@hanamesh/dsh-app-host 0.2.0-rc.2 → 0.6.12

package/docs/LIBRARY.md

@@ -9,7 +9,7 @@
 ## 目录源
 
 - `library.fixture` 只用于受控验收；内容必须符合 `schemas/catalog-provider-page.schema.json`。
-- `library.sources` **未配置**时默认为 HanaMesh 目录源 `https://market.hanamesh.com/catalog-source.json`（rc.26；显式 `[]` = 不要来源）；可有多项，但浏览时必须恰好启用一项。远端 manifest 只接受标准端口 HTTPS、无凭据/query/fragment；endpoint 必须同源。
+- `library.sources` **未配置**时默认为 HanaMesh 目录源 `https://market.hanamesh.com/catalog-source.json?view=hanamesh`（rc.26；显式 `[]` = 不要来源）；可有多项，但浏览时必须恰好启用一项。目录 manifest 接受标准端口 HTTPS；本机回环 127.0.0.1、::1、localhost 另接受任意端口 HTTP（Node URL 解析后精确匹配主机名，安全上下文回环例外）。无凭据/fragment，仅允许可选查询 view=hanamesh；endpoint 和重定向必须保持完整同源（协议、主机、端口），不把主机别名互换。新默认仅在初始 revision=0 且来源为空时播种，已保存旧来源、自定义来源和手动清空列表均不自动改写。
 - 请求固定 `Accept: application/json` 与 `Accept-Encoding: identity`；最多三次同源跳转，拒绝压缩响应与超过 2 MiB 的响应。
 - `categories` 含 `hanamesh-app` 且 `package.registry` 为 `npm` 的条目是应用（安装后读 `app.json`、供给 runtime）；其它 `package.registry` 为 `npm` 的条目是插件（rc.28 起同样可装卸，只跑 `dsh plugin add/remove`）；无 npm 包的条目（repository-only）只展示。
 
@@ -17,7 +17,9 @@
 
 钉版本 DSH 没有向插件公开 profile 目录或 profile 名。桌面壳通过 overlay 显式给出 `library.profileDir`（绝对路径）、`library.profileName`、`library.dshBin` 与 `nodeBinary`，显式值永远优先。**纯 DSH CLI profile（rc.26）** 下缺省值按 `CONTRACT.md`「应用库配置」推断：`profileDir` 来自本包自身真实安装位置所属的 profile、`profileName` 为其目录名、`dshBin` 只取启动本进程的 `@deepseek-ai/dsh/lib/bin.js`、`nodeBinary` 只在非 Electron 进程取 `process.execPath`。Electron 下仍必须由 dsh-runtime/core 提供绝对 `nodeBinary`；应用库不会在 Electron 里回退到 `process.execPath`。
 
-安装先向 registry 的 `latest` 端点复核精确稳定版本，再用显式 Node 执行 DSH 自己的 `bin.js plugin --profile <name> add --save-exact <package>@<version>`。成功后读取包内 `app.json`；如果描述符声明 runtime，则调用随包内联的锁定 `@hanamesh/lib-provision@0.1.0-rc.1`。生产默认拒绝 prerelease；隔离 Verdaccio 验收可显式设 `allowPrerelease: true`。
+安装先向 registry 的 `latest` 端点复核精确稳定版本，再用显式 Node 执行 DSH 自己的 `bin.js plugin --profile <name> add --save-exact <package>@<version>`。成功后读取包内 `app.json`；如果描述符声明 runtime，则调用随包内联的锁定 `@hanamesh/lib-provision@0.1.0-rc.3`。生产默认拒绝 prerelease；隔离 Verdaccio 验收可显式设 `allowPrerelease: true`。
+
+rc.10：add 之后的读回、定义校验或 provision 失败按基线补偿（新装 `dsh plugin remove`、升级 `dsh plugin add` 原规格，runtime 按 ownership 回收或按原定义重供），逐项读回后在 `library.install-failed` 的 `recovery` 里报告 `not-needed`/`restored`/`failed`；详见 `INSTALL_TARGET.md`「安装失败后的恢复」。
 
 安装/卸载完成只返回 `restart-required`，绝不静默重启 DSH。卸载只删除包与 lib-provision 账本认领的 runtime 文件，保留 `<dataRoot>` 下应用数据；彻底删除需用户手动处理对应数据目录。
 
@@ -42,4 +44,43 @@
 
 - 市场页默认 `category=`（全部）；筛选：全部 / 应用（`hanamesh-app`）/ 插件（客户端视图：本页非应用的 npm 条目）/ 目录页里出现过的类别（累积自 `categories`）。路由 `/hanamesh/library` 的缺省 `category=hanamesh-app` 不变（向后兼容）。
 - 卡片：`kind · 发布者 · latestVersion · 类别`；已装行显示状态与版本；「升级到 x.y.z」出现在 `upgradeAvailable` 时；插件「卸载」走 `plugins/uninstall`。页面底部「已安装」列出应用与插件（含 bundle 未启用为 profile 层的提示）。
-- 「需重启 DSH」横幅：任一装卸操作完成后，或列表 `restartRequired` 为真时显示；壳内为 `hanamesh://restart` 链接，官方 DSH 直开为文字提示。
+- 「需重新打开客户端」横幅：任一装卸操作完成后，或列表 `restartRequired` 为真时显示；所有渠道均提示完全退出 HanaMesh 客户端或 DSH 后重新打开，关闭窗口不等于退出。不提供旧壳深链或 postMessage 重启桥；只有正式宿主重启 API 供给后才另行接入。
+
+### 0.3.0 · catalog major compatibility
+
+Catalog `manifestVersion` / `schemaVersion` accept valid SemVer with major 1, including additive minor/patch inputs; different majors and malformed versions remain refused. Schema field checks and HTTPS/same-origin controls remain enforced. Known optional additions (attribution notice / item updatedAt) are preserved; arbitrary unknown fields remain invalid. Install-target `contractVersion: "1"`, storage schema numbers and installed-package exact readback are distinct fields and retain their original grammar. This does not claim that a 0.x package caret includes every minor.
+
+Both SOURCE fixture sets and suites ship as `@hanamesh/dsh-app-host/catalog/suite` (`runCatalogProviderSuite`, `runCatalogConsumerSuite`) with schema exports under `catalog/schema/`. The default consumer suite drives this package's actual catalog loader against labelled transport fixtures; it is not a live market or product acceptance gate. Version grammar follows [SemVer 2.0.0](https://semver.org/).
+
+## HanaMesh 套件
+
+市场只显示一张官方、不计分的「HanaMesh 套件」卡。完整性只显示 Core 的 `completeness`，同时展示 `installed` 的要求范围、实际版本、状态和 `blocked` 的具名原因；Core 缺席或读取失败时完整性为 unknown，并保留物理包版本供诊断。Core、使用记录、应用库不再分别作为普通可安装卡。品牌插件只属于 HanaMesh 自有客户端。
+
+DSH 首次安装或缺组件时，完全退出客户端后执行同一行，再重新打开：
+
+```sh
+dsh plugin --profile desktop add --save-exact 'github:yzsnstotz/hanamesh-core#main' 'github:yzsnstotz/hanamesh-usage#main' 'github:yzsnstotz/hanamesh-plugin-app-host#main'
+```
+
+套件版本范围、是否完整、候选来源及兼容/升级规则唯一属于 Core。App-host 只读物理安装版本，不能用它们推导兼容或安装许可；不自行读取 npm latest、计算组件组合、校验候选宿主 peers 或持有 Core 的版本范围副本。普通安装/卸载接口继续拒绝套件包。
+
+DSH 入口通过既有 optional injection 监听 `hanameshCore` 出现/卸载，仅消费字符串 protocol `'1'` 的可选 `getSuiteDeclaration`（C-CORE D）。市场事实读取不传 request，不触发候选 registry 网络；查询升级时传入实际执行 `registry`。缺方法、旧 Core 或卸载后明确显示 **Core 未提供套件声明**，「检查兼容升级」不可点；直接查询升级目标返回503 `CORE_SUITE_DECLARATION_MISSING`，不回退 getHealth、内部 profile、旧范围或 registry latest。DTO 形状无效返回 `CORE_SUITE_DECLARATION_INVALID`；具名 Core 错误保持传播，事实读取失败为 unknown。
+
+公开 adapter 仅检查 DTO/精确命令的形状与固定三包边界，不重算范围、Node、peer、来源或升级排序。默认展示 `upgrades` 的第一条组合，保留完整 `declarationId`、规范 registry、目标身份/来源/摘要/版本及物理基线；其他候选的 blocked 行不会否决这条 Core 已提供的有效组合。`completeness` 非 complete、来源不符或没有组合分别明确拒绝。`createLibraryInstaller({coreSuitePlan})` 仍是内部归一化执行测试接缝，不是公开 Core DTO、配置项或浏览器权限；替身测试不能证明真实 Core 包接通。
+
+本人确认当前计划才执行一次官方 CLI；执行前重读并比较 declarationId、registry、选中组合和 Core 物理基线（checkedAt 不参与比较），再检查磁盘版本及启用清单；改变/撤回即拒绝，不静默重试。安装后按精确 profile/module 版本和启用状态读回，不以 Core 回执冒充实际安装结果。网站只能经允许名单交接此意图。
+
+成功须读回三个精确保存的版本、实际解析版本与启用状态，随后完全退出并重新打开客户端。安装命令失败或读回不符时，界面显示实际组件状态、错误与同一行补齐命令；部分变更不冒充成功或未安装，不自动静默重试。
+
+套件卡不把 Core 版本当作 agent 套件分发版本：`suite.version` 保持为 Core 实际版本，界面明确标为 Core，组件逐项显示。`unknown` 表示 Core 无法确认事实，不等于组件缺失。预览阶段被 Core 拒绝时说明尚未执行安装，保留具名 blocked 原因；已执行失败仍显示物理读回及修复步骤。网站四渠道面板和 Claude/Codex 安装状态不从 App-host 监听是否存在推断。
+
+### 0.6.8 · HanaMesh 目录展示字段
+
+HanaMesh 视图原样保留可选 `official:boolean`（包括 false）与 C-INDEXER-CATALOG 的 `SuitePresentationDTO`；suite 的角色、组件、版本事实及 GitHub 精确 ref 按公开形状逐层校验，未知字段和畸形字段仍拒绝。历史可选版本事实缺省时不补猜。旧 major-1 视图不增加这些字段。该展示信息不构成安装权限；兼容与升级仍只读取公开 Core 声明。
+
+### 宿主主题（2026-10-21候选）
+
+市场覆盖页、内嵌应用框、表单控件与状态提示消费正式 DSH ui-theme 的公开 `--dsw-alias-bg-layer-2`、`label-primary/secondary`、`border-l2`、`state-error/success/warn/business-*` token，不写白底黑字或新增全局色。主题值与切换仍归宿主；不修改客户端或覆盖其它插件。缺主题提供方时不能把本候选截图当正式宿主支持。
+
+
+0.6.12：目录条目的展示/跳转链接（`sourceLinks.sourceUrl`、`homepage`、`repository.url`、`publisher.url`）接受 fragment 并原样保留；目录自身 attribution 展示链接亦保留 fragment。manifest 来源和 `transport.endpoint` 等请求 URL 校验不变。单条非法仍拒绝整个 provider page，不返回部分结果。

package/docs/LICENSES.json

@@ -1,19 +1,26 @@
 {
   "package": {
     "name": "@hanamesh/dsh-app-host",
-    "version": "0.2.0-rc.2",
+    "version": "0.6.12",
     "license": "SEE LICENSE IN LICENSE",
     "source": "git+https://github.com/yzsnstotz/hanamesh-plugin-app-host.git",
     "purpose": "Application ownership, view leases, Router forwarding, and application library for official DSH"
   },
-  "scope": "Direct dependencies and build-time inlined module. External packages retain their own licenses; the root MIT terms do not cover dist/provision/**.",
+  "scope": "AppHost own code and declared dependencies/peers; lib-provision 随包分发、源仓不变; original LICENSE retained; no relicensing.",
   "components": {
     "@hanamesh/lib-provision": {
-      "version": "0.1.0-rc.1",
-      "license": "UNLICENSED",
-      "source": "vendor/hanamesh-lib-provision-0.1.0-rc.1.tgz",
-      "purpose": "Inlined runtime download, extraction, atomic promotion, and ledger logic in dist/provision/**",
-      "sha256": "386d57361ccc3c8578f54cad8137acc291dd72e01b3ff987e65dfaa716f2e0b0"
+      "version": "0.2.1",
+      "license": "SEE LICENSE IN LICENSE",
+      "source": "file:vendor/hanamesh-lib-provision-0.2.1.tgz",
+      "purpose": "Runtime provision/remove/ledger API; 随包分发、源仓不变; no inlined copy",
+      "sha256": "4217b9fe1be98f6e82437539d1c4c43166ed1f5c292efff100733e0cb09530e9",
+      "specs": {
+        "dependencies": "file:vendor/hanamesh-lib-provision-0.2.1.tgz"
+      },
+      "sourceCommit": "575d63fb70e08c47e980dbf25f07921a7ba5aa2a",
+      "distribution": "bundleDependencies; original LICENSE at node_modules/@hanamesh/lib-provision/LICENSE",
+      "originalSource": "git+https://github.com/yzsnstotz/hanamesh-lib-provision.git#575d63fb70e08c47e980dbf25f07921a7ba5aa2a",
+      "archiveSha256": "4217b9fe1be98f6e82437539d1c4c43166ed1f5c292efff100733e0cb09530e9"
     },
     "zod": {
       "version": "4.5.4",
@@ -22,83 +29,102 @@
       "purpose": "Runtime snapshot validation",
       "usedAs": [
         "dependencies"
-      ]
+      ],
+      "specs": {
+        "dependencies": "4.5.4"
+      }
     },
     "@deepseek-ai/cordis": {
-      "version": "4.0.4",
+      "version": "4.0.5-alpha.1",
       "license": "MIT",
-      "source": "https://registry.npmjs.org/@deepseek-ai/cordis/-/cordis-4.0.4.tgz",
+      "source": "https://registry.npmjs.org/@deepseek-ai/cordis/-/cordis-4.0.5-alpha.1.tgz",
       "purpose": "Official DSH plugin lifecycle and service container",
       "usedAs": [
         "peerDependencies",
         "devDependencies"
-      ]
+      ],
+      "specs": {
+        "peerDependencies": ">=4.0.4 <4.1.0-0 || >=4.0.5-alpha.1 <4.1.0-0",
+        "devDependencies": "4.0.5-alpha.1"
+      }
     },
     "@deepseek-ai/dsh-storage-domain": {
-      "version": "0.2.0-rc.2",
+      "version": "0.2.1-alpha.2",
       "license": "MIT",
-      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-storage-domain/-/dsh-storage-domain-0.2.0-rc.2.tgz",
+      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-storage-domain/-/dsh-storage-domain-0.2.1-alpha.2.tgz",
       "purpose": "Official DSH persistent storage service",
       "usedAs": [
         "peerDependencies",
         "devDependencies"
-      ]
+      ],
+      "specs": {
+        "peerDependencies": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0",
+        "devDependencies": "0.2.1-alpha.2"
+      }
     },
     "@deepseek-ai/schemastery": {
-      "version": "3.18.4",
+      "version": "3.18.5-alpha.1",
       "license": "MIT",
-      "source": "https://registry.npmjs.org/@deepseek-ai/schemastery/-/schemastery-3.18.4.tgz",
+      "source": "https://registry.npmjs.org/@deepseek-ai/schemastery/-/schemastery-3.18.5-alpha.1.tgz",
       "purpose": "Official DSH configuration schema service",
       "usedAs": [
         "peerDependencies",
         "devDependencies"
-      ]
+      ],
+      "specs": {
+        "peerDependencies": ">=3.18.4 <3.19.0-0 || >=3.18.5-alpha.1 <3.19.0-0",
+        "devDependencies": "3.18.5-alpha.1"
+      }
     },
     "@deepseek-ai/dsh-host-webserver": {
-      "version": "0.2.0-rc.2",
+      "version": "0.2.1-alpha.2",
       "license": "MIT",
-      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-host-webserver/-/dsh-host-webserver-0.2.0-rc.2.tgz",
+      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-host-webserver/-/dsh-host-webserver-0.2.1-alpha.2.tgz",
       "purpose": "Official DSH authenticated HTTP route host",
       "usedAs": [
         "peerDependencies",
         "devDependencies"
-      ]
+      ],
+      "specs": {
+        "peerDependencies": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0",
+        "devDependencies": "0.2.1-alpha.2"
+      }
     },
     "@deepseek-ai/dsh-client-connection": {
-      "version": "0.2.0-rc.2",
+      "version": "0.2.1-alpha.2",
       "license": "MIT",
-      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-client-connection/-/dsh-client-connection-0.2.0-rc.2.tgz",
+      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-client-connection/-/dsh-client-connection-0.2.1-alpha.2.tgz",
       "purpose": "Official DSH client connection service",
       "usedAs": [
         "peerDependencies"
-      ]
-    },
-    "@deepseek-ai/dsh-client-ui-slots": {
-      "version": "0.2.0-rc.2",
-      "license": "MIT",
-      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-client-ui-slots/-/dsh-client-ui-slots-0.2.0-rc.2.tgz",
-      "purpose": "Official DSH client UI placement",
-      "usedAs": [
-        "peerDependencies"
-      ]
+      ],
+      "specs": {
+        "peerDependencies": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0"
+      }
     },
     "@deepseek-ai/dsh-client-ui-settings": {
-      "version": "0.2.0-rc.2",
+      "version": "0.2.1-alpha.2",
       "license": "MIT",
-      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-client-ui-settings/-/dsh-client-ui-settings-0.2.0-rc.2.tgz",
+      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-client-ui-settings/-/dsh-client-ui-settings-0.2.1-alpha.2.tgz",
       "purpose": "Official DSH client settings surface",
       "usedAs": [
         "peerDependencies"
-      ]
+      ],
+      "specs": {
+        "peerDependencies": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0"
+      }
     },
     "@deepseek-ai/dsh-client-locale": {
-      "version": "0.2.0-rc.2",
+      "version": "0.2.1-alpha.2",
       "license": "MIT",
-      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-client-locale/-/dsh-client-locale-0.2.0-rc.2.tgz",
+      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-client-locale/-/dsh-client-locale-0.2.1-alpha.2.tgz",
       "purpose": "Official DSH client localization",
       "usedAs": [
         "peerDependencies"
-      ]
+      ],
+      "specs": {
+        "peerDependencies": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0"
+      }
     },
     "react": {
       "version": "18.3.1",
@@ -107,70 +133,94 @@
       "purpose": "Official DSH client UI peer",
       "usedAs": [
         "peerDependencies"
-      ]
+      ],
+      "specs": {
+        "peerDependencies": "^18.3.1"
+      }
     },
     "@deepseek-ai/dsh-scope": {
-      "version": "0.2.0-rc.2",
+      "version": "0.2.1-alpha.2",
       "license": "MIT",
-      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-scope/-/dsh-scope-0.2.0-rc.2.tgz",
+      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-scope/-/dsh-scope-0.2.1-alpha.2.tgz",
       "purpose": "Build and test fixture for official DSH scopes",
       "usedAs": [
         "devDependencies"
-      ]
+      ],
+      "specs": {
+        "devDependencies": "0.2.1-alpha.2"
+      }
     },
     "@deepseek-ai/dsh-session": {
-      "version": "0.2.0-rc.2",
+      "version": "0.2.1-alpha.2",
       "license": "MIT",
-      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-session/-/dsh-session-0.2.0-rc.2.tgz",
+      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-session/-/dsh-session-0.2.1-alpha.2.tgz",
       "purpose": "Build and test fixture for official DSH sessions",
       "usedAs": [
         "devDependencies"
-      ]
+      ],
+      "specs": {
+        "devDependencies": "0.2.1-alpha.2"
+      }
     },
     "@deepseek-ai/dsh-session-persistence": {
-      "version": "0.2.0-rc.2",
+      "version": "0.2.1-alpha.2",
       "license": "MIT",
-      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-session-persistence/-/dsh-session-persistence-0.2.0-rc.2.tgz",
+      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-session-persistence/-/dsh-session-persistence-0.2.1-alpha.2.tgz",
       "purpose": "Build and test fixture for official DSH session persistence",
       "usedAs": [
         "devDependencies"
-      ]
+      ],
+      "specs": {
+        "devDependencies": "0.2.1-alpha.2"
+      }
     },
     "@deepseek-ai/dsh-session-persistence-jsonl": {
-      "version": "0.2.0-rc.2",
+      "version": "0.2.1-alpha.2",
       "license": "MIT",
-      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-session-persistence-jsonl/-/dsh-session-persistence-jsonl-0.2.0-rc.2.tgz",
+      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-session-persistence-jsonl/-/dsh-session-persistence-jsonl-0.2.1-alpha.2.tgz",
       "purpose": "Build and test fixture for official DSH JSONL session persistence",
       "usedAs": [
         "devDependencies"
-      ]
+      ],
+      "specs": {
+        "devDependencies": "0.2.1-alpha.2"
+      }
     },
     "@deepseek-ai/dsh-session-projection": {
-      "version": "0.2.0-rc.2",
+      "version": "0.2.1-alpha.2",
       "license": "MIT",
-      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-session-projection/-/dsh-session-projection-0.2.0-rc.2.tgz",
+      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-session-projection/-/dsh-session-projection-0.2.1-alpha.2.tgz",
       "purpose": "Build and test fixture for official DSH session projections",
       "usedAs": [
         "devDependencies"
-      ]
+      ],
+      "specs": {
+        "devDependencies": "0.2.1-alpha.2"
+      }
     },
     "@deepseek-ai/dsh-storage": {
-      "version": "0.2.0-rc.2",
+      "version": "0.2.1-alpha.2",
       "license": "MIT",
-      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-storage/-/dsh-storage-0.2.0-rc.2.tgz",
+      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-storage/-/dsh-storage-0.2.1-alpha.2.tgz",
       "purpose": "Build and test fixture for official DSH storage",
       "usedAs": [
         "devDependencies"
-      ]
+      ],
+      "specs": {
+        "devDependencies": "0.2.1-alpha.2"
+      }
     },
     "@deepseek-ai/dsh-storage-json": {
-      "version": "0.2.0-rc.2",
+      "version": "0.2.1-alpha.2",
       "license": "MIT",
-      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-storage-json/-/dsh-storage-json-0.2.0-rc.2.tgz",
+      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-storage-json/-/dsh-storage-json-0.2.1-alpha.2.tgz",
       "purpose": "Build and test fixture for official DSH JSON storage",
       "usedAs": [
         "devDependencies"
-      ]
+      ],
+      "specs": {
+        "devDependencies": "0.2.1-alpha.2"
+      }
     },
     "typescript": {
       "version": "5.8.3",
@@ -179,7 +229,85 @@
       "purpose": "Build-time type checking and declarations",
       "usedAs": [
         "devDependencies"
-      ]
+      ],
+      "specs": {
+        "devDependencies": "5.8.3"
+      }
+    },
+    "@hanamesh/devkit": {
+      "version": "0.2.3",
+      "license": "SEE LICENSE IN LICENSE",
+      "source": "file:vendor/hanamesh-devkit-0.2.3.tgz",
+      "purpose": "Development-only centralized tool execution; never imported by runtime; no public peer",
+      "usedAs": [
+        "devDependencies"
+      ],
+      "specs": {
+        "devDependencies": "file:vendor/hanamesh-devkit-0.2.3.tgz"
+      },
+      "sourceCommit": "e6ccf710369a77c5fbf9ce4810b182727e4f2aa8",
+      "licenseNotice": "# HanaMesh distribution notice\n\nThis package contains HanaMesh-owned code. The project owner confirmed that its\nown code may be distributed (D-2026-10-05-02) and directed correction of outdated\nprivate / UNLICENSED package metadata (D-2026-10-05-16, 2026-10-05).\n\nThis notice records that distribution authorization. It does not assign an SPDX\nlicense identifier, adopt MIT or another standard license, or grant additional\nrelicensing rights. Rights not covered by the owner's recorded distribution\nauthorization remain reserved. See LICENSE_RECORD.md for the package name,\nversion, source, purpose and third-party boundaries.\n\nThird-party components retain their existing licenses. No third-party component\nis relicensed by this notice. This metadata change is not an npm publication or\na change to repository visibility.\n",
+      "distributionRecord": "# Devkit license and distribution record\n\n| Name | Version | License / authorization | Source | Purpose |\n| --- | --- | --- | --- | --- |\n| @hanamesh/devkit | 0.2.3 | SEE LICENSE IN LICENSE; HanaMesh-owned distribution authorized in D-2026-10-05-02 and D-2026-10-05-16; no new standard license or relicensing grant | yzsnstotz/hanamesh-server-shared, packages/devkit; baseline b2b5c9bb7faa990e3eb9f99007abd6427d62e88b / rc.1 | Development preflight, mutation execution, package verification and toolchain checks |\n\nThe original rc.1 manifest contained private=true and license=UNLICENSED, with no\nstandalone LICENSE text. Those obsolete metadata fields are superseded for rc.2\nby private=false and this explicit distribution notice. The old tarball and\nrecords remain unchanged. 0.2.0 adds Git tag-range installation and the\n`contract/` supply schema, fixtures and suite under the same authorization;\nit still adds no dependency. This package has no dependency or peerDependency and\nships no third-party runtime or compiler. It uses Node standard-library APIs;\nNode itself is supplied by the consumer and is not bundled here.\n\nAuthority: the project owner's 2026-10-05 instruction to correct lib-provision\nand devkit vendor metadata under D-2026-10-05-02, recorded in D-2026-10-05-16.\nThe notice does not extend that instruction into a new general license.\n",
+      "licenseSha256": "242b0b71d3a4a91899ccf38fb70f06d151f3f005c3d7ac7d1e4a6c0461dc0e2d",
+      "historicalArtifact": {
+        "version": "0.2.0",
+        "sha256": "de15f0913dd6de5ba9ce96b8d92ea862ec44489eb698628de963cbbead68bc25",
+        "sourceCommit": "8f9bcc69cbacf01d97ffe63bbbade4f865e6dd89"
+      },
+      "originalSource": "git+https://github.com/yzsnstotz/hanamesh-server-shared.git#semver:^0.2.0&path:/packages/devkit",
+      "archiveSha256": "40d7ad33b2802677d12111943f3472aa6e4564ba000d48074a32de33ff51c7bb"
+    },
+    "semver": {
+      "version": "7.8.5",
+      "license": "ISC",
+      "source": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "purpose": "Public host compatibility ranges and PluginManager exact-save capability version check",
+      "specs": {
+        "dependencies": "7.8.5"
+      }
+    },
+    "@deepseek-ai/dsh-client-ui-renderer": {
+      "version": "0.2.1-alpha.2",
+      "license": "MIT",
+      "source": "https://registry.npmjs.org/@deepseek-ai/dsh-client-ui-renderer/-/dsh-client-ui-renderer-0.2.1-alpha.2.tgz",
+      "purpose": "Public DSH renderer slots service; official client placement without client changes",
+      "usedAs": [
+        "peerDependencies",
+        "devDependencies"
+      ],
+      "specs": {
+        "peerDependencies": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0",
+        "devDependencies": "0.2.1-alpha.2"
+      }
+    },
+    "@hanamesh/release-platform-gate": {
+      "version": "0.1.9",
+      "license": "UNKNOWN: private development tool does not declare a license",
+      "source": "file:vendor/hanamesh-release-platform-gate-0.1.9.tgz",
+      "purpose": "Development-only shared immutable platform dependency release gate; R2 PASS tool019, integration subject to R1; never runtime or bundled",
+      "usedAs": [
+        "devDependencies"
+      ],
+      "specs": {
+        "devDependencies": "file:vendor/hanamesh-release-platform-gate-0.1.9.tgz"
+      },
+      "sourceCommit": "13ec0db3bc6aa6b6235f2105d3f0a6b998855ff5",
+      "archiveSha256": "c72010c96a5f22e36d65f6c1fd850e583dead7e843644eba1657b4416d9cbd0d"
+    }
+  },
+  "downloadedRuntimes": {
+    "Node.js": {
+      "versions": [
+        "24.13.1",
+        "24.22.0"
+      ],
+      "license": "MIT for Node.js; original archive LICENSE retains bundled third-party notices and licenses",
+      "source": "https://nodejs.org/dist/",
+      "purpose": "Plugin-managed standalone guardian/CLI supervisor runtime, acquired only after explicit plugin-page confirmation",
+      "distribution": "Not bundled in npm package; complete official tar.gz retained under lib-provision ownership, including LICENSE",
+      "pinnedAssets": "dist/node-runtime/releases.json",
+      "releaseKeyringCommit": "481637f813e912c4aa3622d7964ab426c97b8e8d",
+      "sourceProof": "Official clear-signed SHASUMS256.txt.asc verified by gpgv; each full mac archive SHA matched; byte/payload/license hashes recorded in release catalog"
     }
   }
 }

package/docs/PROVENANCE.json

@@ -1,10 +1,25 @@
 {
   "currentCandidate": {
-    "version": "0.2.0-rc.2",
-    "dshTarget": "0.2.0-rc.2",
-    "vendorSha256VerifiedAtBuild": true,
-    "libProvisionDistribution": "Owner confirmed self-owned and distributable; source license remains UNLICENSED; see LICENSE and docs/LICENSES.json",
-    "publicNpmGate": "NOT_RUN"
+    "version": "0.6.12",
+    "dshTarget": ">=0.2.0-rc.2 <0.3.0-0 || >=0.2.1-0 <0.3.0-0",
+    "vendorSha256VerifiedAtBuild": false,
+    "libProvisionDistribution": "随包分发、源仓不变; bundleDependencies; original LICENSE retained, no relicensing",
+    "publicNpmGate": "NOT_RUN",
+    "verification": "PARTIAL / D230 failed activation cleanup; real original facts, native isolation and final-package U2 independently pending",
+    "node": "24.13.1",
+    "pnpm": "10.33.0",
+    "fixedUpstream": "d743267388641bc76f17c45ce8b4c231aed1d32c",
+    "devkit": "0.2.3",
+    "libProvision": "0.2.1",
+    "compatibility": "SOURCE: official installed rc.2 public API audit; separate runtime, browser, package and owner gates pending",
+    "reviewedInputs": {
+      "managedNode": "4c2d5bf63aa11b84dbfb4851a9da35e538ac47b1",
+      "manualRestart": "dd76828",
+      "hostThemeTokens": "0d6b533",
+      "b17": "b13e60a5e27fa011fd7a5904d5dd0e03e9229a4e"
+    },
+    "excludedPendingCandidate": "PKG/PRE/first-profile seeds and complete application installation remain separate gates",
+    "knownBaselineLimitation": "0.6.9 historical missing relative ledger import is fixed by the C-reviewed B17 public lib-provision ledger reader; managed Node readiness still does not establish full application operation acceptance."
   },
   "module": "app-host",
   "version": "0.1.0-rc.12",
@@ -50,14 +65,40 @@
   "auxiliaryAgents": 0,
   "tokenUsage": "not independently metered",
   "upstreamFilesModified": 0,
-  "bundledArtifacts": {
+  "sessionLogWrites": 0,
+  "historicalCandidateLicense": "UNLICENSED; no upstream-license inheritance or open-source grant asserted",
+  "developmentArtifacts": {
+    "@hanamesh/devkit": {
+      "version": "0.2.3",
+      "source": "file:vendor/hanamesh-devkit-0.2.3.tgz",
+      "sourceCommit": "e6ccf710369a77c5fbf9ce4810b182727e4f2aa8",
+      "mode": "Fixed provider package archive; unchanged published files at sourceCommit; development-only, excluded from runtime tarball",
+      "license": "SEE LICENSE IN LICENSE",
+      "distributionNotice": "Canonical LICENSE and LICENSE_RECORD.md copied verbatim to docs/LICENSES.json; no new MIT or relicensing grant",
+      "lockfile": {
+        "path": "pnpm-lock.yaml",
+        "resolution": "fixed file archive with integrity, no Git credentials"
+      },
+      "licenseSha256": "242b0b71d3a4a91899ccf38fb70f06d151f3f005c3d7ac7d1e4a6c0461dc0e2d",
+      "historicalArtifact": {
+        "version": "0.2.0",
+        "sha256": "de15f0913dd6de5ba9ce96b8d92ea862ec44489eb698628de963cbbead68bc25",
+        "sourceCommit": "8f9bcc69cbacf01d97ffe63bbbade4f865e6dd89"
+      },
+      "originalSource": "git+https://github.com/yzsnstotz/hanamesh-server-shared.git#semver:^0.2.0&path:/packages/devkit",
+      "sha256": "40d7ad33b2802677d12111943f3472aa6e4564ba000d48074a32de33ff51c7bb"
+    }
+  },
+  "externalArtifacts": {
     "@hanamesh/lib-provision": {
-      "version": "0.1.0-rc.1",
-      "source": "vendor/hanamesh-lib-provision-0.1.0-rc.1.tgz",
-      "sha256": "386d57361ccc3c8578f54cad8137acc291dd72e01b3ff987e65dfaa716f2e0b0",
-      "mode": "build-time inline into dist/provision; no package dependency or peer declaration"
+      "version": "0.2.1",
+      "source": "file:vendor/hanamesh-lib-provision-0.2.1.tgz",
+      "sha256": "4217b9fe1be98f6e82437539d1c4c43166ed1f5c292efff100733e0cb09530e9",
+      "mode": "Fixed provider package archive; unchanged published files at sourceCommit; bundled runtime dependency",
+      "sourceCommit": "575d63fb70e08c47e980dbf25f07921a7ba5aa2a",
+      "license": "SEE LICENSE IN LICENSE",
+      "originalSource": "git+https://github.com/yzsnstotz/hanamesh-lib-provision.git#575d63fb70e08c47e980dbf25f07921a7ba5aa2a"
     }
   },
-  "sessionLogWrites": 0,
-  "historicalCandidateLicense": "UNLICENSED; no upstream-license inheritance or open-source grant asserted"
+  "historicalInputNotice": "Top-level legacy input/runtime/prototype fields below describe the original rc.12 intake only. Current candidate identity and verification are in currentCandidate; they do not inherit legacy host/UI evidence."
 }

package/docs/SECURITY.md

@@ -1,3 +1,11 @@
+0.6.7 installation-status is a separately consented read capability: exact existing loopback Host/approved Origin, credentials omitted, strict POST body before any reader. Core is authoritative; CLI executable/profile/target/budgets are static trusted settings, never browser input. Official list output is whitelisted and no raw paths, unrelated inventory or errors leave the host. A live detached IPC anchor owns cancellation and parent-disconnect group cleanup; no cached installed answer. See INSTALLATION_STATUS.md for exact protocol and scope limits.
+
+D-230: failed activation releases only resources acquired by that AppHost activation, including partially registered routes and optional-service listeners. Once-only releases also serve normal Cordis unload. All failed-startup releases are attempted in reverse order; APPHOST_CLEANUP_FAILED names the internal resource without raw errors or credentials, and logger failures cannot replace the original activation error. No authentication, origin, lease, application or browser policy is relaxed.
+
+D-221: service availability, package binding, readiness and authorized traffic are not proof of application presentation/business success. No verified original fact source is connected, so the adapter emits no automatic Usage record or timestamp and logs only a fixed USAGE_FACT_UNAVAILABLE capability diagnostic. Independent Router counts, including legacy reported bits, do not prove business success or Usage confirmation. No application event/SDK/credential or trust bridge is introduced.
+
+D-214: verification is trusted producer/client-view configuration, never a Target/URL/global-page capability. Normal builds remain off. Verification uses the existing authenticated/authorized endpoints and explicit installation confirmation; showing full public error JSON does not expose internal exceptions or grant application privileges. Native test automation stays card-local and validates actual owned PID/start/PPID/PGID/argv before claiming launcher evidence.
+
 # 安全与运行边界
 
 ## 可信边界
@@ -50,3 +58,26 @@ DSH/宿主 cookie、控制头与 Authorization 默认不传上游；应用 cooki
 实际 Chromium 启动于独立临时 profile，但回环导航返回 `net::ERR_BLOCKED_BY_ADMINISTRATOR`。未改管理员 policy、未关 CSP、未使用绕过标志。两个 REAL_BROWSER 测试显式 skip 并在产品矩阵标 PARTIAL，不算 PASS。
 
 测试 Chromium 的 `--no-sandbox` 仅为隔离容器内以 root 运行测试驱动所需，绝非生产应用/DSH 的启动配置；不应该移植到生产 profile。
+
+## D-202 Desktop control and data origin separation
+
+For the fixed Desktop workspace only, each full live view binding owns one independent loopback listener with two exact, freshly random 192-bit localhost names: `control-<nonce>.localhost:<port>` and `data-<nonce>.localhost:<port>`. Only 127.0.0.1 is listened on. Names are non-secret isolation identifiers, never credentials; known retired names cannot be reassigned. A reused OS port does not restore an old origin. Scope is principal/view/generation plus the owning instance and active lease checked by AppHost. A different live view never authorizes an old request.
+
+The workspace checks the precise control origin and the iframe Window; the controlled bootstrap checks exactly `dsh-app://app` and its parent Window. The existing public connection authentication, lease ownership and single-use challenge exchange precede navigation. Authorization appears only in the authenticated response and exact-window message/exchange body, never URLs or logs. One natural control-to-data navigation consumes its own initial grant, then HTTP/resources require the exact data-origin context and live complete binding; WS requires the exact data Origin. Closing, generation rotation and restart invalidate prior authority.
+
+Control serves only bootstrap/exchange, never application documents or resources. Data serves application bytes, never bootstrap authorization pages, so the application ServiceWorker cannot control the bootstrap origin. Only exact registered Host/Origin/Referer/WS origins are admitted; no wildcard localhost, null, aliases or unrelated live grants. Data CSP admits its exact data origin for nested application frames plus the approved workspace ancestor; control CSP does not admit data. Application bodies, SDK, auth/CSRF/CORS and other security headers are unchanged. Ordinary loopback workspace security and the separately specified public install-target endpoint retain their original boundaries.
+
+These are source invariants, not native browser evidence. Component synthetic-header requests, genuine natural native requests, third-party cookie policy, retained frame/worker/SW attacks, same-response bytes, restart and final-tarball U2 are recorded separately. A constructor rejection, skipped browser, draft package or older UI observation cannot close those gates.
+
+
+## 套件兼容声明边界
+
+兼容、完整性与可升级目标由 Core 公开声明唯一决定；App-host 不复制范围/候选规则、不读其内部文件。内部 `coreSuitePlan` 只由可信装配适配器提供，不进入浏览器参数或用户配置。生产装配仅绑定可选 protocol `1` 的 `hanameshCore.getSuiteDeclaration()`，缺源必须明确 `CORE_SUITE_DECLARATION_MISSING` 并禁止升级，不以 registry latest 代替。执行端只校验固定包/精确版本的计划结构、重读确认和物理安装结果；来源及宿主兼容性由 Core 提供方承担，真实包联调、原生运行与 owner 验收仍须各自证据；物理三包齐全不能替代 Core 完整性。升级后的公开状态继续读 Core，物理读回只用于执行确认与失败诊断；Core 服务消失时不再公开缓存的完整已装状态。
+
+
+## Managed Node trust boundary
+
+The authenticated browser supplies settings or opaque plan/operation identifiers, never an executable manifest, arbitrary verification arguments or launch command. Only pinned official signed release digests enter the static manifest. Changing an HTTPS mirror changes transport, not the accepted digest. No user-info/query/hash URL or symlinked storage path is accepted. No download before current-plan confirmation. A per-runtime FileLock serializes lib-provision writes; SHA, ownership/ledger and clean-environment standalone platform/version checks precede publication. Host guardian remains unchanged and rejects Electron independently. Source or verification failure never silently falls back to system Node, another mirror or a retry.
+
+
+B17 候选的套件来源选择仅在 AppHost 自有同源已准入设置端点写入。Core 来源状态是公开只读事实，不授予安装权限；预览/确认/执行及异步声明返回时复读来源，沿用原 planId/精确 tuple/物理 baseline，来源丢失或替换即拒绝原确认。设置保存只串行持久化选择，不触发下载/安装或改写 Core 配置；持久失败保持旧选择。无 service/watch/generation 时保持不可观察边界，不缓存 ready 或回退 registry。详见 CONTRACT.md B17 段。

package/node_modules/@hanamesh/lib-provision/LICENSE

@@ -0,0 +1,15 @@
+HanaMesh-owned code: distribution authorization record
+
+Package: @hanamesh/lib-provision 0.2.1
+Source: https://github.com/yzsnstotz/hanamesh-lib-provision
+Use: Node.js library and CLI for verified archive provisioning.
+
+The project owner confirmed distribution of this HanaMesh-owned code under
+D-2026-10-05-02 (D02). The recorded original statement is:
+“那么这个我早就确认过了，而且是我们自己的代码，完全可以分发，你问这个有毛病吧”。
+
+This record documents the existing authorization to distribute this package.
+No SPDX license was designated in that authorization. This record does not
+assign MIT or another new license, or grant additional relicensing rights.
+The package metadata points here to avoid the obsolete UNLICENSED marker.
+Third-party components retain their own licenses; see THIRD_PARTY_NOTICES.md.