@treeseed/dsh-chapters 0.1.24 → 0.2.1

package/docs/backlog.md

@@ -1,4 +1,78 @@
-# Open items — 2026-10-11
+# Open items — 2026-10-23 (host 0.2.0-rc.2)
+
+Handoff while the nine-leg re-record and strict replay are in flight on
+`feature/56-reanchor-tape-corpus`. Read this section first; the 2026-10-11 record below is history,
+and item 1 there (live-model proof of the plans journey) is still open — tonight's `plans` leg was
+again recorded through the scripted stub (`tests/e2e/stub-model.ts`), as its PROVENANCE says.
+
+**What the last two days changed about our claims.** The preset pin had been written to a retired row
+id (`agent-presets` → `agent-preset-registry`), so every browser boot since the 0.2.x move ran the
+STANDARD realm: no `compaction/*`, no artifacting, no `chapters_rules` — the legs were measuring an
+absence, not a failure (#56). The 0.2.x flattened `tool/result` shape silently disabled arrival
+artifacting chain-wide. `uiWorkspace.openSession` never existed, so the continuation door reported a
+switch it could not make (#77). All four are fixed with rows; the corpus is being re-anchored as I
+write, and **no e2e claim is current until replay is green** — `CORPUS_HOST` was flipped in the same
+change, so a red replay means that flip must be reverted, not the tape widened.
+
+0. **The acceptance chain is one rig bug from green — and it was #77's lesson, in my own tooling.**
+   A pristine home commits a draft under a **fresh session id** while `dsh.sessions.current` keeps
+   naming the draft, so `newSessionWithTurn` watched a log that received nothing (journey turn
+   completed at seq 42, 28 s after its question, in *another* directory). Warm homes hide it; CI is
+   always cold, which is why "green here, red there" survived the matcher fix (#89's path fold), the
+   host-binary fix (`resolveHostBinary`), the tracked profile seeds, and my own false
+   header-composition claim (withdrawn on #89). Fixed by `adoptSessionForTurn` — the durable log
+   decides, candidates are only where to look, `null` rather than an invented id — with 4 rows,
+   mutation-checked. **The pending step is mechanical but long**: re-distill the nine legs under it
+   (`var/run-decisive.sh`, heavy behind the #86 watchdog), strict-replay locally, then one push and
+   watch hosted acceptance. Only then: corpus commit + `CORPUS_HOST` re-lift, `coverage:e2e`,
+   merge #89, rewrite #73's verification from those numbers.
+
+0b. **One sequencer at a time (#82, live lesson 2026-10-23).** Two detached helper scripts
+   (`var/after-pass.sh`, `var/after-pass2.sh`) were both waiting on "runner idle"; the first fired,
+   relaunched a full eight-leg pass against a build taken *before* the newest commit, and the second
+   would have stacked a competing cycle on top. Killed the duplicate. Rules now written into the tooling:
+   `run-decisive.sh` honors `DISTILL_PROJECTS` so a follow-up re-records only the legs that need a new
+   build, and a cycle script must `pgrep` for any live `distill|playwright|run-decisive` before starting.
+   Careful with `pgrep -f` patterns from inside a shell whose own command line contains the pattern — my
+   cleanup killed its own tool call.
+
+1. **#83 — the e2e specs have never been type-checked.** `npm run typecheck:e2e` (new, deliberately not
+   in CI) reports **120 errors**: 39 wrong-arity calls, 12 cannot-find-name, 10 argument-type, 26
+   un-narrowed `unknown`, 22 missing-lib, 3 phantom properties. Two bugs this week (a missing import,
+   a dropped closing paren — both mine, both from the composer wiring) were invisible *only* because
+   this check did not exist. Close it: fix the arity class by giving `newSessionWithTurn` a named
+   options object (`{ turnMs, actionGrace }`) so a positional `false` is un-writable; triage the rest;
+   then wire the gate beside `typecheck` and `typecheck:client`. Do not exclude a file to shrink the
+   number — a dev-only tool moves out of `tests/e2e` instead.
+2. **#82 — a running distill and the deterministic suite share `tests/fixtures/model-tape`.** (Third live instance 2026-10-23: `tape-provenance.test.ts` correctly went red mid-re-record because the runner had cleared a project directory — that row is now the canary, don't soften it.) Tonight
+   the tape-coherence rows went red for exactly the projects being re-recorded, and a leg that dies
+   halfway can leave a partial project directory in the corpus. Recommended shape: record into
+   `tests/fixtures/.tape-staging/<proj>`, promote with `rename` on `rc == 0`. That makes "the corpus
+   is one coherent change" a mechanism instead of my self-control, which has already slipped once.
+3. **#80 — plugin command results produce nothing operator-visible.** Durable `command/done` yes, DOM
+   no (measured twice: this leg's own teardown aria snapshot; `/chapters-status` on a fresh boot).
+   Success paths are undelivered, which is #61a one layer up. Needs a host fact (`docs/contract.md`)
+   before code: is there a slot/toast/flow renderer for `command/done`, or must the plugin own the
+   affordance?
+4. **#81 criteria 3 and 4.** The delivery guard is now at every composer call site with a drift row,
+   but the browser assertion "one instruction ⇒ exactly one `user/message` carrying it" is not written
+   yet, and the predicate still decides from the durable log only — a synthetic turn whose record is
+   delayed is still a race we have not measured.
+5. **#78 — the design decision, still the maintainer's.** A single `tool/result` larger than what can
+   fit beside the mandatory retain tail is NOT relievable by pressure compaction (measured: 6
+   compactions + 6 `context-overflow` entries + the endpoint's `400`, with the arrival floor switched
+   off by design). Option A: treat survivability as an invariant (hard ceiling, artifact with a loud
+   warning — the archive keeps every byte, so the worst case is a context-economy miss). Option B:
+   accept "disable the floor, read 30K tokens, the session degrades" as correct. `heavy` is green, so
+   this no longer blocks a leg — it is a product statement we should make deliberately.
+6. **The remaining release steps for #56**, in order: green strict replay (no fallback) → fresh
+   `coverage:e2e` → PR to `staging` (reload the `release-workflow` skill first — the gate is
+   mandatory) → CI green → merge → rewrite PR #73's verification text so every claim carries the
+   artifact that proves it. `main` stays agent-forbidden.
+
+---
+
+# Open items — 2026-10-11 (history)
 
 Handoff for a fresh session. Everything below is *scoped and reachable*; none of it is a unknown
 defect. Shipped state: **0.1.13** (tag = npm `latest` = the user's installed profile), hosted CI green
@@ -119,9 +193,15 @@ NEW host too (measured). Full record: `docs/contract.md` § Presets are declarat
 
 **Open, in order:**
 
-0. **Re-anchor the e2e host, then re-distill the tapes.** `tests/e2e/boot.ts` now refuses by name
-   while `dev/dsh-host-lock` pins a pre-0.2.0 host, and the refusal lifts itself when the lock moves —
-   that is the upgrade path, not a TODO. `ci.yml`'s `host-capability` job reads that same lock and
+0. **Re-anchor the e2e host, then re-distill the tapes — IN PROGRESS (#54).** The lock now
+   resolves `@deepseek-ai/dsh` **0.2.0-rc.2** (chosen by witness: the host this box has been running
+   the plugin on, not npm's latest), `hostSupportsPresetRows()` answers true, and the boot's named
+   refusal has lifted itself exactly as designed. Three 0.2.x rig drifts were found by booting rather
+   than guessing and are fixed — the `session.v4` log format, the Preview Notice focus trap, and the
+   provider block that 0.2.x reads only from `cordis.patch.yml`. Distillation no longer needs the GPU
+   box (see `docs/development.md` § Distilling tapes WITHOUT the GPU box). REMAINING: re-distill all
+   eight projects on the new host, re-run `npm run test:e2e:replay` strict and `coverage:e2e`, and
+   re-measure the browser ledger before ANY browser-plane claim is made. `ci.yml`'s `host-capability` job reads that same lock and
    SKIPS the acceptance job with a step-summary reason plus a `::warning::` while the pinned host
    predates declaration rows: visibly skipped, never red-by-accident, never green-by-omission.
    Publishing is unaffected — the release gate is the deterministic suite. The per-boot row pins (`thresholdRatio`, `enrichmentEnabled`,
@@ -174,3 +254,153 @@ pin the pair deliberately in the profile patch (`disabled: true` on `directory-p
 `@deepseek-ai/dsh-host-directory-picker-browse` + `@deepseek-ai/dsh-client-ui-directory-picker-browse`).
 Upstream ask: compat aliases for the renamed icon exports, or a boot-time shell↔plugin version handshake
 that rejects a mismatched bundle instead of crashing at render.
+
+## Two-tier rules — specified, deliberately not built (2026-10-20, #50)
+
+The design round that produced record §7.1 + §7.3–§7.9 and Amendment 2026-10-20 started from one
+measured hole: `planSummarize` composes `leadSections = [planSection, plotSection]`, so a plan and a
+plot survive an in-place compaction and a **rule does not**. Docs are committed ahead of code
+(docs-first); `docs/verify.md § Two-Tier Rules — SPEC` rows R1–R10 are the checklist, and each one is
+supposed to be provable-red before it is called a fact. A fresh session should start at the tests, not
+at the implementation.
+
+Two things the round decided **not** to do, so they don't get rediscovered as oversights:
+
+**1. Team-identity curation facts (multi-human collective approval) — deferred, and it is a real
+design question, not a gap.** Approval is per-machine by the 2026-09-20 amendment, and that boundary
+was NOT relaxed: a rule a teammate approves is not `core` on your machine. For checkouts on *one*
+machine that is invisible (`harnessId` = hostname, so they share one facts file) — which is exactly the
+use case that asked for it. For **several humans on one project**, the cost is re-reviewing a growing
+list. The clean way to buy it back without reopening the bug the amendment closed: keep facts namespaced
+by *writer* and let a machine read **more** namespaces — my own `edits/<harness>/curation.jsonl` ∪ a
+recognized team identity's `edits/<teamId>/curation.jsonl`, still one writer per file (§3.3 survives),
+no file rewrite, and "primary architect" becomes whoever holds the team credentials rather than a role
+people are trusted to respect. Local `revoke` must still win over a team fact (last-write-wins by
+namespace precedence, stated explicitly). Needs a decision first: is the population one team, or can
+unrelated projects share a TreeDX instance? The second turns this from a feature into governance.
+
+**2. Per-request rule injection — rejected on measurement, not taste.** Invariant 3 keeps the global
+system prompt out, and E3/r23-r28 show a head-position replacement reuses nothing on llama.cpp
+(`cacheReuse 0`) — a ruleset that churns mid-session would be a cache-wipe machine on the target
+hardware. Carriage happens at the two moments a head is actually rebuilt, plus `chapters_rules` on
+demand. If someone revisits this, the honest argument is "small models drift mid-window", and the
+answer is the pinned class + the withheld-count line, not more injection.
+
+## #50 two-tier rules — what the next session inherits (2026-10-20)
+
+The round landed green on the deterministic plane (640 unit / 137 integration rows, coverage gate
+held at 93.16 / 85.53 / 90.01). Three things are deliberately unfinished, and none is a surprise:
+
+1. **Mined-rule quality: first data in, sample tiny.** `npm run mining:probe` (2026-10-21) mined
+   three real chapters of THIS repo at `qwen3.8-flash` through the shipped path: 9 rules, 6 stated / 3
+   inferred, every inference confined to the one chapter that had no human text, none wrong or unsafe.
+   Full numbers and the caveats in `docs/verify.md` R5. Next: probe archives from a project that is not
+   this repo — our own history is the friendliest corpus available, and a rule like "treat pinned tests
+   as authoritative" is true here partly because the reader is already convinced.
+
+   1b. **Settled 2026-10-21, and settled twice:** the first reading ("mining is being truncated by
+   `ENRICH_MAX_TOKENS = 900`") was wrong — the token-plan route does not enforce `max_tokens` at all
+   (a 64-token cap returned 113 tokens, `finish_reason: stop`) and it itemizes
+   `completion_tokens_details.reasoning_tokens`. What was real is that the budget was three
+   hardcoded literals sized for pre-mining answers, so it is now `enrichmentMaxTokens` (default
+   4000). If a future provider DOES enforce the ceiling, this is the knob; if mining ever needs its
+   own budget, `rulesModel` already gives it its own call.
+   1c. **Endpoint default is the regional token-plan door**
+   (`token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1`): QwenCloud gives no region
+   choice, and the `maas.qwencloudapi.com/compatible-mode/v1` alias answers `401 Invalid API-key
+   provided` for the keys on this box. `scripts/llm.mjs` defaults to the regional door, keeps the
+   alias as a probe candidate behind it, and takes `DSH_LLM_BASE` as the override — so a credential
+   that starts working at the alias is used with no edit.
+2a-1. **The knowledge-loop journey cannot reach the door after two commands run** — precise,
+   measured 2026-10-22. `suite` now dies at `forkDoor(page).click()` waiting for
+   `button[aria-label="Fork with chapters"]:visible, last` for 25 minutes, with the upstream
+   journal showing **44 completed answers, 0 throttles, 0 deadlines** — so it is not quota and
+   not the model. What the journey does between the last assistant message and the click:
+   `/chapters-link`, then `/chapters-status`. Those render as command **flow nodes**, so after
+   them the last assistant chat row is no longer the newest actionable node, and the door row
+   on it is not `:visible` (host action rows appear to be gated on the newest/hovered message —
+   the fork journey, which forks right after ONE turn, clicks the same helper without issue).
+   FIX (rig, not assertion-weakening): select the door **scoped to the last assistant message**,
+   scrolling/hovering that message first — the same affordance a human uses — rather than
+   "the last visible door in the document". Keep `forkDoor` as the single selector so all four
+   journeys move together, and keep the `toBeVisible` assertions: a door nobody can reach is a
+   real defect, whether the cause is the plugin or the client's hover gating.
+
+2a. **On 0.2.x the switch to a forked child is a silent no-op, and the child never
+   appears in the session list** — measured 2026-10-22 against the CURRENT build (host
+   0.2.0-rc.2, plugin link-verified by the new boot guard). The door announces success
+   (`branch “…” is session ch-3865899e…`) and renders NO note element, which
+   `src/client/doors.ts` emits only when `sessions.open()` did not throw — yet
+   `localStorage['dsh.sessions.current']` still names the PARENT, focus stays on the parent's
+   composer, and after a full reload the sidebar lists one session. The child is real: its
+   directory holds `session.lock` + `session.v4.jsonl.zstd`, `session_projcache` has both
+   entries, and the log carries the whole notice (`Project: …`, `(N msgs)`, rule categories).
+   **Prime suspect is our own swallowed failure**: `src/tools.ts` attaches with
+   `workspaceRegistry.createCanonical(cwd)` → `workspace?.attachSession?.(sessionId)`, both
+   optional-chained — and AGENTS records that very attach as the fix for round 6's "an
+   unattached session shows as an unrelated root, so it is not listed". If 0.2.x reshaped that
+   return, the chain no-ops silently and orphans the child from the workspace, which matches
+   every symptom. NEXT: make the attach loud (diagnostic + door note when the service or method
+   is absent; never an optional chain through a required step), re-run, and let the message name
+   what is missing. `tests/e2e/fork-button.spec.ts` already asserts the switch — it is the gate,
+   and it is red for the right reason.
+   Superseded by the above, kept so nobody re-bisects it: an earlier version of this entry blamed
+   a `format v4 message requires a producer-owned source kind` refusal. That message was real but
+   came from a COPIED plugin tree dated Oct 16 in `.dshdev-local`; the current build produces no
+   such refusal, and `spikes/seed-admission/` shows host 0.2.0-rc.2 admitting our notice, the
+   notice + `plan/mode`, and the notice + `agentOptions` + preset mount (5–6 durable events each)
+   while correctly refusing the retired v3 wrapper.
+2. **The browser plane is blocked by CORPUS PROVENANCE, not by the host any more.** The
+   preset-row refusal is gone — `dev/dsh-host-lock` resolves 0.2.0-rc.2 and
+   `hostSupportsPresetRows()` answers true, so the rig boots the preset and CI's acceptance job
+   RUNS instead of skipping on capability. What stops replay now is that the eight tape projects
+   were distilled against 0.1.5-rc.1, and tape matching is normalized request-PREFIX matching over
+   prompt bytes the host composes. `tests/fixtures/model-tape/CORPUS_HOST` says so in one place,
+   `scripts/corpus-anchor.mjs` reads it, `tests/e2e/boot.ts` refuses REPLAY by name (RECORD stays
+   allowed — a gate that blocked the way out would strand itself), and CI skips the acceptance job
+   with a step summary and a `::warning::`. Lift it by re-distilling all eight
+   (`scripts/distill-tapes.sh`) and updating the record — **issue #56**, with **#57** (door
+   selector scoped to the last assistant message) as the blocker inside it. Extending
+   `rules.spec.ts` with the checkpoint-carriage and continue-vs-fork assertions is still owed, and
+   must be written after the corpus is anchored — spec assertions that cannot execute are a false
+   witness, which is why they are not written preemptively.
+3. **R10 is only partly proven.** Marker rules re-derive off the durable log and dedupe against
+   disk, but there is no end-to-end wipe-and-replay row yet.
+
+Two local truths to save the next agent an hour: the suites need **Node ≥ 24** (on 22 every file
+fails for a reason that looks like your diff), and `coverage:ci` intermittently reddens
+`git-auth-classification`/`sync-remote` on this box under parallel load — **verified pre-existing** by
+running it in a worktree at the last docs-only commit. Re-run before blaming the change.
+
+
+## Retrieval is untested in the field (#61, record only — do not "fix" it speculatively)
+
+Measured over 26 SAIP sessions / 4,049 tool calls: `chapters_search`, `chapters_artifact` and
+`chapters_rules` were called **0 times**, and no tool call anywhere referenced a `.dsh-chapters` path.
+So the archive's retrieval promise is **unverified in the field**, not proven broken: the deterministic
+and browser planes both exercise those doors, and a real long session may simply never have needed them.
+
+Deliberately NOT acted on in #61: no persona rewrite, no "make the model search more" prompt change. The
+persona is a product-prompt surface and every byte of it costs a tape re-distill (#56/#57), so a change
+there needs a measured defect, not an inference from an unused-tool count. If a future project shows
+knowledge that WAS archived and never retrievable when asked for, that is the evidence that opens this.
+
+## #71 prompt recommendations — push transport (follow-up, gated on the compile-deps move)
+
+The feature ships on the PULL transport (`/chapters-prompt suggest` over `remote.commands`,
+the door-proven wire) because our compile-time `@deepseek-ai/*` closure is still
+0.1.5-rc.2, where `appendPluginRecord` / `PluginRecordMap` do not exist (grep-verified;
+facts in `docs/contract.md` § Composer Ghost Layer). When the workspace deps move to 0.2.x
+(they must for `hostSupportsPresetRows`-era work anyway):
+
+1. Merge `SessionProjectionMap['chaptersPrompt']` + `PluginRecordMap['plugin:dsh-chapters/prompt']`
+   in `src/prompt.ts`; at generation, `appendPluginRecord` the whole-value record (durable,
+   append-only, never surface-eligible — invariant 1 honored), register a
+   `ProjectionDefinition` folding it (plan/goal pattern), and have the client read
+   `useProjection('chaptersPrompt')` instead of pulling.
+2. Screen the record type in `src/injections.ts` (host-injected, never archived) and bucket it
+   as un-rendered in the chapter renderer — one predicate, per the #59 rule.
+3. Add a kernel-drift row: plugin records must stay NOT surface-eligible
+   (`isSurfaceEligibleType`), read from the kernel's own exports.
+4. The pull command stays as a manual verb (`suggest` re-arms the ghost); the anti-dup client
+   row keeps the wire body singular either way.

package/docs/contract.md

@@ -95,7 +95,8 @@ export const inject = [
 
 - `agents` — `ctx.agents.create`, the continuation primitive. **The load-bearing one.**
 - `storageDomain` — chain registry.
-- `sessionQuery` — `observeSession` for the calling agent's own log and preset projection.
+- `sessionQuery` — `observeSession` for the calling agent's own log and preset projection, plus the
+  durable reads for **other** sessions (see § Durable reads — the verbs are not interchangeable).
 - `tokenMeter` — pressure math and the continuation budget preflight.
 - **`systemPrompt` is excluded on purpose** (invariant 3).
 - Add `commands` at the UI/CLI trigger phase; `connection` / `sessionController` only if a create path
@@ -103,6 +104,49 @@ export const inject = [
 
 Declare only what you use — `dsh-compact` gets by on `inject = ["commands"]`.
 
+## Durable reads — `sessionQuery` verbs are NOT interchangeable
+
+Measured 2026-10-22 against host `0.2.0-rc.2` while root-causing #58. The rule this section exists to
+enforce: **measure a host verb's payload *shape*, not its presence.** `spikes/subagent-end/FINDINGS.md`
+finding 5 recorded `{count, types}` from `listEvents`, saw 10 plausible event types, wrote "returned the
+full durable log", and the whole of door 5 was built on that. The types were real; the payloads were not
+there at all.
+
+| verb | returns | safe as an archive input? |
+|---|---|---|
+| `listEvents(sessionId)` | `SessionEventRecord[]` = `{sessionId, seq, type, time, surface}` — **no `data`** | **No.** Types and seqs only: a metadata index. |
+| `readSession(sessionId)` | `{session: structuredClone(header), inheritedEventCount, events: snapshotSessionEvent(e)[]}` | **Yes**, and it carries the header too — one call, so no `listSessions()` scan. |
+| `readSurface(sessionId)` | cloned header + `currentSurfaceEvents` (folded surface, snapshot-detached) | Yes for surface work; it is *folded*, so it is not the whole log. |
+| `filterEvents(sessionId, filters)` | semantic event documents | No — search documents, not events. |
+
+File:line (host install, `/home/adrian/node_modules/@deepseek-ai/dsh-session-query/`):
+`lib/index.js:1141` `async listEvents(sessionId) { return eventRecords(sessionId, (await this._corpus.load(sessionId)).events) }`
+→ `:845-847` `eventRecords` → `analyzeEventLog(sessionId, events).records`, built at `:966-973` as
+`records: events.map((event) => ({ sessionId, seq: event.seq, type: event.type, time: event.time, surface: … }))`.
+Published type: `lib/types/types.d.ts:43-54` (`interface SessionEventRecord` — the doc comment says
+*"Lightweight metadata for one event"*, which is the sentence the spike skipped).
+`lib/index.js:1079-1087` `readSession` → `events: loaded.events.map(snapshotSessionEvent)`;
+`snapshotSessionEvent = adoptSessionEvent(structuredClone(event))` at
+`@deepseek-ai/dsh-session/lib/index.js:1106-1108`, i.e. a **validated, payload-bearing** clone.
+
+Read the header, never infer it: `readSession().session` is the kernel's own `SessionHeader` clone, so
+`origin` / `parentSession` / `agentPreset` / `cwd` come from the same observation as the bytes being
+archived — which is what door 5's gate needs (#58). The header is *recorded* on the child's own row
+(`subagent`/`parentSession` frontmatter), not used to re-link the tree — see docs/architecture.md
+§ The archive moments for why `linkChild` was measured and rejected.
+
+And the host's own teardown ordering, which decides **which** arm runs:
+`@deepseek-ai/dsh-subagent/lib/index.js:1240-1250` (continuable) — `flushFinalState` →
+`await activation.handle.dispose()` → `resident.delete(childId)` → `observer.settle(failure)`, and
+`settle` is what emits `subagent/end` (`:317-324`). `observeRun` (one-shot, `:296-306`) emits earlier,
+before disposal. So a continuable child's live handle is **always** gone at settlement: the durable arm
+is the only arm for it, and the fast path is the only arm for one-shot children. Both must be tested;
+one measurement of one mode is what #58 is.
+
+`SessionEventLike.data` is therefore **required** in `src/types.ts` (was optional). Optionality is the
+reason a `listEvents` record passed as `SessionEventLike[]` type-checked, and the renderer's
+`ev.data ?? {}` then made a hollow chapter legal instead of failing to compile.
+
 ## Tools
 
 `defineTool` at `packages/core/tools/src/schema.ts:545`:
@@ -467,3 +511,85 @@ not stylistic:
 - Manual is MVP. The button path cannot supply model-authored titles or ranges, so segmentation must be
   a plain function callable **without an agent turn** — build that seam in Phase 1, not Phase 5, or the
   UI and automatic paths both force a rewrite.
+
+## Composer Ghost Layer — measured host facts (#71, verified 2026-10-21 against `examples/dsh` @ 0.2.1-rc.2; runtime pin 0.2.0-rc.2, compile deps still 0.1.5-rc.2)
+
+The prompt-recommendation feature renders a ghost layer in the composer. What the host does
+and does not let a plugin do, with anchors:
+
+- **The placeholder text is NOT plugin-writable.** `placeholderText` is computed inside the
+  host's `InputBar.tsx:363-372` (`packages/client/ui-conversation/src/client/skeleton/`): an
+  owner prop (passed only by the host's own `ConversationContent`) ?? offline/disabled/steer
+  states ?? `useProjection('plan')` swap ?? locale defaults. Every string is locale-owned
+  (`client/locales.ts`, enforced upstream by `verify-client-ui-i18n`); no config key, slot,
+  projection input, or service feeds a plugin value into that chain. Plan mode swaps it from
+  host code (`InputBar.tsx:67-68`) — mechanism precedent, not an extension point.
+- **The composer overlay slot is the hole.** `'conversation.input.overlay'` — "floating
+  entries rendered inside the resident composer card", `{ kind: 'list'; scope: 'session' }`
+  (`contract/slots.ts:271-272`), rendered at `InputBar.tsx:404` inside
+  `[data-composer-overlay]`. The shipped slash-menu occupies it
+  (`ui-input-trigger/src/client/index.ts:65`) — registering there is a proven path, and
+  `slots.inject(name, …)` waits for the declaration, same as our assistant-actions door rows.
+- **Standard session props give the composer machine.** Session-scope slot entries receive
+  `useConversation` / `useInput` / `inputActions` (`contract/slots.ts:329-336`); `InputActions`
+  carries `setDraft(text)` ("replace the whole draft with plain text"), `insertText`,
+  `persistDraft`, `submit` (`contract/input.ts:263-291`), and `InputState.draft` is the
+  published draft text (`contract/input.ts`, `InputState`). `useProjection` is on
+  `SessionStandardProps` (`ui-session/src/client/index.ts:166-173`) for the 0.2.x push upgrade.
+- **ArrowRight is free.** The composer keymap registers `KEY_ARROW_UP/DOWN`, `KEY_TAB`,
+  `KEY_ESCAPE`, `KEY_SPACE`, `KEY_ENTER` at `COMMAND_PRIORITY_CRITICAL`
+  (`input/editor/keymap.ts:104-140`); `grep ArrowRight` over `ui-conversation/src/client` is
+  empty on both 0.1.5 and the 0.2.1 checkout. `ComposerKeyboard` itself is
+  "InputBar-exclusive … never across a plugin boundary" (`contract/draft-editor.ts:54-58`),
+  so the plugin's accept gesture attaches a capture-phase `keydown` listener at the DOM level
+  while its ghost is visible — fail-open: if the host ever claims the key or reshapes the DOM,
+  the click-to-accept path still works and nothing else breaks.
+- **Host→client pull channel: `remote.commands.execute(sessionId, line, [])`**, the exact wire
+  the door buttons ride (`src/client/doors.ts`, Playwright-verified; result arm
+  `{value.result.kind/text}`). New **wire events are NOT available to plugins**: the forwarded
+  allowlist is app-owned ("the one home of this application's forwarded-Host-event allowlist",
+  `packages/api/remotes/src/remote-events.ts:24`).
+- **Push transport is 0.2.x-only.** `appendPluginRecord(session, 'plugin:<name>', data)`
+  (`packages/core/session/src/index.ts:492`, grammar/types at `types.ts:525-543`, reader
+  `pluginRecordOf` at `index.ts:508`): durable, append-only, "never enters the model-visible
+  surface", retained by fork/resume, skipped by unknown readers. The `verify-plugin-record-callers`
+  gate is a **source-tree policy inside the dsh repo** ("rejects any other production caller
+  *in this repository*") — it does not and cannot gate an external plugin, and the `plugin:`
+  grammar is precisely the external-plugin carrier. `PluginRecordMap` is declaration-merged
+  (`export interface PluginRecordMap {}`, `types.ts:533`); a `ProjectionDefinition` registered
+  on `ctx.sessionProjections` (the plan/goal pattern; our host plane ALREADY injects
+  `sessionProjections`) folds committed events to client-pushed values. Both APIs are absent
+  from our installed `@deepseek-ai/dsh-session@0.1.5-rc.2` (grep-verified on `lib/types`),
+  which is why #71 ships the PULL transport; the push swap is the backlog item, and it needs
+  the compile-time `@deepseek-ai/*` closure moved to 0.2.x alongside the runtime pin.
+
+## Client Sessions Service: which verbs exist (measured 0.2.0-rc.2, #77)
+
+The client service injected as `sessions` (`dsh-api-session-controller/lib/types/client/sessions/
+service.js`) is a **session store and lifecycle**, not a navigator. Its verbs are
+`create / fork / using / retain / retainInfo / release / refresh / projectList / binding /
+handleSessionAdded / handleSessionRemoved / handleSessionActivity / …`. There is **no
+`sessions.open`** — a guard written as `if (typeof sessions.open !== 'function') return false`
+fails silently on every call, which is exactly how the chapters door spent three evenings looking
+like a client that refused to catalogue a plugin-created child.
+
+The navigation verb lives on the workspace service (`dsh-client-ui-workspace/lib/client.js`):
+
+```js
+openSession(target) { this.replaceMain(target, this.lifetime.signal, "reveal"); }
+```
+
+and the host's own fork affordance uses it — `dsh-client-ui-chat/lib/client.js`, right after its
+fork RPC resolves: `.then((childId) => { ctx.uiWorkspace.openSession(childId); })`. So a plugin
+that must move the visible session injects **`uiWorkspace`** and calls `openSession(sessionId)`;
+`sessions.*` cannot do it. `sessions.using/retain` materialize a scope for a session the client
+addresses; they do not change what is displayed.
+
+Two corollaries, both bought once:
+- A client capability you assume is a client capability you must assert at the decision point —
+  `src/client/doors.ts` now prints which verbs were actually present when it decided
+  (`+c/+u/+o/+w`), because a note that blames the user's client for the plugin's own missing port
+  sends the next reader down the wrong path.
+- An injected port that is optional and stops being wired fails as a symptom, not as an error:
+  `tests/unit/client-doors.test.ts` has a row that fails if `src/client/index.ts` drops
+  `uiWorkspace` from `inject` or stops passing it.