@treeseed/dsh-chapters 0.1.16 → 0.1.17

package/cordis.patch.yml

@@ -10,17 +10,40 @@
 # Two planes, two surfaces:
 #   HOST PLANE  — the `config:` block below (defaults shown commented; set any
 #                 under your profile's plugin entry).
-#   REALM PLANE — the compaction ENGINE row in the preset
-#                 (presets/chapters/agent.cordis.yml); shared names behave per
-#                 plane. Design record: docs/knowledge-repo.md §12.
+#   REALM PLANE — the compaction ENGINE row inside the preset's composition
+#                 (src/preset.ts for hosts that register rows; for pre-0.1.7
+#                 hosts, presets/chapters/agent.cordis.yml); shared names behave
+#                 per plane. Design record: docs/knowledge-repo.md §12.
+#
+# PRESET DELIVERY — one mechanism, and the host floor is 0.2.0:
+#   Hosts from 0.1.7-alpha.1 compose presets from '@deepseek-ai/dsh-agent-preset'
+#   DECLARATION ROWS and read nothing in $DSH_HOME/.agent-presets. This plugin registers
+#   the `chapters` row itself at activation, through the host's own agentPresets.register()
+#   — the same call the host's declaration-row plugin makes (src/preset.ts; why not a
+#   shipped patch layer is recorded there with the boot-breaking failures measured on
+#   0.1.5-rc.1). Rows this host cannot import are PRUNED and named in the mount line,
+#   because ONE unresolvable row makes the whole preset broken and every chapters
+#   session unopenable. Hosts below 0.2.0 have no register(): the mount line says
+#   `delivery: REFUSED`, the tools still work, and the preset cannot exist there.
+#   Either way the boot then ASKS THE ROSTER — file presence is not preset existence,
+#   and "declared" is not "usable". Read the `dsh-chapters:` lines at startup.
 #
 # config:
 #   # ---- identity & install --------------------------------------------
-#   installChaptersPreset: true    # copy presets/chapters into the home's
-#                                  # .agent-presets at boot; a user-edited
-#                                  # preset is never clobbered (write-once)
+#   installChaptersPreset: true    # register the chapters declaration row at
+#                                  # activation. Turning it off means a preset you
+#                                  # declare yourself (a patch layer in this or
+#                                  # another bundle); ours then stands down as
+#                                  # "already-declared" rather than throwing a
+#                                  # duplicate-preset error through our own row.
+#   compactionThresholdRatio: 0.9  # the registered preset's engine row: share of the
+#                                  # window that triggers a chapter checkpoint. This is
+#                                  # the knob a preset YAML used to carry in the home.
 #   fallbackPreset: 'chapters'     # preset mounted for children when the
-#                                  # caller's own preset cannot be resolved
+#                                  # caller's own preset cannot be resolved — and
+#                                  # the id the roster check looks for. This id is
+#                                  # DURABLE STATE: every child's log records it,
+#                                  # so renaming it orphans those sessions.
 #   harnessId: '<hostname>'        # per-machine identity: git commit author,
 #                                  # token scoping, edits/<harness>/ curation
 #                                  # partition, rule-approval authorship

package/docs/backlog.md

@@ -95,3 +95,75 @@ about.
   machine-only when you expected the pool, that note is the first thing to read.
 - **`/chapters-continue` vs `/chapters-fork`** is the intent line: continue carries the operative plan
   and may seed plan mode; fork carries nothing.
+
+## Preset delivery on 0.1.7+/0.2.x — landed, and what it exposed (2026-10-16)
+
+**Landed:** the `chapters` preset now EXISTS on a declaration-row host, by `agentPresets.register()` at
+activation (`src/preset.ts`), with rows the host cannot import dropped and named, a held disposer, and a
+deferred ROSTER check (`present` / `DECLARED BUT BROKEN` / `absent` / `unknown`) as the only health signal.
+**Support floor is 0.2.0** (user decision 2026-10-16): the legacy `.agent-presets` copy, the
+`presets/chapters/` tree, `installChaptersPreset`'s copy arm and `preset-install.test.ts` are DELETED; a
+pre-0.2.0 host gets `delivery: REFUSED` with its tools intact. The engine row's `thresholdRatio` became
+the host-plane config `compactionThresholdRatio` (no hardcoded tunables). Verified on real boots:
+0.2.0-rc.2 → `register: pruned, roster: present, inventoryRows: 28, unusableRows: []`;
+0.2.1-alpha.4 → `register: registered, roster: present, inventoryRows: 29, unusableRows: []`
+(after dropping `toolFilter`, which alpha.4 THROWS on — see the config-key row of the drift test). `tests/unit/preset-declaration.test.ts`
+(13 rows, `src/preset.ts` at 100%) is the drift gate, and it now RUNS on this box instead of skipping.
+
+**Why the row is not a shipped patch layer** — measured, because it looks like the obvious fix and it is a
+boot-breaking one: `dsh.bundle.patch` as an ARRAY throws `ERR_INVALID_ARG_TYPE` at
+`dsh-app-boot/lib/index.js:853` on every host before 0.1.7-alpha.1, and a row naming
+`@deepseek-ai/dsh-agent-preset` aborts that host's plugin tree (`Cannot find package`). `disabled: !!js`
+cannot gate it either: the Loader evaluates `disabled` before services mount, so the row is disabled on the
+NEW host too (measured). Full record: `docs/contract.md` § Presets are declaration rows.
+
+**Open, in order:**
+
+0. **Re-anchor the e2e host, then re-distill the tapes.** `tests/e2e/boot.ts` now refuses by name
+   while `dev/dsh-host-lock` pins a pre-0.2.0 host, and the refusal lifts itself when the lock moves —
+   that is the upgrade path, not a TODO. The per-boot row pins (`thresholdRatio`, `enrichmentEnabled`,
+   `auto`, `elicitedPlot`, `toolResultArtifactTokens`) and the `[e2e] boot pins:` line were deleted with
+   the YAML they patched; they come back expressed as CONFIG on the registered row (`compactionThresholdRatio`
+   exists now; the rest need the same treatment). Until then the browser acceptance chain does not run, and
+   `docs/verify.md`'s P23 is retired rather than passing.
+1. **The roster check is the only evidence we have that a preset composes — and it is a boot-time log
+   line.** A user cannot see it without a terminal. Candidate: surface `delivery:` + the roster verdict in
+   `/chapters-status` (and a warning row in the Settings plugin panel), so "installed and running" stops
+   being the whole answer. Nothing else in the plugin reports health to a human today.
+2. **`compositionInventory()` is used by the dev witness only.** Making the boot check itself compare
+   mounted rows would catch a row that resolves but never activates — the `broken` flag does not always
+   cover that, and the witness proves the shape of the answer already.
+3. **A reset registry can overwrite a chapter — no guard exists today.** `writeArchive`
+   (`src/archive.ts:106`) reserves numbers from the registry and writes them; nothing checks whether that
+   path already exists on disk. So the exact incident shape — registry gone (host reinstall) while chapter
+   files remain, or restored by rehydration — lets a NEW archive reuse number 001 and clobber a surviving
+   file, which breaks the append-only rule from the inside. Two rows are missing: at boot, report files the
+   registry does not know (`<store>/<root>/chapters/*.md` vs registry rows, counted); and refuse a
+   reservation whose target path exists, with the numbers.
+4. **Rehydration restores bytes, not rows.** `rehydrateStoreFromMirror` (`src/sync.ts:476`) fills absent
+   chapter and artifact files only. Search works off the files' own frontmatter, but numbering, ancestry and
+   collections are registry state, so a rehydrated store can be searched and cannot be continued cleanly.
+   Decide: rebuild rows from frontmatter (honest — the bytes are the ground truth), or refuse continuation
+   over a partially restored store with numbers. Do not let it look like a fresh chain.
+
+## Host bug we cannot fix: the workspace directory-picker modal (2026-10-16)
+
+Reported by the user as "the directory selection modal crashes before I can select a workspace", and it
+survived a host upgrade. Root-caused with real boots (`var/picker-probe/FINDINGS.md`, kept out of the
+repo's claims — it is host code): the picker's CLIENT bundle and the shell's client module table must come
+from the same host generation. The 0.1.x picker asks for `IconFolderOpen16`/`IconFolderClose16`;
+0.2.0-rc.2's shell exports only the `…Regular` spellings, with no compat alias in either direction. The
+slot boundary catches it, so the symptom is a rendered-then-dead dialog:
+`Error: Minified React error #130 … got: undefined`, logged as
+`slot entry crashed in 'sidebar.workspaces.directoryFlow'`
+(`@deepseek-ai/dsh-client-ui-renderer/lib/client.js:618`). A stale profile-local copy of
+`@deepseek-ai/dsh-client-ui-directory-picker-*` under `$DSH_HOME/profiles/<p>/node_modules` shadows the
+upgraded global install and reproduces "the new host did not fix it" exactly.
+
+Nothing in this plugin contributes to that slot (its client half registers
+`conversation.chat.assistant-actions` only), so the repo can ship no fix — only the recipe, which the
+site documents: purge the stale picker copies, and if the auto-resolved backend is not the one you want,
+pin the pair deliberately in the profile patch (`disabled: true` on `directory-picker`, insert
+`@deepseek-ai/dsh-host-directory-picker-browse` + `@deepseek-ai/dsh-client-ui-directory-picker-browse`).
+Upstream ask: compat aliases for the renamed icon exports, or a boot-time shell↔plugin version handshake
+that rejects a mismatched bundle instead of crashing at render.

package/docs/contract.md

@@ -244,12 +244,13 @@ The subclass seam, with everything measured by rounds 12-17 (sources: the instal
   `resolveConfig` **rejects unknown keys at runtime** (`BasicCompactionConfig:
   unknown key "artifactStoreRoot"`, r18) — peel engine-specific keys in the
   subclass constructor before `super(ctx, baseConfig)`.
-- Preset delivery: profile `!!js` evaluates `new Function("ctx", …) with (ctx)` —
-  `dshHomePath`/`process` reachable, **`require` is not** (r20 boot-killer) — so a
-  patch cannot name a package-relative `agentPresets` roots path. The plugin
-  copies its `presets/chapters/` into `$DSH_HOME/.agent-presets/` at boot,
-  write-if-missing (`installChaptersPreset`, schemastery default import —
-  version line `@deepseek-ai/schemastery@3.x`, NOT host rc.x).
+- Preset delivery: the plugin registers the `chapters` declaration row at activation
+  (`src/preset.ts` -> `ctx.get('agentPresets').register(...)`). The old copy of
+  `presets/chapters/` into `$DSH_HOME/.agent-presets/` is GONE with the 0.2.0 support
+  floor; the section "Presets are declaration rows" records why the row is not a shipped
+  patch layer (`!!js` evaluates `disabled` before services mount, and an array
+  `dsh.bundle.patch` throws on a pre-0.1.7 host). Related: profile `!!js` reaches
+  `dshHomePath`/`process` but NOT `require` (r20 boot-killer).
 - `ctx.logger` output is invisible to headless `dsh web` (r19); engine failures
   mirror to `$DSH_CHAPTERS_ENGINE_ERRORS` when set. Engine finalization runs on
   BOTH the success and rejection paths of `compactIfNeeded`/`compactNow` — the
@@ -354,6 +355,98 @@ Entry `apply(ctx, config)`. Build with `tsc -p tsconfig.json` and **build before
 UI (later phase) additionally needs `dsh.client` and a `tsdown.client.config.ts` — see
 `dsh-session-fork/package.json` for the shape.
 
+### Presets are declaration rows now (host ≥ 0.1.7-alpha.1) — measured, with the incident
+
+A user preset used to be a directory `$DSH_HOME/.agent-presets/<id>/` holding `preset.yml` +
+`agent.cordis.yml`. The host's own migration note is blunt: *"Nothing reads that directory any more."*
+(`@deepseek-ai/dsh-agent-preset/skills/editing-cordis-compositions/SKILL.md`). A preset is now an
+`@deepseek-ai/dsh-agent-preset` **declaration row** (`config: {id, name?, description?, order, plugins}`;
+`dsh-agent-preset/lib/index.js:13-20`) carried by a patch layer, and `AgentPresetRegistry.register()` is
+fed only by such rows (`dsh-agent-preset-registry/lib/index.js:470`, installed 0.2.0-rc.2). Nothing
+crashes when a plugin misses this: the bundle boots, its tools register, Settings says "enabled and
+running", the preset is simply absent — and a session's preset id is **durable state** (`resumeObserved()`
+→ `presets.resolve(id)`, `dsh-api-session-controller/lib/index.js:404`, `:364`; `resolve()` throws
+`agent-preset/not-found`, `dsh-agent-preset-registry/lib/index.js:596`), so every chapters session refuses
+to OPEN while its log sits there intact.
+
+**This bundle does NOT ship the row as a patch layer.** It registers the row itself at activation,
+through the host's own `ctx.get('agentPresets').register(definition)` — the same call the host's
+declaration-row plugin makes (`dsh-agent-preset/lib/index.js`, `[Service.init]`). The reason is two
+boot-breaking failures measured on the pinned legacy closure (`@deepseek-ai/dsh 0.1.5-rc.1`, the host
+`dev/dsh-host-lock` freezes for tape bytes) against the installed 0.2.0-rc.2:
+
+- `dsh.bundle.patch` as an **array** (what a second layer requires) dies at profile load on a pre-0.1.7
+  host: `TypeError [ERR_INVALID_ARG_TYPE]: The "path" argument must be of type string. Received an
+  instance of Array` — legacy `dsh-app-boot/lib/index.js:853` does `join(packageDir, declared)`. Array
+  support (`bundlePatchFiles`) and declaration rows arrive in the SAME release, 0.1.7-alpha.1, verified
+  across the published `dsh-app-boot` tarballs. A two-layer manifest is therefore exactly as incompatible
+  with 0.1.5/0.1.6 as it looks, and the host does not warn — it just never comes up.
+- The **row itself** in any layer a legacy host reads is fatal the same way:
+  `dsh: plugin tree failed to load: … failed to import loader entry preset-chapters
+  (@deepseek-ai/dsh-agent-preset): Cannot find package` (measured; `@deepseek-ai/dsh-agent-preset` is
+  first published at 0.1.7-alpha.1, and 0.1.5-rc.1 ships `dsh-agent-presets`, plural, whose service has
+  no `register()` — `this.ctx.agentPresets.register is not a function`).
+- **`disabled: !!js` cannot gate the row either**, which is the tempting fix. The Loader evaluates a row's
+  `disabled` before services are mounted (`cordis-plugin-loader/lib/index.js:348` →
+  `evaluate(this.ctx, expr)` = `with (ctx) { eval(expr) }`), so `get('agentPresets')` is undefined *on the
+  modern host too* and the row is disabled everywhere — measured on 0.2.0-rc.2: `preset-v2 … failed to
+  import`, roster without it, while the same row with `disabled: !!js false` registered normally. Bare
+  `get(...)` also throws in that scope (`ctx` is bound, `get` is not).
+
+The registration path is verified on both mechanisms with real boots: on 0.2.0-rc.2 the witness reports
+`register: pruned, roster: present, inventoryRows: 28, unusableRows: []`; on 0.1.5-rc.1 it reports
+and the same build on 0.1.5-rc.1 logs
+`delivery: REFUSED — this host predates preset declaration rows (< 0.2.0)` — the tools work,
+the preset cannot exist there, and 0.2.0 is now the support floor.
+
+Three consequences of reading the registry rather than the filesystem:
+
+- **A row that does not resolve is dropped, never mounted.** `mountPreset` throws if ANY enabled row failed
+  (`dsh-agent-preset-registry/lib/index.js:272`), the registry stores it as `record.broken` (`:541`), and
+  `retain()` then refuses with `agent-preset/invalid` (`:651`) — so one stale row makes the whole preset
+  unusable, which is the same user-visible failure as a missing preset. Measured on 0.2.0-rc.2 with a row
+  for `@deepseek-ai/dsh-tool-schedule` (published only from 0.2.1-alpha.1):
+  `preset "chapters" is DECLARED BUT BROKEN — tool-schedule …: never started`. `pruneResolvableRows`
+  (`src/preset.ts`) drops such rows and NAMES them in the mount line; `resolvableFromThisPackage` is the
+  probe, asked with the row's full specifier so a lost subpath export is caught too.
+- **A held disposer, not an effect.** `register()` returns an unregister disposer, and wiring it through
+  `ctx.effect` un-registers the preset the moment our activation finishes — measured: `register()`
+  succeeded while the roster came back WITHOUT `chapters`. The same apply-fiber trap bit the storage
+  domain in r35. The disposer is held in a module array instead.
+- **The roster is the health check, and it must be asked after activation.** The registry re-audits a mount
+  by awaiting the settled loader tree (`:562`), and its doc says callers "must not run inside a Host row's
+  own activation, which the settlement would wait on". So `reportPresetRoster()` runs deferred, and
+  `compositionInventory()` rows say which mounted rows are actually `active` — `broken` alone hides a row
+  that resolved but never started.
+
+Rows are renamed and dropped between host versions, so re-anchor `src/preset.ts` against the installed
+host's own `@deepseek-ai/dsh-web-app/presets/standard.patch.yml` after an upgrade. Measured drift across
+the five published versions (rc.1, rc.2, alpha.1, alpha.2, alpha.4): alpha.1 ADDS `dsh-time-context` +
+`dsh-tool-schedule` + `toolFilter.deny[schedule_*]`; alpha.2 DROPS the persona `suffix` (with its
+`{{cwd}}`), `backgroundMode`, and the codex/claude-code/ralph rows; alpha.4 rewrites the plan-mode
+sentence, drops `toolFilter`, adds `dsh-plugin-market`. rc.1 and rc.2 are byte-identical.
+`tests/unit/preset-declaration.test.ts` is what turns the next rename into a red row instead of a broken
+user session — and it pins that `dsh.bundle.patch` is still a string.
+
+- **Prompt variables are a closed set, and violating them throws per turn, not at boot.** `dsh-agent-loop`
+  registers `provider`/`model`/`cwd` through 0.2.0-rc.2 (`lib/index.js:1564-1566`) and only `provider` and
+  `model` from 0.2.1-alpha.2 (`:1591-1592`); `interpolate()` rejects any other reference with `prompt
+  variable "{{x}}" has no value for this assembly` (`dsh-system-prompt/lib/index.js:171`). There is no
+  `{{cwd}}` worth writing: `dsh-working-directory` (host plane) already prints `Current working directory:
+  "…"` into the runtime context. This is what broke every new chapters session immediately AFTER the
+  delivery fix above — the preset composed fine, the legacy `persona.suffix` interpolated `{{cwd}}`, and
+  assembly threw on every turn. Pinned by the `{{variable}}` row of the test.
+- **Some host plugins reject unknown config keys**, so a preset row's config is not free-form:
+  `dsh-compaction-tool-result-pruner`, `dsh-compaction-basic` and `dsh-plan-mode` throw on any key they do
+  not know (`PlanModeConfig has unknown key(s) …`); `dsh-tool-subagent` and `dsh-tool-ralph` are plain zod
+  objects that strip them. Keep exactly `{thresholdChars, headChars, tailChars}` on the pruner and exactly
+  `{section}` on plan mode.
+- **Persona wording is load-bearing for the engine.** `src/engine-core.ts`'s `PLOT_TEMPLATE_ECHO` suppresses
+  a "plot" that is really our own instruction quoted back (the 2026-09-25 audit: eight checkpoints of a
+  real run inherited boilerplate, and because the result was non-null the bounded elicited fallback never
+  ran). It matches phrases inside the suffix, so reword the suffix and the guard in the same change — the
+  gate asserts that coupling by behaviour, not by copying the regex.
+
 ## Trigger Constraints
 
 Two different actions, two different timings — Phase 0b measured the seam so this split is now factual,

package/docs/development.md

@@ -355,7 +355,7 @@ happened in these notes before it was caught.
 | `src/notice.ts` + `test/notice.test.ts` — TOC-notice builder, kernel-rejection reproduction, vocabulary pins + drift guard (Phase 0b check 5) | **done**, 10 tests |
 | `src/registry.ts` + `src/store.ts` — pure numbering/ancestry/plan state; zod domain spec, storage-domain + node-fs adapters | **done**, 13 + 7 tests; durability witness passed |
 | `src/engine-core.ts` + `src/engine.ts` — ChaptersCompactionEngine | **done & boot-proven** (r18/r19: realm subpath row mounts; real cascade finalizes; catch-path fix — FINDINGS § Phase 1) |
-| `presets/chapters/` + copy-on-boot install | **done & boot-proven** (r21; `!!js` has no `require`, so copying is the delivery mechanism — r20) |
+| preset delivery | **rewritten in 0.1.17**: the row is registered at activation (`src/preset.ts`). The `presets/chapters/` + copy-on-boot mechanism it replaced is deleted with the 0.2.0 support floor (docs/contract.md) |
 | `npm test` (unit + integration) | **188 passing, <2 s** — unit imports no harness services; integration runs the sync loop against a fake git driver AND a real git smart-HTTP server (git-http-backend on loopback; the git binary is test-only scaffolding, the product stays pure-JS) |
 | 20-check verify.md pass | **r26/26b**: 18 mechanical on `.dshdev2` (refusals with numbers, tamper marks, idempotent retry, cross-boot registry + resume); human rows per verify.md evidence map |
 | dsh-session-fork coexistence | **moot at this version** (r26a pair-boot): the example fails to boot the installed host ALONE (unguarded `webServer` read in the installed dsh-client-connection) — assumed-neutral until a version-matched pair-boot |
@@ -465,3 +465,30 @@ commands were *verified*.
 
 `docs/contract.md`'s file:line citations are from the `examples/` snapshot (rc.1-era), not the rc.2 fork —
 re-anchor them against whichever version a test actually boots.
+
+### Running the TS tests on this box (node 22, no native type stripping)
+
+Measured 2026-10-16: `npm test` (`node --test tests/unit/*.test.ts`) needs node ≥ 23 for type
+stripping, and this machine's `/usr/bin/node` is **v22.22.1 compiled WITHOUT TypeScript support**
+(`ERR_NO_TYPESCRIPT`, not merely a missing flag). The package's `engines` floor is node 24, and CI
+installs it; locally, run the same files through `tsx`:
+
+```bash
+npm install --no-save --no-audit --no-fund tsx unrun     # both, in ONE command
+node --import tsx --test tests/unit/*.test.ts tests/integration/*.test.ts
+npx c8 --check-coverage --statements 85 --branches 85 --functions 85 --lines 85 \
+  node --import tsx --test tests/unit/*.test.ts tests/integration/*.test.ts
+```
+
+Two traps measured while finding that:
+
+- **`npm install --no-save A` then `--no-save B` removes A.** npm prunes what is not in the manifest,
+  so unsaved helpers must be installed in a single command (`unrun` disappeared the moment `tsx` was
+  added, and `npm run build` — which bundles the client through `tsdown` — failed with
+  `Cannot find module "unrun"`).
+- `tsconfig.test.json` (committed) transpiles `src` + `tests` to `var/tsbuild` with `--noCheck` for
+  the rare case you want emitted JS instead of a loader. It is NOT how the suite is meant to run;
+  tests import `.ts` sources directly and are not typechecked by design (`npm run typecheck` covers
+  `src/` only).
+
+Never fix a missing test runner by editing the tests. The suite is the contract; the runner is local.

package/docs/plans-carriage.md

@@ -4,7 +4,7 @@ Written 2026-10-09. **Read before writing code.** Human decisions for this featu
 § Decisions Taken and are binding; anything marked *deferred* is a human call, not ours.
 
 DSh ships plan mode (`@deepseek-ai/dsh-plan-mode`) and our own preset mounts it
-(`presets/chapters/agent.cordis.yml:109-133`). Today a session plan survives an archive only as the
+(the `plan-mode` row of the registered preset: `PLAN_MODE_SECTION` in `src/preset.ts`; before the 0.2.0 floor it lived in `presets/chapters/agent.cordis.yml`). Today a session plan survives an archive only as the
 first 400 characters of a tool-call line. That is the worst possible outcome for the one artifact in a
 conversation that is *deliberately* decision-complete — and the reason the plugin exists at all: a
 continuation that cannot see the approved plan either re-plans from recall (lossy) or implements

package/docs/verify.md

@@ -152,7 +152,7 @@ renderer, the segmentation tool, and the child's notice.
 | P10 | Artifact citations resolve wherever they were written | a chapter's `artifacts/aa/<sha>.txt` reference resolves whether the blob sits at the STORE ROOT (arrival stubs) or inside the ANCESTRY TREE (`<store>/<root>/artifacts/…`, where `writeArchive` puts deferred results and every plan) — before this fix the second form was unreadable through `chapters_artifact`, which is what "every byte remains retrievable" actually promised | `artifact-query.test.ts` rows + integration `plans-carriage.test.ts` (`resolveArtifactWithMirror` over the real tree) |
 | P11 | The browser plane runs in the chain | `/plan <message>` → a real `exit_plan_mode` call → the host's review card opened and answered by a real CLICK → fork; asserts the submission's bytes are the artifact's bytes (or provably only-redacted), `planMode: inactive` from the fold, a `kind: plan` document on disk, and that the BRANCH child carries **no** `## Active plan` and no call-out while still citing the archive; plus a guard that no `compaction/*` entered the journey | `tests/e2e/plans.spec.ts` = chain project `plans` (13 s replay, no LLM; 3-entry tape). **Scope, learned at cost:** the continuation leg was REMOVED from this journey because a tape freezes the model's tool ARGUMENTS — my scripted upstream derived `chapters_continue` ranges from the ceiling the live segment tool reported while distilling (30 here), and the runner's session lands at 29, so `validateRanges` refused the stale input (correctly). A journey whose recorded request embeds a machine-specific seq cannot be hardware-neutral. Continuation semantics — `## Active plan`, `## Previous plans`, the seeded `plan/mode`, the checkpoint carry — are covered by the deterministic plane (`continue-plans`, `plans-engine`, `plan-documents`, the § 10 kernel probe) and the in-place path by the heavy/arrival/enrich/fanout journeys. Tape provenance: scripted upstream, see `tests/fixtures/model-tape/plans/PROVENANCE.md` |
 
-| P23 | A partially-wiped preset **self-heals and says so** | `installChaptersPreset(srcDir, dstDir, log, parent)` validates the **whole shipped file set**, not just `preset.yml`; missing shipped files are restored **additively** (files the user already has are never overwritten, so edits survive); statuses `installed / repaired / complete / failed / no-source` are returned, not just logged; the mount line now carries the status and logs **UNHEALTHY** on `failed` instead of claiming it mounted; the dev witness reports `presetComplete` + `presetMissing` (it had the same one-file blindness, in the very tool a user reaches for when this breaks) | unit `preset-install.test.ts` (7 rows, real temp dirs — the function previously hard-resolved its own paths so it was untestable): fresh install, complete-left-alone, **THE INCIDENT** (delete `agent.cordis.yml` → `repaired`, user's `preset.yml` edit preserved, warn names it), nested subdirectory, failure→`failed`+warn+error carried, source-without-manifest→`no-source` and no partial dir left |
+| P23 | **Retired in 0.1.17 with the legacy copy** (support floor 0.2.0): `installChaptersPreset` and `presets/chapters/` are deleted, so there is no installed file set to half-delete. The health evidence is the ROSTER check and the mounted rows — pinned by P24/P25 below | unit `preset-declaration.test.ts` (14 rows) + real boots on 0.2.0-rc.2 and 0.2.1-alpha.4 |
 | P21 | The continuation has a **human-pulled door**, and the two doors cannot drift | `/chapters-continue` = `deterministicCommand({intent:'continue'})`, the same builder as `/chapters-fork`; only name/verbs/intent/no-directive prose differ; archive semantics identical (everything since the watermark). CLIENT SIDE, same discipline: the assistant row registers both doors from ONE runner (`src/client/doors.ts` `makeDoorRunner` + a two-row `DOOR_ACTIONS` table) — a composer-only continue left the user with a created child and no affordance | unit `continue-command.test.ts` (7 rows) incl. the **no-drift row**: same events in ⇒ same ranges, titles and plan facts out of both doors; the no-plan case, the refusal naming its own door, and approved ⇒ NOT seeded vs still-planning ⇒ seeded `['user/message','plan/mode']`. Unit `client-doors.test.ts` (7 rows) pins the two client rows (distinct id/order/label/command, the fork label frozen for the specs), that ONE child-id regex parses BOTH door wordings, that both rows fire their own command through the same body, and — by reading the server's own templates — that the reply wording the client parses is still what `deterministicCommand` emits. Browser: project `fork` asserts BOTH buttons render |
 | P22 | The continuation shape is covered **in the browser**, on every push | the leg that a tape could not carry (§ 15) is back, driven by the command — no model request, no frozen `endSeq`; asserted from the child's durable log without switching the UI: `## Active plan`, the operative plan by title with its real verdict, `plan document:` and `chapters_artifact` citations, `## Finding things`, no seeded gate after approval, exactly one synthetic notice (invariant 2) | `tests/e2e/plans.spec.ts` project `plans` — replays in ~14 s with no LLM/GPU, eight-project chain green |
 | P18 | Search answers **without a pool linked** — the findability audit | `buildLocalCorpus` walks the workspace store (chapters, `kind: plan` documents, rules) and answers through the SAME scorer as the mirror door (`rankEntries`), so ranking cannot drift between doors; artifacts are deliberately not indexed (they answer to `chapters_artifact`); the answer names its door ("searched this machine's store, N docs, no pool mirror") so a session never reads *this machine only* as *the whole project*; "nothing matched" (`documents>0`) is distinguished from "nothing here" (`empty`); a pool miss falls back to the local store before answering empty | unit `local-corpus.test.ts` (5) + integration `find-without-a-pool.test.ts` through the real tool wrapper — the empty answer used to be born in the wrapper, not the pure function |

package/lib/index.d.ts

@@ -1,4 +1,5 @@
 import Schema from '@deepseek-ai/schemastery';
+import { type RegisterOutcome } from './preset.ts';
 import { type SyncScheduler } from './sync.ts';
 /** The cordis surface this entry touches; widened in later stages. */
 interface HostCtx {
@@ -26,6 +27,7 @@ interface HostCtx {
 }
 export interface Config {
     installChaptersPreset: boolean;
+    compactionThresholdRatio: number;
     artifactStoreRoot: string;
     chapterTokenTarget: number;
     toolResultDeferFloorTokens: number;
@@ -91,39 +93,59 @@ export declare function apply(ctx: HostCtx, config: Config): Promise<void>;
  * before anything archives.
  */
 export declare function createScheduler(store: import('./store.ts').RegistryStore, domain: import('./store.ts').DomainLike, config: Config, debounceOverride?: number, onSyncDone?: (cwd: string, ok: boolean) => void, warn?: (m: string) => void): SyncScheduler;
-export type PresetInstallStatus = 'installed' | 'repaired' | 'complete' | 'failed' | 'no-source';
-/** What the preset install actually did — the caller must not report success on a 'failed'. */
-export interface PresetInstallReport {
-    status: PresetInstallStatus;
-    /** Shipped files absent from the installed copy (the partial-preset case). */
-    missing: string[];
-    dstDir: string;
-    error?: string;
-}
 /**
- * Install the `chapters` preset into the user preset directory, and — the part that
- * used to be missing — tell the truth about what happened.
+ * Why delivery is a `register()` call and not a file, in one incident: hosts from
+ * 0.1.7-alpha.1 stopped reading `$DSH_HOME/.agent-presets/` — a preset is an
+ * `@deepseek-ai/dsh-agent-preset` declaration row — while the plugin kept copying,
+ * kept logging that it had mounted, and the preset was simply GONE. That is worse
+ * than a crash, because `resume` resolves the preset id recorded in the session's
+ * own log and throws `agent-preset/not-found`, so every chapters session became
+ * unopenable while its durable log sat there intact and uncorrupted.
  *
- * The never-clobber rule exists because the installed copy is user-owned: the user may
- * have edited `agent.cordis.yml` to retune the compaction row. But the OLD guard tested
- * for `preset.yml` ALONE, and the preset is really two files — `agent.cordis.yml` is the
- * one that names the engine realm row. So a partially wiped home (an interrupted
- * uninstall/reinstall is what triggered this) left a preset directory that passed the
- * guard forever: the installer returned early on every boot, the preset could not mount,
- * and the plugin still logged that it had mounted. Sessions that had chosen the preset
- * then looked corrupted, while their logs and data were untouched — the break was in
- * composition, which is invisible if the report lies.
+ * Shipping the row as a patch layer instead is what a reader will reach for, and it
+ * is a boot-breaking choice on the hosts this plugin used to support: `dsh.bundle.patch`
+ * as an array throws `ERR_INVALID_ARG_TYPE` at legacy `dsh-app-boot/lib/index.js:853`,
+ * an unresolvable row aborts a legacy plugin tree, and `disabled: !!js` cannot gate the
+ * row because the Loader evaluates `disabled` before any service is mounted (all three
+ * measured). Support floor is 0.2.0 now, so the row is registered here through the
+ * host's own `agentPresets.register()` — the same call its declaration-row plugin makes.
+ */
+/**
+ * Whether a row's module can be imported from THIS package's resolution family.
  *
- * The repair is therefore *additive*: missing shipped files are restored, files the user
- * already has are never overwritten. That keeps the user's edits intact AND makes a
- * half-deleted preset self-healing, because restoring a missing file is not clobbering
- * anything.
+ * The preset mount resolves its rows from the registry's context, which shares this Node
+ * resolution root; a false answer here means a row that would activate as failed — and one
+ * failed row makes the whole preset `broken`, which is worse than a missing tool.
  *
- * Exported for testing with real temp directories; `srcDir`/`dstDir` are parameters so no
- * test has to touch the developer's DSH home.
+ * Never throws: an unresolvable specifier is the answer. Two limits of the probe are the
+ * host's own, not ours to paper over: a RELATIVE specifier resolves without touching the
+ * filesystem (Node answers the URL, not existence), so a file-URL row would always be
+ * reported resolvable; and a name that resolves is not yet a name that ACTIVATES — a plugin
+ * that rejects its config throws later, which is what the roster line reports as
+ * `DECLARED BUT BROKEN`. Subpath exports are the useful case, and they are the ones a host
+ * rename eats first: `@scope/pkg/no-longer-exported` answers `ERR_PACKAGE_PATH_NOT_EXPORTED`.
  */
-export declare function installChaptersPreset(srcDir: string, dstDir: string, log?: {
-    info?: (m: string) => void;
-    warn?: (m: string) => void;
-}, userPresetRoot?: string): PresetInstallReport;
+export declare function resolvableFromThisPackage(specifier: string): boolean;
+/** What the host roster says about our preset. */
+export type RosterVerdict = {
+    state: 'present';
+    broken?: string;
+} | {
+    state: 'absent';
+    rows: string[];
+} | {
+    state: 'unknown';
+    error: string;
+};
+/** Ask the host which presets exist. Tolerates both shapes the service has
+ *  offered: the bare row array (`list()`) and the remote envelope (`{presets}`). */
+export declare function readRosterVerdict(presets: {
+    list?: () => Promise<unknown>;
+} | undefined, presetId: string): Promise<RosterVerdict>;
+/** The remedy, in the two shapes an absent preset can have on a supported host. */
+export declare function rosterRemediation(presetId: string, outcome: RegisterOutcome): string;
+/** Deferred boot check: one truthful line about the preset, plus the verdict for the witness.
+ * Exported so the four arms of that line are tested without booting a host — the line IS the
+ * health signal a user reads, and an untested health signal is how the silent case survived. */
+export declare function reportPresetRoster(ctx: HostCtx, presetId: string, outcome: RegisterOutcome): Promise<RosterVerdict>;
 export {};