@deepseek-harness-tui/dsh-tui 0.10.0 → 0.10.2

package/lib/types/dsh-adapter/decision-guard.d.ts

@@ -8,10 +8,11 @@
  * and `tui/compact` are NOT free-for-all `ctx.on` targets: the subscribing
  * plugin (identified by its verified Component identity) must hold the
  * matching `domain.resource.intercept` grant. Grant answers
- * come from the unified 8-permission GrantStore in ./grants.js (registry-
- * driven defaults, `grants`/`denies` sections, corrupt fail-closed) — this
- * module is only the subscribe-time CHECKPOINT: which event needs which
- * permission, and the cordis bail hook that enforces it.
+ * come from the unified 8-permission GrantStore in
+ * `../adapter/standard/grants.js` (registry-driven defaults,
+ * `grants`/`denies` sections, corrupt fail-closed) — this module is only the
+ * subscribe-time CHECKPOINT: which event needs which permission, and the
+ * cordis bail hook that enforces it.
  *
  * A denied subscription never enters the dispatch chain — it is "as if
  * unregistered" (D-7) and the caller gets a no-op disposer plus a logger
@@ -27,18 +28,23 @@
  * the whole hook — no patching of the events service.
  */
 import type { Context } from '@deepseek-ai/cordis';
-import { EXTENSION_GRANTS_FILE, type GrantStore } from './grants.js';
+import { EXTENSION_GRANTS_FILE, type GrantStore } from '../adapter/standard/grants.js';
 import { type VerifiedComponentIdentity } from './component-identity.js';
-/** The intercept permission each decision event requires (D-7 naming:
- *  `domain.resource.intercept`). Observe-class events (tui/rewind-done,
- *  tui/session-switched) are deliberately absent. */
-export declare const DECISION_EVENT_PERMISSIONS: Readonly<Record<string, string>>;
+import { DECISION_EVENT_PERMISSIONS } from '../adapter/spec/protocol-constants.js';
+import { type AdapterRuntimeOptions } from '../adapter/kernel/runtime.js';
+/** The intercept permission each decision event requires. The map is
+ * derived in src/adapter/spec/protocol-constants.ts and re-exported here for
+ * compatibility; product code must not declare a second copy. */
+export { DECISION_EVENT_PERMISSIONS };
 export { EXTENSION_GRANTS_FILE };
-/** @deprecated Use GrantStore from ./grants.js (same shape, plus more). */
+/** @deprecated Use GrantStore from `../adapter/standard/grants.js` (same shape, plus more).
+ * Long-term compatibility alias; owner: dsh-tui adapter. */
 export type ExtensionGrants = GrantStore;
-/** @deprecated Use parseGrantStore from ./grants.js. */
+/** @deprecated Use parseGrantStore from `../adapter/standard/grants.js`.
+ * Long-term compatibility alias; owner: dsh-tui adapter. */
 export declare const parseExtensionGrants: (text: string) => GrantStore;
-/** @deprecated Use readGrantStore from ./grants.js. */
+/** @deprecated Use readGrantStore from `../adapter/standard/grants.js`.
+ * Long-term compatibility alias; owner: dsh-tui adapter. */
 export declare const readExtensionGrants: (dir?: string) => GrantStore;
 export interface DecisionHandlerMetadata {
     componentId: string;
@@ -69,6 +75,7 @@ export interface RegisteredDecisionHandler {
     readonly listener: (payload: Record<string, unknown>) => unknown;
 }
 export interface DecisionRegistry {
+    runtime: AdapterRuntimeOptions;
     grants: GrantStore;
     handlers: Map<string, Map<string, RegisteredDecisionHandler>>;
 }
@@ -80,5 +87,42 @@ export declare function registerDecisionHandler(pluginCtx: Context, identity: Ve
 /** Execute ctx.on for one host-mediated decision registration. */
 export declare function withDecisionRegistration<T>(ctx: Context, callback: () => T): T;
 export declare function decisionHandlerMetadataOf(listener: Function): DecisionHandlerMetadata | undefined;
+/** Return the event names for which a real dispatch topology is recorded in
+ * this composition. Empty means only a guard (or nothing) is mounted. */
+export declare function decisionDispatchEventNames(ctx: Context): readonly string[];
+/** True when this composition has at least one real DecisionEvents dispatch
+ * source (today: the live channel). Used by host descriptor/admission views. */
+export declare function hasDecisionDispatchTopology(ctx: Context): boolean;
+/**
+ * Record that this composition contains a real DecisionEvents dispatch
+ * source for the supplied event names. Called by the channel after it mounts
+ * the dispatch path; never called by guard installation alone.
+ *
+ * Returns a disposer that decrements this source's contribution. Multiple
+ * dispatch sources in the same composition are reference-counted per event,
+ * so unloading one channel does not erase another live channel's topology.
+ *
+ * Lifecycle assumption: in the current TUI the channel is mounted by a
+ * Cordis plugin/context and `createChannel()` registers this disposer in that
+ * context's effect cleanup, so unloading the owning context unmarks the
+ * topology. If an embedder intentionally treats the channel as a
+ * process-level singleton and never disposes the owning context, the marker
+ * persists for the process lifetime — matching the singleton assumption and
+ * not leaking across unloaded channels. Tests can always call the disposer or
+ * `unmarkDecisionDispatchTopology()` explicitly to prove post-unload
+ * behavior.
+ */
+export declare function markDecisionDispatchTopology(ctx: Context, events?: readonly string[]): () => void;
+/**
+ * Remove this composition's DecisionEvents dispatch topology registration for
+ * the supplied events (defaults to all known events). Also available as the
+ * disposer returned by `markDecisionDispatchTopology()`; `createChannel()`
+ * calls it when the channel's Cordis effect/context is unloaded.
+ */
+export declare function unmarkDecisionDispatchTopology(ctx: Context, events?: readonly string[]): void;
+/** Read-only DecisionEvents feature probe: reports only event names that have
+ * BOTH a guard and a real channel/dispatch topology in this composition. It
+ * creates no subscription and is used by the live-driver evidence path. */
+export declare function probeDecisionEventFeatures(ctx: Context): readonly string[];
 export declare function installDecisionGuard(ctx: Context, grants: GrantStore): void;
 //# sourceMappingURL=decision-guard.d.ts.map

package/lib/types/dsh-adapter/decision-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decision-guard.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/decision-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EACL,qBAAqB,EAGrB,KAAK,UAAU,EAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,yBAAyB,CAAA;AAShC;;qDAEqD;AACrD,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAKtE,CAAA;AAMF,OAAO,EAAE,qBAAqB,EAAE,CAAA;AAEhC,2EAA2E;AAC3E,MAAM,MAAM,eAAe,GAAG,UAAU,CAAA;AAExC,wDAAwD;AACxD,eAAO,MAAM,oBAAoB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,UAA4B,CAAA;AAEjF,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,UAA2B,CAAA;AAgB/E,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACd;AAGD;;;cAGc;AACd,MAAM,WAAW,2BAA2B;IAC1C;kFAC8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;sEACkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAA;IAC5C,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAA;CACjE;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,UAAU,CAAA;IAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAA;CAC9D;AAoBD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAEjE;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,GACpB,SAAS,yBAAyB,EAAE,CA6BtC;AAsCD,2DAA2D;AAC3D,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,OAAO,EAClB,QAAQ,EAAE,yBAAyB,EACnC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,EACvD,OAAO,GAAE,2BAAgC,EACzC,SAAS,CAAC,EAAE,MAAM,IAAI,GACrB,MAAM,OAAO,CA8Ff;AAkBD,kEAAkE;AAClE,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAI9E;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,GAAG,uBAAuB,GAAG,SAAS,CAEjG;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA+D3E"}
+{"version":3,"file":"decision-guard.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/decision-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EACL,qBAAqB,EAGrB,KAAK,UAAU,EAChB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,yBAAyB,CAAA;AAOhC,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAA;AAGlF,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,8BAA8B,CAAA;AAErC;;iEAEiE;AACjE,OAAO,EAAE,0BAA0B,EAAE,CAAA;AAQrC,OAAO,EAAE,qBAAqB,EAAE,CAAA;AAEhC;4DAC4D;AAC5D,MAAM,MAAM,eAAe,GAAG,UAAU,CAAA;AAExC;4DAC4D;AAC5D,eAAO,MAAM,oBAAoB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,UAA4B,CAAA;AAEjF;4DAC4D;AAC5D,eAAO,MAAM,mBAAmB,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,UAA2B,CAAA;AA4B/E,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;CACd;AAGD;;;cAGc;AACd,MAAM,WAAW,2BAA2B;IAC1C;kFAC8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;sEACkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,CAAA;IAC5C,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAA;CACjE;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,qBAAqB,CAAA;IAC9B,MAAM,EAAE,UAAU,CAAA;IAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC,CAAA;CAC9D;AAqBD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAEjE;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,MAAM,GACpB,SAAS,yBAAyB,EAAE,CA6BtC;AAsCD,2DAA2D;AAC3D,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,OAAO,EAClB,QAAQ,EAAE,yBAAyB,EACnC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,EACvD,OAAO,GAAE,2BAAgC,EACzC,SAAS,CAAC,EAAE,MAAM,IAAI,GACrB,MAAM,OAAO,CAgGf;AAkBD,kEAAkE;AAClE,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAI9E;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,GAAG,uBAAuB,GAAG,SAAS,CAEjG;AAED;yEACyE;AACzE,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,CAQ1E;AAED;gFACgF;AAChF,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEjE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,OAAO,EACZ,MAAM,GAAE,SAAS,MAAM,EAA6B,GACnD,MAAM,IAAI,CAqBZ;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,OAAO,EACZ,MAAM,GAAE,SAAS,MAAM,EAA6B,GACnD,IAAI,CAaN;AAED;;2EAE2E;AAC3E,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,CAI1E;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CA+D3E"}

package/lib/types/dsh-adapter/decision-guard.js

@@ -8,10 +8,11 @@
  * and `tui/compact` are NOT free-for-all `ctx.on` targets: the subscribing
  * plugin (identified by its verified Component identity) must hold the
  * matching `domain.resource.intercept` grant. Grant answers
- * come from the unified 8-permission GrantStore in ./grants.js (registry-
- * driven defaults, `grants`/`denies` sections, corrupt fail-closed) — this
- * module is only the subscribe-time CHECKPOINT: which event needs which
- * permission, and the cordis bail hook that enforces it.
+ * come from the unified 8-permission GrantStore in
+ * `../adapter/standard/grants.js` (registry-driven defaults,
+ * `grants`/`denies` sections, corrupt fail-closed) — this module is only the
+ * subscribe-time CHECKPOINT: which event needs which permission, and the
+ * cordis bail hook that enforces it.
  *
  * A denied subscription never enters the dispatch chain — it is "as if
  * unregistered" (D-7) and the caller gets a no-op disposer plus a logger
@@ -26,28 +27,29 @@
  * result skips the registration and becomes the caller's disposer. That is
  * the whole hook — no patching of the events service.
  */
-import { EXTENSION_GRANTS_FILE, parseGrantStore, readGrantStore, } from './grants.js';
+import { EXTENSION_GRANTS_FILE, parseGrantStore, readGrantStore, } from '../adapter/standard/grants.js';
 import { componentIdentityOf, requiresDecisionEvents, } from './component-identity.js';
-import { INTERCEPT_EVENT_SCOPE_BY_PERMISSION, normalizePermissionScope, permissionScopeCovers, } from '../plugin-spec/permission-scope.js';
-import { TUI_DECISION_EVENT_NAMES } from '../plugin-spec/tui-extension.js';
+import { INTERCEPT_EVENT_SCOPE_BY_PERMISSION, normalizePermissionScope, permissionScopeCovers, } from '../adapter/standard/permission-scope.js';
+import { TUI_DECISION_EVENT_NAMES } from '../adapter/standard/tui-extension.js';
+import { DECISION_EVENT_PERMISSIONS } from '../adapter/spec/protocol-constants.js';
 import { bindCallerEffect, compositionRoot } from './host-access.js';
-/** The intercept permission each decision event requires (D-7 naming:
- *  `domain.resource.intercept`). Observe-class events (tui/rewind-done,
- *  tui/session-switched) are deliberately absent. */
-export const DECISION_EVENT_PERMISSIONS = Object.freeze({
-    'tui/input': 'session.input.intercept',
-    'tui/rewind-prompt': 'session.rewind.intercept',
-    'tui/session-switch': 'session.switch.intercept',
-    'tui/compact': 'session.compact.intercept',
-});
+import { adapterRuntimeFor } from '../adapter/kernel/runtime-context.js';
+import { assertCapabilityShadowPolicy, } from '../adapter/kernel/runtime.js';
+/** The intercept permission each decision event requires. The map is
+ * derived in src/adapter/spec/protocol-constants.ts and re-exported here for
+ * compatibility; product code must not declare a second copy. */
+export { DECISION_EVENT_PERMISSIONS };
 // ── Compatibility aliases (pre-GrantStore names) ────────────────────────────
-// The grant-file format and these entry points predate the unified store;
-// keep them working — verify batteries and any embedder code import them
-// from this module.
+// These aliases are intentionally outside the P6 removal scope: they are a
+// long-term compatibility surface for existing embedder/test code. They map
+// directly to the canonical `../adapter/standard/grants.js` implementation.
+// OWNER: dsh-tui adapter. UNTIL: no scheduled removal.
 export { EXTENSION_GRANTS_FILE };
-/** @deprecated Use parseGrantStore from ./grants.js. */
+/** @deprecated Use parseGrantStore from `../adapter/standard/grants.js`.
+ * Long-term compatibility alias; owner: dsh-tui adapter. */
 export const parseExtensionGrants = parseGrantStore;
-/** @deprecated Use readGrantStore from ./grants.js. */
+/** @deprecated Use readGrantStore from `../adapter/standard/grants.js`.
+ * Long-term compatibility alias; owner: dsh-tui adapter. */
 export const readExtensionGrants = readGrantStore;
 /**
  * Install the D-7 gate: every subscription to a decision event is checked
@@ -63,6 +65,18 @@ export const readExtensionGrants = readGrantStore;
  * lands first is unobservable.
  */
 const guardedRoots = new WeakSet();
+/**
+ * Real DecisionEvents dispatch topology, keyed by Cordis composition root.
+ *
+ * The guard alone is NOT evidence that an event is actually dispatched:
+ * `installDecisionGuard()` only installs the subscribe-time gate. The actual
+ * dispatch paths live in the channel (`createChannel`), which calls
+ * `markDecisionDispatchTopology()` after it is composed. Until that marker is
+ * present, `probeDecisionEventFeatures()` returns no features — the public
+ * Host Descriptor must not publish DecisionEvents from a composition that only
+ * has a guard and no real channel/dispatch source.
+ */
+const decisionDispatchTopology = new WeakMap();
 const handlerMetadata = new WeakMap();
 const registries = new WeakMap();
 function rootKey(ctx) {
@@ -70,9 +84,10 @@ function rootKey(ctx) {
 }
 function registryFor(ctx, grants) {
     const key = rootKey(ctx);
+    const runtime = adapterRuntimeFor(ctx);
     let registry = registries.get(key);
     if (registry === undefined) {
-        registry = { grants: grants ?? readGrantStore(), handlers: new Map() };
+        registry = { grants: grants ?? readGrantStore(undefined, undefined, runtime), handlers: new Map(), runtime };
         registries.set(key, registry);
     }
     else if (grants !== undefined) {
@@ -153,6 +168,8 @@ function defaultDecisionScope(identity, event) {
 }
 /** Host-only registration used by TuiPluginHostRuntime. */
 export function registerDecisionHandler(pluginCtx, identity, event, listener, options = {}, onRelease) {
+    const runtime = registryFor(pluginCtx).runtime;
+    assertCapabilityShadowPolicy('host.decision.subscribe', runtime.mode, runtime.slices);
     if (componentIdentityOf(pluginCtx) !== identity) {
         throw new Error('DecisionEvents registration identity is not bound to the calling activation');
     }
@@ -284,6 +301,101 @@ export function withDecisionRegistration(ctx, callback) {
 export function decisionHandlerMetadataOf(listener) {
     return handlerMetadata.get(listener);
 }
+/** Return the event names for which a real dispatch topology is recorded in
+ * this composition. Empty means only a guard (or nothing) is mounted. */
+export function decisionDispatchEventNames(ctx) {
+    const root = compositionRoot(ctx);
+    const counts = typeof root === 'object' && root !== null
+        ? decisionDispatchTopology.get(root)
+        : undefined;
+    return counts === undefined
+        ? Object.freeze([])
+        : Object.freeze([...counts.keys()].sort());
+}
+/** True when this composition has at least one real DecisionEvents dispatch
+ * source (today: the live channel). Used by host descriptor/admission views. */
+export function hasDecisionDispatchTopology(ctx) {
+    return decisionDispatchEventNames(ctx).length > 0;
+}
+/**
+ * Record that this composition contains a real DecisionEvents dispatch
+ * source for the supplied event names. Called by the channel after it mounts
+ * the dispatch path; never called by guard installation alone.
+ *
+ * Returns a disposer that decrements this source's contribution. Multiple
+ * dispatch sources in the same composition are reference-counted per event,
+ * so unloading one channel does not erase another live channel's topology.
+ *
+ * Lifecycle assumption: in the current TUI the channel is mounted by a
+ * Cordis plugin/context and `createChannel()` registers this disposer in that
+ * context's effect cleanup, so unloading the owning context unmarks the
+ * topology. If an embedder intentionally treats the channel as a
+ * process-level singleton and never disposes the owning context, the marker
+ * persists for the process lifetime — matching the singleton assumption and
+ * not leaking across unloaded channels. Tests can always call the disposer or
+ * `unmarkDecisionDispatchTopology()` explicitly to prove post-unload
+ * behavior.
+ */
+export function markDecisionDispatchTopology(ctx, events = TUI_DECISION_EVENT_NAMES) {
+    const root = compositionRoot(ctx);
+    if (typeof root !== 'object' || root === null)
+        return () => undefined;
+    const known = new Set(TUI_DECISION_EVENT_NAMES);
+    const added = [];
+    let counts = decisionDispatchTopology.get(root);
+    if (counts === undefined) {
+        counts = new Map();
+        decisionDispatchTopology.set(root, counts);
+    }
+    for (const event of events) {
+        if (!known.has(event))
+            continue;
+        counts.set(event, (counts.get(event) ?? 0) + 1);
+        added.push(event);
+    }
+    let disposed = false;
+    return () => {
+        if (disposed)
+            return;
+        disposed = true;
+        unmarkDecisionDispatchTopology(ctx, added);
+    };
+}
+/**
+ * Remove this composition's DecisionEvents dispatch topology registration for
+ * the supplied events (defaults to all known events). Also available as the
+ * disposer returned by `markDecisionDispatchTopology()`; `createChannel()`
+ * calls it when the channel's Cordis effect/context is unloaded.
+ */
+export function unmarkDecisionDispatchTopology(ctx, events = TUI_DECISION_EVENT_NAMES) {
+    const root = compositionRoot(ctx);
+    if (typeof root !== 'object' || root === null)
+        return;
+    const counts = decisionDispatchTopology.get(root);
+    if (counts === undefined)
+        return;
+    const known = new Set(TUI_DECISION_EVENT_NAMES);
+    for (const event of events) {
+        if (!known.has(event))
+            continue;
+        const remaining = (counts.get(event) ?? 0) - 1;
+        if (remaining > 0)
+            counts.set(event, remaining);
+        else
+            counts.delete(event);
+    }
+    if (counts.size === 0)
+        decisionDispatchTopology.delete(root);
+}
+/** Read-only DecisionEvents feature probe: reports only event names that have
+ * BOTH a guard and a real channel/dispatch topology in this composition. It
+ * creates no subscription and is used by the live-driver evidence path. */
+export function probeDecisionEventFeatures(ctx) {
+    const root = compositionRoot(ctx);
+    if (typeof root !== 'object' || root === null || !guardedRoots.has(root))
+        return Object.freeze([]);
+    return decisionDispatchEventNames(ctx);
+}
 export function installDecisionGuard(ctx, grants) {
     // Degraded/fake contexts (minimal embedders, test harnesses) may lack
     // `root` or `on` entirely — the gate is best-effort there, matching the

package/lib/types/dsh-adapter/dialogs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dialogs.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/dialogs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAItD,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,8DAA8D;AAC9D,MAAM,MAAM,iBAAiB,GACzB;IACE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAA;CACnD,GACD;IACE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B,GACD;IACE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB,CAAA;AAEL,8BAA8B;AAC9B,MAAM,WAAW,aAAa;IAC5B,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAA;IACb,+DAA+D;IAC/D,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB;wDACoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,sBAAuB,SAAQ,aAAa;IAC3D,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAA;CAC1C;AAED,MAAM,WAAW,uBAAwB,SAAQ,aAAa;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;sDACsD;AACtD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAA;AAc1D;yEACyE;AACzE,KAAK,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,OAAO,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,KAAK,CAAA;AAW/D;;sBAEsB;AACtB,eAAO,MAAM,WAAW,MAAM,CAAA;AAE9B,0DAA0D;AAC1D,eAAO,MAAM,yBAAyB,QAAS,CAAA;AAI/C;;;GAGG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,MAAM,CAA6B;IAE3C,uEAAuE;IACvE,GAAG,CACD,QAAQ,EAAE,UAAU,CAAC,iBAAiB,CAAC,EACvC,MAAM,CAAC,EAAE,WAAW,EACpB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,OAAO,EACf,eAAe,CAAC,EAAE,CAChB,QAAQ,EAAE,MAAM,OAAO,EACvB,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,OAAO,KAAK,IAAI,KAC3C,OAAO,GACX,OAAO,CAAC,eAAe,CAAC;IA+D3B,yDAAyD;IACzD,WAAW,IAAI,iBAAiB,GAAG,IAAI;IAIvC;;;;;;;;OAQG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI;IAQjD;sEACkE;IAClE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAQzB,2EAA2E;IAC3E,SAAS,IAAI,IAAI;IASjB,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAO3C,OAAO,CAAC,OAAO;IAOf,OAAO,CAAC,IAAI;CAGb;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,UAAU,EAAE,gBAAgB,CAAA;KAC7B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,OAAO;gBAC/B,GAAG,EAAE,OAAO;IAYxB;;0DAEsD;IACtD,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,SAAS;IAMjB,6EAA6E;IAC7E,MAAM,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IACpE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAuCpF,8DAA8D;IAC9D,OAAO,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;IAC3D,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;IAkC3E,kEAAkE;IAClE,KAAK,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAClE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CA0BnF;AAeD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,GAAG,cAAc,GAAG,SAAS,CAOpG;AAED,eAAe,gBAAgB,CAAA"}
+{"version":3,"file":"dialogs.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/dialogs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAStD,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,8DAA8D;AAC9D,MAAM,MAAM,iBAAiB,GACzB;IACE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAA;CACnD,GACD;IACE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B,GACD;IACE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB,CAAA;AAEL,8BAA8B;AAC9B,MAAM,WAAW,aAAa;IAC5B,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAA;IACb,+DAA+D;IAC/D,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB;wDACoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,sBAAuB,SAAQ,aAAa;IAC3D,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAA;CAC1C;AAED,MAAM,WAAW,uBAAwB,SAAQ,aAAa;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;sDACsD;AACtD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAA;AAc1D;yEACyE;AACzE,KAAK,UAAU,CAAC,CAAC,IAAI,CAAC,SAAS,OAAO,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,KAAK,CAAA;AAW/D;;sBAEsB;AACtB,eAAO,MAAM,WAAW,MAAM,CAAA;AAE9B,0DAA0D;AAC1D,eAAO,MAAM,yBAAyB,QAAS,CAAA;AAI/C;;;GAGG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsB;IAC5C,OAAO,CAAC,MAAM,CAA6B;IAE3C,uEAAuE;IACvE,GAAG,CACD,QAAQ,EAAE,UAAU,CAAC,iBAAiB,CAAC,EACvC,MAAM,CAAC,EAAE,WAAW,EACpB,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,OAAO,EACf,eAAe,CAAC,EAAE,CAChB,QAAQ,EAAE,MAAM,OAAO,EACvB,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,OAAO,KAAK,IAAI,KAC3C,OAAO,GACX,OAAO,CAAC,eAAe,CAAC;IA+D3B,yDAAyD;IACzD,WAAW,IAAI,iBAAiB,GAAG,IAAI;IAIvC;;;;;;;;OAQG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,IAAI;IAQjD;sEACkE;IAClE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAQzB,2EAA2E;IAC3E,SAAS,IAAI,IAAI;IASjB,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAO3C,OAAO,CAAC,OAAO;IAOf,OAAO,CAAC,IAAI;CAGb;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,UAAU,EAAE,gBAAgB,CAAA;KAC7B;CACF;AAED;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,OAAO;gBAC/B,GAAG,EAAE,OAAO;IAaxB;;0DAEsD;IACtD,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,SAAS;IAMjB,6EAA6E;IAC7E,MAAM,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IACpE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAwCpF,8DAA8D;IAC9D,OAAO,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;IAC3D,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC;IAmC3E,kEAAkE;IAClE,KAAK,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAClE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CA2BnF;AAsBD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,GAAG,cAAc,GAAG,SAAS,CAOpG;AAED,eAAe,gBAAgB,CAAA"}

package/lib/types/dsh-adapter/dialogs.js

@@ -21,6 +21,8 @@
 import { Context, Service } from '@deepseek-ai/cordis';
 import { cleanScalarText } from './sanitize.js';
 import { activationContext, bindCallerEffect, compositionRoot, concreteService, requirePluginCaller } from './host-access.js';
+import { assertCapabilityShadowPolicy, } from '../adapter/kernel/runtime.js';
+import { adapterRuntimeFor } from '../adapter/kernel/runtime-context.js';
 /** Render-path strings are untrusted: sanitization (control-char stripping,
  *  cell-width caps, scalar-only coercion) lives in ./sanitize.js — the one
  *  implementation of the Track A contract. `clean` drops non-scalars to ''
@@ -187,6 +189,7 @@ export class TuiDialogRuntime extends Service {
         // compatibility.
         const store = new TuiDialogStore();
         hostDialogStores.set(this, store);
+        hostDialogRuntimes.set(this, adapterRuntimeFor(ctx));
         ctx.effect(() => () => store.settleAll());
     }
     /** Cordis traceable services normally provide the caller through `this.ctx`;
@@ -211,6 +214,7 @@ export class TuiDialogRuntime extends Service {
             : DIALOG_DEFAULT_TIMEOUT_MS;
     }
     select(ownerOrRequest, explicitRequest) {
+        assertCapabilityShadowPolicy('host.dialogs.select', dialogRuntimeFor(this).mode, dialogRuntimeFor(this).slices);
         try {
             const owner = this.callContext(ownerOrRequest);
             const request = (explicitRequest ?? ownerOrRequest);
@@ -244,6 +248,7 @@ export class TuiDialogRuntime extends Service {
         }
     }
     confirm(ownerOrRequest, explicitRequest) {
+        assertCapabilityShadowPolicy('host.dialogs.confirm', dialogRuntimeFor(this).mode, dialogRuntimeFor(this).slices);
         try {
             const owner = this.callContext(ownerOrRequest);
             const request = (explicitRequest ?? ownerOrRequest);
@@ -271,6 +276,7 @@ export class TuiDialogRuntime extends Service {
         }
     }
     input(ownerOrRequest, explicitRequest) {
+        assertCapabilityShadowPolicy('host.dialogs.input', dialogRuntimeFor(this).mode, dialogRuntimeFor(this).slices);
         try {
             const owner = this.callContext(ownerOrRequest);
             const request = (explicitRequest ?? ownerOrRequest);
@@ -297,6 +303,13 @@ export class TuiDialogRuntime extends Service {
  * public surface is select/confirm/input.
  */
 const hostDialogStores = new WeakMap();
+const hostDialogRuntimes = new WeakMap();
+function dialogRuntimeFor(runtime) {
+    const state = hostDialogRuntimes.get(concreteService(runtime));
+    if (state === undefined)
+        throw new Error('tuiDialogs host runtime is unavailable');
+    return state;
+}
 function dialogStoreFor(runtime) {
     const store = hostDialogStores.get(concreteService(runtime));
     if (store === undefined)

package/lib/types/dsh-adapter/effect-ledger.d.ts

@@ -77,6 +77,11 @@ export declare class TuiEffectLedgerRuntime extends Service {
      * parameter); omitting it records `undeclared`, never a guess.
      */
     record(entry: LedgerEntry, identity?: Context): void;
+    /** Append one kernel-resolved record to the JSONL file. */
+    private appendKernelRecord;
+    /** Kernel-ledger owner resolver: verified activation identity wins; host /
+     * undeclared fallbacks are explicit and never borrowed from fiber names. */
+    private resolveKernelOwner;
     /** Runtime generation (C-050): options override, else the plugin-host
      *  service's id — resolved on first record and cached (the host row mounts
      *  before any caller can record). */

package/lib/types/dsh-adapter/effect-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"effect-ledger.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/effect-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAOtD,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,QAAwC,CAAA;AAEvE,4DAA4D;AAC5D,eAAO,MAAM,qBAAqB,6HAUxB,CAAA;AAEV,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,gBAAgB,CAAA;AAC1F,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAA;AAE3D,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,eAAe,CAAA;IAC1B,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACtC,MAAM,EAAE,YAAY,CAAA;IACpB,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,yDAAyD;IACzD,QAAQ,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/D,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,eAAe,EAAE,sBAAsB,CAAA;KACxC;CACF;AAWD,kEAAkE;AAClE,qBAAa,sBAAuB,SAAQ,OAAO;gBAE/C,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAO;IA0BhG;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,IAAI;IA6DpD;;yCAEqC;IACrC,OAAO,CAAC,UAAU;IAOlB,gFAAgF;IAChF,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,OAAO;IAUf,OAAO,CAAC,UAAU;IAgBlB,OAAO,CAAC,YAAY;CAarB;AA6CD,eAAe,sBAAsB,CAAA"}
+{"version":3,"file":"effect-ledger.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/effect-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAIH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AActD,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,QAAwC,CAAA;AAEvE,4DAA4D;AAC5D,eAAO,MAAM,qBAAqB,6HAUxB,CAAA;AAEV,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,gBAAgB,CAAA;AAC1F,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAA;AAE3D,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,eAAe,CAAA;IAC1B,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACtC,MAAM,EAAE,YAAY,CAAA;IACpB,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,yDAAyD;IACzD,QAAQ,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/D,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,eAAe,EAAE,sBAAsB,CAAA;KACxC;CACF;AAWD,kEAAkE;AAClE,qBAAa,sBAAuB,SAAQ,OAAO;gBAE/C,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAO;IAsChG;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,IAAI;IAWpD,2DAA2D;IAC3D,OAAO,CAAC,kBAAkB;IAwD1B;gFAC4E;IAC5E,OAAO,CAAC,kBAAkB;IAqB1B;;yCAEqC;IACrC,OAAO,CAAC,UAAU;IAOlB,gFAAgF;IAChF,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,OAAO;IAUf,OAAO,CAAC,UAAU;IAgBlB,OAAO,CAAC,YAAY;CAarB;AA+CD,eAAe,sBAAsB,CAAA"}

package/lib/types/dsh-adapter/effect-ledger.js

@@ -36,12 +36,14 @@
  */
 import { appendFileSync, mkdirSync, readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
-import { Service } from '@deepseek-ai/cordis';
+import { Context, Service } from '@deepseek-ai/cordis';
 import { DATA_DIR } from '../utils/paths.js';
-import { loadSpecData } from '../plugin-spec/registry.js';
-import { check } from '../plugin-spec/schema-check.js';
+import { loadSpecData } from '../adapter/standard/registry.js';
+import { check } from '../adapter/standard/schema-check.js';
+import { adapterRuntimeFor } from '../adapter/kernel/runtime-context.js';
 import { componentIdentityOf } from './component-identity.js';
 import { compositionRoot, concreteService } from './host-access.js';
+import { createKernelLedger } from '../adapter/kernel/ledger.js';
 /** Default ledger file (JSONL, one record per line). */
 export const EFFECT_LEDGER_FILE = join(DATA_DIR, 'effect-ledger.jsonl');
 /** Resource kinds recorded by the host's wired emitters. */
@@ -83,12 +85,19 @@ export class TuiEffectLedgerRuntime extends Service {
             nextActivation: 1,
             sequence: 0,
             schemaWarned: false,
+            runtime: adapterRuntimeFor(ctx),
             ledgerSchema: undefined,
+            kernelLedger: undefined,
         };
         // `'ledgerSchema' in options` lets a caller force-undefined (fail-closed
         // test seam), same contract as the message observer's envelopeSchema.
         state.ledgerSchema = 'ledgerSchema' in options ? options.ledgerSchema : loadSpecData()?.schemas.ledger;
         state.sequence = resumeSequence(file);
+        // Route every public ledger write through the unified Kernel ledger
+        // channel. The kernel ledger performs shadow-policy enforcement and
+        // owner derivation; this class only serializes the normalized record to
+        // the existing JSONL file.
+        state.kernelLedger = createKernelLedger(record => this.appendKernelRecord(record, state), state.runtime.mode, context => this.resolveKernelOwner(context, state), state.runtime.slices);
         ledgerStates.set(this, state);
     }
     /**
@@ -97,25 +106,35 @@ export class TuiEffectLedgerRuntime extends Service {
      * parameter); omitting it records `undeclared`, never a guess.
      */
     record(entry, identity) {
-        let state;
+        const state = ledgerStateFor(this);
+        // The Kernel ledger is the single owner-deriving write channel. It
+        // asserts shadow policy and calls back with a kernel-resolved owner.
+        try {
+            state.kernelLedger.record(entry, identity);
+        }
+        catch {
+            // Ledger writes are explicitly best-effort and must not affect the seam.
+        }
+    }
+    /** Append one kernel-resolved record to the JSONL file. */
+    appendKernelRecord(kernelRecord, state) {
         try {
-            state = ledgerStateFor(this);
             if (state.ledgerSchema === undefined) {
                 if (!state.schemaWarned) {
                     state.schemaWarned = true;
-                    state.hostContext.logger.warn('dsh-tui: effect ledger schema unavailable — suppressing all ledger writes (fail-closed)');
+                    state.hostContext.logger.warn('dsh-tui: effect ledger schema unavailable - suppressing all ledger writes (fail-closed)');
                 }
                 return;
             }
-            const fiber = this.fiberOf(identity);
-            const verified = identity === undefined ? undefined : componentIdentityOf(identity);
-            const pluginId = this.pluginIdOf(identity, fiber, verified?.componentId);
+            const { entry, owner } = kernelRecord;
+            const pluginId = cleanField(owner.componentId, 128, 'undeclared');
+            const activationInstance = cleanField(owner.activationId ?? pluginId, 128, pluginId);
             const record = {
                 ledgerVersion: '0.15',
                 sequence: state.sequence,
                 timestamp: new Date().toISOString(),
                 pluginId,
-                activationInstance: verified?.activationId ?? this.activationOf(fiber, pluginId),
+                activationInstance,
                 runtimeGenerationId: this.generation(),
                 operation: entry.operation,
                 resource: {
@@ -138,9 +157,6 @@ export class TuiEffectLedgerRuntime extends Service {
                     : {}),
                 ...(entry.valueDigest !== undefined ? { valueDigest: entry.valueDigest } : {}),
             };
-            // Fail-closed self-check: a record that does not satisfy the vendored
-            // schema is DROPPED, not written (the schema's additionalProperties:
-            // false is the structural secret ban).
             try {
                 check(record, state.ledgerSchema, state.ledgerSchema);
             }
@@ -153,9 +169,31 @@ export class TuiEffectLedgerRuntime extends Service {
             state.sequence += 1;
         }
         catch (error) {
-            ;
-            (state?.hostContext ?? this.ctx).logger.warn('dsh-tui: effect ledger write failed');
+            state.hostContext.logger.warn('dsh-tui: effect ledger write failed');
+        }
+    }
+    /** Kernel-ledger owner resolver: verified activation identity wins; host /
+     * undeclared fallbacks are explicit and never borrowed from fiber names. */
+    resolveKernelOwner(identity, state) {
+        if (!Context.is(identity)) {
+            return { componentId: 'undeclared', activationId: 'undeclared' };
+        }
+        const verified = componentIdentityOf(identity);
+        if (verified !== undefined) {
+            return { componentId: verified.componentId, activationId: verified.activationId };
+        }
+        const fiber = this.fiberOf(identity);
+        let name = '';
+        try {
+            name = typeof identity.fiber?.name === 'string' ? identity.fiber.name : '';
+        }
+        catch {
+            name = '';
+        }
+        if (fiber === undefined || name === '' || name === 'root') {
+            return { componentId: 'host', activationId: 'host' };
         }
+        return { componentId: 'undeclared', activationId: this.activationOf(fiber, 'undeclared') };
     }
     /** Runtime generation (C-050): options override, else the plugin-host
      *  service's id — resolved on first record and cached (the host row mounts

package/lib/types/dsh-adapter/extension-events.d.ts

@@ -1,3 +1,5 @@
+import type { TuiRewindMode } from '../adapter/ports/channel-session.js';
+export type { TuiRewindMode } from '../adapter/ports/channel-session.js';
 /**
  * Decision-point events the TUI fires on the cordis bus so plugins can
  * intercept, cancel, or customize interactive flows — the `session_before_*`
@@ -104,15 +106,6 @@ export interface TuiRewindPromptEvent extends TuiDecisionContext {
     /** Session event seq of the picked message. */
     seq: number;
 }
-/** One extra rewind mode offered by a plugin (e.g. "also restore files"). */
-export interface TuiRewindMode {
-    /** Stable id reported back in `TuiRewindDoneEvent.mode`. */
-    id: string;
-    /** One-line label shown in the confirm pane. */
-    label: string;
-    /** Optional dimmed description under the label. */
-    description?: string;
-}
 export type TuiRewindPromptDecision = 
 /** Abort the rewind; the picker stays open. Optional reason is toasted. */
 {

package/lib/types/dsh-adapter/extension-events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extension-events.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/extension-events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAYlD;;wEAEwE;AACxE,eAAO,MAAM,2BAA2B,OAAO,CAAA;AAC/C,eAAO,MAAM,yBAAyB,OAAO,CAAA;AA4C7C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,KAAK,CAAC,GAAG,SAAS,GAC1E,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CA4DxB;AAED;uEACuE;AACvE,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,IAAI,CAAC,CAwCf;AAED;;;kDAGkD;AAClD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC3B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAQ/C;AAED,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAA;IACjB,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAc,SAAQ,kBAAkB;IACvD,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,2EAA2E;IAC3E,QAAQ,EAAE,UAAU,GAAG,OAAO,CAAA;CAC/B;AAED,MAAM,MAAM,gBAAgB;AAC1B,6DAA6D;AAC3D;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE;AAClB;+EAC+E;GAC7E;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AACpC,kEAAkE;GAChE;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AACnC,gDAAgD;GAC9C,SAAS,CAAA;AAEb;;;;GAIG;AACH,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,EAAE,EAAE,MAAM,CAAA;IACV,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAA;IACb,mDAAmD;IACnD,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,MAAM,uBAAuB;AACjC,2EAA2E;AACzE;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AACnC;0DAC0D;GACxD;IAAE,KAAK,EAAE,SAAS,aAAa,EAAE,CAAA;CAAE;AACrC,oEAAoE;GAClE,SAAS,CAAA;AAEb;;;;GAIG;AACH,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAA;IACZ;oCACgC;IAChC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAA;IACnB,6CAA6C;IAC7C,eAAe,EAAE,MAAM,CAAA;IACvB,2DAA2D;IAC3D,cAAc,EAAE,MAAM,CAAA;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAsB,SAAQ,kBAAkB;IAC/D,IAAI,EAAE,KAAK,GAAG,QAAQ,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,MAAM,wBAAwB;AAClC;4BAC4B;AAC1B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,SAAS,CAAA;AAEb;;;;;GAKG;AACH,MAAM,WAAW,uBAAwB,SAAQ,kBAAkB;IACjE,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC1C,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAA;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,2CAA2C;AAC3C,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;CAAG;AAE9D,MAAM,MAAM,kBAAkB;AAC5B,qEAAqE;AACnE;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,SAAS,CAAA;AAEb,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,MAAM;QACd,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;QAC/E,mBAAmB,CAAC,KAAK,EAAE,oBAAoB,GAAG,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;QAC5G,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;QAC9F,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,GAAG,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAA;QAChH,sBAAsB,CAAC,KAAK,EAAE,uBAAuB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC5E,aAAa,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;KACxF;CACF"}
+{"version":3,"file":"extension-events.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/extension-events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAA;AACxE,YAAY,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAA;AACxE;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAYlD;;wEAEwE;AACxE,eAAO,MAAM,2BAA2B,OAAO,CAAA;AAC/C,eAAO,MAAM,yBAAyB,OAAO,CAAA;AA4C7C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,KAAK,CAAC,GAAG,SAAS,GAC1E,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CA4DxB;AAED;uEACuE;AACvE,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,IAAI,CAAC,CAwCf;AAED;;;kDAGkD;AAClD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC3B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAQ/C;AAED,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAA;IACjB,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAc,SAAQ,kBAAkB;IACvD,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,2EAA2E;IAC3E,QAAQ,EAAE,UAAU,GAAG,OAAO,CAAA;CAC/B;AAED,MAAM,MAAM,gBAAgB;AAC1B,6DAA6D;AAC3D;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE;AAClB;+EAC+E;GAC7E;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AACpC,kEAAkE;GAChE;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AACnC,gDAAgD;GAC9C,SAAS,CAAA;AAEb;;;;GAIG;AACH,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,MAAM,uBAAuB;AACjC,2EAA2E;AACzE;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AACnC;0DAC0D;GACxD;IAAE,KAAK,EAAE,SAAS,aAAa,EAAE,CAAA;CAAE;AACrC,oEAAoE;GAClE,SAAS,CAAA;AAEb;;;;GAIG;AACH,MAAM,WAAW,kBAAmB,SAAQ,kBAAkB;IAC5D,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAA;IACZ;oCACgC;IAChC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAA;IACnB,6CAA6C;IAC7C,eAAe,EAAE,MAAM,CAAA;IACvB,2DAA2D;IAC3D,cAAc,EAAE,MAAM,CAAA;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAsB,SAAQ,kBAAkB;IAC/D,IAAI,EAAE,KAAK,GAAG,QAAQ,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,MAAM,wBAAwB;AAClC;4BAC4B;AAC1B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,SAAS,CAAA;AAEb;;;;;GAKG;AACH,MAAM,WAAW,uBAAwB,SAAQ,kBAAkB;IACjE,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC1C,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAA;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,2CAA2C;AAC3C,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;CAAG;AAE9D,MAAM,MAAM,kBAAkB;AAC5B,qEAAqE;AACnE;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACjC,SAAS,CAAA;AAEb,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,MAAM;QACd,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;QAC/E,mBAAmB,CAAC,KAAK,EAAE,oBAAoB,GAAG,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;QAC5G,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;QAC9F,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,GAAG,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAA;QAChH,sBAAsB,CAAC,KAAK,EAAE,uBAAuB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC5E,aAAa,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;KACxF;CACF"}

package/lib/types/dsh-adapter/extension-events.js

@@ -1,23 +1,3 @@
-/**
- * Decision-point events the TUI fires on the cordis bus so plugins can
- * intercept, cancel, or customize interactive flows — the `session_before_*`
- * style seam (pi's `session_before_fork` / `input` events) expressed in
- * cordis dispatch semantics.
- *
- * All of these are FIRED BY THE CHANNEL and answered by admitted Components
- * through the host-mediated DecisionEvents registry. No extra service row is
- * involved: an absent handler simply means "no opinion", and the built-in
- * flow proceeds unchanged. Dispatch is SERIAL in the registry's stable order
- * with the first VALID decision winning — see {@link dispatchTuiDecision} for
- * why this is not raw `ctx.serial`: per-handler crash isolation, deadlines and
- * return-value normalization mean a broken or malformed handler can never
- * skip a later (possibly safety) veto.
- *
- * Synchronous-only rule: handlers may be async, but while a decision is
- * awaited the originating UI flow is parked (the submit is not delivered,
- * the rewind confirm has not happened). Handlers that need user input should
- * use the managed dialogs (`ctx.tuiDialogs`) or open a scene, then resolve.
- */
 import { cleanScalarText } from './sanitize.js';
 import { DECISION_EVENT_PERMISSIONS, decisionHandlersOf, decisionRegistryOf, } from './decision-guard.js';
 /** Toast-bound plugin text (veto reasons) is render-path data: sanitized

package/lib/types/dsh-adapter/extensions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extensions.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAU7C,eAAO,MAAM,IAAI,uBAAuB,CAAA;AAExC,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAQxC"}
+{"version":3,"file":"extensions.d.ts","sourceRoot":"","sources":["../../../src/dsh-adapter/extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAW7C,eAAO,MAAM,IAAI,uBAAuB,CAAA;AAExC,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAQxC"}

package/lib/types/dsh-adapter/extensions.js

@@ -37,10 +37,11 @@ import TuiRendererRuntime from './renderers.js';
 import TuiToastRuntime from './toast.js';
 import TuiThemeRuntime from './themes.js';
 import { installDecisionGuard } from './decision-guard.js';
-import { readGrantStore } from './grants.js';
+import { readGrantStore } from '../adapter/standard/grants.js';
+import { adapterRuntimeFor } from '../adapter/kernel/runtime-context.js';
 export const name = 'dsh-tui-extensions';
 export function apply(ctx) {
-    installDecisionGuard(ctx, readGrantStore());
+    installDecisionGuard(ctx, readGrantStore(undefined, undefined, adapterRuntimeFor(ctx)));
     ctx.plugin(TuiDialogRuntime);
     ctx.plugin(TuiStatusRuntime);
     ctx.plugin(TuiShortcutRuntime);