Cordis hands out a fresh traced proxy on every ctx.tools property read of a
tracked Service (ToolRuntime is one), each closing over the reader's context.
The hook keyed its WeakSet dedupe on the proxy identity, so every read
re-wrapped and pinned one restore closure per read — patched[] then retained
each caller's whole agent (scope tag -> agent -> session log) past disposal,
and the unload restore guard (instance.register === wrappedRegister) never
held through a traced proxy, leaving the dead wrapper on the shared service.
Peel to the stable underlying instance before dedupe/patch/restore (the
handler still returns the caller's own proxy, keeping scoped registration
this-binding), record the reader as a scalar fiber name instead of the
reader Context, and add a tracked-service regression test: single wrap
across reads, live scoped attribution, and restore on unload. #108
bowenliang123
0ece2c85ec