@tacrine_f/oh-my-dsh-omo-fork-chs 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -4,6 +4,185 @@ All notable changes to this project are documented in this file.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+**What this is for.** `A5` checks that `files[]` *contains* every entry in `REQUIRED_FILES`, but no
+assertion checked that those entries *resolve to anything*. **`A19`** closes that gap: for every
+`files[]` entry that names a directory, the tool now requires at least one path under it that is
+both tracked and present on disk.
+
+**The hole, measured rather than argued.** With `"test/"` still listed in `files[]`, `git rm -r test`
+was the silent state: the old tool exited **0** with verdict OK, `prepack` passed, `npm pack` yielded
+**28** entries instead of 34, and `node --test` reported **0 tests at exit 0** — the package shipped
+without its test suite and nothing went red. A plain `rm -r test` that leaves the index intact was
+**already** red before this change, reached through `A14`'s machine-path scan reading a tracked path
+that is no longer on disk (`cannot read test/check-package-negative.test.mjs: ENOENT`); that state
+was never green. So in that second state `A19`'s contribution is not that it turns a green gate red,
+but that the failure is now **about the missing directory** rather than about a missing file, and
+that it keeps working if `A14`'s list of files it reads by name ever changes.
+
+**What it does not prove.** It proves that at least one path under a `files[]`-named directory is
+both tracked and present on disk. It does not prove the directory is non-empty beyond that, nor that
+its contents match what `files[]` implies, and it does not cover a `files[]` entry naming a missing
+**file** — the known files are covered elsewhere (`A4`/`A6` for the personas, `A17` for the two
+copied modules, `A9`/`A12`/`A13`/`A15` for the licence documents and the patch).
+
+**Counts.** The tool now runs **22** structural and license assertions rather than 21, and the test
+suite totals **56** tests rather than 55.
+
+## [0.2.0] — 2026-10-30
+
+**What this release is for.** The 9 subagent rows are migrated from the old
+`persona: !!js readFileSync(...)` + `toolFilter` pattern to 9
+`dsh-agent-preset` sub-presets (`omo-explore` through `omo-multimodal-looker`)
+using `agentPreset`, which is the supported mechanism in cordis `^4.0.1`.
+The duplicate `list-agents` subpath was removed, and atlas gained a
+transport-failure reuse rule. The bundle is now verified on two 0.2.x builds
+rather than one — `0.2.1-alpha.1` with the 0.1.x patch, `0.2.2-alpha.2` with
+this patch.
+
+**Requires DSH ≥ 0.2.2.** The 9 subagent rows now select their preset with
+`agentPreset`, a field that only the 0.2.2 `dsh-tool-subagent` reads; 0.2.2 also
+removed the `persona` and `toolFilter` fields the old rows used. On DSH 0.2.1 and
+earlier the rows still mount, but `agentPreset` is accepted and then never read
+(the schema merges unknown keys instead of rejecting them), so the child gets
+**no persona and no tool restriction** and inherits the parent's full toolset: a
+read-only child such as explore or oracle would silently gain write and
+subagent-spawning tools. That is a silent privilege escalation, not a mount
+failure. The declared peer range still admits older 0.2.x builds, so this is a
+functional requirement documented here rather than a semver constraint.
+
+No persona prose or orchestration doctrine changes. What changes is how each
+subagent's tool set is expressed: the `toolFilter` deny lists are replaced by
+per-preset plugin lists, and the patch grows from 540 to 946 lines because each
+sub-preset repeats its `!!js readFileSync(...)` expression from the old
+`persona:` field.
+
+### Changed
+
+- **Cordis migration — `persona`/`toolFilter` → `agentPreset`.** The 9 subagent
+  rows (`tool-subagent-explore` through `tool-subagent-multimodal-looker`)
+  no longer carry a `persona:` field or a `toolFilter:` list. Instead, 9 new
+  `dsh-agent-preset` blocks are appended to the patch (`omo-explore` order 100
+  through `omo-multimodal-looker` order 108), each setting `dsh-persona`
+  `prefix:` to the same `!!js readFileSync(...)` expression. The `toolFilter`
+  was dropped: a preset's plugin list *is* its tool catalog, so the deny list
+  becomes structural. Three template groups (read-only A, writable B, vision C)
+  follow the same pattern as `preset-tri-*`. The `persona:` field is removed
+  from the 9 rows, and `agentPreset` on each row references the corresponding
+  sub-preset id. See Todo 2 in `notepads/handover-v0.2.0-upgrade/learnings.md`.
+- **atlas.md: transport-failure reuse rule added.** A new section
+  `### 网络/提供商波动 → 复用同一 child，不冷启（MUST）` was inserted before the
+  existing `### 禁止静默冷启` ban, so atlas reuses the same child on provider
+  or network fluctuations instead of starting a cold replacement.
+
+### Fixed
+
+- **Removed duplicate `dsh-tool-subagent-control/list-agents` row.** The root
+  `dsh-tool-subagent-control` entry already calls `registerListAgents(ctx)`, so
+  the second row would double-register `list_agents`/`send_message`/`interrupt_agent`.
+  Deleting it matches the upstream reference (`tri-agent`'s patch has exactly one
+  `tool-subagent-control` row).
+
+### The package check tool was updated for the new patch shape
+
+`tools/check-package.mjs` A16 now expects 946 patch lines and 173 `- id:` rows
+(instead of 540 and 40), and the `EXPECTED.version` moved to `0.2.0`.
+`baseline/cordis.patch.yml` was re-derived, so `node tools/verify-patch.mjs`
+reports `verdict: "IDENTICAL"` again.
+
+### Verification extended to dsh 0.2.2-alpha.2
+
+0.1.1 was verified on `0.2.1-alpha.1` — one 0.2.x build. This release was also
+verified on `0.2.2-alpha.2` (the published DSH 0.2.2 alpha build) by a real
+`--dump-config` run against a profile that registers this package as a bundle:
+with no exemption present, the run exits 0, writes 0 bytes to stderr, and the
+dump carries the preset with all 9 persona anchors and all 9 sub-presets. That
+is still a claim about mount and anchor paths, not about persona bytes or preset
+behaviour — no agent was invoked.
+
+## [0.1.1] — 2026-10-14
+
+**What this release is for.** 0.1.0 declared peer ranges that stopped below dsh 0.2, so a dsh 0.2.x
+host reported the bundle as incompatible, skipped it, and still exited 0 — a failure visible only on
+stderr. **0.1.1 widens those ranges so the bundle mounts on dsh 0.2.x with no exemption**, which is
+the change most consumers will care about. It also adds two checks to the package tool and corrects
+several documentation statements. Nothing in the preset's behaviour changes: the preset id, its
+`order`, the personas and the patch are the same as 0.1.0.
+
+Two gates were added to `tools/check-package.mjs` after 0.1.0 was released. They close
+gaps that the existing assertions could not see, and they change what the tool reports:
+it now runs **21** structural and license assertions rather than 19. The test suite is
+unchanged at 55 tests, because the new gates are asserted by the tool itself and by the
+existing negative-path cases rather than by new test files.
+
+### Added
+
+- A content-hash gate on `index.js` and `plan-aware-persona.mjs`: the tool asserts the
+  SHA256 of each against a frozen value. A byte count is not enough for these two,
+  because it is sensitive to length only — a swapped character, a changed identifier or
+  a reordered token leaves the length identical and the file different, which is exactly
+  the class of edit a formatter makes to a `.mjs`. Measured: flipping one byte of
+  `plan-aware-persona.mjs` leaves it at 3685 bytes and changes its hash.
+- An anchor-resolution gate: every internal markdown anchor — a link whose target begins
+  with a `#` — in `README.md`, `README.zh.md`, `CHANGELOG.md` and `NOTICE.md` must
+  resolve to a heading slug in the same document,
+  using GitHub's own slug rule (lowercase; strip everything that is not a word
+  character, a hyphen or whitespace; keep CJK; spaces to hyphens; repeated headings
+  deduplicated with `-1`, `-2`). The rule was verified against `github-slugger` 2.0.0 on
+  all 38 headings of the four documents with 0 disagreements.
+
+### Fixed
+
+- `README.zh.md`'s two badge links pointed at `#license` and `#peer-model` while the
+  document's headings are `## 许可` and `## Peer 模型`, so both links landed nowhere.
+  The links now match the headings. The headings were not renamed: they are the
+  document's structure, and the English document's equivalent links were already
+  correct.
+- The `.gitattributes` scope entry was named in `NOTICE.md`'s mit-scope block and in the
+  tool's expected scope set, but missing from the anchor list that resolves each entry
+  against the block claiming it. It is now anchored like its ten siblings.
+- `check-package.mjs`'s untracked-file failure message named the same directory once per
+  spelling when `files[]` listed one directory under two spellings, so a reader saw
+  `test/, test/` and had to work out that these are one directory and not two. Each
+  offending directory is now named exactly once.
+
+### The peer range now covers dsh 0.2.x — verified on one 0.2.x build
+
+The 24 `@deepseek-ai/dsh-*` peer ranges were widened from `>=0.1.7-rc.2 <0.2.0` to:
+
+```
+>=0.1.7-rc.2 <0.2.0 || >=0.2.0-0 <0.3.0-0 || >=0.2.1-alpha.1 <0.3.0-0
+```
+
+The first clause is the range inherited from the upstream fork, so the previously supported line is
+unchanged; the second and third add the 0.2 line. `@deepseek-ai/cordis` stays at `^4.0.1`. The
+package `version` moves from `0.1.0` to `0.1.1` in this release, which is what carries the widened
+ranges to consumers.
+
+**Why the change.** The host decides whether a profile bundle loads with a semver range check over
+the peers named `@deepseek-ai/dsh` or `@deepseek-ai/dsh-*`, evaluated with prereleases included
+(`{ includePrerelease: true }`). The old range rejects `0.2.1-alpha.1`, so on that runtime the host
+reported the plugin as incompatible, skipped the bundle, and still exited 0 — a silent failure
+visible only on stderr. The widened range accepts that runtime, so no exemption is needed for it.
+
+**What was verified, by experiment rather than by reading the range back.** On `0.2.1-alpha.1` —
+the only 0.2.x build available, so this is one build and not a general claim — with the working tree
+mounted as a local bundle and **no exemption present in the profile**, a `--dump-config` run exits
+0, writes **0 bytes to stderr**, and carries the preset with `order: 11` and all **nine** persona
+anchors, each resolving to a real file inside the mounted package. The same package with the old
+ranges produces 1884 bytes of stderr and no anchors, so the widening is what removed the skip.
+
+**What that does not prove.** It proves the anchor *paths* resolve, not that a persona's *bytes* are
+intact — a persona that still existed but had been truncated would pass the same check. It proves
+structural facts, not that the preset does anything, because no agent is invoked. And it is one
+build.
+
+**The re-entry condition is `0.3.0-alpha.1`.** The widened range rejects it, so a future runtime in
+that line is skipped again, with the same incompatibility warning on stderr and the same exit 0.
+The exemption remains documented and remains needed for that case and for the published `0.1.0`,
+whose manifest still carries the old narrower range.
+
 ## [0.1.0] — 2026-10-11
 
 0.1.0 is the first release of this repository; no earlier version was published. It carries the
@@ -103,7 +282,10 @@ SUL-1.0 is not an SPDX identifier and this package is dual-licensed. `files[]` s
   with `dsh plugin allow-version "<pkg>@<version>" --dsh-version <version> --accept-risk`, which is
   the host's own escape hatch and carries the risk the host warns about. On a runtime inside the
   declared range the preset mounts and composes correctly, including all nine persona anchors. This
-  is inherited from the upstream fork and is not specific to this localization.
+  is inherited from the upstream fork and is not specific to this localization. **Superseded — see
+  the Unreleased section "The peer range now covers dsh 0.2.x": the 24 peer ranges were widened
+  after this section was released, so the sentence above describes 0.1.0 as published and no longer
+  describes the current manifest.**
 - `exports` keeps `"./package.json"`, because the nine persona anchors locate the package directory
   through `createRequire(baseUrl).resolve('<pkg>/package.json')`. Without that export they fail with
   `ERR_PACKAGE_PATH_NOT_EXPORTED` at mount time.
@@ -118,4 +300,7 @@ SUL-1.0 is not an SPDX identifier and this package is dual-licensed. `files[]` s
   repositories with separate packages, preset ids and scope mappings, and neither affects the other.
 - A missing or empty persona file fails the mount by design, naming the file in the error.
 
+[Unreleased]: https://github.com/Tacrine/oh-my-dsh-omo-fork-chs/compare/v0.2.0...HEAD
+[0.2.0]: https://github.com/Tacrine/oh-my-dsh-omo-fork-chs/releases/tag/v0.2.0
+[0.1.1]: https://github.com/Tacrine/oh-my-dsh-omo-fork-chs/releases/tag/v0.1.1
 [0.1.0]: https://github.com/Tacrine/oh-my-dsh-omo-fork-chs/releases/tag/v0.1.0

package/README.md

@@ -165,7 +165,8 @@ error that names the file is far easier to act on than an agent that quietly los
 
 Every `@deepseek-ai/*` package the patch mounts is declared as a **`peerDependency`**, never as a
 regular `dependency`. DSH provides them; the bundle must not install its own copies. Peer ranges are
-pinned as `>=0.1.7-rc.2 <0.2.0` (and `@deepseek-ai/cordis` as `^4.0.1`). The package declares 25
+declared as `>=0.1.7-rc.2 <0.2.0 || >=0.2.0-0 <0.3.0-0 || >=0.2.1-alpha.1 <0.3.0-0`, which keeps the
+0.1.7 line and adds the 0.2 line (and `@deepseek-ai/cordis` as `^4.0.1`). The package declares 25
 peers and **no** runtime dependencies and **no** dev dependencies, so nothing has to be installed
 for the tests or for the zero-dependency part of the check chain.
 
@@ -179,7 +180,7 @@ Everything below runs from the repository root with **no install**, except `chec
 a runtime and is marked as such.
 
 ```powershell
-# 1. The test suite. Zero dependencies. 55 tests.
+# 1. The test suite. Zero dependencies. 56 tests.
 npm run test
 
 # 2. The check chain. Zero dependencies, no runtime needed.
@@ -202,10 +203,10 @@ What each one proves:
 
 - **`npm run test`** runs the `node:test` suite: the three forward rewrites, the inverse rewrites
   and their round trip, the argument parsers, the machine-path pattern from both sides, the
-  zero-byte guard, and the package check's negative paths. It is 55 tests and it needs nothing
+  zero-byte guard, and the package check's negative paths. It is 56 tests and it needs nothing
   installed.
 - **`npm run check`** is `node tools/check-package.mjs && node tools/verify-patch.mjs`. The first
-  runs 19 structural and license assertions (manifest identity, the four `exports`, the single
+  runs 22 structural and license assertions (manifest identity, the four `exports`, the single
   self-reference row, the nine persona anchors and their files, the `files[]` coverage, the eleven
   persona byte counts, the license pointers, the three license documents, the paths that must never
   ship, the untracked-file check over every directory `files[]` lists and the untracked root files
@@ -213,7 +214,9 @@ What each one proves:
   when one is supplied, the modification-notice claims, the license scope mapping and the per-entry
   anchors
   that pin each scope block to the content it claims, the machine-path
-  scan and the classes that govern where the pre-port package name may appear, and the patch's
+  scan and the classes that govern where the pre-port package name may appear, the SHA256 of the
+  two modules the package copies out of this repository, the internal markdown anchors of every
+  document that carries one, and the patch's
   shape). The second proves the published patch
   still equals what the three documented rewrites compute from the frozen baseline, and reports
   `verdict: "IDENTICAL"` with 11 rewrite sites. Both are **zero-dependency**, so they pass in a
@@ -248,6 +251,16 @@ What each one proves:
 > mapping check that reports success for work it never did is worse than no check at all. The
 > published package includes the tools and the test suite so the chain can be re-run from a clone.
 
+> **Counting a document's lines in PowerShell: `Measure-Object -Line` counts non-empty lines
+> only.** `(Get-Content README.md | Measure-Object -Line).Lines` reports **311** for this file,
+> while `(Get-Content README.md).Count` reports **374** — the same file, two readings, and the
+> difference is 63 blank lines that the first command never saw. Nothing in the command's name or
+> output says so, so a length check built on it silently under-counts any file with blank lines in
+> it. Use `.Count`, or `[IO.File]::ReadAllLines(path).Count`, when you want the raw line count. The
+> same trap has already produced wrong readings of a plan file in this repository twice, from two
+> separate contributors, because the two numbers look equally plausible when you have not measured
+> both.
+
 ## License
 
 This repository is **dual-licensed**, and the two licenses are not alternatives you may choose
@@ -291,16 +304,41 @@ Upstream names and trademarks belong to their owners.
 
 ## Known issues
 
-- **The declared peer range excludes dsh 0.2.0 and above, and the host skips the bundle there.** The
-  peers are declared as `>=0.1.7-rc.2 <0.2.0`, matching the upstream fork. On a dsh at 0.2.0 or
-  above, the host reports the plugin as incompatible, **skips the bundle**, and the command **still
-  exits 0**, so the failure is silent unless you read stderr: the preset never appears in the dump.
-  On such a version you must either run a dsh inside the declared range, or grant the exact-version
-  exemption with `dsh plugin allow-version "<pkg>@<version>" --dsh-version <version> --accept-risk`.
-  That exemption is the host's own escape hatch and carries the risk the host itself warns about, so
-  it is a deliberate acceptance of risk rather than a supported configuration. This behaviour is
-  inherited from the upstream fork and is not specific to this localization. On a runtime inside the
-  declared range the package mounts and composes correctly, including all nine persona anchors.
+- **This version requires DSH ≥ 0.2.2.** The 0.2.0 patch selects each of the 9
+  subagent presets with `agentPreset`, a field that only the 0.2.2
+  `dsh-tool-subagent` reads; 0.2.2 also removed the `persona` and `toolFilter`
+  fields the old rows used. On DSH 0.2.1 and earlier the rows still mount, but
+  `agentPreset` is accepted and then never read (the schema merges unknown keys
+  instead of rejecting them), so the child gets **no persona and no tool
+  restriction** and inherits the parent's full toolset: a read-only child such as
+  explore or oracle would silently gain write and subagent-spawning tools. That is
+  a silent privilege escalation, not a mount failure. The declared peer range
+  below still admits older 0.2.x builds, so this is a functional requirement
+  rather than a semver constraint. Verified on `0.2.2-alpha.2`; do not run this
+  version on DSH older than 0.2.2.
+- **The declared peer range covers the 0.1.7 line and the 0.2 line. The range check was verified on two 0.2.x builds, but `0.2.1-alpha.1` only with the 0.1.x patch.** The 24
+  `@deepseek-ai/dsh-*` peers are declared as
+  `>=0.1.7-rc.2 <0.2.0 || >=0.2.0-0 <0.3.0-0 || >=0.2.1-alpha.1 <0.3.0-0`, which keeps the range this
+  fork inherited from upstream and adds the 0.2 line. The host decides compatibility with a semver
+  range check over those peers, evaluating prereleases, so the range accepts `0.2.0`,
+  `0.2.1-alpha.1` and the later prerelease `0.2.2-beta`, and rejects `0.3.0-alpha.1`.
+  **Verified by experiment on `0.2.1-alpha.1` (0.1.x patch only) and `0.2.2-alpha.2` (this patch)**: with
+  no exemption present in the profile, a config dump of this package exits 0, writes **0 bytes to
+  stderr**, and carries the preset with all nine persona anchors; the `0.2.2-alpha.2` run was against
+  a profile that registers this package as a bundle. That is a claim about the mount and the anchor
+  paths, not about the personas' bytes and not about the preset's behaviour: no agent was invoked,
+  and a persona that still existed but had been truncated would pass the same check.
+  **`0.3.0-alpha.1` is the re-entry condition**: a future runtime in that range is rejected again,
+  with the same incompatibility warning on stderr and the same exit 0, so the failure stays silent
+  unless you read stderr. On such a version you must either run a dsh inside the declared range, or
+  grant the exact-version exemption with
+  `dsh plugin allow-version "<pkg>@<version>" --dsh-version <version> --accept-risk`. That exemption
+  is the host's own escape hatch and carries the risk the host itself warns about, so it is a
+  deliberate acceptance of risk rather than a supported configuration. **It is still needed for cases
+  this widening does not cover**: the published `0.1.0` on npm carries the old narrower range, and any
+  future 0.3.x runtime will need it. `@deepseek-ai/cordis` is declared at `^4.0.1` as well, but the
+  host never tests it — it only evaluates peers named `@deepseek-ai/dsh` or `@deepseek-ai/dsh-*` —
+  so that entry is not a compatibility constraint the host enforces.
 - **`baseline/` proves reproducibility, not correctness.** The baseline is a frozen snapshot of the
   pre-port patch, committed so the round trip can be checked anywhere. It is byte-identical to the
   source patch, and the derivation proves the port is **reproducible**: the published patch and the

package/README.zh.md

@@ -1,8 +1,8 @@
 # oh-my-dsh-omo-fork-chs
 
 [![npm version](https://img.shields.io/npm/v/@tacrine_f/oh-my-dsh-omo-fork-chs)](https://www.npmjs.com/package/@tacrine_f/oh-my-dsh-omo-fork-chs)
-[![license: SUL-1.0 (content) + MIT (packaging)](https://img.shields.io/badge/license-SUL--1.0_(content)_%2B_MIT_(packaging)-orange)](#license)
-[![node](https://img.shields.io/badge/node-%5E22.19.0%20%7C%7C%20%3E%3D24.0.0-blue)](#peer-model)
+[![license: SUL-1.0 (content) + MIT (packaging)](https://img.shields.io/badge/license-SUL--1.0_(content)_%2B_MIT_(packaging)-orange)](#许可)
+[![node](https://img.shields.io/badge/node-%5E22.19.0%20%7C%7C%20%3E%3D24.0.0-blue)](#peer-模型)
 
 `tri-agent` agent preset 的**简体中文非官方 fork**，面向
 [DeepSeek Harness](https://www.npmjs.com/package/@deepseek-ai/dsh) 打包为可发布的 Cordis bundle。
@@ -153,8 +153,9 @@ plan-aware-persona: persona "file:///.../personas/atlas.md" is empty
 ## Peer 模型
 
 patch 挂载的每个 `@deepseek-ai/*` 包都声明为 **`peerDependency`**，而不是普通 `dependency`。它们由
-DSH 提供；bundle 不得安装自己的副本。peer 范围固定为 `>=0.1.7-rc.2 <0.2.0`（`@deepseek-ai/cordis`
-为 `^4.0.1`）。本包声明 25 条 peer，且**没有**运行期依赖、**没有**开发依赖，因此测试与检查链中零依赖
+DSH 提供；bundle 不得安装自己的副本。peer 范围声明为
+`>=0.1.7-rc.2 <0.2.0 || >=0.2.0-0 <0.3.0-0 || >=0.2.1-alpha.1 <0.3.0-0`，既保留 0.1.7 线，又加入
+0.2 线（`@deepseek-ai/cordis` 为 `^4.0.1`）。本包声明 25 条 peer，且**没有**运行期依赖、**没有**开发依赖，因此测试与检查链中零依赖
 的那部分都不需要安装任何东西。
 
 DSH profile 的 `.npmrc` 设置了 `auto-install-peers=false`，所以这些 peer 是**纯声明式**的：pnpm 不会
@@ -165,7 +166,7 @@ DSH profile 的 `.npmrc` 设置了 `auto-install-peers=false`，所以这些 pee
 下面全部在仓库根目录运行，且**无需安装**，只有 `check:full` 例外，它需要 runtime，并已如此标注。
 
 ```powershell
-# 1. 测试套件。零依赖。55 个测试。
+# 1. 测试套件。零依赖。56 个测试。
 npm run test
 
 # 2. 检查链。零依赖，不需要 runtime。
@@ -187,14 +188,15 @@ npm run port -- --src <dir holding cordis.patch.yml>
 每一条各自证明什么：
 
 - **`npm run test`** 运行 `node:test` 套件：三组正向改写、反向改写及其往返、参数解析器、从两侧检验
-  机器路径模式、零字节守卫，以及包检查的失败路径。共 55 个测试，不需要安装任何东西。
-- **`npm run check`** 是 `node tools/check-package.mjs && node tools/verify-patch.mjs`。前者运行 19 条
+  机器路径模式、零字节守卫，以及包检查的失败路径。共 56 个测试，不需要安装任何东西。
+- **`npm run check`** 是 `node tools/check-package.mjs && node tools/verify-patch.mjs`。前者运行 22 条
   结构与许可断言（manifest 身份、四个 `exports`、唯一一条自引用 row、九条 persona 锚点及其文件、
   `files[]` 覆盖、11 个 persona 的字节数、许可指针、三份许可文档、绝不允许进入 tarball 的路径，
   对 `files[]` 所列每个目录的未跟踪文件检查，以及 npm 无论 `files[]` 如何都会自动收录的根目录文件、
   提供了上游指纹时的比对、
   修改声明的各项主张、许可范围映射及逐条把每个范围块钉到其所声明内容的锚点、机器路径扫描、
-  约束移植前包名出现位置的类，以及 patch 的形状）。
+  约束移植前包名出现位置的类、本仓库向消费者复制的两个模块的 SHA256、
+  每份带内部锚点的文档中锚点是否都能解析到标题，以及 patch 的形状）。
   后者证明已发布的 patch 仍然等于三项已记录改写从冻结 baseline 算出的结果，并报告
   `verdict: "IDENTICAL"` 与 11 处改写点。两者都**零依赖**，因此在干净克隆里、无需安装即可通过。
 - **`npm run check:full`** 就是单独运行 `node tools/verify-patch.mjs`。当 `DSH_RUNTIME` 指向一个包含
@@ -255,14 +257,33 @@ bundle patch 表达式的**逐字片段**，以便生成和校验该 patch。那
 
 ## 已知问题
 
-- **声明的 peer 范围不含 dsh 0.2.0 及以上，宿主会在这类版本上跳过本 bundle。** peer 声明为
-  `>=0.1.7-rc.2 <0.2.0`，与上游 fork 一致。在 0.2.0 或更高的 dsh 上，宿主会把该插件判为不兼容、
-  **跳过该 bundle**，而命令**仍然以 0 退出**，所以除非去看 stderr，这个失败是静默的：preset 根本不会
-  出现在 dump 里。在这类版本上，你必须要么使用落在声明范围内的 dsh，要么用
+- **本版本要求 DSH ≥ 0.2.2。** 0.2.0 patch 用 `agentPreset` 为 9 个子代理各选一个 preset，
+  而这个字段只有 0.2.2 的 `dsh-tool-subagent` 才会读取；0.2.2 同时移除了旧行使用的 `persona`
+  与 `toolFilter` 字段。在 DSH 0.2.1 及更早版本上，这些行**照常挂载**，但 `agentPreset` 只是被
+  接受、随后从不被读取（schema 会合并未知键而不是拒绝它），于是子代理**既没有 persona，也没有
+  任何工具限制**，直接继承父代理的全部工具集：像 explore 或 oracle 这样的只读子代理会静默获得
+  写文件与派生子代理的能力。这是**静默提权，不是挂载失败**。下面声明的 peer 范围仍然放行更旧的
+  0.2.x 构建，所以这是一条功能性要求，而不是 semver 约束。已于 `0.2.2-alpha.2` 验证；请不要在
+  低于 0.2.2 的 DSH 上运行本版本。
+- **声明的 peer 范围覆盖 0.1.7 线与 0.2 线。范围检查在两个 0.2.x 构建上验证过，但 `0.2.1-alpha.1` 只验证过 0.1.x 的 patch。** 24 个
+  `@deepseek-ai/dsh-*` peer 声明为
+  `>=0.1.7-rc.2 <0.2.0 || >=0.2.0-0 <0.3.0-0 || >=0.2.1-alpha.1 <0.3.0-0`，既保留本 fork 从上游继承的
+  范围，又加入 0.2 线。宿主用一个 semver 范围检查来判定这些 peer 是否兼容，并且会把预发布版本纳入比较，
+  因此该范围接受 `0.2.0`、`0.2.1-alpha.1` 与更晚的预发布版本 `0.2.2-beta`，而拒绝 `0.3.0-alpha.1`。
+  **已用实验在 `0.2.1-alpha.1`（仅 0.1.x 的 patch）与 `0.2.2-alpha.2`（本 patch）上验证**：在 profile 中不存在任何
+  豁免的情况下，对本包做 config dump 会以 0 退出、向 **stderr 写入 0 字节**，并在 dump 中带上该 preset 与
+  全部九条 persona 锚点；其中 `0.2.2-alpha.2` 这次运行针对的是把本包注册为 bundle 的 profile。这证明的是
+  挂载与锚点路径，而不是 persona 的字节内容，也不是 preset 的行为：本次验证没有调用任何 agent，
+  一个仍然存在但已被截断的 persona 同样会通过这项检查。
+  **`0.3.0-alpha.1` 是重新触发的条件**：将来的运行时一旦落在该范围内就会再次被拒，stderr 上出现同样的
+  不兼容警告，退出码同样是 0，所以除非去看 stderr，这个失败仍然是静默的。在这类版本上，你必须要么使用
+  落在声明范围内的 dsh，要么用
   `dsh plugin allow-version "<pkg>@<version>" --dsh-version <version> --accept-risk` 授予精确版本
   豁免。该豁免是宿主自带的逃生舱，并带有宿主自己警告过的风险，因此它是对风险的刻意接受，而不是受支持的
-  配置。这一行为继承自上游 fork，并非本地化引入。在声明范围内的运行时上，本包能正确挂载并完成装配，包括
-  全部九条 persona 锚点。
+  配置。**对于本次放宽没有覆盖的情形，它仍然是必需的**：npm 上已发布的 `0.1.0` 携带的是旧的、更窄的范围，
+  而将来任何 0.3.x 运行时也都需要它。`@deepseek-ai/cordis` 同样声明为 `^4.0.1`，但宿主从不检查它——
+  宿主只评估名为 `@deepseek-ai/dsh` 或以 `@deepseek-ai/dsh-` 开头的 peer——所以那一条并不是宿主会执行的
+  兼容性约束。
 - **`baseline/` 证明的是可复现，而不是正确。** baseline 是移植前 patch 的冻结快照，提交它是为了让往返
   校验在任何地方都能跑。它与源 patch 逐字节一致，而这次推导证明移植是**可复现**的：已发布的 patch 与
   baseline 之间恰好由三项已记录改写相连，别无其他。它**不**证明内容正确。如果源 patch 本身是错的，

package/baseline/README.md

@@ -11,15 +11,16 @@ that this fork vendors from. It was captured by reversing the three port rewrite
 `node tools/derive-baseline.mjs`, which reads this repository's published `cordis.patch.yml`
 and applies the inverse of the rules in `tools/lib/rewrites.mjs`.
 
-- Source: the chs bundle's `cordis.patch.yml`
-- Source byte count: 26903
-- Source line count: 540
-- Source SHA256: `BD9619038AFB3817C4EC8599B6A67EAC559A6193FFF53C820F1895E26312514F`
-
-The baseline file in this directory is **byte-identical** to that source: same 26903 bytes,
-same 540 lines, same SHA256. It carries no header, no provenance comment and no added blank
-line, because any of those would break both the byte-identity assertion and the round trip.
-This sidecar exists precisely so that nothing has to be added to the file itself.
+- Source: the repository's own `cordis.patch.yml` (the published agentPreset form)
+- Source byte count: 42649
+- Source line count: 946
+- Source SHA256: `06CA0E349E975DA6C948CE823D648DA1D2F370149F61D63BE9964692ACD7E829`
+
+The baseline file in this directory is the **pre-port** form: 41743 bytes, 946 lines,
+SHA256 `E086ED15B390DF293A46B6F901103B9F84839C0F4C2B5E562537F34A2644830C`. It differs from the
+source because the three port rewrites transform the package reference and persona-file paths.
+Re-applying those rewrites (`node tools/port-patch.mjs --src baseline`) reproduces the published
+patch byte for byte, which is what the verification chain proves.
 
 ## Upstream provenance