@wowyuarm/dsh-agent-team 0.1.14 → 0.1.15

package/packages/agent-team/lib/human-profile.js

@@ -1,33 +1,79 @@
+import { readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import z from '@deepseek-ai/schemastery';
+import { parse } from 'yaml';
 /**
  * Human identity profile: the one configurable display name plus the avatar
  * reference. `member:human` stays the durable identity everywhere; only the
  * handle shown in team_view, @ matching, and UI follows this profile.
  *
  * Storage split (see spec.md v1):
- * - name + avatarRef live in the Host settings namespace `agent-team-human`
- *   (settings.yaml user layer, live through `ctx.settings`).
- * - avatar bytes live under a persistent directory below; the settings
- *   document holds only the reference, never a data URL. The composer
- *   attachment cache is TTL-bound and must not hold avatar bytes.
+ * - name + avatarRef are the Team Host row's own Config, so they live in the
+ *   active profile's patch document as that row's `config` and the settings
+ *   service derives their form from this schema. rc.1 derives every form from
+ *   a plugin's Config, so the retired `installSection` namespace — a section of
+ *   its own — has no counterpart; the row id below is the settings namespace.
+ * - avatar bytes live under a persistent directory below; the profile holds
+ *   only the reference, never a data URL. The composer attachment cache is
+ *   TTL-bound and must not hold avatar bytes.
  */
-export const HUMAN_PROFILE_SETTINGS_NAMESPACE = 'agent-team-human';
+/**
+ * Settings namespace of the Human profile: the Team Host row's id in
+ * `cordis.patch.yml`, which is what the settings service addresses a form and a
+ * write by AND the id the profile-document write patches. It is addressed by
+ * this constant, never by the running Host's `ctx.fiber.entry`: a Remote call
+ * runs under its caller's context, so that lookup names the RPC gateway's row.
+ * `shipping.spec.ts` pins the constant to the row the composition declares.
+ */
+export const HUMAN_PROFILE_SETTINGS_NAMESPACE = 'wowyuarm-agent-team-host';
 /** Fallback display name before any user override is stored. */
 export const HUMAN_PROFILE_DEFAULT_NAME = 'human';
 /** Repository home for the version footnote link. */
 export const HUMAN_PROFILE_REPO_URL = 'https://github.com/wowyuarm/dsh-agent-team';
 /**
- * Bundle version shown in the settings footnote. Kept in sync with the root
- * package.json by hand until the Host build injects it; the footnote is
+ * Bundle version shown in the settings footnote, and the current side of the
+ * update check: the version of the package THIS Host runs from — read from the
+ * installed manifest, so a `link:` checkout under the development profile and a
+ * registry tarball under stable each state their own truth. It is not a
+ * hand-maintained string: the 0.1.14 bundle shipped with `0.1.13` written in
+ * it, which made the footnote name the previous release and the update check
+ * offer the release the user already had.
+ *
+ * Resolved once at load, three levels above this module — `packages/agent-team/{src,lib}`
+ * sits that deep in both layouts, the same relative positioning
+ * `member-runtime.ts` uses to find `core-skills`. An unreadable or malformed
+ * manifest degrades to `'unknown'`: the Remote's `version: string` contract
+ * holds and the update comparison simply compares nothing. The footnote is
  * informational only and never gates behavior.
  */
-export const HUMAN_PROFILE_VERSION = '0.1.13';
-/** Schemastery schema resolving the `agent-team-human` namespace value. */
+export const HUMAN_PROFILE_VERSION = readInstalledBundleVersion();
+/** Version of the manifest this package installed from, or `'unknown'`. */
+function readInstalledBundleVersion() {
+    try {
+        const manifestPath = resolve(dirname(fileURLToPath(import.meta.url)), '../../../package.json');
+        const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+        if (typeof manifest.version === 'string' && manifest.version !== '')
+            return manifest.version;
+    }
+    catch {
+        // Reading our own manifest must never fail the Host boot: a host that
+        // cannot find its own package.json is a broken install, and the footnote
+        // reporting 'unknown' says so more honestly than a stale number.
+    }
+    return 'unknown';
+}
+/**
+ * Schemastery schema of the Human profile: the Team Host row's Config. Both
+ * fields are volatile, which is what lets an edit reach the running Host
+ * without remounting it — and what makes the settings service derive a form
+ * from this schema at all.
+ */
 export const HUMAN_PROFILE_SETTINGS_SCHEMA = z.object({
-    name: z.string().default(HUMAN_PROFILE_DEFAULT_NAME),
+    name: z.string().default(HUMAN_PROFILE_DEFAULT_NAME).volatile(),
     // Schemastery fields are optional unless `.required()`: a missing avatarRef
     // simply resolves absent, which the profile reads as "no custom avatar".
-    avatarRef: z.string(),
+    avatarRef: z.string().volatile(),
 });
 /** Normalize one candidate display name the way Member handles normalize. */
 export function normalizeHumanName(raw) {
@@ -44,3 +90,68 @@ export function assertValidHumanName(raw) {
         throw new Error('human name must not be empty');
     return name;
 }
+/**
+ * The retired settings section this profile's facts lived in before rc.1.
+ * rc.1 derives every settings form from a plugin's Config, and its legacy
+ * `settings.yaml` importer maps a section to a composition entry id through a
+ * closed built-in list — this third-party section matches nothing there, so
+ * the import rejects it and the values survive only in the renamed document.
+ * This Host owns the section, so adopting what is left belongs here.
+ */
+export const LEGACY_HUMAN_PROFILE_SECTION = 'agent-team-human';
+/**
+ * Read the legacy section out of one legacy settings document. An
+ * unparsable document or a missing section means "nothing to adopt" rather
+ * than an error — the file is retired input, not an authority — and each
+ * field is validated independently so one bad field never costs the other.
+ */
+export function parseLegacyHumanProfile(yamlText) {
+    let document;
+    try {
+        document = parse(yamlText);
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof document !== 'object' || document === null)
+        return undefined;
+    const section = document[LEGACY_HUMAN_PROFILE_SECTION];
+    if (typeof section !== 'object' || section === null)
+        return undefined;
+    const fields = section;
+    let name;
+    if (typeof fields.name === 'string') {
+        try {
+            name = assertValidHumanName(fields.name);
+        }
+        catch {
+            name = undefined;
+        }
+    }
+    const avatarRef = typeof fields.avatarRef === 'string' && fields.avatarRef.trim() !== ''
+        ? fields.avatarRef.trim()
+        : undefined;
+    if (name === undefined && avatarRef === undefined)
+        return undefined;
+    return { ...(name === undefined ? {} : { name }), ...(avatarRef === undefined ? {} : { avatarRef }) };
+}
+/**
+ * Decide what adoption may write: nothing unless the stored profile is still
+ * the pristine default, so a value the Human re-entered after the upgrade
+ * always wins, and never the legacy default name itself. The current profile
+ * carries explicit `undefined` on `avatarRef` — the Host getter spreads a
+ * settings read — and so is not `HumanProfile` under
+ * exactOptionalPropertyTypes; taking that shape directly keeps the Host call
+ * cast-free. The returned fields are exactly the ops the profile page would
+ * have written; byte existence for `avatarRef` is the caller's I/O and must
+ * already hold.
+ */
+export function planLegacyAdoption(current, legacy) {
+    if (current.name !== HUMAN_PROFILE_DEFAULT_NAME || current.avatarRef !== undefined)
+        return undefined;
+    const name = legacy.name !== undefined && legacy.name !== HUMAN_PROFILE_DEFAULT_NAME ? legacy.name : undefined;
+    const avatarRef = legacy.avatarRef;
+    if (name === undefined && avatarRef === undefined)
+        return undefined;
+    return { ...(name === undefined ? {} : { name }), ...(avatarRef === undefined ? {} : { avatarRef }) };
+}

package/packages/agent-team/lib/index.js

@@ -40,6 +40,8 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
     done = true;
 };
 import { randomUUID } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 import { Service } from '@deepseek-ai/cordis';
 import { installModelSelection } from '@deepseek-ai/dsh-agent';
@@ -50,18 +52,17 @@ import { Session, SessionId, SessionLogOffset } from '@deepseek-ai/dsh-session';
 import { setSandboxMode } from '@deepseek-ai/dsh-sandbox-policy';
 import { Remote, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
 import { ATTACHMENT_MAX_BYTES, attachmentPayloadPath, attachmentsRoot, copyPathAttachment, newAttachmentId, readAttachment, sanitizeMediaType, sweepAttachmentCache, validatePathAttachment, writeAttachment } from "./attachments.js";
-import { HUMAN_PROFILE_DEFAULT_NAME, HUMAN_PROFILE_REPO_URL, HUMAN_PROFILE_SETTINGS_NAMESPACE, HUMAN_PROFILE_SETTINGS_SCHEMA, HUMAN_PROFILE_VERSION, assertValidHumanName, normalizeHumanName } from "./human-profile.js";
+import { HUMAN_PROFILE_DEFAULT_NAME, HUMAN_PROFILE_REPO_URL, HUMAN_PROFILE_SETTINGS_NAMESPACE, HUMAN_PROFILE_SETTINGS_SCHEMA, HUMAN_PROFILE_VERSION, assertValidHumanName, normalizeHumanName, parseLegacyHumanProfile, planLegacyAdoption } from "./human-profile.js";
 import { humanAvatarsRoot, readHumanAvatar, removeHumanAvatar, writeHumanAvatar } from "./human-avatar.js";
 import { createHumanUpdateChecker } from "./human-update-check.js";
 import { PressurePolicyCoordinator } from "./pressure-policy.js";
 import { CONTEXT_CONTINUITY_PROJECTION_KEY, readContextTimeline } from '@wowyuarm/dsh-context-continuity';
 import { createTeamContextManagement, TEAM_CONTEXT_CODEC } from "./context-continuity-host.js";
-import { AGENT_TEAM_PLUGIN_ID } from "./context-source.js";
+import { AGENT_TEAM_PLUGIN_ID, isAgentTeamSource } from "./context-source.js";
 import { boundaryByRef, carriedInputOf, checkpointByRef, checkpointRefFor, createTeamContextProjectionConfig, createTeamContextProjectionDefinition, foldTeamContextProjection, retainedTopicsThrough, TeamContextProjectionHost } from "./context-projection.js";
 import { AGENT_TEAM_HUMAN_MEMBER_ID, AgentTeamLedger, agentTeamHumanActor } from "./ledger.js";
 import { AGENT_TEAM_TOOL_NAMES, deepCopyCapabilities, memberMemoryDirectoryName, MemberRuntime } from "./member-runtime.js";
 import { classifyRecoverableError, RecoveryCoordinator, RECOVERY_MAX_CONSECUTIVE_ERRORS } from "./recovery.js";
-import { SessionRemediation, handoffAlreadyInLog } from "./session-remediation.js";
 import { StoredSessionReadError, StoredSessionReader, sessionFailureOf } from "./stored-session-reader.js";
 import { agentTeamDomainSpec } from "./spec.js";
 import { formatTeamTimestamp } from "./time-format.js";
@@ -98,7 +99,7 @@ const MAX_TIMELINE_LIMIT = 24;
  * disagree about where history ends.
  */
 const MAX_TIMELINE_ANCESTORS = 8;
-/** Product pressure budget constants (see docs/team-collaboration.md). */
+/** Product pressure budget constants (see docs/team-collaboration/README.md). */
 const CONTEXT_HARD_LIMIT_CAP = 256_000;
 const CONTEXT_HANDOFF_AT_CAP = 200_000;
 const CONTEXT_HANDOFF_RESERVE = 8_000;
@@ -198,6 +199,7 @@ let AgentTeam = (() => {
     let _putHumanAvatar_decorators;
     let _getHumanAvatar_decorators;
     let _removeHumanAvatar_decorators;
+    let _setHumanProfile_decorators;
     let _reply_decorators;
     let _changeAttention_decorators;
     let _inbox_decorators;
@@ -233,6 +235,7 @@ let AgentTeam = (() => {
             _putHumanAvatar_decorators = [Remote('putHumanAvatar')];
             _getHumanAvatar_decorators = [Remote('getHumanAvatar')];
             _removeHumanAvatar_decorators = [Remote('removeHumanAvatar')];
+            _setHumanProfile_decorators = [Remote('setHumanProfile')];
             _reply_decorators = [Remote('reply')];
             _changeAttention_decorators = [Remote('changeAttention')];
             _inbox_decorators = [Remote('inbox')];
@@ -265,6 +268,7 @@ let AgentTeam = (() => {
             __esDecorate(this, null, _putHumanAvatar_decorators, { kind: "method", name: "putHumanAvatar", static: false, private: false, access: { has: obj => "putHumanAvatar" in obj, get: obj => obj.putHumanAvatar }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _getHumanAvatar_decorators, { kind: "method", name: "getHumanAvatar", static: false, private: false, access: { has: obj => "getHumanAvatar" in obj, get: obj => obj.getHumanAvatar }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _removeHumanAvatar_decorators, { kind: "method", name: "removeHumanAvatar", static: false, private: false, access: { has: obj => "removeHumanAvatar" in obj, get: obj => obj.removeHumanAvatar }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _setHumanProfile_decorators, { kind: "method", name: "setHumanProfile", static: false, private: false, access: { has: obj => "setHumanProfile" in obj, get: obj => obj.setHumanProfile }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _reply_decorators, { kind: "method", name: "reply", static: false, private: false, access: { has: obj => "reply" in obj, get: obj => obj.reply }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _changeAttention_decorators, { kind: "method", name: "changeAttention", static: false, private: false, access: { has: obj => "changeAttention" in obj, get: obj => obj.changeAttention }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _inbox_decorators, { kind: "method", name: "inbox", static: false, private: false, access: { has: obj => "inbox" in obj, get: obj => obj.inbox }, metadata: _metadata }, null, _instanceExtraInitializers);
@@ -274,6 +278,8 @@ let AgentTeam = (() => {
             __esDecorate(this, null, _view_decorators, { kind: "method", name: "view", static: false, private: false, access: { has: obj => "view" in obj, get: obj => obj.view }, metadata: _metadata }, null, _instanceExtraInitializers);
             if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
+        config = __runInitializers(this, _instanceExtraInitializers);
+        static Config = HUMAN_PROFILE_SETTINGS_SCHEMA;
         static inject = [
             'storageDomain',
             'workspaceRegistry',
@@ -284,7 +290,7 @@ let AgentTeam = (() => {
             'sessionPersistence',
             'sessionProjections',
         ];
-        domain = __runInitializers(this, _instanceExtraInitializers);
+        domain;
         ledger;
         handles = new Map();
         /** Live Member per session id; drives the root session/event listener. */
@@ -324,12 +330,6 @@ let AgentTeam = (() => {
         pressurePolicy;
         notifiedInbox = new Map();
         attachmentGcTimer;
-        /**
-         * Current human profile source, wired to the `agent-team-human` settings
-         * namespace when a settings service is present. Falls back to the historic
-         * default so team_view and @ matching keep working without settings.
-         */
-        humanProfileSource = () => ({ name: HUMAN_PROFILE_DEFAULT_NAME });
         /**
          * New-release check behind the settings footnote. Memory-only and
          * background-refreshed, so the profile read path never waits on the
@@ -361,7 +361,7 @@ let AgentTeam = (() => {
          * successful `context_rollover` tool result into its next private context
          * generation. The ledger owns the binding audit, the engine's projection
          * unit owns intent, and this coordinator owns only reconstructible process
-         * state. See docs/architecture.md and docs/team-collaboration.md.
+         * state. See docs/architecture/README.md and docs/team-collaboration/README.md.
          */
         contextManagement = createTeamContextManagement({
             agentForMember: memberId => this.handles.get(memberId)?.agent,
@@ -381,6 +381,8 @@ let AgentTeam = (() => {
         });
         lifecycleTail = Promise.resolve();
         accepting = true;
+        /** One adoption attempt per boot: the two readiness edges fire once each, and this keeps their attempt single. */
+        legacyAdoptionStarted = false;
         /**
          * Presence wake epoch: Agent running/idle/failure is runtime state with no
          * durable fact behind it, so the presence scope counts those edge wakes in
@@ -388,14 +390,9 @@ let AgentTeam = (() => {
          */
         presenceEpoch = 0;
         changeWaiters = new Set();
-        /**
-         * The startup-opened remediation instance, held for the restart heal: the
-         * completion-cache domain may only be opened once per plugin lifecycle, so
-         * the restart path reuses this instance instead of opening its own.
-         */
-        remediation;
-        constructor(ctx) {
+        constructor(ctx, config) {
             super(ctx, 'agentTeam');
+            this.config = config;
             this.pressurePolicy = new PressurePolicyCoordinator({
                 agentForMember: memberId => this.handles.get(memberId)?.agent,
                 memberForAgent: agent => {
@@ -412,37 +409,30 @@ let AgentTeam = (() => {
                 },
                 log: message => { this.ctx.logger.warn(`agent-team: ${message}`); },
             });
-            // Human profile settings: the composition entry is the historic default;
-            // the settings provider overlays the user document section when present.
-            // Reads stay live through the source closure, so team_view and @ matching
-            // follow a rename without a Host restart.
+            // Human profile: this Host row's own Config (name + avatarRef, both
+            // volatile), so the settings service derives its form from the schema and
+            // an edit lands in the running plugin without a remount. Team's own page
+            // owns that surface, so the row declares itself presentation-owned rather
+            // than schema-page owned. Reads go straight to the live Config reference;
+            // this subscription is the change signal the retired section hook used to
+            // be — the ledger's runtime @ handle follows every edit.
             this.ctx.inject(['settings'], settingsCtx => {
-                settingsCtx.settings.installSection(this.ctx, HUMAN_PROFILE_SETTINGS_NAMESPACE, HUMAN_PROFILE_SETTINGS_SCHEMA, { name: HUMAN_PROFILE_DEFAULT_NAME }, {
-                    setSource: (current) => {
-                        this.humanProfileSource = current;
-                        this.syncHumanHandle();
-                    },
-                    validate: (value) => {
-                        this.validateHumanProfile(value);
-                    },
-                    onChange: () => {
-                        this.syncHumanHandle();
-                    },
-                });
+                settingsCtx.effect(() => settingsCtx.settings.configure({ auto: false }, this.ctx.fiber));
+                this.adoptLegacyHumanProfile();
             });
+            this.ctx.on('loader/volatile-update', () => { this.syncHumanHandle(); });
         }
         /** Current human display name; the single source for team_view and @ matching. */
         humanHandle() {
-            const name = normalizeHumanName(this.humanProfileSource().name);
+            const name = normalizeHumanName(this.config.name.get());
             return name === '' ? HUMAN_PROFILE_DEFAULT_NAME : name;
         }
-        /** Current human profile reference held in settings (name + avatarRef). */
+        /** Current human profile reference held in this Host row's Config (name + avatarRef). */
         humanProfile() {
-            const current = this.humanProfileSource();
-            const name = this.humanHandle();
-            return Object.freeze({ name, ...(current.avatarRef === undefined ? {} : { avatarRef: current.avatarRef }) });
+            const avatarRef = this.config.avatarRef.get();
+            return Object.freeze({ name: this.humanHandle(), ...(avatarRef === undefined ? {} : { avatarRef }) });
         }
-        /** Push the current settings name into the ledger's runtime @ handle. */
+        /** Push the current Config name into the ledger's runtime @ handle. */
         syncHumanHandle() {
             try {
                 this.ledger?.setHumanDisplayHandle(this.humanHandle());
@@ -452,9 +442,10 @@ let AgentTeam = (() => {
             }
         }
         /**
-         * Settings-level validation for the human profile: same non-empty floor as
-         * Member handles plus global uniqueness against live Members. Runs inside
-         * the settings write path, so a colliding rename rejects before persisting.
+         * The two judgements the Config schema cannot make about a Human name: the
+         * same non-empty floor as Member handles, plus global uniqueness against live
+         * Members. `setHumanProfile` runs it before the write, so a colliding rename
+         * rejects instead of persisting.
          */
         validateHumanProfile(value) {
             const name = assertValidHumanName(value.name);
@@ -470,6 +461,73 @@ let AgentTeam = (() => {
                 }
             }
         }
+        /**
+         * One-time adoption of the profile facts the retired `agent-team-human`
+         * settings section held (see `LEGACY_HUMAN_PROFILE_SECTION` for why the
+         * upstream importer cannot carry them over). The values land in this Host
+         * row's own Config through the same Remote the profile page writes, so the
+         * page, the ledger's @ handle, and every avatar seat follow as after any
+         * edit. Readiness has two one-way edges — the settings service arrives, the
+         * ledger opens — and whichever fires second starts the attempt; only a
+         * pristine profile is adopted, and one attempt per boot is its whole
+         * lifetime, so adoption never loops and never re-writes.
+         */
+        adoptLegacyHumanProfile() {
+            if (this.legacyAdoptionStarted)
+                return;
+            if (this.ctx.get('settings') === undefined || this.ledger === undefined)
+                return;
+            this.legacyAdoptionStarted = true;
+            void this.adoptLegacyHumanProfileNow().catch((error) => {
+                this.ctx.logger.warn('agent-team: legacy human profile adoption failed: %s', String(error));
+            });
+        }
+        /** Carry the first legacy document that still has the section into a pristine profile. */
+        async adoptLegacyHumanProfileNow() {
+            // A profile-launched Host always carries the profile context; a Host booted
+            // without one still adopts from the DSH home, which is where a pre-rc.1
+            // install kept the document. Read through `get`: cordis refuses a direct
+            // `ctx.profileContext` for a service this plugin does not declare, and
+            // adoption may not gate the Host on app-boot.
+            const profileHome = this.ctx.get('profileContext')?.home;
+            const homes = profileHome === undefined ? [dshHomePath()] : [dshHomePath(), profileHome];
+            const candidates = new Set(homes.flatMap(home => [join(home, 'settings.yaml'), join(home, 'settings.yaml.imported')]));
+            let legacy;
+            let source;
+            for (const candidate of candidates) {
+                let text;
+                try {
+                    text = readFileSync(candidate, 'utf8');
+                }
+                catch {
+                    // Absent candidates are the steady state once adoption settles; the
+                    // live document is one only because the first boot after the upgrade
+                    // can race the importer that renames it.
+                    continue;
+                }
+                const parsed = parseLegacyHumanProfile(text);
+                if (parsed !== undefined) {
+                    legacy = parsed;
+                    source = candidate;
+                    break;
+                }
+            }
+            if (legacy === undefined || source === undefined)
+                return;
+            // The reference is carried only while its bytes still draw: the avatar
+            // store is the authority for whether this avatar exists at all.
+            let avatarRef = legacy.avatarRef;
+            if (avatarRef !== undefined && await readHumanAvatar(humanAvatarsRoot(), avatarRef) === undefined)
+                avatarRef = undefined;
+            const plan = planLegacyAdoption(this.humanProfile(), {
+                ...(legacy.name === undefined ? {} : { name: legacy.name }),
+                ...(avatarRef === undefined ? {} : { avatarRef }),
+            });
+            if (plan === undefined)
+                return;
+            await this.setHumanProfile(plan);
+            this.ctx.logger.info('agent-team: adopted the legacy human profile from %s', source);
+        }
         /** Open the durable ledger and restore every enabled Member independently. */
         async [Service.init]() {
             // The continuity projection registers once per Host: the framework keeps
@@ -545,7 +603,6 @@ let AgentTeam = (() => {
             const domain = await this.ctx.storageDomain.open(agentTeamDomainSpec);
             this.ctx.effect(() => async () => {
                 this.accepting = false;
-                this.remediation = undefined;
                 this.recovery.dispose();
                 this.contextManagement.dispose();
                 this.pressurePolicy.dispose();
@@ -564,25 +621,15 @@ let AgentTeam = (() => {
             this.domain = domain;
             const ledger = new AgentTeamLedger(domain.table('operations'));
             this.ledger = ledger;
-            // The settings wiring in the constructor may have fired before the ledger
-            // existed; sync once here so @ matching starts from the stored name.
+            // A live Config edit in the constructor's window may have arrived before
+            // the ledger existed; sync once here so @ matching starts from the stored
+            // name.
             this.syncHumanHandle();
+            this.adoptLegacyHumanProfile();
             const initialization = await ledger.initialize();
             if (initialization.committed)
                 this.emitCommitted(initialization.value);
             this.startAttachmentGc(ledger);
-            // Legacy-artifact remediation runs before any Member activation: no write
-            // lease exists yet, so publishing sibling generations for refused Session
-            // logs cannot race a live writer. Remediation failure never blocks
-            // startup — the next start retries exactly what the cache does not cover.
-            try {
-                const remediation = new SessionRemediation(this.ctx, this.ctx.sessionPersistence, await SessionRemediation.open(this.ctx));
-                this.remediation = remediation;
-                await remediation.remediateEnabledMembers(ledger.listMembers());
-            }
-            catch (error) {
-                this.ctx.logger.warn(`agent-team: legacy Session remediation did not run to completion (it will retry on the next start): ${error instanceof Error ? error.message : String(error)}`);
-            }
             // One metadata listing serves every Member restore; per-member list calls
             // would repeat the same I/O linearly during startup.
             const persistedSessions = new Set((await this.persistedSessionHeaders()).map(snapshot => snapshot.header.id));
@@ -836,23 +883,10 @@ let AgentTeam = (() => {
                 if (member.state !== 'enabled')
                     throw new Error(`Agent Member '${member.handle}' is ${member.state}; only enabled Members can be restarted`);
                 this.ctx.logger.info(`agent-team: restarting member '${member.handle}' after a failed activation`);
-                // A deterministic session refusal may be repairable in place: run the
-                // same bounded startup remediation for this one Member before retrying
-                // activation, so the restart heals instead of replaying the failure.
-                const activation = this.memberFailures.get(request.memberId)?.activation;
-                if (activation !== undefined && activation.class === 'session-refused' && this.remediation !== undefined) {
-                    const outcome = await this.remediation.remediateMember(member);
-                    if (outcome.repaired > 0) {
-                        this.ctx.logger.info(`agent-team: repaired ${outcome.repaired} refused Session artifact(s) for member '${member.handle}'; retrying activation`);
-                    }
-                    else if (outcome.completed) {
-                        // The walk finished and nothing was provably this plugin's to fix:
-                        // a retry would fail identically. Mark the refusal non-remediable
-                        // so the surface stops offering restart and says why.
-                        this.markRefusalNonRemediable(request.memberId);
-                        return Object.freeze({ status: this.memberStatus(member) });
-                    }
-                }
+                // There is no write-side repair pass anymore: dsh 0.1.7 converts the
+                // released V3 history at read time, and this bundle no longer authors
+                // the old wrapper shape, so a refusal stays a deterministic failure the
+                // retry reports again rather than something the restart heals.
                 await this.reactivateMember(request.memberId);
                 return Object.freeze({ status: this.memberStatus(member) });
             }
@@ -1068,7 +1102,7 @@ let AgentTeam = (() => {
             const body = notifications.length === 0 ? text : `${text}\n\n${this.notificationText(notifications, member.memberId)}`;
             const hint = createUserMessage({
                 content: [{ type: 'text', text: body }],
-                source: { kind: 'plugin', plugin: AGENT_TEAM_PLUGIN_ID, form: 'notice', summary: RECOVERY_NOTICE_SUMMARY },
+                source: { kind: AGENT_TEAM_PLUGIN_ID, form: 'notice', summary: RECOVERY_NOTICE_SUMMARY },
             });
             for (const pending of [...handle.agent.inbox.nextStep, ...handle.agent.inbox.nextTurn]) {
                 if (this.isInboxNotice(pending))
@@ -1276,9 +1310,9 @@ let AgentTeam = (() => {
         }
         /**
          * Human profile read for the settings page and footnote: name + avatar
-         * reference from settings plus version facts. Human-scoped (the Web
-         * Client calls it); agent tools never receive avatar bytes, only the name
-         * through team_view. The new-release check stays best-effort and cached —
+         * reference from this Host row's live Config plus version facts. Human-scoped
+         * (the Web Client calls it); agent tools never receive avatar bytes, only the
+         * name through team_view. The new-release check stays best-effort and cached —
          * `updateAvailable` is false until a background refresh actually observes a
          * newer published release.
          */
@@ -1318,6 +1352,47 @@ let AgentTeam = (() => {
             await removeHumanAvatar(humanAvatarsRoot(), request.avatarRef);
             return Object.freeze({ removed: true });
         }
+        /**
+         * Overwrite the Human profile fields the caller supplies. The Host owns this
+         * write because the profile is the Host row's own Config: the schema supplies
+         * the shape, this method supplies the two judgements the schema cannot make
+         * (a non-empty name, a name no live Member already answers to), and the
+         * settings service persists the result into the active profile's patch
+         * document and applies it to the running plugin live.
+         *
+         * No expected revision accompanies the write: the profile is two scalar
+         * fields written from the Human's own pages, where the last write wins. This
+         * is not a hard boundary around a user-editable document — the settings
+         * service's own document opener (and a text editor) can change the stored
+         * name without passing here, exactly as the retired section validator could
+         * not stop it.
+         */
+        async setHumanProfile(request) {
+            this.requireAccepting();
+            const settings = this.ctx.get('settings');
+            if (settings === undefined)
+                throw new Error('the settings service is unavailable');
+            const name = request.name === undefined ? undefined : assertValidHumanName(request.name);
+            if (name !== undefined)
+                this.validateHumanProfile({ name });
+            const ops = [];
+            if (name !== undefined)
+                ops.push({ op: 'set', path: ['name'], value: name });
+            if (request.avatarRef === null)
+                ops.push({ op: 'unset', path: ['avatarRef'] });
+            else if (request.avatarRef !== undefined)
+                ops.push({ op: 'set', path: ['avatarRef'], value: request.avatarRef });
+            if (ops.length !== 0) {
+                // The settings namespace IS this Host row's id in the composition, and it
+                // must be addressed by that name rather than by `ctx.fiber.entry` here: a
+                // Remote call runs under its caller's context, whose fiber entry is the
+                // RPC gateway's row (`typert-gateway`), which the settings service then
+                // looks up as an unrelated plugin. shipping.spec.ts pins the constant to
+                // the row `cordis.patch.yml` declares.
+                await settings.mutate(HUMAN_PROFILE_SETTINGS_NAMESPACE, ops);
+            }
+            return Object.freeze({ ...this.humanProfile() });
+        }
         /** Human existing-Thread reply; unread and revision conflicts are business outcomes. */
         async reply(request) {
             return this.replyAs(this.humanCall(request.workspaceId), request);
@@ -1483,7 +1558,7 @@ let AgentTeam = (() => {
             try {
                 const message = createUserMessage({
                     content: [{ type: 'text', text: this.dmRelayText(agent, recipient, request.body.trim(), result.value.receipt.occurredAt, result.value.receipt.operationId, request.workspaceId) }],
-                    source: { kind: 'plugin', plugin: AGENT_TEAM_PLUGIN_ID, form: 'relay' },
+                    source: { kind: AGENT_TEAM_PLUGIN_ID, form: 'relay' },
                 });
                 // An idle recipient gets one ordinary turn; a busy one is steered into
                 // its current turn — the same wake split subagent continuations use.
@@ -2430,12 +2505,11 @@ let AgentTeam = (() => {
                     // delivered activates the new Session with no handoff in its own
                     // log — never treat that as an ordinary blank Member Session. The
                     // operation's recorded previous Session (the lineage parent) still
-                    // holds the intent; rebuild the handoff from it. "No handoff in its
-                    // own log" is judged over both shapes: a generation rescued from the
-                    // retired custom kinds carries its handoff as a source the projection
-                    // does not classify, and rebuilding on top of it would inject the same
-                    // handoff twice.
-                    if (!handoffAlreadyInLog(state.boundaries, created.agent.session.ownEvents())) {
+                    // holds the intent; rebuild the handoff from it. Presence is judged
+                    // by the projection boundary alone: every handoff this Host ever
+                    // published classifies under the context source's recognizer,
+                    // including the history the read-time conversion renamed.
+                    if (!state.boundaries.some(boundary => boundary.kind === 'handoff')) {
                         await this.reconstructMissingHandoff(member, created.agent);
                     }
                     // Carried input redelivery binds to the committed transition target —
@@ -2609,14 +2683,6 @@ let AgentTeam = (() => {
             }
             return { class: 'activation', detail: error instanceof Error ? error.message : String(error) };
         }
-        /** Mark a session-refused activation diagnostic as proven non-remediable. */
-        markRefusalNonRemediable(memberId) {
-            const failures = this.memberFailures.get(memberId);
-            const activation = failures?.activation;
-            if (activation === undefined || activation.class !== 'session-refused')
-                return;
-            failures.activation = Object.freeze({ ...activation, remediable: false });
-        }
         clearMemberFailure(memberId, slot) {
             const failures = this.memberFailures.get(memberId);
             if (failures === undefined || failures[slot] === undefined)
@@ -2657,7 +2723,7 @@ let AgentTeam = (() => {
                     const path = this.ctx.workspaceRegistry.get(operation.data.workspaceId)?.path;
                     const text = `Team participation changed: you have ${operation.kind === 'team/member-workspace-joined' ? 'joined' : 'left'} Workspace ${operation.data.workspaceId}${path === undefined ? ' (path unavailable)' : ` (${JSON.stringify(path)})`}.\nCurrent Workspace ids: ${ledger.workspacesOf(operation.data.memberId).join(', ')}. This replaces earlier participation information. Your Session and cwd have not moved.`;
                     const notice = createUserMessage({ content: [{ type: 'text', text }],
-                        source: { kind: 'plugin', plugin: AGENT_TEAM_PLUGIN_ID, form: 'notice', summary: 'Team Workspace participation changed' } });
+                        source: { kind: AGENT_TEAM_PLUGIN_ID, form: 'notice', summary: 'Team Workspace participation changed' } });
                     try {
                         if (agent.status === 'idle' || agent.inbox.nextTurn.some(message => message.source.kind === 'user'))
                             agent.followup(notice);
@@ -2754,7 +2820,7 @@ let AgentTeam = (() => {
                 agent.inbox.remove(existingInboxHint.id);
             const hint = createUserMessage({
                 content: [{ type: 'text', text: this.notificationText(notifications, member.memberId) }],
-                source: { kind: 'plugin', plugin: AGENT_TEAM_PLUGIN_ID, form: 'notice', summary: INBOX_NOTICE_SUMMARY },
+                source: { kind: AGENT_TEAM_PLUGIN_ID, form: 'notice', summary: INBOX_NOTICE_SUMMARY },
             });
             this.notifiedInbox.set(member.memberId, signature);
             try {
@@ -2775,12 +2841,12 @@ let AgentTeam = (() => {
         }
         isInboxNotice(message) {
             const source = message.source;
-            return source.kind === 'plugin' && source.plugin === AGENT_TEAM_PLUGIN_ID
+            return isAgentTeamSource(source)
                 && source.form === 'notice' && source.summary === INBOX_NOTICE_SUMMARY;
         }
         isRecoveryNotice(message) {
             const source = message.source;
-            return source.kind === 'plugin' && source.plugin === AGENT_TEAM_PLUGIN_ID
+            return isAgentTeamSource(source)
                 && source.form === 'notice' && source.summary === RECOVERY_NOTICE_SUMMARY;
         }
         notificationText(notifications, readerId) {