@khorsheed/dsh-ankh-guard 0.4.2 → 0.4.3

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # 变更记录
 
+## 0.4.3（2026-10-22）
+
+- **启动环境 scrub 扩展到 NODE_PATH / NODE_OPTIONS**：看门狗 `launch_instance`、CLI 的 bare-restart spawn 与 supervisor spawn 三处在清 `WD_*` 之外同步清 `NODE_PATH` / `NODE_OPTIONS`。从 tsx 等工具包裹的 shell 拉起看门狗时，tsx 会把 `NODE_PATH` 钉到自己的 pnpm 仓；不清掉的话它遗传给每一代实例，bundle 解析被劫持到那个检出的 workspace——组合默默地服务那个检出的内容而不是 profile 里装的版本（3080，2026-10-12：presets 被解析到主检出的 workspace 副本，新部署的 preset 行整天不可见，逐字节排查复现 9 vs 10 才定位）
+- **已结束的切换不再引发快速请求循环**：启动切换完成后，新标签页对该 cutoverId 没有匹配的注册记录，可选链把「记录不存在」误判为「尚未确认」，长轮询立即结束、客户端立刻重询；且每次所有权校验在 macOS 上同步起进程探针，阻塞其它 HTTP 响应。现在仅注册记录存在且尚未确认时才唤醒轮询；处理器在启动代际通道与回执通道之间复用自身进程身份缓存（回执、注册、认证、canary 检查仍实时执行，身份不可用时拒绝授权）；浏览器收到 `idle` 后至少等 250ms 再发起下一次 poll
+- 适配宿主 0.2.1 线：`@deepseek-ai/dsh-*` peer 区间加宽覆盖 0.2.1，声明 `engines.dsh`；退役 load 期 invariant 伴生探针（guard 状态文件损坏仍在 gate 读取时 fail-loud，契约不变）
+- 能力目录的 skill 卡片 provider 从裸词 `ankh-guard` 归一到全名 `@khorsheed/dsh-ankh-guard`，与其它卡片一致
+
 ## 0.4.2（2026-09-30）
 
 - **修复重启浮层卡死**：标签页带着 pending handoff 时，若 cutover 已不经由本标签页收口（操作员 restore、handoff off、监督链楔死），服务端对该 cutoverId 永远回 409，「正在重启」浮层会无限重试不下台。现在每 8 次失败 ACK 花一次 poll——`idle` 即证明没有在途事务，丢弃 pending 并收浮层。sessionStorage 按标签页存活，所以旧实例上已卡住的标签页不受影响此修复——关掉重开即可（3080 实测案例）

package/README.en.md

@@ -203,7 +203,7 @@ None.
 
 - npm release line (`@deepseek-ai/dsh@0.1.5-rc.1`): supported — 0.1.5-rc.1 full-line boot-verified (42 packages including capture, 2026-09-25) — with two designed degrades. The composition-preflight gate runs through the standalone `preflight-runner` (composing through the published `@deepseek-ai/dsh-app-boot` primitives with a drift tripwire, since 0.1.5-rc.1 still does not export `composeProfile`) wherever a dsh app layout resolves — `--harness-root`, the durable launch spec, `DSH_HARNESS`, or the default checkout. On a pure npm deployment with no harness checkout the gate reports a notice and proceeds instead. The original-tab bridge feature-probes the optional WebServer/connection authentication seams; hosts without token auth naturally take the existing-cookie path. Cold reads (the parked probe and the preset derivation) ride the 0.1.5 handle-based sessionPersistence (`open(id, 'read')` → `read` → `close`; the one-shot `inspect` is gone). Every other capability is intact on the npm line. minHost stays 0.1.5-rc.1 — older hosts stay on the previous release line.
 - Historical verification: a live npm-host 0.1.1-rc.2 → 0.1.2-alpha.4 isolated cutover passed (transition preflight removed a v3 whole-unit projection cache with an old-schema record from a home copy, live apply quarantined the old file, and target completed Token URL → 303 → cookie 200, the ownership stability window, and canary at zero retries; the old file remained byte-exact in the cutover directory. An untransitioned control over the same home failed on the missing Alpha.4 record fields, demonstrating that acceptance covered the real schema break).
-- source line (deepseek-harness master, fork or upstream): ✅ (verifiedHost: 0.1.7-rc.2) — the gate runs through the standalone `preflight-runner` (resolves the published `@deepseek-ai/dsh-app-boot` etc. from the live checkout), so no fork patch is required.
+- source line (deepseek-harness master, fork or upstream): ✅ (verifiedHost: 0.2.1-rc.1) — host-021 wave: full build+test green against the 0.2.1-rc.1 tree (including the 3080 production deployment acceptance); no other surface changes. The gate runs through the standalone `preflight-runner` (resolves the published `@deepseek-ai/dsh-app-boot` etc. from the live checkout), so no fork patch is required. History: the 3080 production instance's 0.2.0-rc.2 line — watchdog-supervised gated restarts passed from 2026-10-09 on (readiness + ownership stability window + canary, deployment proofs recorded on the 0.2.0-rc.2 release head `639ed01539`).
 - Dual-line evidence: the 0.1.5 boot passes end-to-end through three compat layers — the [preset-registry dual-name probe](../../.agents/notes/implemented/bug-fix/2026-09-25-preset-registry-dual-name-probe.md), [dual-shape typert codecs](../../.agents/notes/implemented/bug-fix/2026-09-25-typert-codec-dual-shape.md), and [typert faces carrying zod@4](../../.agents/notes/implemented/bug-fix/2026-09-25-typert-faces-carry-zod-v4.md).
 
 **Version line mapping**: the first release after 0.2.0 supports host `0.1.5-rc.1` and later; hosts on `0.1.2-rc.1` stay on `0.2.0`, hosts on `0.1.0-rc.6` ~ `0.1.1-rc.2` stay on the 0.1.x release line (last release `0.1.1`).

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # last confirmed-consistent state. Both languages carry equal authority; after
 # editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/ankh-guard/README.en.md
-packages/ankh-guard/README.en.md: fb474172d57154e58e44661bbefb6824c78425e0
-packages/ankh-guard/README.md: e58a1358dcfae6d426b3ced160120de361709e24
+packages/ankh-guard/README.en.md: c2163a3e673790cc46fe34b044eb85e57a0a9305
+packages/ankh-guard/README.md: db9d7b6f3c75e7b80226cffa9946cef973e7be4c

package/README.md

@@ -202,7 +202,7 @@ dsh-ankh-guard restart \
 
 - npm 发布线（`@deepseek-ai/dsh@0.1.5-rc.1`）：支持——0.1.5-rc.1 全量 boot 实证通过（42 包含 capture，2026-09-25）——带两处设计内降级。composition-preflight 门禁通过独立的 `preflight-runner` 运行（0.1.5-rc.1 仍未导出 `composeProfile`，runner 改经已发布的 `@deepseek-ai/dsh-app-boot` 原语组装，带漂移绊线测试），只要能解析到 dsh app 布局——`--harness-root`、耐久 launch spec、`DSH_HARNESS` 或默认检出路径——就完整运行。没有 harness 检出的纯 npm 部署下门禁退化为提示后放行。原标签页桥会探测可选 WebServer/connection 认证 seam，不使用 token 认证的宿主自然走现有 Cookie 路径；冷读（停靠探测与 preset 推导）走 0.1.5 的 handle 制 sessionPersistence（`open(id, 'read')` → `read` → `close`，一次性 `inspect` 已移除）。其余能力在 npm 线上完整。minHost 保持 0.1.5-rc.1，旧宿主请停留在旧发布线。
 - 历史验证：npm host 的 0.1.1-rc.2 → 0.1.2-alpha.4 隔离切换已通过（transition preflight 在 home 副本上移开带旧 schema record 的 v3 whole-unit projection cache，live apply 隔离旧文件，target 以零重试完成 Token URL → 303 → Cookie 200、ownership 稳定窗口与 canary；旧文件逐字节保留在 cutover 目录。相同 home 的无 transition 对照因缺少 Alpha.4 record 字段而拒绝，证明验收覆盖了真实 schema 断裂面）。
-- 源码线（deepseek-harness master，fork 或上游）：✅（verifiedHost: 0.1.7-rc.2）——门禁通过独立的 `preflight-runner` 运行（从在线 checkout 解析已发布的 `@deepseek-ai/dsh-app-boot` 等），不再需要 fork 补丁。
+- 源码线（deepseek-harness master，fork 或上游）：✅（verifiedHost: 0.2.1-rc.1）——host-021 波对 0.2.1-rc.1 树全量 build+test 绿（含 3080 生产部署验收），无其它表面变化。门禁通过独立的 `preflight-runner` 运行（从在线 checkout 解析已发布的 `@deepseek-ai/dsh-app-boot` 等），不再需要 fork 补丁。历史：3080 生产实例的 0.2.0-rc.2 线——watchdog 值守的 gated restart 自 2026-10-09 起连续 PASS（readiness + ownership 稳定窗口 + canary，deployment proof 记于 0.2.0-rc.2 release 头 `639ed01539`）。
 - 双线证据：0.1.5 的 boot 经三层兼容修复端到端通过——[preset-registry 双名探测](../../.agents/notes/implemented/bug-fix/2026-09-25-preset-registry-dual-name-probe.md)、[typert codec 双形状](../../.agents/notes/implemented/bug-fix/2026-09-25-typert-codec-dual-shape.md)、[face 自带 zod@4](../../.agents/notes/implemented/bug-fix/2026-09-25-typert-faces-carry-zod-v4.md)。
 
 **版本线对照**：0.2.0 之后的首个发布起支持宿主 `0.1.5-rc.1` 及以后；宿主 `0.1.2-rc.1` 请停留在 `0.2.0`，宿主 `0.1.0-rc.6` ~ `0.1.1-rc.2` 请停留在 0.1.x 发布线（末版 `0.1.1`）。

package/lib/cli.js

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
-import { i as resolveStateDir, n as isDirectInvocation, r as resolveRepoDir, t as SRC_ARTIFACT_PATTERN } from "./defaults-CduvOcGq.js";
-import { A as writeStableLaunchSpec, C as prepareLaunchCutover, D as selectedLaunchSpec, E as recordCutoverEvent, F as workingTreeChanges, M as currentHead, N as isWorkingTreeClean, O as summarizeLaunchState, P as resetToCheckpoint, T as readLaunchState, _ as writeRestartOutcome, b as activeCutover, c as readInstanceLaunch, f as writeAdoptionRecord, h as writeInstanceLaunchAsSupervisor, j as commitCheckpoint, k as writeCutoverControl, p as writeCompositionRecovery, u as readSkillRegistration, w as readCutoverReceipt, x as commandSha256, y as writeUnexpectedExitRecord } from "./restart-context-DlaDZWKq.js";
+import { i as resolveStateDir, n as isDirectInvocation, r as resolveRepoDir, t as SRC_ARTIFACT_PATTERN } from "./defaults-DX6GVMvK.js";
+import { A as writeStableLaunchSpec, B as pidAlive, C as prepareLaunchCutover, D as selectedLaunchSpec, E as recordCutoverEvent, F as setProvenDeployment, G as resetToCheckpoint, H as commitCheckpoint, I as verifyCredential, K as workingTreeChanges, L as lastGoodBootRevision, M as loadState, N as recordCredential, O as summarizeLaunchState, P as setCheckpoint, R as livePidIn, T as readLaunchState, U as currentHead, V as stateFile, W as isWorkingTreeClean, _ as writeRestartOutcome, b as activeCutover, c as readInstanceLaunch, f as writeAdoptionRecord, h as writeInstanceLaunchAsSupervisor, j as clearCredential, k as writeCutoverControl, p as writeCompositionRecovery, u as readSkillRegistration, w as readCutoverReceipt, x as commandSha256, y as writeUnexpectedExitRecord, z as liveWatchdogPid } from "./restart-context-BYN4zJsu.js";
 import { _ as processIdentity, c as appendTestLifecycleEvent, d as registerTestProcess, f as discoverLaunchCommand, h as killPidTree, l as appendTestLifecycleEventForProcess, m as findPidOnPort, n as TEST_PROCESS_ROLE_ENV, p as findOwnedListener, r as TEST_PROCESS_TEMP_ROOT_ENV, t as TEST_PROCESS_PORT_ENV, u as registerCurrentTestProcess, v as processIdentityMatches } from "./test-seam-dwvaKjRp.js";
-import { a as setProvenDeployment, c as lastGoodBootRevision, d as pidAlive, f as stateFile, i as setCheckpoint, l as livePidIn, n as loadState, r as recordCredential, s as verifyCredential, t as clearCredential, u as liveWatchdogPid } from "./state-CZMypGkB.js";
 import { execFileSync, spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { chmodSync, constants, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, utimesSync, writeFileSync } from "node:fs";
@@ -3071,6 +3070,8 @@ async function runCli(argv, io) {
 				const startEnv = { ...process.env };
 				delete startEnv.DSH_ANKH_RESTART_DRIVER;
 				for (const key of Object.keys(startEnv)) if (key.startsWith("WD_")) delete startEnv[key];
+				delete startEnv.NODE_PATH;
+				delete startEnv.NODE_OPTIONS;
 				const child = spawn(start, {
 					shell: true,
 					detached: true,
@@ -3255,6 +3256,8 @@ async function runCli(argv, io) {
 			const supervisorBaseEnv = { ...process.env };
 			delete supervisorBaseEnv.DSH_ANKH_VERDICT_FILE;
 			for (const key of Object.keys(supervisorBaseEnv)) if (key.startsWith("WD_")) delete supervisorBaseEnv[key];
+			delete supervisorBaseEnv.NODE_PATH;
+			delete supervisorBaseEnv.NODE_OPTIONS;
 			const env = {
 				...supervisorBaseEnv,
 				WD_PORT: String(spec.port),

package/lib/client.js

@@ -272,7 +272,7 @@ window.__ModuleLoader__.load({
 					if (typeof result.bootId === "string") sessionStorage.setItem(BOOT_ID_KEY, result.bootId);
 					if (result.state === "idle") {
 						document.getElementById("ankh-guard-browser-handoff")?.remove();
-						schedule();
+						schedule(ACTIVE_RETRY_MS);
 						return;
 					}
 					if (result.state === "waiting") waitingOverlay();

package/lib/{defaults-CduvOcGq.js → defaults-DX6GVMvK.js}

@@ -3,8 +3,8 @@ import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 //#region lib/types/defaults.js
 /**
-* Default state/repo directory resolution, shared by the cordis plugin, the
-* CLI, and the invariant companion so all three agree on where a credential
+* Default state/repo directory resolution, shared by the cordis plugin and
+* the CLI so both agree on where a credential
 * lives. The state file must survive a restart, so it anchors to DSH_HOME (or
 * the checkout) rather than any process-lifetime directory.
 */

package/lib/exit-agent.js

@@ -1,4 +1,4 @@
-import { n as isDirectInvocation } from "./defaults-CduvOcGq.js";
+import { n as isDirectInvocation } from "./defaults-DX6GVMvK.js";
 import { m as findPidOnPort, u as registerCurrentTestProcess } from "./test-seam-dwvaKjRp.js";
 import { writeFileSync } from "node:fs";
 //#region lib/types/exit-agent.js

package/lib/index.js

@@ -1,7 +1,6 @@
-import { i as resolveStateDir, r as resolveRepoDir, t as SRC_ARTIFACT_PATTERN } from "./defaults-CduvOcGq.js";
-import { M as currentHead, N as isWorkingTreeClean, P as resetToCheckpoint, S as cutoverBlocksWake, a as interruptedSnapshotFile, b as activeCutover, c as readInstanceLaunch, d as restartContextText, g as writeInterruptedSnapshot, i as continueInterruptedText, j as commitCheckpoint, l as readInterruptedSnapshot, m as writeInstanceLaunch, n as buildLaunchCommand, o as isParkedOnUserInput, r as continueAndReportText, s as pendingRestartRecord, t as acknowledgeRestartRecord, v as writeSkillRegistration, w as readCutoverReceipt } from "./restart-context-DlaDZWKq.js";
-import { _ as processIdentity, g as listeningPortsForPid, v as processIdentityMatches } from "./test-seam-dwvaKjRp.js";
-import { f as stateFile, i as setCheckpoint, n as loadState, r as recordCredential, s as verifyCredential, t as clearCredential, u as liveWatchdogPid } from "./state-CZMypGkB.js";
+import { i as resolveStateDir, r as resolveRepoDir, t as SRC_ARTIFACT_PATTERN } from "./defaults-DX6GVMvK.js";
+import { G as resetToCheckpoint, H as commitCheckpoint, I as verifyCredential, M as loadState, N as recordCredential, P as setCheckpoint, S as cutoverBlocksWake, U as currentHead, V as stateFile, W as isWorkingTreeClean, a as interruptedSnapshotFile, b as activeCutover, c as readInstanceLaunch, d as restartContextText, g as writeInterruptedSnapshot, i as continueInterruptedText, j as clearCredential, l as readInterruptedSnapshot, m as writeInstanceLaunch, n as buildLaunchCommand, o as isParkedOnUserInput, r as continueAndReportText, s as pendingRestartRecord, t as acknowledgeRestartRecord, v as writeSkillRegistration, w as readCutoverReceipt, z as liveWatchdogPid } from "./restart-context-BYN4zJsu.js";
+import { _ as processIdentity, g as listeningPortsForPid } from "./test-seam-dwvaKjRp.js";
 import { spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { chmodSync, existsSync, linkSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
@@ -242,17 +241,21 @@ function authenticationState(connection, req) {
 function createBrowserHandoffHandler(dependencies) {
 	const pid = dependencies.pid ?? process.pid;
 	const now = dependencies.now ?? Date.now;
-	const identityMatches = dependencies.identityMatches ?? processIdentityMatches;
 	const identityProvider = dependencies.identityProvider ?? processIdentity;
 	const longPollMs = dependencies.longPollMs ?? DEFAULT_LONG_POLL_MS;
 	const longPollIntervalMs = dependencies.longPollIntervalMs ?? DEFAULT_LONG_POLL_INTERVAL_MS;
-	let bootIdCache;
+	let selfIdentity;
+	const identity = () => {
+		if (selfIdentity === void 0) selfIdentity = identityProvider(pid);
+		return selfIdentity;
+	};
+	const identityMatches = dependencies.identityMatches ?? ((expected) => {
+		const own = identity();
+		return own !== null && expected.pid === pid && own.pid === pid && own.startToken === expected.startToken;
+	});
 	const thisBootId = () => {
-		if (bootIdCache === void 0) {
-			const identity = identityProvider(pid);
-			bootIdCache = identity === null ? null : `${String(identity.pid)}:${identity.startToken}`;
-		}
-		return bootIdCache ?? void 0;
+		const own = identity();
+		return own === null ? void 0 : `${String(own.pid)}:${own.startToken}`;
 	};
 	return async (req, res) => {
 		const connection = dependencies.connectionProvider?.() ?? dependencies.connection;
@@ -305,7 +308,8 @@ function createBrowserHandoffHandler(dependencies) {
 				}
 				const ready = currentReadyOwnership(dependencies.stateDir, pid, identityMatches);
 				const registration = readBrowserHandoffRequest(dependencies.stateDir);
-				return ready !== null && matchingRegistration(registration, ready.cutoverId, requestAuthority.authority, digest)?.acknowledgedAt === void 0;
+				const registered = ready === null ? void 0 : matchingRegistration(registration, ready.cutoverId, requestAuthority.authority, digest);
+				return registered !== void 0 && registered.acknowledgedAt === void 0;
 			};
 			await waitForPollState(pollHasState, longPollMs, longPollIntervalMs);
 			const active = activeCutover(dependencies.stateDir);
@@ -787,7 +791,7 @@ function registerRestartSkill(ctx, stateDir) {
 			description,
 			content,
 			source: "runtime",
-			provider: "ankh-guard"
+			provider: "@khorsheed/dsh-ankh-guard"
 		}));
 		writeSkillRegistration(stateDir, {
 			registered: true,

package/lib/preflight-runner.js

@@ -1,4 +1,4 @@
-import { n as isDirectInvocation } from "./defaults-CduvOcGq.js";
+import { n as isDirectInvocation } from "./defaults-DX6GVMvK.js";
 import { createRequire } from "node:module";
 import { existsSync, mkdtempSync, statSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";

package/lib/{restart-context-DlaDZWKq.js → restart-context-BYN4zJsu.js}

@@ -1,4 +1,4 @@
-import { f as stateFile } from "./state-CZMypGkB.js";
+import { c as appendTestLifecycleEvent } from "./test-seam-dwvaKjRp.js";
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { chmodSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
@@ -248,6 +248,325 @@ function resetToCheckpoint(repoDir, sha) {
 	}
 }
 //#endregion
+//#region lib/types/state-files.js
+/**
+* The guard's state-directory protocol: every file that lives in the state
+* dir, named exactly once. Five writers in three languages (this package's
+* TS, the watchdog's bash, the schedule-exit exit agent's inline JS, and the
+* two supervisor installers) read and write these — a literal drifting in
+* any one of them splits the protocol silently (three review rounds of path
+* bugs came from exactly that). The bash sides are pinned by
+* tests/state-files.spec.ts, which asserts every state-dir literal in the
+* watchdog and both installers appears here, and that no script re-derives
+* the directory from the home.
+*/
+/** Every state-directory file name, keyed by role. */
+const STATE_FILES = {
+	/** The guard's credential/checkpoint/audit state (state.ts). */
+	guard: "self-restart-guard.json",
+	/** Watchdog-stamped last deployment-proven revision. */
+	lastGoodBoot: "last-good-boot.json",
+	/** schedule-exit → watchdog: an intentional restart, run the canary. */
+	restartRequested: "restart-requested.json",
+	/** The exit agent's restart outcome record (the report's source). */
+	lastRestart: "last-restart.json",
+	/** The SIGTERM snapshot of interrupted sessions. */
+	interruptedSessions: "interrupted-sessions.json",
+	/** The supervising watchdog's pidfile. */
+	watchdogPid: "watchdog.pid",
+	/** Cross-session mutual exclusion for the restart verb. */
+	restartLock: "restart.lock",
+	/** The detached restart driver's log. */
+	restartLog: "restart.log",
+	/** Marker: exit the watchdog without respawn. */
+	watchdogStop: "watchdog-stop",
+	/** Marker: the watchdog gave up; a crash page holds the port. */
+	watchdogGaveUp: "watchdog-gave-up",
+	/** The current boot attempt's captured output. */
+	bootAttemptLog: "boot-attempt.log",
+	/** The watchdog's own log. */
+	watchdogLog: "watchdog.log",
+	/** The watchdog's stderr, captured separately by the supervisor installers. */
+	watchdogStderrLog: "watchdog.stderr.log",
+	/** The exit agent's log. */
+	scheduleExitLog: "schedule-exit.log",
+	/** How the current instance was launched (recorded by the plugin at apply). */
+	instanceLaunch: "instance-launch.json",
+	/** The atomically selected full launch configuration (stable or in cutover). */
+	launchSpec: "launch-spec.json",
+	/** Redacted durable receipt for the latest launch-configuration cutover. */
+	launchCutover: "launch-cutover.json",
+	/** Legacy combined operator-control marker, retained for rolling upgrades. */
+	cutoverControl: "launch-cutover-control.json",
+	/** Operator → watchdog: abort according to the pre-approved recovery policy. */
+	cutoverAbort: "launch-cutover-abort.json",
+	/** Monotonic stronger operator action: explicitly restore the previous spec. */
+	cutoverRestorePrevious: "launch-cutover-restore-previous.json",
+	/** Original browser-tab registry: per-tab capability hashes only; retained through terminal recovery. */
+	browserHandoffRequest: "browser-handoff-request.json",
+	/** Browser → watchdog acknowledgement for one proven final process. */
+	browserHandoffAck: "browser-handoff-ack.json",
+	/** Whether the restart-protocol skill registered at apply (and why not). */
+	skillRegistration: "skill-registration.json",
+	/** Directory: the healthy-boot snapshot of the profile composition inputs. */
+	lastGoodComposition: "last-good-composition",
+	/** Directory prefix: a failing composition backed up before rollback restores over it. */
+	compositionBackup: "composition-backup-"
+};
+/** Absolute path of a state file inside a state directory. */
+function stateFile(stateDir, role) {
+	return join(stateDir, STATE_FILES[role]);
+}
+/**
+* The last deployment-proven revision, stamped by the watchdog on every
+* healthy boot, or undefined. Lives here rather than in the credential core:
+* the stamp is written by the watchdog and proves the deployment composed and
+* came up — a green credential only ever proves build+test passed.
+* @param stateDir - state directory.
+* @returns the stamped revision, or undefined.
+*/
+function lastGoodBootRevision(stateDir) {
+	try {
+		const stamp = JSON.parse(readFileSync(stateFile(stateDir, "lastGoodBoot"), "utf8"));
+		return typeof stamp.revision === "string" && stamp.revision !== "" ? stamp.revision : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Whether the pid named by this raw pid/lock-file content is alive. Empty
+* content reads as NO holder: Number('') is 0 and kill(0, 0) probes our own
+* process group (always succeeds), which once read as "alive" and refused
+* every restart forever — the bug that had to be fixed in two copies of this
+* logic before it was consolidated here.
+*/
+function pidAlive(raw) {
+	const pid = Number(raw);
+	if (raw === "" || !Number.isInteger(pid) || pid <= 0) return false;
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** The live pid named by a pid/lock file (as the raw string), or null when absent/stale. */
+function livePidIn(file) {
+	try {
+		const raw = readFileSync(file, "utf8").trim();
+		return pidAlive(raw) ? raw : null;
+	} catch {
+		return null;
+	}
+}
+/** The live supervising watchdog's pid, or null when none is (pidfile + kill 0). */
+function liveWatchdogPid(stateDir) {
+	const raw = livePidIn(stateFile(stateDir, "watchdogPid"));
+	const pid = raw === null ? null : Number(raw);
+	appendTestLifecycleEvent("watchdog-liveness-probe", {
+		pid: pid ?? 0,
+		live: pid !== null
+	}, "parent-observer");
+	return pid;
+}
+//#endregion
+//#region lib/types/state.js
+/**
+* Pure credential/checkpoint state core for the self-restart guard.
+*
+* The guard records one "green build" credential — bound to the git HEAD it
+* was recorded on and to a freshness window — and answers `verify()` against
+* the CURRENT head and wall clock. A later fully gated boot may promote that
+* credential into a deployment proof whose exact runtime fingerprint can be
+* reused by the same-launch restart path. Framework-free: the cordis plugin
+* and the CLI share this module.
+*/
+/** Absolute path of the state file inside a state directory. */
+function stateFilePath(stateDir) {
+	return stateFile(stateDir, "guard");
+}
+/** A fresh, credential-less state. */
+function emptyState() {
+	return { audit: [] };
+}
+function isCredential(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const c = value;
+	return typeof c.scope === "string" && typeof c.revision === "string" && typeof c.recordedAt === "number" && typeof c.command === "string";
+}
+function isCheckpoint(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const c = value;
+	return typeof c.revision === "string" && typeof c.recordedAt === "number" && typeof c.message === "string";
+}
+function isSha256(value) {
+	return typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+}
+function isProvenDeployment(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const proof = value;
+	const credential = proof.credential;
+	const fingerprint = proof.fingerprint;
+	return proof.version === 1 && typeof proof.provenAt === "number" && credential !== void 0 && typeof credential.revision === "string" && credential.revision !== "" && typeof credential.recordedAt === "number" && typeof credential.scope === "string" && isSha256(credential.commandSha256) && fingerprint?.version === 1 && typeof fingerprint.credentialRevision === "string" && fingerprint.credentialRevision !== "" && typeof fingerprint.harnessRevision === "string" && fingerprint.harnessRevision !== "" && isSha256(fingerprint.launchSpecSha256) && isSha256(fingerprint.profileSha256) && isSha256(fingerprint.hostRuntimeSha256) && isSha256(proof.fingerprintSha256);
+}
+function isAuditEntry(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const e = value;
+	return (e.action === "record" || e.action === "clear" || e.action === "checkpoint" || e.action === "prove-deployment") && typeof e.ts === "number" && typeof e.detail === "string";
+}
+/**
+* Read the state file; an absent file is an empty state, a malformed one is a
+* loud misconfiguration error (never silently ignored).
+* @param stateDir - directory holding the state file.
+* @returns the parsed state.
+*/
+function loadState(stateDir) {
+	try {
+		const raw = readFileSync(stateFilePath(stateDir), "utf8");
+		const parsed = JSON.parse(raw);
+		if (parsed === null || typeof parsed !== "object") return emptyState();
+		const state = { audit: Array.isArray(parsed.audit) ? parsed.audit.filter(isAuditEntry) : [] };
+		if (isCredential(parsed.credential)) state.credential = parsed.credential;
+		if (isProvenDeployment(parsed.provenDeployment)) state.provenDeployment = parsed.provenDeployment;
+		if (isCheckpoint(parsed.checkpoint)) state.checkpoint = parsed.checkpoint;
+		return state;
+	} catch (error) {
+		if (error?.code === "ENOENT") return emptyState();
+		throw new Error(`ankh-guard: unreadable state file ${stateFilePath(stateDir)}: ${String(error)}`);
+	}
+}
+/** Persist a state (creates the directory as needed). */
+function saveState(stateDir, state) {
+	mkdirSync(stateDir, { recursive: true });
+	const file = stateFilePath(stateDir);
+	const tmp = `${file}.${process.pid}.tmp`;
+	writeFileSync(tmp, `${JSON.stringify(state, null, 2)}\n`);
+	renameSync(tmp, file);
+}
+function withAudit(state, entry) {
+	return {
+		...state,
+		audit: [...state.audit, entry].slice(-50)
+	};
+}
+/**
+* Record a green-build credential bound to {@link RecordInput.revision}.
+* @param stateDir - state directory.
+* @param input - scope, the git HEAD, and the command that went green.
+* @param now - epoch milliseconds (injected for deterministic tests).
+* @returns the persisted state.
+*/
+function recordCredential(stateDir, input, now) {
+	const credential = {
+		...input,
+		recordedAt: now
+	};
+	const { provenDeployment: _oldProof, ...withoutOldProof } = withAudit(loadState(stateDir), {
+		action: "record",
+		ts: now,
+		detail: `${input.scope} @ ${input.revision}`
+	});
+	const updated = {
+		...withoutOldProof,
+		credential
+	};
+	saveState(stateDir, updated);
+	return updated;
+}
+/**
+* Drop the credential (checkpoint and audit survive).
+* @param stateDir - state directory.
+* @param now - epoch milliseconds (injected for deterministic tests).
+* @returns the persisted state.
+*/
+function clearCredential(stateDir, now) {
+	const audited = withAudit(loadState(stateDir), {
+		action: "clear",
+		ts: now,
+		detail: "credential cleared"
+	});
+	const updated = { audit: audited.audit };
+	if (audited.checkpoint !== void 0) updated.checkpoint = audited.checkpoint;
+	saveState(stateDir, updated);
+	return updated;
+}
+/** Persist a deployment proof after the watchdog has completed its canary. */
+function setProvenDeployment(stateDir, proof, now) {
+	const updated = {
+		...withAudit(loadState(stateDir), {
+			action: "prove-deployment",
+			ts: now,
+			detail: `${proof.credential.revision} ${proof.fingerprintSha256.slice(0, 16)}`
+		}),
+		provenDeployment: proof
+	};
+	saveState(stateDir, updated);
+	return updated;
+}
+/**
+* Persist a pre-batch checkpoint commit reference.
+* @param stateDir - state directory.
+* @param input - the checkpoint commit SHA and its message.
+* @param now - epoch milliseconds (injected for deterministic tests).
+* @returns the persisted state.
+*/
+function setCheckpoint(stateDir, input, now) {
+	const checkpoint = {
+		...input,
+		recordedAt: now
+	};
+	const updated = {
+		...withAudit(loadState(stateDir), {
+			action: "checkpoint",
+			ts: now,
+			detail: `${input.revision} ${input.message}`
+		}),
+		checkpoint
+	};
+	saveState(stateDir, updated);
+	return updated;
+}
+/**
+* Answer the gate: a credential is valid only when present, recorded on the
+* CURRENT revision, and younger than {@link maxAgeMinutes}.
+* @param state - the loaded state.
+* @param currentRevision - the git HEAD of the checkout, or null when unavailable.
+* @param now - epoch milliseconds (injected for deterministic tests).
+* @param maxAgeMinutes - freshness window.
+* @param workingTreeClean - whether staged, unstaged, and untracked inputs are absent.
+* @returns ok plus a human reason either way.
+*/
+function verifyCredential(state, currentRevision, now, maxAgeMinutes, workingTreeClean = true) {
+	const credential = state.credential;
+	if (credential === void 0) return {
+		ok: false,
+		reason: "no green-build credential recorded"
+	};
+	if (currentRevision === null) return {
+		ok: false,
+		reason: "current git HEAD unavailable (not inside a git repository?)"
+	};
+	if (!workingTreeClean) return {
+		ok: false,
+		reason: "working tree is dirty (staged, unstaged, or untracked changes exist) — commit or remove them, then rebuild and re-record"
+	};
+	if (credential.revision !== currentRevision) return {
+		ok: false,
+		reason: `green credential is bound to revision ${credential.revision}, but current HEAD is ${currentRevision} — the tree changed since it was recorded; rebuild and re-record`
+	};
+	const ageMs = now - credential.recordedAt;
+	const maxMs = maxAgeMinutes * 6e4;
+	if (ageMs > maxMs) return {
+		ok: false,
+		reason: `green credential is stale (${Math.round(ageMs / 6e4)} min old, limit ${maxAgeMinutes} min) — rebuild and re-record`
+	};
+	const leftMs = Math.max(0, maxMs - ageMs);
+	return {
+		ok: true,
+		reason: `green credential valid (${credential.scope} @ ${credential.revision}, ${Math.round(leftMs / 6e4)} min left)`
+	};
+}
+//#endregion
 //#region lib/types/launch-spec.js
 /**
 * Durable launch-configuration cutovers.
@@ -1247,4 +1566,4 @@ function isParkedOnUserInput(events) {
 	return lastToolName === USER_INPUT_TOOL || pendingApproval;
 }
 //#endregion
-export { writeStableLaunchSpec as A, prepareLaunchCutover as C, selectedLaunchSpec as D, recordCutoverEvent as E, workingTreeChanges as F, currentHead as M, isWorkingTreeClean as N, summarizeLaunchState as O, resetToCheckpoint as P, cutoverBlocksWake as S, readLaunchState as T, writeRestartOutcome as _, interruptedSnapshotFile as a, activeCutover as b, readInstanceLaunch as c, restartContextText as d, writeAdoptionRecord as f, writeInterruptedSnapshot as g, writeInstanceLaunchAsSupervisor as h, continueInterruptedText as i, commitCheckpoint as j, writeCutoverControl as k, readInterruptedSnapshot as l, writeInstanceLaunch as m, buildLaunchCommand as n, isParkedOnUserInput as o, writeCompositionRecovery as p, continueAndReportText as r, pendingRestartRecord as s, acknowledgeRestartRecord as t, readSkillRegistration as u, writeSkillRegistration as v, readCutoverReceipt as w, commandSha256 as x, writeUnexpectedExitRecord as y };
+export { writeStableLaunchSpec as A, pidAlive as B, prepareLaunchCutover as C, selectedLaunchSpec as D, recordCutoverEvent as E, setProvenDeployment as F, resetToCheckpoint as G, commitCheckpoint as H, verifyCredential as I, workingTreeChanges as K, lastGoodBootRevision as L, loadState as M, recordCredential as N, summarizeLaunchState as O, setCheckpoint as P, livePidIn as R, cutoverBlocksWake as S, readLaunchState as T, currentHead as U, stateFile as V, isWorkingTreeClean as W, writeRestartOutcome as _, interruptedSnapshotFile as a, activeCutover as b, readInstanceLaunch as c, restartContextText as d, writeAdoptionRecord as f, writeInterruptedSnapshot as g, writeInstanceLaunchAsSupervisor as h, continueInterruptedText as i, clearCredential as j, writeCutoverControl as k, readInterruptedSnapshot as l, writeInstanceLaunch as m, buildLaunchCommand as n, isParkedOnUserInput as o, writeCompositionRecovery as p, continueAndReportText as r, pendingRestartRecord as s, acknowledgeRestartRecord as t, readSkillRegistration as u, writeSkillRegistration as v, readCutoverReceipt as w, commandSha256 as x, writeUnexpectedExitRecord as y, liveWatchdogPid as z };

package/lib/types/browser-handoff.d.ts

@@ -1,7 +1,7 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { Context } from '@deepseek-ai/cordis';
 import { type LaunchRole } from './launch-spec.ts';
-import { processIdentityMatches, type ProcessIdentity } from './processes.ts';
+import { type processIdentityMatches, type ProcessIdentity } from './processes.ts';
 export declare const BROWSER_HANDOFF_ROUTE = "/_ankh-guard/browser-handoff";
 export type BrowserHandoffChannel = 'original-tab' | 'fallback-tab';
 export type BrowserHandoffAuthentication = 'existing-cookie' | 'launch-url';

package/lib/types/browser-handoff.js

@@ -29,7 +29,7 @@ import { createHash, randomBytes } from 'node:crypto';
 import { chmodSync, linkSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { activeCutover, readCutoverReceipt } from "./launch-spec.js";
-import { processIdentity, processIdentityMatches } from "./processes.js";
+import { processIdentity } from "./processes.js";
 import { stateFile } from "./state-files.js";
 export const BROWSER_HANDOFF_ROUTE = '/_ankh-guard/browser-handoff';
 const CAPABILITY_PATTERN = /^[A-Za-z0-9_-]{43}$/;
@@ -267,19 +267,25 @@ function authenticationState(connection, req) {
 export function createBrowserHandoffHandler(dependencies) {
     const pid = dependencies.pid ?? process.pid;
     const now = dependencies.now ?? Date.now;
-    const identityMatches = dependencies.identityMatches ?? processIdentityMatches;
     const identityProvider = dependencies.identityProvider ?? processIdentity;
     const longPollMs = dependencies.longPollMs ?? DEFAULT_LONG_POLL_MS;
     const longPollIntervalMs = dependencies.longPollIntervalMs ?? DEFAULT_LONG_POLL_INTERVAL_MS;
-    // Cached: a process's boot id never changes over its lifetime, and the
-    // platform lookup (ps/python3) must not run per held poll.
-    let bootIdCache;
+    // The handler only proves its own listener identity. That identity cannot
+    // change while this process is serving: a recycled PID has a new handler.
+    // Share one lookup with the boot channel; never spawn ps/python per poll.
+    let selfIdentity;
+    const identity = () => {
+        if (selfIdentity === undefined)
+            selfIdentity = identityProvider(pid);
+        return selfIdentity;
+    };
+    const identityMatches = dependencies.identityMatches ?? ((expected) => {
+        const own = identity();
+        return own !== null && expected.pid === pid && own.pid === pid && own.startToken === expected.startToken;
+    });
     const thisBootId = () => {
-        if (bootIdCache === undefined) {
-            const identity = identityProvider(pid);
-            bootIdCache = identity === null ? null : `${String(identity.pid)}:${identity.startToken}`;
-        }
-        return bootIdCache ?? undefined;
+        const own = identity();
+        return own === null ? undefined : `${String(own.pid)}:${own.startToken}`;
     };
     return async (req, res) => {
         const connection = dependencies.connectionProvider?.() ?? dependencies.connection;
@@ -344,7 +350,8 @@ export function createBrowserHandoffHandler(dependencies) {
                 }
                 const ready = currentReadyOwnership(dependencies.stateDir, pid, identityMatches);
                 const registration = readBrowserHandoffRequest(dependencies.stateDir);
-                return ready !== null && matchingRegistration(registration, ready.cutoverId, requestAuthority.authority, digest)?.acknowledgedAt === undefined;
+                const registered = ready === null ? undefined : matchingRegistration(registration, ready.cutoverId, requestAuthority.authority, digest);
+                return registered !== undefined && registered.acknowledgedAt === undefined;
             };
             await waitForPollState(pollHasState, longPollMs, longPollIntervalMs);
             const active = activeCutover(dependencies.stateDir);

package/lib/types/cli.js

@@ -2203,6 +2203,12 @@ export async function runCli(argv, io) {
                     if (key.startsWith('WD_'))
                         delete startEnv[key];
                 }
+                // NODE_PATH/NODE_OPTIONS go too: from a tool-wrapped caller (tsx pins
+                // NODE_PATH to its own pnpm store) they hijack the instance's module
+                // resolution onto that checkout's workspace — the watchdog's
+                // launch_instance scrubs them for the same reason (3080, 2026-10-12).
+                delete startEnv.NODE_PATH;
+                delete startEnv.NODE_OPTIONS;
                 const child = spawn(start, {
                     shell: true, detached: true, stdio: 'ignore',
                     env: testChildEnv('restart-instance-root', startEnv, { port, tempRoot: stateDir }),
@@ -2453,6 +2459,12 @@ export async function runCli(argv, io) {
                 if (key.startsWith('WD_'))
                     delete supervisorBaseEnv[key];
             }
+            // NODE_PATH/NODE_OPTIONS must not reach the watchdog either: it forwards
+            // its environment to every instance it launches, and a tool-wrapped
+            // caller (tsx pins NODE_PATH to its own pnpm store) would otherwise
+            // hijack instance module resolution onto that checkout (3080, 2026-10-12).
+            delete supervisorBaseEnv.NODE_PATH;
+            delete supervisorBaseEnv.NODE_OPTIONS;
             const env = {
                 ...supervisorBaseEnv,
                 WD_PORT: String(spec.port),

package/lib/types/client/index.js

@@ -286,9 +286,9 @@ export function apply(_ctx) {
                 sessionStorage.setItem(BOOT_ID_KEY, result.bootId);
             if (result.state === 'idle') {
                 document.getElementById('ankh-guard-browser-handoff')?.remove();
-                // The server holds idle polls, providing event-like wakeup without a
-                // permanent fixed-frequency request loop.
-                schedule();
+                // Healthy servers hold idle polls. Keep a floor for older servers or
+                // terminal states that answer immediately, so they cannot create a spin.
+                schedule(ACTIVE_RETRY_MS);
                 return;
             }
             if (result.state === 'waiting')

package/lib/types/defaults.js

@@ -1,6 +1,6 @@
 /**
- * Default state/repo directory resolution, shared by the cordis plugin, the
- * CLI, and the invariant companion so all three agree on where a credential
+ * Default state/repo directory resolution, shared by the cordis plugin and
+ * the CLI so both agree on where a credential
  * lives. The state file must survive a restart, so it anchors to DSH_HOME (or
  * the checkout) rather than any process-lifetime directory.
  */

package/lib/types/index.js

@@ -128,7 +128,7 @@ function registerRestartSkill(ctx, stateDir) {
             description,
             content,
             source: 'runtime',
-            provider: 'ankh-guard',
+            provider: '@khorsheed/dsh-ankh-guard',
         }));
         writeSkillRegistration(stateDir, { registered: true, at: Date.now() });
     }

package/lib/types/state.js

@@ -5,8 +5,8 @@
  * was recorded on and to a freshness window — and answers `verify()` against
  * the CURRENT head and wall clock. A later fully gated boot may promote that
  * credential into a deployment proof whose exact runtime fingerprint can be
- * reused by the same-launch restart path. Framework-free: the cordis plugin,
- * the CLI, and the invariant companion all share this module.
+ * reused by the same-launch restart path. Framework-free: the cordis plugin
+ * and the CLI share this module.
  */
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { stateFile } from "./state-files.js";
@@ -94,8 +94,8 @@ export function loadState(stateDir) {
 export function saveState(stateDir, state) {
     mkdirSync(stateDir, { recursive: true });
     // Atomic via tmp + rename: a crash mid-write must never leave a truncated
-    // state file — a malformed one throws in loadState and fails the host's
-    // boot invariant, i.e. the guard's own state would take the host down.
+    // state file — a malformed one throws in loadState the next time the gate
+    // reads it, i.e. the guard's own state would fail every later verify.
     const file = stateFilePath(stateDir);
     const tmp = `${file}.${process.pid}.tmp`;
     writeFileSync(tmp, `${JSON.stringify(state, null, 2)}\n`);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@khorsheed/dsh-ankh-guard",
   "description": "Hard gate for self-modification restarts: a green-build credential bound to the git HEAD, checked before any restart of the running instance",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -13,10 +13,6 @@
       "types": "./lib/types/index.d.ts",
       "default": "./lib/index.js"
     },
-    "./invariant": {
-      "types": "./lib/types/invariant.d.ts",
-      "default": "./lib/invariant.js"
-    },
     "./cli": {
       "types": "./lib/types/cli.d.ts",
       "default": "./lib/cli.js"
@@ -42,16 +38,18 @@
     "CHANGELOG.md"
   ],
   "license": "MIT",
+  "engines": {
+    "dsh": ">=0.1.5-rc.1 <0.3.0-0"
+  },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-agent": "^0.1.0-rc.6 || ^0.2.0-rc.1",
-    "@deepseek-ai/dsh-agent-preset-registry": "^0.1.0-rc.6 || ^0.2.0-rc.1",
-    "@deepseek-ai/dsh-agent-presets": "^0.1.0-rc.6 || ^0.2.0-rc.1",
-    "@deepseek-ai/dsh-client-connection": "^0.1.0-rc.6 || ^0.2.0-rc.1",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.6 || ^0.2.0-rc.1",
-    "@deepseek-ai/dsh-invariants": "^0.1.0-rc.6 || ^0.2.0-rc.1",
-    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6 || ^0.2.0-rc.1",
-    "@deepseek-ai/dsh-session-persistence": "^0.1.0-rc.6 || ^0.2.0-rc.1",
+    "@deepseek-ai/dsh-agent": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
+    "@deepseek-ai/dsh-agent-preset-registry": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
+    "@deepseek-ai/dsh-agent-presets": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
+    "@deepseek-ai/dsh-client-connection": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
+    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
+    "@deepseek-ai/dsh-session-persistence": "^0.1.0-rc.6 || ^0.2.0-rc.1 || ^0.2.1-rc.1",
     "@deepseek-ai/schemastery": "^3.18.1"
   },
   "peerDependenciesMeta": {
@@ -90,8 +88,8 @@
     },
     "compat": {
       "minHost": "0.1.5-rc.1",
-      "notes": "0.1.5-rc.1 full-line boot-verified 2026-09-25 (42 packages including capture) through the three compat layers: preset-registry dual-name probe, dual-shape typert codecs, and typert faces carrying zod@4; 0.1.7-rc.2 is the 3080 production-verified line; composition-preflight runs via the standalone preflight-runner and degrades to a notice when no live harness checkout resolves; original-tab browser handoff feature-probes optional WebServer/connection auth seams; reversible state quarantine was exercised in a live 0.1.1-rc.2 to 0.1.2-alpha.4 cutover; since 0.4.0 the preflight verdict also fails on any agent preset the registry marks broken — preset rows mount on standing scopes beside the profile tree, so a clean-booting profile whose presets cannot serve sessions (picker 加载失败, resume never-started) no longer passes the gate",
-      "verifiedHost": "0.1.7-rc.2"
+      "notes": "0.1.5-rc.1 full-line boot-verified 2026-09-25 (42 packages including capture) through the three compat layers: preset-registry dual-name probe, dual-shape typert codecs, and typert faces carrying zod@4; 0.2.0-rc.2 is the 3080 production-verified line (watchdog-supervised gated restarts PASS — readiness, ownership window, canary, deployment proof on the 0.2.0-rc.2 release head 639ed01539 — since 2026-10-09); composition-preflight runs via the standalone preflight-runner and degrades to a notice when no live harness checkout resolves; original-tab browser handoff feature-probes optional WebServer/connection auth seams; reversible state quarantine was exercised in a live 0.1.1-rc.2 to 0.1.2-alpha.4 cutover; since 0.4.0 the preflight verdict also fails on any agent preset the registry marks broken — preset rows mount on standing scopes beside the profile tree, so a clean-booting profile whose presets cannot serve sessions (picker 加载失败, resume never-started) no longer passes the gate",
+      "verifiedHost": "0.2.1-rc.1"
     }
   }
 }

package/scripts/dsh-watchdog.sh

@@ -182,6 +182,14 @@ launch_instance() {
     if [ -n "$launch_harness_root" ]; then export DSH_HARNESS="$launch_harness_root"; fi
     cd "$launch_home/home" 2>/dev/null || cd /tmp || exit 1
     for v in $(env | sed -n 's/^\(WD_[^=]*\)=.*/\1/p'); do unset "$v"; done
+    # NODE_PATH/NODE_OPTIONS get the same scrub: launched from a tool-wrapped
+    # shell (tsx sets NODE_PATH to its own pnpm store), the instance's module
+    # resolution would be hijacked onto that checkout's workspace — bundle
+    # patches then resolve to the REPO's packages instead of the profile's
+    # installed ones, and the composition silently serves whatever the repo
+    # checkout happens to hold (3080, 2026-10-12: presets resolved to the main
+    # checkout's workspace copy, hiding the newly deployed preset rows).
+    unset NODE_PATH NODE_OPTIONS
     sh -c "$start_cmd"
   )
 }

package/lib/invariant.js

@@ -1,40 +0,0 @@
-import { i as resolveStateDir } from "./defaults-CduvOcGq.js";
-import { n as loadState, o as stateFilePath } from "./state-CZMypGkB.js";
-import { existsSync } from "node:fs";
-//#region lib/types/invariant.js
-/**
-* Package-owned invariant companion for `@khorsheed/dsh-ankh-guard`.
-* @module @khorsheed/dsh-ankh-guard/invariant
-*/
-const PACKAGE_NAME = "@khorsheed/dsh-ankh-guard";
-/** Cordis companion plugin name. */
-const name = "ankh-guard-invariant";
-/** Service required before the companion can reserve package ownership. */
-const inject = ["invariants"];
-/**
-* Owned-data check: the package's state file, when present at the default
-* location, must parse as a well-formed guard state. A malformed file would
-* make the gate unreadable — the credential's revision/recordedAt shape is
-* this package's own contract, so corruption fails loud at load instead of at
-* the moment a restart needs the gate.
-* @param _ctx - host context (unused; the check reads only the state file).
-* @param fail - invariant failure reporter.
-*/
-const install = (_ctx, fail) => {
-	const stateDir = resolveStateDir(void 0);
-	const file = stateFilePath(stateDir);
-	if (!existsSync(file)) return;
-	try {
-		loadState(stateDir);
-	} catch (error) {
-		fail(`state file ${file} is malformed: ${String(error)}`);
-	}
-};
-/**
-* Register this package's invariant companion.
-* @param ctx - Cordis context carrying the invariant service.
-* @returns The installed registration's disposer after setup succeeds.
-*/
-const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
-//#endregion
-export { apply, inject, install, name };

package/lib/state-CZMypGkB.js

@@ -1,323 +0,0 @@
-import { c as appendTestLifecycleEvent } from "./test-seam-dwvaKjRp.js";
-import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-//#region lib/types/state-files.js
-/**
-* The guard's state-directory protocol: every file that lives in the state
-* dir, named exactly once. Five writers in three languages (this package's
-* TS, the watchdog's bash, the schedule-exit exit agent's inline JS, and the
-* two supervisor installers) read and write these — a literal drifting in
-* any one of them splits the protocol silently (three review rounds of path
-* bugs came from exactly that). The bash sides are pinned by
-* tests/state-files.spec.ts, which asserts every state-dir literal in the
-* watchdog and both installers appears here, and that no script re-derives
-* the directory from the home.
-*/
-/** Every state-directory file name, keyed by role. */
-const STATE_FILES = {
-	/** The guard's credential/checkpoint/audit state (state.ts). */
-	guard: "self-restart-guard.json",
-	/** Watchdog-stamped last deployment-proven revision. */
-	lastGoodBoot: "last-good-boot.json",
-	/** schedule-exit → watchdog: an intentional restart, run the canary. */
-	restartRequested: "restart-requested.json",
-	/** The exit agent's restart outcome record (the report's source). */
-	lastRestart: "last-restart.json",
-	/** The SIGTERM snapshot of interrupted sessions. */
-	interruptedSessions: "interrupted-sessions.json",
-	/** The supervising watchdog's pidfile. */
-	watchdogPid: "watchdog.pid",
-	/** Cross-session mutual exclusion for the restart verb. */
-	restartLock: "restart.lock",
-	/** The detached restart driver's log. */
-	restartLog: "restart.log",
-	/** Marker: exit the watchdog without respawn. */
-	watchdogStop: "watchdog-stop",
-	/** Marker: the watchdog gave up; a crash page holds the port. */
-	watchdogGaveUp: "watchdog-gave-up",
-	/** The current boot attempt's captured output. */
-	bootAttemptLog: "boot-attempt.log",
-	/** The watchdog's own log. */
-	watchdogLog: "watchdog.log",
-	/** The watchdog's stderr, captured separately by the supervisor installers. */
-	watchdogStderrLog: "watchdog.stderr.log",
-	/** The exit agent's log. */
-	scheduleExitLog: "schedule-exit.log",
-	/** How the current instance was launched (recorded by the plugin at apply). */
-	instanceLaunch: "instance-launch.json",
-	/** The atomically selected full launch configuration (stable or in cutover). */
-	launchSpec: "launch-spec.json",
-	/** Redacted durable receipt for the latest launch-configuration cutover. */
-	launchCutover: "launch-cutover.json",
-	/** Legacy combined operator-control marker, retained for rolling upgrades. */
-	cutoverControl: "launch-cutover-control.json",
-	/** Operator → watchdog: abort according to the pre-approved recovery policy. */
-	cutoverAbort: "launch-cutover-abort.json",
-	/** Monotonic stronger operator action: explicitly restore the previous spec. */
-	cutoverRestorePrevious: "launch-cutover-restore-previous.json",
-	/** Original browser-tab registry: per-tab capability hashes only; retained through terminal recovery. */
-	browserHandoffRequest: "browser-handoff-request.json",
-	/** Browser → watchdog acknowledgement for one proven final process. */
-	browserHandoffAck: "browser-handoff-ack.json",
-	/** Whether the restart-protocol skill registered at apply (and why not). */
-	skillRegistration: "skill-registration.json",
-	/** Directory: the healthy-boot snapshot of the profile composition inputs. */
-	lastGoodComposition: "last-good-composition",
-	/** Directory prefix: a failing composition backed up before rollback restores over it. */
-	compositionBackup: "composition-backup-"
-};
-/** Absolute path of a state file inside a state directory. */
-function stateFile(stateDir, role) {
-	return join(stateDir, STATE_FILES[role]);
-}
-/**
-* The last deployment-proven revision, stamped by the watchdog on every
-* healthy boot, or undefined. Lives here rather than in the credential core:
-* the stamp is written by the watchdog and proves the deployment composed and
-* came up — a green credential only ever proves build+test passed.
-* @param stateDir - state directory.
-* @returns the stamped revision, or undefined.
-*/
-function lastGoodBootRevision(stateDir) {
-	try {
-		const stamp = JSON.parse(readFileSync(stateFile(stateDir, "lastGoodBoot"), "utf8"));
-		return typeof stamp.revision === "string" && stamp.revision !== "" ? stamp.revision : void 0;
-	} catch {
-		return;
-	}
-}
-/**
-* Whether the pid named by this raw pid/lock-file content is alive. Empty
-* content reads as NO holder: Number('') is 0 and kill(0, 0) probes our own
-* process group (always succeeds), which once read as "alive" and refused
-* every restart forever — the bug that had to be fixed in two copies of this
-* logic before it was consolidated here.
-*/
-function pidAlive(raw) {
-	const pid = Number(raw);
-	if (raw === "" || !Number.isInteger(pid) || pid <= 0) return false;
-	try {
-		process.kill(pid, 0);
-		return true;
-	} catch {
-		return false;
-	}
-}
-/** The live pid named by a pid/lock file (as the raw string), or null when absent/stale. */
-function livePidIn(file) {
-	try {
-		const raw = readFileSync(file, "utf8").trim();
-		return pidAlive(raw) ? raw : null;
-	} catch {
-		return null;
-	}
-}
-/** The live supervising watchdog's pid, or null when none is (pidfile + kill 0). */
-function liveWatchdogPid(stateDir) {
-	const raw = livePidIn(stateFile(stateDir, "watchdogPid"));
-	const pid = raw === null ? null : Number(raw);
-	appendTestLifecycleEvent("watchdog-liveness-probe", {
-		pid: pid ?? 0,
-		live: pid !== null
-	}, "parent-observer");
-	return pid;
-}
-//#endregion
-//#region lib/types/state.js
-/**
-* Pure credential/checkpoint state core for the self-restart guard.
-*
-* The guard records one "green build" credential — bound to the git HEAD it
-* was recorded on and to a freshness window — and answers `verify()` against
-* the CURRENT head and wall clock. A later fully gated boot may promote that
-* credential into a deployment proof whose exact runtime fingerprint can be
-* reused by the same-launch restart path. Framework-free: the cordis plugin,
-* the CLI, and the invariant companion all share this module.
-*/
-/** Absolute path of the state file inside a state directory. */
-function stateFilePath(stateDir) {
-	return stateFile(stateDir, "guard");
-}
-/** A fresh, credential-less state. */
-function emptyState() {
-	return { audit: [] };
-}
-function isCredential(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const c = value;
-	return typeof c.scope === "string" && typeof c.revision === "string" && typeof c.recordedAt === "number" && typeof c.command === "string";
-}
-function isCheckpoint(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const c = value;
-	return typeof c.revision === "string" && typeof c.recordedAt === "number" && typeof c.message === "string";
-}
-function isSha256(value) {
-	return typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
-}
-function isProvenDeployment(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const proof = value;
-	const credential = proof.credential;
-	const fingerprint = proof.fingerprint;
-	return proof.version === 1 && typeof proof.provenAt === "number" && credential !== void 0 && typeof credential.revision === "string" && credential.revision !== "" && typeof credential.recordedAt === "number" && typeof credential.scope === "string" && isSha256(credential.commandSha256) && fingerprint?.version === 1 && typeof fingerprint.credentialRevision === "string" && fingerprint.credentialRevision !== "" && typeof fingerprint.harnessRevision === "string" && fingerprint.harnessRevision !== "" && isSha256(fingerprint.launchSpecSha256) && isSha256(fingerprint.profileSha256) && isSha256(fingerprint.hostRuntimeSha256) && isSha256(proof.fingerprintSha256);
-}
-function isAuditEntry(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const e = value;
-	return (e.action === "record" || e.action === "clear" || e.action === "checkpoint" || e.action === "prove-deployment") && typeof e.ts === "number" && typeof e.detail === "string";
-}
-/**
-* Read the state file; an absent file is an empty state, a malformed one is a
-* loud misconfiguration error (never silently ignored).
-* @param stateDir - directory holding the state file.
-* @returns the parsed state.
-*/
-function loadState(stateDir) {
-	try {
-		const raw = readFileSync(stateFilePath(stateDir), "utf8");
-		const parsed = JSON.parse(raw);
-		if (parsed === null || typeof parsed !== "object") return emptyState();
-		const state = { audit: Array.isArray(parsed.audit) ? parsed.audit.filter(isAuditEntry) : [] };
-		if (isCredential(parsed.credential)) state.credential = parsed.credential;
-		if (isProvenDeployment(parsed.provenDeployment)) state.provenDeployment = parsed.provenDeployment;
-		if (isCheckpoint(parsed.checkpoint)) state.checkpoint = parsed.checkpoint;
-		return state;
-	} catch (error) {
-		if (error?.code === "ENOENT") return emptyState();
-		throw new Error(`ankh-guard: unreadable state file ${stateFilePath(stateDir)}: ${String(error)}`);
-	}
-}
-/** Persist a state (creates the directory as needed). */
-function saveState(stateDir, state) {
-	mkdirSync(stateDir, { recursive: true });
-	const file = stateFilePath(stateDir);
-	const tmp = `${file}.${process.pid}.tmp`;
-	writeFileSync(tmp, `${JSON.stringify(state, null, 2)}\n`);
-	renameSync(tmp, file);
-}
-function withAudit(state, entry) {
-	return {
-		...state,
-		audit: [...state.audit, entry].slice(-50)
-	};
-}
-/**
-* Record a green-build credential bound to {@link RecordInput.revision}.
-* @param stateDir - state directory.
-* @param input - scope, the git HEAD, and the command that went green.
-* @param now - epoch milliseconds (injected for deterministic tests).
-* @returns the persisted state.
-*/
-function recordCredential(stateDir, input, now) {
-	const credential = {
-		...input,
-		recordedAt: now
-	};
-	const { provenDeployment: _oldProof, ...withoutOldProof } = withAudit(loadState(stateDir), {
-		action: "record",
-		ts: now,
-		detail: `${input.scope} @ ${input.revision}`
-	});
-	const updated = {
-		...withoutOldProof,
-		credential
-	};
-	saveState(stateDir, updated);
-	return updated;
-}
-/**
-* Drop the credential (checkpoint and audit survive).
-* @param stateDir - state directory.
-* @param now - epoch milliseconds (injected for deterministic tests).
-* @returns the persisted state.
-*/
-function clearCredential(stateDir, now) {
-	const audited = withAudit(loadState(stateDir), {
-		action: "clear",
-		ts: now,
-		detail: "credential cleared"
-	});
-	const updated = { audit: audited.audit };
-	if (audited.checkpoint !== void 0) updated.checkpoint = audited.checkpoint;
-	saveState(stateDir, updated);
-	return updated;
-}
-/** Persist a deployment proof after the watchdog has completed its canary. */
-function setProvenDeployment(stateDir, proof, now) {
-	const updated = {
-		...withAudit(loadState(stateDir), {
-			action: "prove-deployment",
-			ts: now,
-			detail: `${proof.credential.revision} ${proof.fingerprintSha256.slice(0, 16)}`
-		}),
-		provenDeployment: proof
-	};
-	saveState(stateDir, updated);
-	return updated;
-}
-/**
-* Persist a pre-batch checkpoint commit reference.
-* @param stateDir - state directory.
-* @param input - the checkpoint commit SHA and its message.
-* @param now - epoch milliseconds (injected for deterministic tests).
-* @returns the persisted state.
-*/
-function setCheckpoint(stateDir, input, now) {
-	const checkpoint = {
-		...input,
-		recordedAt: now
-	};
-	const updated = {
-		...withAudit(loadState(stateDir), {
-			action: "checkpoint",
-			ts: now,
-			detail: `${input.revision} ${input.message}`
-		}),
-		checkpoint
-	};
-	saveState(stateDir, updated);
-	return updated;
-}
-/**
-* Answer the gate: a credential is valid only when present, recorded on the
-* CURRENT revision, and younger than {@link maxAgeMinutes}.
-* @param state - the loaded state.
-* @param currentRevision - the git HEAD of the checkout, or null when unavailable.
-* @param now - epoch milliseconds (injected for deterministic tests).
-* @param maxAgeMinutes - freshness window.
-* @param workingTreeClean - whether staged, unstaged, and untracked inputs are absent.
-* @returns ok plus a human reason either way.
-*/
-function verifyCredential(state, currentRevision, now, maxAgeMinutes, workingTreeClean = true) {
-	const credential = state.credential;
-	if (credential === void 0) return {
-		ok: false,
-		reason: "no green-build credential recorded"
-	};
-	if (currentRevision === null) return {
-		ok: false,
-		reason: "current git HEAD unavailable (not inside a git repository?)"
-	};
-	if (!workingTreeClean) return {
-		ok: false,
-		reason: "working tree is dirty (staged, unstaged, or untracked changes exist) — commit or remove them, then rebuild and re-record"
-	};
-	if (credential.revision !== currentRevision) return {
-		ok: false,
-		reason: `green credential is bound to revision ${credential.revision}, but current HEAD is ${currentRevision} — the tree changed since it was recorded; rebuild and re-record`
-	};
-	const ageMs = now - credential.recordedAt;
-	const maxMs = maxAgeMinutes * 6e4;
-	if (ageMs > maxMs) return {
-		ok: false,
-		reason: `green credential is stale (${Math.round(ageMs / 6e4)} min old, limit ${maxAgeMinutes} min) — rebuild and re-record`
-	};
-	const leftMs = Math.max(0, maxMs - ageMs);
-	return {
-		ok: true,
-		reason: `green credential valid (${credential.scope} @ ${credential.revision}, ${Math.round(leftMs / 6e4)} min left)`
-	};
-}
-//#endregion
-export { setProvenDeployment as a, lastGoodBootRevision as c, pidAlive as d, stateFile as f, setCheckpoint as i, livePidIn as l, loadState as n, stateFilePath as o, recordCredential as r, verifyCredential as s, clearCredential as t, liveWatchdogPid as u };

package/lib/types/invariant.d.ts

@@ -1,27 +0,0 @@
-/**
- * Package-owned invariant companion for `@khorsheed/dsh-ankh-guard`.
- * @module @khorsheed/dsh-ankh-guard/invariant
- */
-import type { Context } from '@deepseek-ai/cordis';
-import type { InvariantInstaller } from '@deepseek-ai/dsh-invariants';
-/** Cordis companion plugin name. */
-export declare const name = "ankh-guard-invariant";
-/** Service required before the companion can reserve package ownership. */
-export declare const inject: string[];
-/**
- * Owned-data check: the package's state file, when present at the default
- * location, must parse as a well-formed guard state. A malformed file would
- * make the gate unreadable — the credential's revision/recordedAt shape is
- * this package's own contract, so corruption fails loud at load instead of at
- * the moment a restart needs the gate.
- * @param _ctx - host context (unused; the check reads only the state file).
- * @param fail - invariant failure reporter.
- */
-export declare const install: InvariantInstaller;
-/**
- * Register this package's invariant companion.
- * @param ctx - Cordis context carrying the invariant service.
- * @returns The installed registration's disposer after setup succeeds.
- */
-export declare const apply: (ctx: Context) => Promise<() => void>;
-//# sourceMappingURL=invariant.d.ts.map

package/lib/types/invariant.js

@@ -1,41 +0,0 @@
-/**
- * Package-owned invariant companion for `@khorsheed/dsh-ankh-guard`.
- * @module @khorsheed/dsh-ankh-guard/invariant
- */
-/* jscpd:ignore-start */
-import { existsSync } from 'node:fs';
-import { resolveStateDir } from "./defaults.js";
-import { loadState, stateFilePath } from "./state.js";
-const PACKAGE_NAME = '@khorsheed/dsh-ankh-guard';
-/** Cordis companion plugin name. */
-export const name = 'ankh-guard-invariant';
-/** Service required before the companion can reserve package ownership. */
-export const inject = ['invariants'];
-/**
- * Owned-data check: the package's state file, when present at the default
- * location, must parse as a well-formed guard state. A malformed file would
- * make the gate unreadable — the credential's revision/recordedAt shape is
- * this package's own contract, so corruption fails loud at load instead of at
- * the moment a restart needs the gate.
- * @param _ctx - host context (unused; the check reads only the state file).
- * @param fail - invariant failure reporter.
- */
-export const install = (_ctx, fail) => {
-    const stateDir = resolveStateDir(undefined);
-    const file = stateFilePath(stateDir);
-    if (!existsSync(file))
-        return;
-    try {
-        loadState(stateDir);
-    }
-    catch (error) {
-        fail(`state file ${file} is malformed: ${String(error)}`);
-    }
-};
-/**
- * Register this package's invariant companion.
- * @param ctx - Cordis context carrying the invariant service.
- * @returns The installed registration's disposer after setup succeeds.
- */
-export const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
-/* jscpd:ignore-end */