@avantf/dsh-mem 0.6.1 → 0.6.2

package/lib/engine/mem/dispatch.d.ts

@@ -13,7 +13,7 @@
  * `ToolSpec.key` is typed `string` (not a literal union), so exhaustiveness cannot be checked at
  * compile time — the spec assertion is the gate.
  */
-import type { KbAddRequest } from '../mem-contract/index.js';
+import type { KbAddRequest, ToolEnvelope, ToolSpec } from '../mem-contract/index.js';
 import type { AvantfRuntime } from './runtime.js';
 /**
  * The default page for a model-facing `kb_list`.
@@ -49,3 +49,21 @@ export declare function supportsToolKey(key: string): boolean;
  * both adapters route the throw through their structured error envelope.
  */
 export declare function dispatchToolKey(rt: AvantfRuntime, key: string, args: Record<string, unknown>): Promise<unknown>;
+/**
+ * The ONE model-facing boundary: validate against the contract spec, dispatch the key, and shape the
+ * result into the agent envelope.
+ *
+ * Every model-facing surface shares this — the DSH tool runner (`@avantf/dsh-mem`) and the MCP
+ * server — because the envelope is `ToolEnvelope`, a wire shape: an MCP caller and a DSH caller
+ * asking the same question must get the same fields. It used to live only in the plugin, so the MCP
+ * surface re-implemented it and the two could drift field by field.
+ *
+ * What stays in the CALLERS is everything AROUND the envelope: MCP's `textResult`/`isError` wrapper
+ * and the plugin's `present` view plus its Remote gateway. The Remote gateway is deliberately NOT
+ * routed through here (`mem/DESIGN.md` §239: it keeps `mem_admin`'s retention diagnostics and uses
+ * the wire error type, not `toolErr`).
+ *
+ * A validation failure answers `validationError` (named for the spec), an unknown key answers
+ * `toolErr`, and a throwing runtime call answers `toolErr` too — a raw exception never escapes.
+ */
+export declare function runToolSpec(rt: AvantfRuntime, spec: ToolSpec, args: unknown): Promise<ToolEnvelope<unknown>>;

package/lib/engine/mem/index.d.ts

@@ -17,6 +17,7 @@ export * from './config/paths.js';
 export * from './config/loader.js';
 export * from './modelBootstrap.js';
 export * from './dispatch.js';
+export * from './trustHeartbeat.js';
 export * from './runtime.js';
 export * from './store/memory.js';
 export * from './store/knowledge.js';

package/lib/engine/mem/trustHeartbeat.d.ts

@@ -0,0 +1,47 @@
+/**
+ * The trust heartbeat: the interval beat that advances the active-day clock and performs the
+ * settle / forget / idle / purge sweeps (TRUST_MODEL.md §5), shared by the DSH plugin and the MCP
+ * server.
+ *
+ * The two surfaces used to install it separately, and the copies drifted in exactly the places a
+ * copy drifts: the wording of the failure line and the work each beat does after the tick. The tick
+ * itself — the one thing that MUST be identical, because it is the trust clock — is what lives
+ * here. The differences are data: {@link TrustHeartbeatOptions.onBeat} is the extra work (the plugin
+ * sweeps entities and retries the vector migration), {@link TrustHeartbeatOptions.tickFailed} is how
+ * that surface names a failed sweep.
+ *
+ * `heartbeatMinutes <= 0` is the caller's decision, not this function's: a surface that disables the
+ * beat also decides whether it logs the interval line.
+ *
+ * Zero dependencies beyond `setInterval` so it stays in the engine (the plugin's index and the MCP
+ * entry both consume it).
+ */
+/** A single beat's worth of the trust clock, plus the two per-surface differences. */
+export interface TrustHeartbeatOptions {
+    /** The store whose active-day clock advances on presence. */
+    readonly memory: {
+        trustTick(): void;
+    };
+    /** Where a failed sweep is reported. Never allowed to make the beat itself throw. */
+    readonly logger: {
+        warn(message: string): void;
+    };
+    /** Minutes between beats. The caller does not install the beat unless this is positive. */
+    readonly heartbeatMinutes: number;
+    /** Extra per-beat work, run after the tick and OUTSIDE its catch (a failure here is the caller's). */
+    readonly onBeat?: () => void;
+    /**
+     * How this surface names a failed tick, given the caught value's message. Optional so the default
+     * (`trust tick failed: …`) holds for a caller that has no opinion.
+     */
+    readonly tickFailed?: (message: string) => string;
+}
+/**
+ * Install the heartbeat and return its disposer.
+ *
+ * A `trustTick` that throws is warned about and swallowed: a failed sweep must never take the host
+ * or the server down, and it must not be invisible either — a trust clock that stopped advancing
+ * shows up much later as facts that never settle, forget or purge. The timer is `unref`'d where the
+ * runtime supports it, so it never holds a process open by itself.
+ */
+export declare function installTrustHeartbeat(options: TrustHeartbeatOptions): () => void;

package/lib/index.js

@@ -1325,6 +1325,170 @@ function promptTextWarnings(sections) {
 	return out;
 }
 //#endregion
+//#region lib/types/interface_gate.js
+/** Read one member without letting a hostile module's getter escape. */
+function member(module, name) {
+	try {
+		return module?.[name];
+	} catch {
+		return;
+	}
+}
+function cannotTell(reason) {
+	return {
+		status: "cannot-tell",
+		reason
+	};
+}
+/**
+* Whether the base's shared capabilities may be used under `verdict`.
+*
+* The ONE mapping from the gate's verdict to the loader's decision, exported so it is asserted
+* directly and the loader and its test cannot drift: only `incompatible` withholds the base;
+* `cannot-tell` does not, because it is not a negative answer. A `false` here is still a DEGRADATION
+* (own prompt defaults, gate skipped, legacy provisioning), never a refused mount.
+*/
+function baseIsUsable(verdict) {
+	return verdict.status !== "incompatible";
+}
+/**
+* Where the build's bake record sits when no explicit URL is given: beside the built ENTRY
+* (`lib/index.js`), which is where `scripts/link-envinit.mjs` writes it. A per-file `tsc` emit of
+* this module lives one directory below that entry and looks one level up; the first readable record
+* wins. Under `vitest` (running from `src/`) neither exists, which is the correct "not baked".
+*/
+const BAKED_CANDIDATES = ["./interface-version.json", "../interface-version.json"];
+/**
+* Read this artifact's baked requirement through the loaded base's own reader.
+* @param read - the base's `readInterfaceRequirement`, taken off the loaded module.
+* @param bakedUrl - test seam: read EXACTLY this record instead of walking {@link BAKED_CANDIDATES}.
+*/
+function requirementOf(read, bakedUrl) {
+	const candidates = bakedUrl === void 0 ? BAKED_CANDIDATES.map((relative) => new URL(relative, import.meta.url)) : [bakedUrl];
+	for (const url of candidates) {
+		let requirement;
+		try {
+			requirement = read(url);
+		} catch {
+			continue;
+		}
+		const version = requirement?.interfaceVersion;
+		if (typeof version === "number" && Number.isInteger(version) && version > 0) return { interfaceVersion: version };
+	}
+}
+/**
+* Ask the loaded base whether it implements the interface generation this artifact was built for.
+*
+* @param module - the loaded base module (only `checkInterface` / `readInterfaceRequirement` are
+*   touched, each through a guarded read).
+* @param bakedUrl - test seam: the bake record to read; production leaves it undefined.
+* @returns a verdict that is never `incompatible` unless BOTH sides were readable and differ, and
+*   never a throw.
+*/
+function interfaceVerdict(module, bakedUrl) {
+	const check = member(module, "checkInterface");
+	const read = member(module, "readInterfaceRequirement");
+	if (typeof check !== "function" || typeof read !== "function") return cannotTell("the loaded base has no interface gate (checkInterface / readInterfaceRequirement missing) — it predates the runtime interface contract, so which generation it implements cannot be told");
+	const requirement = requirementOf(read, bakedUrl);
+	if (requirement === void 0) return cannotTell("this build has no baked interface requirement (lib/interface-version.json is missing or malformed), so the runtime interface gate cannot run");
+	let verdict;
+	try {
+		verdict = check(requirement.interfaceVersion, module);
+	} catch {
+		return cannotTell("the loaded base threw while judging the interface generation");
+	}
+	const status = verdict?.status;
+	if (status !== "ok" && status !== "incompatible" && status !== "cannot-tell") return cannotTell("the loaded base returned no usable interface verdict");
+	return verdict;
+}
+/** Emit a warning without ever letting the logger turn it into a crash. */
+function warn$1(log, message) {
+	try {
+		log?.warn(message);
+	} catch {}
+}
+function reasonOf$1(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/**
+* Run the runtime interface gate and answer whether the loaded base's shared capabilities may be
+* used.
+*
+* `false` is a DEGRADATION the caller answers by taking its own full-degradation route (no runtime,
+* own prompt defaults, the compatibility gate skipped, legacy provisioning) — never a refused mount,
+* and never a throw. `cannot-tell` warns and answers `true`: "cannot tell" is not a negative answer,
+* so the base is used normally. The verdict's own reason is the base's; only the surrounding sentence
+* is the caller's ({@link DegradeWords}).
+*/
+function gateOrDegrade(module, log, words) {
+	const verdict = interfaceVerdict(module);
+	if (!baseIsUsable(verdict)) {
+		warn$1(log, `${words.prefix} WARNING — interface: ${verdict.reason ?? "the loaded base implements another interface generation"}; the base's shared capabilities are NOT used (${words.withheld}) and the plugin mounts anyway`);
+		return false;
+	}
+	if (verdict.status === "cannot-tell") warn$1(log, `${words.prefix} WARNING — interface: ${verdict.reason ?? "the interface generation cannot be told"}; using the loaded base anyway ("cannot tell" is never "incompatible")`);
+	return true;
+}
+/**
+* The guard that makes a loader's "never throws" true: every failure is one warning plus
+* `undefined`. The caller owns the sentence's tail (`words`) and its own cache discipline — a
+* FAILED load is not cached, so this must return `undefined` rather than reject (see
+* {@link createLoadCache}).
+*/
+async function loadGuarded(options, loadOnce, log, words) {
+	try {
+		return await loadOnce(options);
+	} catch (error) {
+		warn$1(log, `${words.prefix} WARNING — environment initialisation failed (${reasonOf$1(error)}); ${words.loadFailure}`);
+		return;
+	}
+}
+/**
+* Wrap a guarded loader in the cache discipline both startups share: the first call runs it, every
+* later and concurrent call shares its result, and a FAILED load is NOT cached. A failure is "cannot
+* tell", not a verdict — and it may be transient (offline at boot, a half-written install) — so a
+* profile reload, or a second instance in the same process, retries instead of replaying the first
+* failure for the whole process lifetime.
+*/
+function createLoadCache(guarded) {
+	let loaded;
+	let loading;
+	return {
+		load(options) {
+			if (loaded !== void 0) return Promise.resolve(loaded);
+			if (loading !== void 0) return loading;
+			loading = guarded(options).then((runtime) => {
+				if (runtime === void 0) loading = void 0;
+				else loaded = runtime;
+				return runtime;
+			}, () => {
+				loading = void 0;
+			});
+			return loading;
+		},
+		clear() {
+			loaded = void 0;
+			loading = void 0;
+		}
+	};
+}
+/**
+* Whether a Cordis context is still alive.
+*
+* Cordis clears `fiber.uid` on disposal, and every later context call then throws
+* `INACTIVE_EFFECT`. `apply` awaits environment preparation, so a profile reload or unload can land
+* inside that window and half-register a plugin (the Remote face cannot be rolled back). A fiberless
+* stub counts as active: an unknown shape is "cannot tell", never "disposed".
+*
+* Generic Cordis liveness rather than interface-gate knowledge — but the two plugins' startup paths
+* share it byte-for-byte, so it lives with their one shared shim, where the two readings of "is my
+* context alive" cannot drift.
+*/
+function stillActive(ctx) {
+	const fiber = ctx?.fiber;
+	return fiber === void 0 || fiber.uid !== null;
+}
+//#endregion
 //#region lib/types/hints.js
 /**
 * The plugin's CONDITIONAL hint: ONE line, contributed only when either store already holds
@@ -3688,6 +3852,79 @@ async function dispatchToolKey(rt, key, args) {
 	if (dispatch === void 0) throw new Error(`unknown tool key ${key}`);
 	return dispatch(rt, args);
 }
+/**
+* The ONE model-facing boundary: validate against the contract spec, dispatch the key, and shape the
+* result into the agent envelope.
+*
+* Every model-facing surface shares this — the DSH tool runner (`@avantf/dsh-mem`) and the MCP
+* server — because the envelope is `ToolEnvelope`, a wire shape: an MCP caller and a DSH caller
+* asking the same question must get the same fields. It used to live only in the plugin, so the MCP
+* surface re-implemented it and the two could drift field by field.
+*
+* What stays in the CALLERS is everything AROUND the envelope: MCP's `textResult`/`isError` wrapper
+* and the plugin's `present` view plus its Remote gateway. The Remote gateway is deliberately NOT
+* routed through here (`mem/DESIGN.md` §239: it keeps `mem_admin`'s retention diagnostics and uses
+* the wire error type, not `toolErr`).
+*
+* A validation failure answers `validationError` (named for the spec), an unknown key answers
+* `toolErr`, and a throwing runtime call answers `toolErr` too — a raw exception never escapes.
+*/
+async function runToolSpec$1(rt, spec, args) {
+	const parsed = spec.input.safeParse(args ?? {});
+	if (!parsed.success) return validationError(spec.name, parsed.error.issues);
+	if (!supportsToolKey(spec.key)) return toolErr(`unknown tool ${spec.key}`);
+	try {
+		const value = await dispatchToolKey(rt, spec.key, parsed.data);
+		return toolOk(modelFacingToolResult(spec.key, parsed.data.action, value));
+	} catch (error) {
+		return toolErr(error);
+	}
+}
+//#endregion
+//#region ../core/lib/trustHeartbeat.js
+/**
+* The trust heartbeat: the interval beat that advances the active-day clock and performs the
+* settle / forget / idle / purge sweeps (TRUST_MODEL.md §5), shared by the DSH plugin and the MCP
+* server.
+*
+* The two surfaces used to install it separately, and the copies drifted in exactly the places a
+* copy drifts: the wording of the failure line and the work each beat does after the tick. The tick
+* itself — the one thing that MUST be identical, because it is the trust clock — is what lives
+* here. The differences are data: {@link TrustHeartbeatOptions.onBeat} is the extra work (the plugin
+* sweeps entities and retries the vector migration), {@link TrustHeartbeatOptions.tickFailed} is how
+* that surface names a failed sweep.
+*
+* `heartbeatMinutes <= 0` is the caller's decision, not this function's: a surface that disables the
+* beat also decides whether it logs the interval line.
+*
+* Zero dependencies beyond `setInterval` so it stays in the engine (the plugin's index and the MCP
+* entry both consume it).
+*/
+/** The generic one-line reason for a caught value. */
+function messageOf$1(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/**
+* Install the heartbeat and return its disposer.
+*
+* A `trustTick` that throws is warned about and swallowed: a failed sweep must never take the host
+* or the server down, and it must not be invisible either — a trust clock that stopped advancing
+* shows up much later as facts that never settle, forget or purge. The timer is `unref`'d where the
+* runtime supports it, so it never holds a process open by itself.
+*/
+function installTrustHeartbeat(options) {
+	const timer = setInterval(() => {
+		try {
+			options.memory.trustTick();
+		} catch (error) {
+			options.logger.warn((options.tickFailed ?? ((message) => `trust tick failed: ${message}`))(messageOf$1(error)));
+		}
+		options.onBeat?.();
+	}, options.heartbeatMinutes * 6e4);
+	const unref = timer.unref;
+	if (typeof unref === "function") unref.call(timer);
+	return () => clearInterval(timer);
+}
 //#endregion
 //#region ../retrieval-core/lib/representation.js
 /**
@@ -16419,6 +16656,12 @@ function cannotDetermine(error, log, prefix) {
 * Run the gate. Call this FIRST in `apply()`: on a refusal nothing has been registered yet, so
 * "do not load" costs nothing to unwind. Never throws — not even with a throwing logger, because
 * "cannot tell" is not "incompatible".
+*
+* The check itself is the BASE's `provision` (gather + verdict + logging, one call). The local
+* fallback stays on purpose (option A): the interface-generation axis cannot gate this dependency
+* (same-generation bases never read as `incompatible`), and raising the peer floor would degrade
+* every host on a base that predates the fix — so a `provision` that cannot be performed still
+* leaves the plugin loading.
 * @param ctx - the plugin's context.
 * @param log - the plugin's logger.
 * @param compat - the loaded gate runtime (see `src/envinit.ts`).
@@ -16427,22 +16670,11 @@ function cannotDetermine(error, log, prefix) {
 * @returns the verdict `apply` branches on.
 */
 function provision(ctx, log, compat, spec = compat.spec) {
-	let evidence;
-	try {
-		evidence = compat.module.gatherEvidence(ctx, spec);
-	} catch (error) {
-		return cannotDetermine(error, log, compat.prefix);
-	}
-	let verdict;
 	try {
-		verdict = compat.module.verdictOf(evidence);
+		return { verdict: compat.module.provision(ctx, log, spec) };
 	} catch (error) {
 		return cannotDetermine(error, log, compat.prefix);
 	}
-	for (const line of verdict.lines) try {
-		log[line.level](line.message);
-	} catch {}
-	return { verdict };
 }
 /**
 * Keep one `/mem` command that reports a refusal.
@@ -16888,83 +17120,6 @@ function rangeOf(value) {
 	return typeof range === "string" && range.trim() !== "" ? range : void 0;
 }
 //#endregion
-//#region lib/types/interface_gate.js
-/** Read one member without letting a hostile module's getter escape. */
-function member(module, name) {
-	try {
-		return module?.[name];
-	} catch {
-		return;
-	}
-}
-function cannotTell(reason) {
-	return {
-		status: "cannot-tell",
-		reason
-	};
-}
-/**
-* Whether the base's shared capabilities may be used under `verdict`.
-*
-* The ONE mapping from the gate's verdict to the loader's decision, exported so it is asserted
-* directly and the loader and its test cannot drift: only `incompatible` withholds the base;
-* `cannot-tell` does not, because it is not a negative answer. A `false` here is still a DEGRADATION
-* (own prompt defaults, gate skipped, legacy provisioning), never a refused mount.
-*/
-function baseIsUsable(verdict) {
-	return verdict.status !== "incompatible";
-}
-/**
-* Where the build's bake record sits when no explicit URL is given: beside the built ENTRY
-* (`lib/index.js`), which is where `scripts/link-envinit.mjs` writes it. A per-file `tsc` emit of
-* this module lives one directory below that entry and looks one level up; the first readable record
-* wins. Under `vitest` (running from `src/`) neither exists, which is the correct "not baked".
-*/
-const BAKED_CANDIDATES = ["./interface-version.json", "../interface-version.json"];
-/**
-* Read this artifact's baked requirement through the loaded base's own reader.
-* @param read - the base's `readInterfaceRequirement`, taken off the loaded module.
-* @param bakedUrl - test seam: read EXACTLY this record instead of walking {@link BAKED_CANDIDATES}.
-*/
-function requirementOf(read, bakedUrl) {
-	const candidates = bakedUrl === void 0 ? BAKED_CANDIDATES.map((relative) => new URL(relative, import.meta.url)) : [bakedUrl];
-	for (const url of candidates) {
-		let requirement;
-		try {
-			requirement = read(url);
-		} catch {
-			continue;
-		}
-		const version = requirement?.interfaceVersion;
-		if (typeof version === "number" && Number.isInteger(version) && version > 0) return { interfaceVersion: version };
-	}
-}
-/**
-* Ask the loaded base whether it implements the interface generation this artifact was built for.
-*
-* @param module - the loaded base module (only `checkInterface` / `readInterfaceRequirement` are
-*   touched, each through a guarded read).
-* @param bakedUrl - test seam: the bake record to read; production leaves it undefined.
-* @returns a verdict that is never `incompatible` unless BOTH sides were readable and differ, and
-*   never a throw.
-*/
-function interfaceVerdict(module, bakedUrl) {
-	const check = member(module, "checkInterface");
-	const read = member(module, "readInterfaceRequirement");
-	if (typeof check !== "function" || typeof read !== "function") return cannotTell("the loaded base has no interface gate (checkInterface / readInterfaceRequirement missing) — it predates the runtime interface contract, so which generation it implements cannot be told");
-	const requirement = requirementOf(read, bakedUrl);
-	if (requirement === void 0) return cannotTell("this build has no baked interface requirement (lib/interface-version.json is missing or malformed), so the runtime interface gate cannot run");
-	let verdict;
-	try {
-		verdict = check(requirement.interfaceVersion, module);
-	} catch {
-		return cannotTell("the loaded base threw while judging the interface generation");
-	}
-	const status = verdict?.status;
-	if (status !== "ok" && status !== "incompatible" && status !== "cannot-tell") return cannotTell("the loaded base returned no usable interface verdict");
-	return verdict;
-}
-//#endregion
 //#region lib/types/envinit.js
 /**
 * Environment initialisation for the memory plugin, through the family base
@@ -17224,8 +17379,22 @@ function modelItem(framework, model) {
 		policy: { timeoutMs: MODEL_REQUEST_TIMEOUT_MS }
 	};
 }
-let loaded;
-let loading;
+/**
+* The plugin-specific halves of the shared loader's sentences: mem says the FRAMEWORK is skipped and
+* names the legacy provisioning path among the withheld capabilities. The mechanism is the shim's
+* (`interface_gate.ts`), the wording is this plugin's.
+*/
+const DEGRADE_WORDS = {
+	prefix: OWN_PREFIX,
+	loadFailure: "the framework is SKIPPED and the plugin will mount anyway",
+	withheld: "own prompt defaults, gate skipped, legacy provisioning"
+};
+/**
+* The loaded runtime, cached once per process through the shared cache discipline: a FAILED load is
+* NOT cached, so a profile reload retries instead of replaying the first failure for the whole
+* process lifetime.
+*/
+const cache = createLoadCache((options) => loadGuarded(options, loadOnce, options.log, DEGRADE_WORDS));
 /**
 * Ensure the framework, then the compatibility base, then dispatch the expensive resources.
 *
@@ -17235,32 +17404,11 @@ let loading;
 * base still returns a runtime, with `compat: undefined`: the mount must continue, and the resource
 * items are still worth dispatching.
 *
-* The result is cached per process; a FAILED load is not, so a profile reload retries instead of
-* replaying the first failure for the whole process lifetime.
-*
 * @param options - logger, family root, download policy and the test seams.
 * @returns the loaded runtime, or `undefined` when the framework itself is unavailable.
 */
-async function loadEnvinit(options = {}) {
-	if (loaded !== void 0) return loaded;
-	if (loading !== void 0) return loading;
-	loading = loadGuarded(options).then((runtime) => {
-		if (runtime === void 0) loading = void 0;
-		else loaded = runtime;
-		return runtime;
-	}, () => {
-		loading = void 0;
-	});
-	return loading;
-}
-/** The guard that makes "never throws" true: every failure is a warning plus `undefined`. */
-async function loadGuarded(options) {
-	try {
-		return await loadOnce(options);
-	} catch (error) {
-		warn(options.log, `${OWN_PREFIX} WARNING — environment initialisation failed (${reasonOf(error)}); the framework is SKIPPED and the plugin will mount anyway`);
-		return;
-	}
+function loadEnvinit(options = {}) {
+	return cache.load(options);
 }
 /** The body of {@link loadEnvinit}; the cache above makes it run at most once per process. */
 async function loadOnce(options) {
@@ -17280,14 +17428,7 @@ async function loadOnce(options) {
 		warn(options.log, `${OWN_PREFIX} WARNING — ${FRAMEWORK_PACKAGE} could not be made available; the plugin falls back to its own provisioning and mounts anyway`);
 		return;
 	}
-	{
-		const verdict = interfaceVerdict(framework);
-		if (!baseIsUsable(verdict)) {
-			warn(options.log, `${OWN_PREFIX} WARNING — interface: ${verdict.reason ?? "the loaded base implements another interface generation"}; the base's shared capabilities are NOT used (own prompt defaults, gate skipped, legacy provisioning) and the plugin mounts anyway`);
-			return;
-		}
-		if (verdict.status === "cannot-tell") warn(options.log, `${OWN_PREFIX} WARNING — interface: ${verdict.reason ?? "the interface generation cannot be told"}; using the loaded base anyway ("cannot tell" is never "incompatible")`);
-	}
+	if (!gateOrDegrade(framework, options.log, DEGRADE_WORDS)) return void 0;
 	const disposers = [];
 	let compat;
 	try {
@@ -17347,8 +17488,7 @@ async function loadOnce(options) {
 			for (const instance of disposers.splice(0)) try {
 				instance.dispose();
 			} catch {}
-			loaded = void 0;
-			loading = void 0;
+			cache.clear();
 		}
 	};
 }
@@ -17899,15 +18039,7 @@ const ENTITY_SWEEP_PER_HEARTBEAT = 2e3;
 /** Minimum spacing between corpus drift checks (`tools/result` fires for EVERY tool). */
 const RECONCILE_MIN_INTERVAL_MS = 2e3;
 async function runToolSpec(spec, rt, args) {
-	const parsed = spec.input.safeParse(args ?? {});
-	if (!parsed.success) return validationError(spec.name, parsed.error.issues);
-	if (!supportsToolKey(spec.key)) return toolErr(`unknown tool ${spec.key}`);
-	try {
-		const value = await dispatchToolKey(rt, spec.key, parsed.data);
-		return toolOk(modelFacingToolResult(spec.key, parsed.data.action, value));
-	} catch (error) {
-		return toolErr(error);
-	}
+	return await runToolSpec$1(rt, spec, args);
 }
 function present(spec, args) {
 	return {
@@ -18261,19 +18393,6 @@ function hostLogger(ctx) {
 	};
 }
 /**
-* Whether this plugin's fiber is still alive after the environment await.
-*
-* The environment gate can take the whole startup budget (15 s on a first run) and the framework may
-* even fetch the gate's base during it. A profile reload or unload landing inside that window clears
-* the fiber's uid, after which every Cordis call throws `INACTIVE_EFFECT` — the plugin would then
-* half-register (the Remote face cannot be rolled back) instead of stopping cleanly. An unknown
-* shape is "cannot tell", so only an explicitly cleared uid counts as disposed.
-*/
-function stillActive(ctx) {
-	const fiber = ctx.fiber;
-	return fiber === void 0 || fiber.uid !== null;
-}
-/**
 * Declare the expensive resources through the family framework, warm the tokenizer and the embedding
 * model, and continue initialisation as each item settles.
 *
@@ -18429,19 +18548,18 @@ async function apply(ctx, config) {
 	});
 	const heartbeatMinutes = rt.config.common.trust.presence.heartbeat_minutes;
 	if (heartbeatMinutes > 0) ctx.effect(() => {
-		const timer = setInterval(() => {
-			try {
-				rt.memory.trustTick();
-			} catch (error) {
-				logger.warn(`trust tick failed: ${error instanceof Error ? error.message : String(error)}`);
-			}
-			sweepEntities();
-			vectorMigration.start();
-		}, heartbeatMinutes * 6e4);
-		const unref = timer.unref;
-		if (typeof unref === "function") unref.call(timer);
+		const stop = installTrustHeartbeat({
+			memory: rt.memory,
+			logger,
+			heartbeatMinutes,
+			onBeat: () => {
+				sweepEntities();
+				vectorMigration.start();
+			},
+			tickFailed: (message) => `trust tick failed: ${message}`
+		});
 		logger.info(`trust heartbeat: every ${heartbeatMinutes}min (active-day clock + lifecycle sweep)`);
-		return () => clearInterval(timer);
+		return stop;
 	});
 	const promptDir = join(rt.config.home, "prompts");
 	const kit = env?.kit;

package/lib/interface-version.json

@@ -1,4 +1,4 @@
 {
-  "baseVersion": "0.4.0",
+  "baseVersion": "0.4.1",
   "interfaceVersion": 3
 }

package/lib/types/envinit-bootstrap.d.ts

@@ -3,7 +3,7 @@
  * @module bootstrap
  */
 /** The bootstrap version; the resolved framework must satisfy {@link supportedRange}. */
-export declare const VERSION = "0.4.0";
+export declare const VERSION = "0.4.1";
 /**
  * The framework interval this bootstrap can launch.
  *

package/lib/types/envinit.d.ts

@@ -123,9 +123,6 @@ interface EnvinitLoadOptions {
  * base still returns a runtime, with `compat: undefined`: the mount must continue, and the resource
  * items are still worth dispatching.
  *
- * The result is cached per process; a FAILED load is not, so a profile reload retries instead of
- * replaying the first failure for the whole process lifetime.
- *
  * @param options - logger, family root, download policy and the test seams.
  * @returns the loaded runtime, or `undefined` when the framework itself is unavailable.
  */

package/lib/types/envinit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"envinit.d.ts","sourceRoot":"","sources":["../../src/envinit.ts"],"names":[],"mappings":"AAoDA,OAAO,KAAK,EAAiB,oBAAoB,EAAe,MAAM,yBAAyB,CAAA;AAG/F,OAAO,EAKL,KAAK,YAAY,EACjB,KAAK,aAAa,EACnB,MAAM,gBAAgB,CAAA;AAKvB,4FAA4F;AAC5F,KAAK,aAAa,GAAG,cAAc,yBAAyB,CAAC,CAAA;AAK7D;;;GAGG;AACH,eAAO,MAAM,WAAW,eAAe,CAAA;AACvC,eAAO,MAAM,UAAU,cAAc,CAAA;AAmDrC,2EAA2E;AAC3E,UAAU,aAAa;IACrB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,8FAA8F;IAC9F,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1C;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAA;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EACV;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GACvF,SAAS,CAAA;CACd;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE;IACR,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,EACD,UAAU,EAAE,MAAM,GACjB,YAAY,CAAC,OAAO,CAAC,CAQvB;AAOD,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,aAAa,GAAG,SAAS,CAAA;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,CAAA;IAC1C,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACnE;;;;;;OAMG;IACH,kBAAkB,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,IAAI,GAAG,IAAI,CAAA;IAC9F,wEAAwE;IACxE,OAAO,IAAI,IAAI,CAAA;CAChB;AAED,uCAAuC;AACvC,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,aAAa,CAAA;IAC5B,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,mHAAmH;IACnH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,yFAAyF;IACzF,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAA;IAClC,0FAA0F;IAC1F,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAA;CACrC;AA6HD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,WAAW,CAAC,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAkBvG"}
+{"version":3,"file":"envinit.d.ts","sourceRoot":"","sources":["../../src/envinit.ts"],"names":[],"mappings":"AAoDA,OAAO,KAAK,EAAiB,oBAAoB,EAAe,MAAM,yBAAyB,CAAA;AAG/F,OAAO,EAKL,KAAK,YAAY,EACjB,KAAK,aAAa,EACnB,MAAM,gBAAgB,CAAA;AAKvB,4FAA4F;AAC5F,KAAK,aAAa,GAAG,cAAc,yBAAyB,CAAC,CAAA;AAK7D;;;GAGG;AACH,eAAO,MAAM,WAAW,eAAe,CAAA;AACvC,eAAO,MAAM,UAAU,cAAc,CAAA;AAmDrC,2EAA2E;AAC3E,UAAU,aAAa;IACrB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,8FAA8F;IAC9F,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1C;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAA;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EACV;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GACvF,SAAS,CAAA;CACd;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE;IACR,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB,EACD,UAAU,EAAE,MAAM,GACjB,YAAY,CAAC,OAAO,CAAC,CAQvB;AAOD,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,aAAa,GAAG,SAAS,CAAA;IACvC,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,CAAA;IAC1C,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACnE;;;;;;OAMG;IACH,kBAAkB,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,IAAI,GAAG,IAAI,CAAA;IAC9F,wEAAwE;IACxE,OAAO,IAAI,IAAI,CAAA;CAChB;AAED,uCAAuC;AACvC,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,aAAa,CAAA;IAC5B,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,mHAAmH;IACnH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,yFAAyF;IACzF,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAA;IAClC,0FAA0F;IAC1F,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAA;CACrC;AA8ID;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAEjG"}

package/lib/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAQlD,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAExC,OAAO,EAAE,mBAAmB,EAAU,MAAM,kCAAkC,CAAA;AAE9E,OAAO,EAQL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,WAAW,EAEhB,KAAK,WAAW,EACjB,MAAM,aAAa,CAAA;AACpB,OAAO,EAeL,KAAK,aAAa,EAClB,KAAK,WAAW,EAEhB,KAAK,YAAY,EACjB,KAAK,cAAc,EAEnB,KAAK,oBAAoB,EAG1B,MAAM,sBAAsB,CAAA;AAqB7B,eAAO,MAAM,IAAI,eAAe,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAGpC,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAQ7E,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,WAAW,GACjB,MAAM,aAAa,CAAA;AAEpB,MAAM,WAAW,MAAM;IACrB,IAAI,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AACD,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAO3B,CAAA;AA6CF,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAOvC;;;;;;;;;;GAUG;AACH,qBAAa,gBAAiB,SAAQ,mBAAmB;IACvD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAe;gBACtB,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa;IAK3C;;;;;;;;;OASG;YACW,IAAI;IAclB;;;;OAIG;IAEH,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;IAMlF,MAAM,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;IAMnF,KAAK,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAKhF;;;;;OAKG;IAEH,EAAE,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAOpD,KAAK,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IAI5D;;;;OAIG;IAEG,cAAc,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC;IAUnF,qFAAqF;IAE/E,SAAS,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;IAUvE;;;;OAIG;IAEG,SAAS,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;IAQvG;;;;OAIG;IAEG,WAAW,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC;IAUpG;;;;;OAKG;IAEG,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;CAiBpE;AAiID,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwYvE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AASlD,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAExC,OAAO,EAAE,mBAAmB,EAAU,MAAM,kCAAkC,CAAA;AAE9E,OAAO,EASL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,WAAW,EAEhB,KAAK,WAAW,EACjB,MAAM,aAAa,CAAA;AACpB,OAAO,EAaL,KAAK,aAAa,EAClB,KAAK,WAAW,EAEhB,KAAK,YAAY,EACjB,KAAK,cAAc,EAEnB,KAAK,oBAAoB,EAG1B,MAAM,sBAAsB,CAAA;AAqB7B,eAAO,MAAM,IAAI,eAAe,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAGpC,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAQ7E,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,WAAW,GACjB,MAAM,aAAa,CAAA;AAEpB,MAAM,WAAW,MAAM;IACrB,IAAI,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AACD,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAO3B,CAAA;AAkCF,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAOvC;;;;;;;;;;GAUG;AACH,qBAAa,gBAAiB,SAAQ,mBAAmB;IACvD,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAe;gBACtB,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa;IAK3C;;;;;;;;;OASG;YACW,IAAI;IAclB;;;;OAIG;IAEH,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;IAMlF,MAAM,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;IAMnF,KAAK,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAKhF;;;;;OAKG;IAEH,EAAE,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAOpD,KAAK,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IAI5D;;;;OAIG;IAEG,cAAc,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC;IAUnF,qFAAqF;IAE/E,SAAS,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;IAUvE;;;;OAIG;IAEG,SAAS,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;IAQvG;;;;OAIG;IAEG,WAAW,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC;IAUpG;;;;;OAKG;IAEG,OAAO,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;CAiBpE;AAmHD,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyYvE"}

package/lib/types/interface_gate.d.ts

@@ -20,6 +20,13 @@
  * `envinit.ts`, never here. `base/plugin-base/test/interface_consumers.spec.ts` pins the two copies
  * against each other, so a divergence is a red test instead of two shims that drifted.
  *
+ * The loader SKELETON the two startups share lives here too: the once-per-process cache
+ * ({@link createLoadCache}), the guard that turns any throw into one warning
+ * ({@link loadGuarded}), and the gate→decision step ({@link gateOrDegrade}). Those sentences are
+ * observably NOT the same in the two plugins, so every shared function takes them as
+ * {@link DegradeWords}: the shim owns the mechanism, the caller owns the wording, and the two trees'
+ * `envinit.spec.ts` pin each plugin's own text verbatim.
+ *
  * @module @avantf/dsh-mem/interface_gate
  */
 import type { InterfaceVerdict } from '@avantf/dsh-plugin-base';
@@ -48,4 +55,67 @@ export declare function baseIsUsable(verdict: InterfaceVerdict): boolean;
  *   never a throw.
  */
 export declare function interfaceVerdict(module: unknown, bakedUrl?: URL | string): InterfaceVerdict;
+/** The logging surface the shared loader helpers need; both plugins' loggers satisfy it. */
+export interface GateLogger {
+    warn(message: string): void;
+}
+/**
+ * The two sentences the shared loader may NOT own, because the plugins word them differently: mem
+ * says the FRAMEWORK is skipped and names legacy provisioning among the withheld capabilities,
+ * mission says the COMPATIBILITY GATE is skipped and names none. Neither is drift — both are read by
+ * an operator — so the caller passes them in and the shared code interpolates them verbatim.
+ */
+export interface DegradeWords {
+    /** This module's warning token, so one grep finds every startup line: `envinit:` / `compat:`. */
+    readonly prefix: string;
+    /** The tail after "environment initialisation failed (...); " in the guarded-load failure line. */
+    readonly loadFailure: string;
+    /** The parenthetical after "the base's shared capabilities are NOT used (" in the incompatible line. */
+    readonly withheld: string;
+}
+/**
+ * Run the runtime interface gate and answer whether the loaded base's shared capabilities may be
+ * used.
+ *
+ * `false` is a DEGRADATION the caller answers by taking its own full-degradation route (no runtime,
+ * own prompt defaults, the compatibility gate skipped, legacy provisioning) — never a refused mount,
+ * and never a throw. `cannot-tell` warns and answers `true`: "cannot tell" is not a negative answer,
+ * so the base is used normally. The verdict's own reason is the base's; only the surrounding sentence
+ * is the caller's ({@link DegradeWords}).
+ */
+export declare function gateOrDegrade(module: unknown, log: GateLogger | undefined, words: DegradeWords): boolean;
+/**
+ * The guard that makes a loader's "never throws" true: every failure is one warning plus
+ * `undefined`. The caller owns the sentence's tail (`words`) and its own cache discipline — a
+ * FAILED load is not cached, so this must return `undefined` rather than reject (see
+ * {@link createLoadCache}).
+ */
+export declare function loadGuarded<O, T>(options: O, loadOnce: (options: O) => Promise<T | undefined>, log: GateLogger | undefined, words: DegradeWords): Promise<T | undefined>;
+/** The per-process result of a guarded load: `load` is idempotent, `clear` is for disposal. */
+export interface LoadCache<O, T> {
+    load(options: O): Promise<T | undefined>;
+    /** Drop the result and the in-flight promise, so the next `load` runs again (unmount/reload). */
+    clear(): void;
+}
+/**
+ * Wrap a guarded loader in the cache discipline both startups share: the first call runs it, every
+ * later and concurrent call shares its result, and a FAILED load is NOT cached. A failure is "cannot
+ * tell", not a verdict — and it may be transient (offline at boot, a half-written install) — so a
+ * profile reload, or a second instance in the same process, retries instead of replaying the first
+ * failure for the whole process lifetime.
+ */
+export declare function createLoadCache<O, T>(guarded: (options: O) => Promise<T | undefined>): LoadCache<O, T>;
+/**
+ * Whether a Cordis context is still alive.
+ *
+ * Cordis clears `fiber.uid` on disposal, and every later context call then throws
+ * `INACTIVE_EFFECT`. `apply` awaits environment preparation, so a profile reload or unload can land
+ * inside that window and half-register a plugin (the Remote face cannot be rolled back). A fiberless
+ * stub counts as active: an unknown shape is "cannot tell", never "disposed".
+ *
+ * Generic Cordis liveness rather than interface-gate knowledge — but the two plugins' startup paths
+ * share it byte-for-byte, so it lives with their one shared shim, where the two readings of "is my
+ * context alive" cannot drift.
+ */
+export declare function stillActive(ctx: unknown): boolean;
 //# sourceMappingURL=interface_gate.d.ts.map

package/lib/types/interface_gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interface_gate.d.ts","sourceRoot":"","sources":["../../src/interface_gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAE/D,mGAAmG;AACnG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;IACpC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAA;CAC5C;AAkBD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAE/D;AA8BD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,GAAG,GAAG,MAAM,GAAG,gBAAgB,CAuB3F"}
+{"version":3,"file":"interface_gate.d.ts","sourceRoot":"","sources":["../../src/interface_gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAE/D,mGAAmG;AACnG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;IACpC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAA;CAC5C;AAkBD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAE/D;AA8BD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,GAAG,GAAG,MAAM,GAAG,gBAAgB,CAuB3F;AAED,4FAA4F;AAC5F,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B;AAeD;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,iGAAiG;IACjG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,mGAAmG;IACnG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,wGAAwG;IACxG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,GAAG,SAAS,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAiBxG;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,CAAC,EAAE,CAAC,EACpC,OAAO,EAAE,CAAC,EACV,QAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,EAChD,GAAG,EAAE,UAAU,GAAG,SAAS,EAC3B,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAUxB;AAED,+FAA+F;AAC/F,MAAM,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAA;IACxC,iGAAiG;IACjG,KAAK,IAAI,IAAI,CAAA;CACd;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAyBtG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAGjD"}

package/lib/types/provision.d.ts

@@ -84,6 +84,12 @@ export declare function runtimeFromCompat(module: CompatModule): CompatRuntime;
  * Run the gate. Call this FIRST in `apply()`: on a refusal nothing has been registered yet, so
  * "do not load" costs nothing to unwind. Never throws — not even with a throwing logger, because
  * "cannot tell" is not "incompatible".
+ *
+ * The check itself is the BASE's `provision` (gather + verdict + logging, one call). The local
+ * fallback stays on purpose (option A): the interface-generation axis cannot gate this dependency
+ * (same-generation bases never read as `incompatible`), and raising the peer floor would degrade
+ * every host on a base that predates the fix — so a `provision` that cannot be performed still
+ * leaves the plugin loading.
  * @param ctx - the plugin's context.
  * @param log - the plugin's logger.
  * @param compat - the loaded gate runtime (see `src/envinit.ts`).

package/lib/types/provision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provision.d.ts","sourceRoot":"","sources":["../../src/provision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EACd,YAAY,EACZ,UAAU,EACV,aAAa,EACb,eAAe,EAChB,MAAM,yBAAyB,CAAA;AAIhC,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,CAAA;AAE7C,wEAAwE;AACxE,MAAM,MAAM,YAAY,GAAG,cAAc,yBAAyB,CAAC,CAAA;AAEnE,mFAAmF;AACnF,eAAO,MAAM,cAAc,4BAA4B,CAAA;AAEvD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,eAAe,EAMvD,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAA6C,CAAA;AAE1F,uFAAuF;AACvF,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAAmE,CAAA;AAKjH,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;IAC7B,wCAAwC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,+FAA+F;IAC/F,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AAED,0BAA0B;AAC1B,UAAU,SAAS;IACjB,kGAAkG;IAClG,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAChC;AAED,sDAAsD;AACtD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE/C;AAED,2EAA2E;AAC3E,wBAAgB,IAAI,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAMzE;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,GAAG,aAAa,CAyBrE;AAoBD;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE,aAAa,EACrB,IAAI,GAAE,UAAwB,GAC7B,SAAS,CAqBX;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE,aAAa,GACpB,IAAI,CAaN;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAC/B,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAQ1C"}
+{"version":3,"file":"provision.d.ts","sourceRoot":"","sources":["../../src/provision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EACd,YAAY,EACZ,UAAU,EACV,aAAa,EACb,eAAe,EAChB,MAAM,yBAAyB,CAAA;AAIhC,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,CAAA;AAE7C,wEAAwE;AACxE,MAAM,MAAM,YAAY,GAAG,cAAc,yBAAyB,CAAC,CAAA;AAEnE,mFAAmF;AACnF,eAAO,MAAM,cAAc,4BAA4B,CAAA;AAEvD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,eAAe,EAMvD,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAA6C,CAAA;AAE1F,uFAAuF;AACvF,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAAmE,CAAA;AAKjH,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;IAC7B,wCAAwC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,+FAA+F;IAC/F,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AAED,0BAA0B;AAC1B,UAAU,SAAS;IACjB,kGAAkG;IAClG,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAChC;AAED,sDAAsD;AACtD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE/C;AAED,2EAA2E;AAC3E,wBAAgB,IAAI,CAAC,GAAG,EAAE,YAAY,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAMzE;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,GAAG,aAAa,CAyBrE;AAoBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE,aAAa,EACrB,IAAI,GAAE,UAAwB,GAC7B,SAAS,CAMX;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,aAAa,EACtB,GAAG,EAAE,YAAY,EACjB,MAAM,EAAE,aAAa,GACpB,IAAI,CAaN;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAC/B,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAQ1C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avantf/dsh-mem",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "avantf-mem DSH native Cordis plugin: host service + tools + RPC + client tabs 记忆/知识",
   "type": "module",
   "main": "lib/index.js",
@@ -78,10 +78,10 @@
   },
   "devDependencies": {
     "@avantf/dsh-plugin-base": ">=0.3.0 <1.0.0",
-    "@avantf/mem": "0.6.1",
-    "@avantf/mem-contract": "0.6.1",
-    "@avantf/mem-convert": "0.6.1",
-    "@avantf/mem-provision": "0.6.1",
+    "@avantf/mem": "0.6.2",
+    "@avantf/mem-contract": "0.6.2",
+    "@avantf/mem-convert": "0.6.2",
+    "@avantf/mem-provision": "0.6.2",
     "@types/node": "^22.0.0",
     "@types/react": "^18.3.0",
     "lightningcss": "^1.32.0",