[ranxianglei]

What

#2766: the four dsh durable classifiers matched on contentType === "text" + marker text with no role boundary. An assistant message echoing a carrier marker (<available_skills>, Instructions from:, <mcp_catalog>, Current runtime context) projected to the same durable/<name> virtual path as the real carrier. Under the default latest-per-identity policy (protectedLatestTools: ["durable/*"], #2736) collectLatestProtected's lastByPath takes the last match — so a later model echo took the identity over from the real host injection: the echo got pinned, the real carrier demoted to foldable, one compression later the forged/partial copy was the only survivor.

Adversarial variant: an injected "list the catalog" instruction makes the model emit a fake <mcp_catalog> with attacker-chosen server names → the forgery survives, the real inventory folds — #2446's failure mode (model hunting servers by wrong names), attacker-authored.

Fix

Every classifier now refuses assistant-role messages first:

return msg.role !== "assistant" && msg.contentType === "text" && ...

• Zero legitimate protection loss: every carrier is a host injection into the user channel (documented per carrier; dsh createUserMessage). system/user-role injections stay covered — the gate targets model output only.
• The marker text cannot be the gate: anything visible to the model eventually shows up in its output (bili-chain tags, render tags on echoed assistant text break session continuity on stateful upstreams (magpie / Claude Code), causing full-history cache misses #2483 render tags, opencode 插件模式下 render tag 注入消息正文，模型回显漏网后原样渲染进 TUI（元数据与正文同层问题） #933/[bug] 插件透传会剥掉工具调用参数里的 render tag（arguments 流挂了 tag-echo 过滤器） #1039 echo noise — same family).
• Kernel unchanged (virtualToolPathOf stays role-agnostic by design); the role boundary belongs to the classifiers that own the traffic evidence (KDD release v0.1.2 #9 discipline). No kernel bump.
• File header documents the durable 身份接管缺口:classifier 无角色边界,模型回声可夺取 durable/* latest 身份 #2766 role boundary rationale; each classifier's doc comment points at it.

Tests

tests/issue2766-durable-role-gate.test.ts — 11 cases, all green:

• per carrier (×4): assistant echo never projects (individual classifier + lane-composed durableMessageToolPaths.dsh); same content user-role still projects;
• system-role carrier still projects (gate direction documented);
• kernel: collectLatestProtected over [real carrier, filler, assistant echo] keeps the real carrier as the latest instance, echo not in msgIds, isMessageLatestProtected true for the carrier / false for the echo;
• kernel: an echo between two real runtime-context snapshots does not break succession (newest real snapshot pinned).

Adjacent green (post-rebase on master da6315ec): durable-tool-identity (8), issue2446/2447/2481 suites (13 — their e2e sections unaffected), typecheck clean.

Closes #2766

[github-actions]

📦 Built Package Artifact

Branch: 2026-10-11_durable-role-gate (004518d)

Option A — Install this exact build (recommended)

npm install -g billion-context@0.0.3051-pr.2774.62054ed

This exact version is immutable and reproducible. The rolling pr tag tracks the newest test build across all PRs.

Option B — Download artifact

1. Download the artifact from the Actions run
2. Extract the tarball and install:

tar xzf billion-context-pr2774.tgz
npm install -g package

---

Install instructions are refreshed on each push.

[github-actions]

📦 Merged Build Published

This merge to master was published as 0.0.281-master.70d651c (rolling master tag).

npm install -g billion-context@0.0.281-master.70d651c  # this exact build
npm install -g billion-context@master  # always the newest merged build

npm view billion-context@master prints the current version at any time.