summary === 'string' ? entry.summary.length : NaN;",
     ),
+    # The one an acceptance review caught, and the reason the mutation list above is not the end of
+    # the story. Every entry there changes what the page COMPUTES. This one changes what it REMEMBERS
+    # about a request that already finished — and every existing check was blind to it from the same
+    # side: the `searchStatusLabel` cases each construct their own state, and a state cannot be stale,
+    # because it was written for the case it is asked about. The `runSearch` checks were source
+    # regexes, and the line being removed is a line they were not written against.
+    #
+    # So nothing cleared `searchError` except typing and pressing the clear button — the two a reader
+    # drives. A poll that re-runs the current query after the transcript changed is not a reader, so
+    # a search that had failed once said 「搜索失败，以下为上次结果」 for the rest of the session, and
+    # because the label reads the error before the counts, the stale error outranked the fresh hit set
+    # it was describing. The page showed the right rows under the wrong sentence.
+    (
+        "an answer that arrives leaves the failure that preceded it standing",
+        "            state.searchError = null;\n            resetWindowMode();",
+        "            resetWindowMode();",
+    ),
 ]
 
 
diff --git a/plugins/avatasia/mmc-trajectory/tests/verify-runtime-diag.mjs b/plugins/avatasia/mmc-trajectory/tests/verify-runtime-diag.mjs
new file mode 100644
index 0000000..ab3f0f2
--- /dev/null
+++ b/plugins/avatasia/mmc-trajectory/tests/verify-runtime-diag.mjs
@@ -0,0 +1,208 @@
+/**
+ * `/api/runtime` is the one route in this package whose contract is entirely about what it does
+ * NOT send. Its own comment says it: 「Names and structure only」, and 「this route must never hand
+ * the browser a filesystem location」. Every other route's contract is about the values it
+ * publishes; this one's is about the values it withholds.
+ *
+ * It was the only row in a promise-to-guard map that came back 「nothing」, and asking the question
+ * is what turned up the reason there should be one. Three fields in that response are not
+ * basenames, counts or flags — they are substrings of exception text:
+ *
+ *   `sqlite.error`      the message from importing node:sqlite
+ *   `sqlite.queryError` the message from a database that could not be opened or queried
+ *   `diagError`         the STACK of anything the handler itself threw
+ *
+ * `diagError` is the one that leaks on every single run: a Node stack frame names the file it is
+ * in, by absolute path, once per frame, so a 600-character slice of one is mostly directory names.
+ * And it fires on precisely the failure paths this route exists to report, so the reader looking at
+ * this output is the reader who is already having a bad day. On Windows those paths carry the user
+ * profile directory, which is the identity leak this package treats as a release blocker elsewhere.
+ *
+ * Three kinds of check, each named for what it is, because a guard that does not say which of its
+ * checks are the strong kind is worse than one that has none:
+ *
+ *   1. BEHAVIOURAL. The redactor is the real exported `createRedactor`, and the text it is handed
+ *      is a REAL stack captured by throwing from a real module written inside a real temporary
+ *      home — so the paths in it are the ones that would actually have gone out. Nothing here is
+ *      typed out to make a point.
+ *
+ *   2. SHAPE, on three lines, count-checked: that the three fields go through `redact`, and that
+ *      they do so BEFORE `slice`. These cannot be behavioural, and the reason is worth recording:
+ *      the handler is a closure inside `start()`, and this suite's own convention
+ *      (`verify-search-endpoint.mjs` states it) is read-only, pure helpers, never start the
+ *      runtime. Moving a route handler out of its closure purely so a test could call it is a
+ *      bigger change to shipped code than the property is worth. So the shape checks hold the
+ *      wiring, the behavioural one holds the property, and neither is asked to do the other's job.
+ *
+ *   3. That the published location fields stay NAMES. `basename` is what turns a path into a fact
+ *      about this machine that the browser cannot use to find anything.
+ *
+ * `tests/mutate-runtime-diag.py` reverts each of the three redacting fields and requires this guard
+ * to report it by name.
+ */
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { basename, join } from 'node:path';
+import { tmpdir, homedir } from 'node:os';
+import { createRedactor, resolveSessionsRoot, scrubAbsolutePaths } from '../miniapp/node/server.mjs';
+
+const SESSION_STORE_TOKEN = '<session-store>';
+const SERVER = fileURLToPath(new URL('../miniapp/node/server.mjs', import.meta.url));
+const server = readFileSync(SERVER, 'utf8');
+
+let pass = 0;
+const failures = [];
+function assert(name, cond, detail) {
+  if (cond) pass += 1;
+  else failures.push(detail ? name + ' -- ' + detail : name);
+}
+
+const home = mkdtempSync(join(mkdtempSync(join(tmpdir(), 'mmc-trajectory-diag-')), '.minimax'));
+try {
+  const where = resolveSessionsRoot({ MMC_TRAJECTORY_ROOT: home });
+  const redact = createRedactor([where.sessionsRoot, where.root, join(homedir(), '.minimax')]);
+
+  // --- 1. BEHAVIOURAL: a real stack, out of a real module, under the home the redactor knows ----
+  const thrower = join(home, 'thrower.mjs');
+  writeFileSync(thrower, 'export function boom() {\n  throw new Error("boom");\n}\n');
+  const { boom } = await import(pathToFileURL(thrower).href);
+
+  let frame = null;
+  try {
+    boom();
+  } catch (error) {
+    frame = String(error.stack);
+  }
+  assert('a real stack names the file it is in, by absolute path',
+    typeof frame === 'string' && frame.includes('thrower.mjs'),
+    frame ? frame.split('\n')[1] : 'no stack');
+  assert('and that path is the READER\'s own directory, spelled the way a stack spells it',
+    typeof frame === 'string' && frame.includes(home.replace(/\\/g, '/')),
+    frame ? frame.split('\n')[1] : 'no stack');
+
+  /* The shape of that path is the part worth pinning, and it is not the obvious one. Node prints a
+   * stack frame as a URL — `file:///C:/Users/…/thrower.mjs` — with FORWARD slashes and a scheme in
+   * front. The store locations are held as backslash paths, so `split(prefix).join(token)` does not
+   * match a single frame, and the `.minimax` fallback catches the store's own directories while
+   * leaving everything else in the frame standing. That was measured on a real stack, not assumed:
+   * `redact` on its own leaves `file:///` in the output.
+   *
+   * So the property this route needs is owned by `scrubAbsolutePaths`, and the assertions below ask
+   * that question of it directly rather than of the route, which is a closure inside `start()`. */
+  const cleaned = typeof frame === 'string' ? scrubAbsolutePaths(redact(frame)) : '';
+  assert('and the store redactor alone does NOT clean it, which is why this route needs a second pass',
+    typeof frame === 'string' && /file:\/\//.test(redact(frame)), redact(frame).split('\n')[1]);
+  assert('BEHAVIOURAL: the path scrubber takes the reader\'s own directory out of the stack',
+    !cleaned.includes(home) && !cleaned.includes(encodeURI(home)), cleaned.split('\n')[1]);
+  assert('leaving no file URL and no drive-qualified path anywhere in the remainder',
+    !/file:\/\//.test(cleaned) && !/[A-Za-z]:[\\/]/.test(cleaned), cleaned.split('\n')[1]);
+  assert('while still leaving the diagnostic itself readable',
+    cleaned.includes('boom') && cleaned.includes(SESSION_STORE_TOKEN), cleaned.split('\n')[0]);
+
+  // The residual, and it is the common one. A stack frame does not only name the store: every other
+  // frame in it is somewhere else entirely — the node install, a temp directory, a dependency — and
+  // none of those is under `.minimax`, so the store redactor has nothing to match them against and
+  // the whole frame passes. This is a SECOND throw, from a module outside the store, because that is
+  // the case the first one cannot see: it sits under `.minimax`, where the fallback happens to save
+  // it, and a guard that only tested that would be reporting safety it has not checked.
+  const outside = mkdtempSync(join(tmpdir(), 'mmc-trajectory-outside-'));
+  const outsideThrower = join(outside, 'elsewhere.mjs');
+  writeFileSync(outsideThrower, 'export function boom2() {\n  throw new Error("boom2");\n}\n');
+  const { boom2 } = await import(pathToFileURL(outsideThrower).href);
+  let outsideFrame = null;
+  try {
+    boom2();
+  } catch (error) {
+    outsideFrame = String(error.stack);
+  }
+  // Everything below compares against the SLASHED spelling, because that is the one a stack uses.
+  // Comparing a Windows path against a `file:///C:/...` frame reads as "nothing matched" and turns
+  // a check into a vacuous pass — which is worse than no check, because it is green.
+  const slashed = (p) => p.replace(/\\/g, '/');
+  try {
+    assert('a real stack from OUTSIDE the store names an absolute path there too',
+      typeof outsideFrame === 'string' && outsideFrame.includes(slashed(outsideThrower)));
+    assert('and the store redactor leaves that one completely alone, which is the whole reason '
+      + 'this route has a second pass',
+      typeof outsideFrame === 'string' && redact(outsideFrame).includes(slashed(outsideThrower)),
+      typeof outsideFrame === 'string' ? redact(outsideFrame).split('\n')[1] : '');
+    assert('BEHAVIOURAL: while the scrubber removes it',
+      typeof outsideFrame === 'string' && !scrubAbsolutePaths(redact(outsideFrame)).includes(slashed(outside)));
+    assert('and the diagnostic still says what happened',
+      scrubAbsolutePaths(redact(outsideFrame)).includes('boom2'));
+  } finally {
+    rmSync(outside, { recursive: true, force: true });
+  }
+
+  // It has to be narrow. Every URL, route and regex in this package starts with a `/`, so a scrub
+  // that matched a bare slash would blank half the output and make the route useless for the one
+  // job it has. The POSIX shape is deliberately anchored on a root only a filesystem has.
+  assert('and it does not blank the things it must leave alone',
+    scrubAbsolutePaths('GET /api/trajectory?since=12 -> 304') === 'GET /api/trajectory?since=12 -> 304',
+    scrubAbsolutePaths('GET /api/trajectory?since=12 -> 304'));
+  assert('including a POSIX store path, which it DOES blank',
+    !scrubAbsolutePaths('at probe (/home/someone/.minimax/v2/x)').includes('/home/'));
+
+  // --- 2. the two SQLite strings, which are a weaker case and are labelled as one ---------------
+  // On this runtime their messages carry no path at all — `unable to open database file` is the
+  // whole text — so nothing leaks through them today. What the shape checks below own is that the
+  // channel stays closed if a message ever does carry one. That is a smaller claim than "this
+  // leaks", and saying so is the difference between a guard and a story about a guard.
+  const dbPath = join(home, 'v2', 'sqlite', 'runtime-state.sqlite');
+  mkdirSync(join(home, 'v2', 'sqlite'), { recursive: true });
+  mkdirSync(dbPath, { recursive: true });   // a directory where a file belongs: refused
+  let sqliteMessage = null;
+  try {
+    const { DatabaseSync } = await import('node:sqlite');
+    const probe = new DatabaseSync(dbPath, { readOnly: true });
+    probe.prepare('select count(*) as n from local_runtime_sessions').get();
+    probe.close();
+  } catch (error) {
+    sqliteMessage = String(error && error.message ? error.message : error);
+  }
+  assert('a real SQLite refusal is produced here, so the check above is about a real string',
+    typeof sqliteMessage === 'string' && sqliteMessage.length > 0);
+  assert('and on this runtime it happens to carry no path, which is why those two fields are held '
+    + 'as a channel rather than as a leak',
+    typeof sqliteMessage === 'string' && !sqliteMessage.includes(home), sqliteMessage);
+  assert('the redactor leaves that message intact, so nothing is redacted into uselessness',
+    typeof sqliteMessage === 'string' && redact(sqliteMessage) === sqliteMessage);
+
+  // --- 3. SHAPE: three fields, redacted, and redacted BEFORE they are clipped --------------------
+  for (const anchor of ['sqlite.error = scrubAbsolutePaths(redact(String(',
+    'sqlite.queryError = scrubAbsolutePaths(redact(String(',
+    'diagError = scrubAbsolutePaths(redact(String(']) {
+    assert('SHAPE: ' + anchor.split(' ')[0] + ' goes through both passes', server.includes(anchor));
+  }
+  // The order is part of the rule, not a style note: `redact(x).slice(n)` and `redact(x.slice(n))`
+  // differ only in whether a secret can be cut in half, and half a Windows profile path is still a
+  // profile path.
+  for (const [field, pattern] of [
+    ['sqlite.error', /sqlite\.error = scrubAbsolutePaths\(redact\(String\([\s\S]*?\)\)\)\.slice\(0, 200\);/],
+    ['sqlite.queryError', /sqlite\.queryError = scrubAbsolutePaths\(redact\(String\([\s\S]*?\)\)\)\.slice\(0, 240\);/],
+    ['diagError', /diagError = scrubAbsolutePaths\(redact\(String\([\s\S]*?\)\)\)\.slice\(0, 600\);/],
+  ]) {
+    assert(`SHAPE: ${field} is redacted and scrubbed BEFORE it is clipped, so no path is cut in half`,
+      pattern.test(server));
+  }
+
+  // --- 4. the published location fields stay names ----------------------------------------------
+  assert('the database file is published as a basename',
+    /sqlite\.dbFile = basename\(join\(location\.root/.test(server));
+  for (const field of ['cwdBasename', 'dataDirBasename']) {
+    assert(`${field} is a basename and not the value it was derived from`,
+      new RegExp(`${field}: basename\\(`).test(server));
+  }
+  assert('and nothing publishes the sessions root or the data directory verbatim',
+    !/:\s*location\.sessionsRoot\s*[,}]/.test(server)
+    && !/:\s*context\.dataDir\s*[,}]/.test(server));
+} finally {
+  rmSync(home, { recursive: true, force: true });
+}
+
+console.log('[runtime-diag] ' + pass + ' passed, ' + failures.length + ' failed');
+if (failures.length) {
+  for (const f of failures) console.log('FAIL  ' + f);
+  process.exit(1);
+}
+console.log('[runtime-diag] OK');