dsh-advisor 0.4.0 → 0.5.0

package/lib/config.js

@@ -4,10 +4,19 @@
  * The exported schemastery `Config` schema is what the cordis Loader uses to
  * validate the plugin row config: it applies defaults (`enabled` false,
  * `immuneTurns` 3, `maxDeltaMessages` 60, `systemPrompt` "") and enforces
- * types/bounds (integers ≥ 0). `resolveAdvisorConfig(raw)` additionally
- * enforces the explicit model gate: when `enabled` is true but `provider` or
- * `model` is missing or empty, it resolves to a disabled-with-reason config —
- * the advisor never starts a model call (hard gate, not a warning).
+ * types/bounds (integers ≥ 0). All six live fields are declared `.volatile()`:
+ * the Loader commits edits to them into the running fiber's references WITHOUT
+ * a remount (dsh 0.1.7-rc.1 — the settings.yaml user layer is gone), so
+ * `apply` receives each field as a `{ get() }` reference and every read must
+ * unwrap it first — {@link unwrapAdvisorConfig}, which tolerates plain values
+ * too (integration harnesses pass plain objects).
+ *
+ * `resolveAdvisorConfig(raw)` additionally enforces the explicit model gate:
+ * when `enabled` is true but `provider` or `model` is missing or empty, it
+ * resolves to a disabled-with-reason config — the advisor never starts a model
+ * call (hard gate, not a warning). The volatile unwrap happens BEFORE the gate:
+ * an unwrapped reference object is truthy, so the enabled/provider/model reads
+ * would silently pass the gate on the reference objects themselves.
  *
  * @module dsh-advisor/config
  */
@@ -32,17 +41,26 @@ const CONFIG_KEYS = new Set([
  * stay optional so an enabled-without-pair config validates and then resolves
  * to disabled-with-reason instead of failing to load.
  *
+ * Volatile (dsh 0.1.7-rc.1): every field is a LIVE field. The Loader commits
+ * edits into the running fiber's references without remounting the plugin
+ * (same pattern as dsh `agent-default-model`), so flat, always-present fields
+ * are exactly what the settings forms surface. `.volatile()` requires a fixed
+ * object path with no enclosing volatile field — this flat schema qualifies.
+ *
  * Type note: left to inference (`Schema<ObjectS, ObjectT>`), so calling the
  * schema accepts partial input (each key optional, `| null`) and yields the
- * fully-defaulted output — matching schemastery's runtime semantics.
+ * fully-defaulted output — matching schemastery's runtime semantics. With
+ * `.volatile()` the output type of each field is the reference shape; the
+ * resolver reads through {@link unwrapAdvisorConfig}, keeping this module's
+ * exported contracts plain-valued.
  */
 export const Config = z.object({
-    enabled: z.boolean().default(false),
-    provider: z.string(),
-    model: z.string(),
-    systemPrompt: z.string().default(''),
-    immuneTurns: z.number().step(1).min(0).default(3),
-    maxDeltaMessages: z.number().step(1).min(0).default(60),
+    enabled: z.boolean().default(false).volatile(),
+    provider: z.string().volatile(),
+    model: z.string().volatile(),
+    systemPrompt: z.string().default('').volatile(),
+    immuneTurns: z.number().step(1).min(0).default(3).volatile(),
+    maxDeltaMessages: z.number().step(1).min(0).default(60).volatile(),
 });
 function isNonEmptyString(value) {
     // Trim before checking: a whitespace-only value ("   ") is empty in effect
@@ -50,6 +68,44 @@ function isNonEmptyString(value) {
     // qc3 I-3 — a strict superset of dsh's own `length === 0` check).
     return typeof value === 'string' && value.trim().length > 0;
 }
+/**
+ * Read one volatile field: unwrap the `{ get() }` reference the Loader hands
+ * over, pass plain values through. Duck-typed on purpose — cosmokit's
+ * reference protocol is structural (`{ get }`), and importing the cosmokit
+ * types would add an undeclared dependency for one member.
+ */
+function unwrapReference(value) {
+    if (typeof value === 'object' && value !== null && typeof value.get === 'function') {
+        return value.get();
+    }
+    return value;
+}
+/**
+ * Snapshot the live entry config into a plain {@link AdvisorConfig}: every
+ * schema-declared field is read through its volatile reference (or taken as
+ * the plain value it is on non-Loader paths), and `null` — which schemastery
+ * passes through for fields without a default — is normalized to `undefined`
+ * so the resolved contract is null-free and the gate treats null exactly like
+ * a missing value. Keys outside the schema ride along untouched (the
+ * schemastery object resolver merges unknown keys through; they are never
+ * volatile-declared, so they are never references) — the hard gate's
+ * unknown-key rejection must keep seeing them.
+ *
+ * This is a snapshot read, NOT a validation: the result is the RAW composed
+ * config `resolveAdvisorConfig` consumes.
+ */
+export function unwrapAdvisorConfig(raw) {
+    const { enabled, provider, model, systemPrompt, immuneTurns, maxDeltaMessages, ...rest } = raw;
+    return {
+        ...rest,
+        enabled: unwrapReference(enabled),
+        provider: unwrapReference(provider) ?? undefined,
+        model: unwrapReference(model) ?? undefined,
+        systemPrompt: unwrapReference(systemPrompt),
+        immuneTurns: unwrapReference(immuneTurns),
+        maxDeltaMessages: unwrapReference(maxDeltaMessages),
+    };
+}
 /**
  * Resolve the raw config into the runtime contract.
  *
@@ -57,6 +113,10 @@ function isNonEmptyString(value) {
  * - Applies the explicit model gate (S4): `enabled: true` with `provider` or
  *   `model` missing/empty → disabled-with-reason, never throws, no model call.
  * - `provider`/`model` are ignored while disabled.
+ *
+ * The volatile unwrap happens FIRST (before any gate read): a reference
+ * object is truthy regardless of the value behind it, so gating on the raw
+ * volatile fields would silently enable the advisor on `{ get() }` objects.
  */
 export function resolveAdvisorConfig(raw) {
     if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {
@@ -67,15 +127,9 @@ export function resolveAdvisorConfig(raw) {
             throw new Error(`dsh-advisor: unknown config key "${key}"`);
         }
     }
-    const config = Config(raw);
-    // schemastery passes nullable input (null) through for fields without a
-    // default — normalize to undefined so the resolved contract is null-free
-    // and the gate treats null exactly like a missing value.
-    const normalized = {
-        ...config,
-        provider: config.provider ?? undefined,
-        model: config.model ?? undefined,
-    };
+    // Config(raw) resolves each `.volatile()` field to its reference; unwrap
+    // into the plain contract the gate (and every consumer) reads.
+    const normalized = unwrapAdvisorConfig(Config(raw));
     if (!normalized.enabled)
         return normalized;
     const missing = [];

package/lib/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,CAAC,MAAM,0BAA0B,CAAA;AA8BxC;;;;;GAKG;AACH,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC;IAC/C,SAAS;IACT,UAAU;IACV,OAAO;IACP,cAAc;IACd,aAAa;IACb,kBAAkB;CACnB,CAAC,CAAA;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACxD,CAAC,CAAA;AAEF,SAAS,gBAAgB,CAAC,KAAyB;IACjD,2EAA2E;IAC3E,2EAA2E;IAC3E,kEAAkE;IAClE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAA;IAC1E,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,GAAG,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAC1B,wEAAwE;IACxE,yEAAyE;IACzE,yDAAyD;IACzD,MAAM,UAAU,GAAkB;QAChC,GAAG,MAAM;QACT,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS;QACtC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,SAAS;KACjC,CAAA;IACD,IAAI,CAAC,UAAU,CAAC,OAAO;QAAE,OAAO,UAAU,CAAA;IAC1C,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACpE,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,UAAU,CAAA;IAC3C,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC;QACzC,CAAC,CAAC,mFAAmF;QACrF,CAAC,CAAC,eAAe,OAAO,CAAC,CAAC,CAAC,qDAAqD,CAAA;IAClF,OAAO,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAA;AAC1D,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,CAAC,MAAM,0BAA0B,CAAA;AA8BxC;;;;;GAKG;AACH,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC;IAC/C,SAAS;IACT,UAAU;IACV,OAAO;IACP,cAAc;IACd,aAAa;IACb,kBAAkB;CACnB,CAAC,CAAA;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IAC9C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC,CAAA;AAEF,SAAS,gBAAgB,CAAC,KAAyB;IACjD,2EAA2E;IAC3E,2EAA2E;IAC3E,kEAAkE;IAClE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAC7D,CAAC;AAoBD;;;;;GAKG;AACH,SAAS,eAAe,CAAI,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAQ,KAA2B,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC1G,OAAQ,KAAsB,CAAC,GAAG,EAAE,CAAA;IACtC,CAAC;IACD,OAAO,KAAU,CAAA;AACnB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAA0B;IAC5D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAA;IAC9F,OAAO;QACL,GAAG,IAAI;QACP,OAAO,EAAE,eAAe,CAAU,OAAO,CAAC;QAC1C,QAAQ,EAAE,eAAe,CAAqB,QAAQ,CAAC,IAAI,SAAS;QACpE,KAAK,EAAE,eAAe,CAAqB,KAAK,CAAC,IAAI,SAAS;QAC9D,YAAY,EAAE,eAAe,CAAS,YAAY,CAAC;QACnD,WAAW,EAAE,eAAe,CAAS,WAAW,CAAC;QACjD,gBAAgB,EAAE,eAAe,CAAS,gBAAgB,CAAC;KAC5D,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAA;IAC1E,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,GAAG,CAAC,CAAA;QAC7D,CAAC;IACH,CAAC;IACD,yEAAyE;IACzE,+DAA+D;IAC/D,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IACnD,IAAI,CAAC,UAAU,CAAC,OAAO;QAAE,OAAO,UAAU,CAAA;IAC1C,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACpE,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,UAAU,CAAA;IAC3C,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC;QACzC,CAAC,CAAC,mFAAmF;QACrF,CAAC,CAAC,eAAe,OAAO,CAAC,CAAC,CAAC,qDAAqD,CAAA;IAClF,OAAO,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAA;AAC1D,CAAC"}

package/lib/delivery.d.ts

@@ -22,13 +22,13 @@
  *   countdown and the KD-5 reset.
  *
  * Message shape (spec §6): a user-role message via `createUserMessage` whose
- * source is the classified first-party `plugin` arm
- * (`kind: 'plugin'`, `plugin: 'advisor'`; src/kinds.ts) and whose content is
- * self-describing `[advisor:{severity}] {note}` — the only cue the primary
- * model gets about how to treat it ("weigh, don't blindly obey" spirit). The
- * plugin's identity rides `source.plugin`, never `source.kind`: `kind` is
- * frozen per session-format generation, so a custom value there would make the
- * whole log unreadable to a future format edge.
+ * source is this plugin's own producer kind (`kind: 'advisor'`, pinned to the
+ * `notice` form; src/kinds.ts) and whose content is self-describing
+ * `[advisor:{severity}] {note}` — the only cue the primary model gets about
+ * how to treat it ("weigh, don't blindly obey" spirit). The kind is claimed by
+ * declaration-merging `MessageSourceMap` in dsh-llm, and the V3→V4 format edge
+ * preserves direct source kinds, so this identity is cross-generation-safe —
+ * the property the retired `plugin` arm used to be borrowed for.
  *
  * Delivery is synchronous and fire-and-forget; the runtime path (T4 F1) is
  * what contains a throwing `inject`/`steer` — this module lets agent-method
@@ -68,8 +68,8 @@ export interface AdvisorDeliveryOptions {
 }
 /**
  * Build the advisor message for one note (spec §6): a user-role message whose
- * source carries this plugin's identity on the `plugin` arm and whose content
- * is self-describing `[advisor:{severity}] {note}`.
+ * source carries this plugin's own producer kind and whose content is
+ * self-describing `[advisor:{severity}] {note}`.
  *
  * Bounds (qc3 F-2 / qc2 S-1): the note itself is already capped at
  * `ADVISOR_NOTE_MAX_CHARS` by extraction; the collapsed-row summary is

package/lib/delivery.js

@@ -22,13 +22,13 @@
  *   countdown and the KD-5 reset.
  *
  * Message shape (spec §6): a user-role message via `createUserMessage` whose
- * source is the classified first-party `plugin` arm
- * (`kind: 'plugin'`, `plugin: 'advisor'`; src/kinds.ts) and whose content is
- * self-describing `[advisor:{severity}] {note}` — the only cue the primary
- * model gets about how to treat it ("weigh, don't blindly obey" spirit). The
- * plugin's identity rides `source.plugin`, never `source.kind`: `kind` is
- * frozen per session-format generation, so a custom value there would make the
- * whole log unreadable to a future format edge.
+ * source is this plugin's own producer kind (`kind: 'advisor'`, pinned to the
+ * `notice` form; src/kinds.ts) and whose content is self-describing
+ * `[advisor:{severity}] {note}` — the only cue the primary model gets about
+ * how to treat it ("weigh, don't blindly obey" spirit). The kind is claimed by
+ * declaration-merging `MessageSourceMap` in dsh-llm, and the V3→V4 format edge
+ * preserves direct source kinds, so this identity is cross-generation-safe —
+ * the property the retired `plugin` arm used to be borrowed for.
  *
  * Delivery is synchronous and fire-and-forget; the runtime path (T4 F1) is
  * what contains a throwing `inject`/`steer` — this module lets agent-method
@@ -37,11 +37,10 @@
  * @module dsh-advisor/delivery
  */
 import { boundContextSummary, createUserMessage } from '@deepseek-ai/dsh-llm';
-import { ADVISOR_PLUGIN_ID } from './kinds.js';
 /**
  * Build the advisor message for one note (spec §6): a user-role message whose
- * source carries this plugin's identity on the `plugin` arm and whose content
- * is self-describing `[advisor:{severity}] {note}`.
+ * source carries this plugin's own producer kind and whose content is
+ * self-describing `[advisor:{severity}] {note}`.
  *
  * Bounds (qc3 F-2 / qc2 S-1): the note itself is already capped at
  * `ADVISOR_NOTE_MAX_CHARS` by extraction; the collapsed-row summary is
@@ -57,8 +56,7 @@ export function buildAdvisorMessage(note) {
     const text = `[advisor:${note.severity}] ${note.note}`;
     const summary = `[${text.slice('[advisor:'.length)}`;
     const source = {
-        kind: 'plugin',
-        plugin: ADVISOR_PLUGIN_ID,
+        kind: 'advisor',
         // n4 (user direction): declare the notice form + a collapsed-row summary so
         // the web shell's ContextInjectionRow shows "… · advisor · [nit] <note>"
         // instead of a bare producer label. The severity tag is part of the summary

package/lib/delivery.js.map

@@ -1 +1 @@
-{"version":3,"file":"delivery.js","sourceRoot":"","sources":["../src/delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAE7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAoC9C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAgB;IAClD,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,IAAI,GAAG,YAAY,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,EAAE,CAAA;IACtD,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAA;IACpD,MAAM,MAAM,GAAkB;QAC5B,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,iBAAiB;QACzB,4EAA4E;QAC5E,yEAAyE;QACzE,4EAA4E;QAC5E,qEAAqE;QACrE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,mBAAmB,CAAC,OAAO,CAAC;KACtC,CAAA;IACD,OAAO,iBAAiB,CAAC;QACvB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACjC,MAAM;KACP,CAAC,CAAA;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,cAAc,CAAC,QAAwB;IAC9C,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,CAAA;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,eAAe;IAClB,WAAW,CAAQ;IACV,WAAW,CAAyD;IACpE,MAAM,CAAuB;IAC9C,wEAAwE;IACvD,MAAM,GAAG,IAAI,GAAG,EAAgC,CAAA;IACjE;;;;OAIG;IACc,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAA;IAErD,YAAY,OAA+B;QACzC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAA;QACtC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC3D,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAA;IACzC,CAAC;IAED,wEAAwE;IACxE,aAAa,CAAC,KAA2B;QACvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;IAClC,CAAC;IAED,qFAAqF;IACrF,eAAe,CAAC,SAAiB;QAC/B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACjC,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,KAAa;QAC1B,IAAI,CAAC,WAAW,GAAG,KAAK,CAAA;IAC1B,CAAC;IAED;;;;OAIG;IACH,gBAAgB,CAAC,SAAiB;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC9C,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,IAAI,CAAC;YAAE,OAAM;QACrD,IAAI,SAAS,IAAI,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;;YAC9C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,GAAG,CAAC,CAAC,CAAA;IAClD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAiB;QACrB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACjC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,SAAiB,EAAE,IAAgB;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;QACvE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE;gBAC/D,SAAS;gBACT,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAA;YACF,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAClD,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YACnD,yEAAyE;YACzE,0EAA0E;YAC1E,uEAAuE;YACvE,kEAAkE;YAClE,IAAI,IAAI,CAAC,WAAW,GAAG,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;YACxE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YACpB,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACrB,OAAO,QAAQ,CAAA;IACjB,CAAC;CACF"}
+{"version":3,"file":"delivery.js","sourceRoot":"","sources":["../src/delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAqC7E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAgB;IAClD,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,IAAI,GAAG,YAAY,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,EAAE,CAAA;IACtD,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAA;IACpD,MAAM,MAAM,GAAkB;QAC5B,IAAI,EAAE,SAAS;QACf,4EAA4E;QAC5E,yEAAyE;QACzE,4EAA4E;QAC5E,qEAAqE;QACrE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,mBAAmB,CAAC,OAAO,CAAC;KACtC,CAAA;IACD,OAAO,iBAAiB,CAAC;QACvB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACjC,MAAM;KACP,CAAC,CAAA;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,cAAc,CAAC,QAAwB;IAC9C,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,CAAA;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,eAAe;IAClB,WAAW,CAAQ;IACV,WAAW,CAAyD;IACpE,MAAM,CAAuB;IAC9C,wEAAwE;IACvD,MAAM,GAAG,IAAI,GAAG,EAAgC,CAAA;IACjE;;;;OAIG;IACc,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAA;IAErD,YAAY,OAA+B;QACzC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAA;QACtC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC3D,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAA;IACzC,CAAC;IAED,wEAAwE;IACxE,aAAa,CAAC,KAA2B;QACvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;IAClC,CAAC;IAED,qFAAqF;IACrF,eAAe,CAAC,SAAiB;QAC/B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACjC,CAAC;IAED;;;;;OAKG;IACH,cAAc,CAAC,KAAa;QAC1B,IAAI,CAAC,WAAW,GAAG,KAAK,CAAA;IAC1B,CAAC;IAED;;;;OAIG;IACH,gBAAgB,CAAC,SAAiB;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QAC9C,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,IAAI,CAAC;YAAE,OAAM;QACrD,IAAI,SAAS,IAAI,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;;YAC9C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,GAAG,CAAC,CAAC,CAAA;IAClD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAiB;QACrB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;IACjC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,SAAiB,EAAE,IAAgB;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;QACvE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE;gBAC/D,SAAS;gBACT,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAA;YACF,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAClD,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YACnD,yEAAyE;YACzE,0EAA0E;YAC1E,uEAAuE;YACvE,kEAAkE;YAClE,IAAI,IAAI,CAAC,WAAW,GAAG,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;YACxE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YACpB,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACrB,OAAO,QAAQ,CAAA;IACjB,CAAC;CACF"}

package/lib/gateway.d.ts

@@ -11,23 +11,24 @@
  * exactly one plain-object `args` field whose keys are the method parameter
  * names (`get()` → `{ args: {} }`; `set(patch)` → `{ args: { patch } }`).
  *
- * Data: `get` reads the `AdvisorSettingsBridge` source — the same live
- * composed config the runtime reads (schema defaults → plugin-row base →
- * settings user layer), resolved through the `resolveAdvisorConfig` hard gate
- * (the SSOT for enabled-without-pair disabled-with-reason). `set` validates
- * the patch against the `Config` schema first (unknown-key rejection
- * unchanged — the settings service itself is non-strict and would accept the
- * unknown key), then writes the USER layer in-process via
- * `ctx.settings.update` (no exposed-namespace gate on the in-process write —
- * the wire-level `exposedNamespaces()` check only guards the apiproxy path),
- * and returns the new composed value.
+ * Data: `get` reads the `AdvisorSettingsBridge` source — the same live entry
+ * config the runtime reads (volatile references unwrapped), resolved through
+ * the `resolveAdvisorConfig` hard gate (the SSOT for enabled-without-pair
+ * disabled-with-reason). `set` validates the patch against the `Config`
+ * schema first (unknown-key rejection unchanged — the settings service itself
+ * is non-strict and would accept the unknown key), then writes the advisor
+ * ENTRY config in-process via `settings.update(ADVISOR_SETTINGS_NAMESPACE, ...)`
+ * (dsh 0.1.7-rc.1: the namespace key IS the profile entry id — the bundle row
+ * id `advisor` — and the write lands through the config editor into the
+ * Loader, which commits the volatile fields and emits `loader/volatile-update`,
+ * re-applying the runtime through the bridge with no restart), and returns
+ * the new composed value.
  *
  * The settings service is OPTIONAL (no settings service → the bridge source
  * stays the entry, `get` still works; `set` fails with a clear error — KD-G5
  * fallback). The gateway captures the service through a conditional
- * `ctx.inject(['settings'], ...)` child (the same activation pattern as
- * `installAdvisorSettings`), because `ctx.settings` is only resolvable from a
- * fiber that declares it.
+ * `ctx.inject(['settings'], ...)` child, because `ctx.settings` is only
+ * resolvable from a fiber that declares it.
  *
  * The returned config is normalized to the typertGateway JSON wire boundary:
  * absent keys (provider/model/disabledReason) are OMITTED, never
@@ -40,9 +41,84 @@ import type { Context } from '@deepseek-ai/cordis';
 import type { TypertContribution } from '@deepseek-ai/dsh-typert-registry';
 import { TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
 import type { AdvisorSettingsBridge } from './settings.js';
+import type { AdvisorModelSource } from './commands.js';
 import type { AdvisorConfig, ResolvedAdvisorConfig } from './config.js';
 /** Patch shape accepted by `advisor.set` — any subset of the config keys. */
 export type AdvisorConfigPatch = Partial<AdvisorConfig>;
+/** An atomic reviewer-route pair on the wire (JSON-safe; never undefined-valued). */
+export interface AdvisorPairWire {
+    readonly provider: string;
+    readonly model: string;
+}
+/**
+ * The authoritative per-session advisor snapshot (spec §5.3) — the wire value
+ * of `advisor/getSession` and of a successful `advisor/setSessionModel`.
+ * Absent optional keys are OMITTED (the typertGateway result validation
+ * rejects undefined values), never present-as-undefined:
+ *
+ * - `modelOverride` — the session's pinned atomic pair; omitted while the
+ *   session inherits the global defaults;
+ * - `modelSource` — where the effective route comes from (`session` = the
+ *   pin, `global` = the composed global pair); present iff an effective pair
+ *   exists at all;
+ * - `effectiveModel` — the effective route; omitted when neither level has a
+ *   complete pair;
+ * - `disabledReason` — the S4 explicit-gate reason when it blocks.
+ */
+export interface AdvisorSessionSnapshotWire {
+    readonly sessionId: string;
+    readonly enabled: boolean;
+    /** Live-session lifetime marker (spec §5.3 — the snapshot is never durable). */
+    readonly lifetime: 'live-session';
+    readonly modelOverride?: AdvisorPairWire;
+    readonly modelSource?: AdvisorModelSource;
+    readonly effectiveModel?: AdvisorPairWire;
+    readonly disabledReason?: string;
+}
+/**
+ * Plugin-domain error tags carried in RETURNED DATA (`{ error: { tag,
+ * message } }`) — never new RemoteError codes (dsh's failure vocabulary stays
+ * frozen) and never a thrown coded failure for these business outcomes:
+ *
+ * - `advisor/session-unknown` — the target session is not (or no longer)
+ *   live; rejected without allocating any state;
+ * - `advisor/unavailable` — this gateway fiber holds no elected owner (no
+ *   controller face); the endpoints stay inert rather than guessing;
+ * - `advisor/rejected` — the selection failed pair validation (nothing was
+ *   written);
+ * - `advisor/failed` — the pre-commit `resolveModelInfo` validation failed
+ *   (previous selection untouched);
+ * - `advisor/superseded` — a newer set/reset superseded the attempt;
+ * - `advisor/cancelled` — the attempt was cancelled before commit.
+ */
+export type AdvisorSessionErrorTag = 'advisor/session-unknown' | 'advisor/unavailable' | 'advisor/rejected' | 'advisor/failed' | 'advisor/superseded' | 'advisor/cancelled';
+/** One `advisor/getSession` / `advisor/setSessionModel` result: snapshot or tagged data error. */
+export type AdvisorSessionRpcResult = {
+    readonly snapshot: AdvisorSessionSnapshotWire;
+} | {
+    readonly error: {
+        readonly tag: AdvisorSessionErrorTag;
+        readonly message: string;
+    };
+};
+/** Build one tagged data error (keeps every call site's shape identical). */
+export declare function advisorSessionError(tag: AdvisorSessionErrorTag, message: string): AdvisorSessionRpcResult;
+/**
+ * The elected owner's session face — implemented by the wiring (`index.ts`)
+ * against the SAME `AdvisorCommandController` the `/advisor model` commands
+ * drive (spec §5.3: one controller, no second state store, no divergence
+ * between the command face and the web face). The gateway consults it lazily
+ * per request: only the reviewer-claiming fiber assigns it, so a gateway on a
+ * non-owner fiber stays inert (`advisor/unavailable`) instead of guessing.
+ */
+export interface AdvisorSessionGatewayFace {
+    /** Authoritative snapshot for one live session (unknown → tagged error). */
+    getSession(sessionId: string): AdvisorSessionRpcResult;
+    /** Validate + commit a pair through the command controller (same fencing). */
+    setSessionModel(sessionId: string, provider: string, model: string): Promise<AdvisorSessionRpcResult>;
+    /** Drop the pin and re-inherit (selection: null); never touches the enable override. */
+    resetSessionModel(sessionId: string): AdvisorSessionRpcResult;
+}
 /**
  * The host-side `advisor` config gateway (`/api/advisor/get` +
  * `/api/advisor/set`). Registered as the cordis service key `'advisor'`
@@ -64,12 +140,24 @@ export declare class AdvisorConfigGateway extends TypertRemoteService {
     private readonly bridge;
     /** The live settings service once the optional inject child activates. */
     private settings;
+    /**
+     * The elected owner's session face, resolved LAZILY per request. The
+     * reviewer-claiming fiber assigns it after its controller exists (the
+     * gateway is constructed before the single-reviewer claim); a `undefined`
+     * answer means this fiber owns the service key but not the reviewer role —
+     * the session endpoints answer `advisor/unavailable` in data and stay
+     * inert (no second controller, no surviving-fiber promotion).
+     */
+    private readonly sessionControl;
     /**
      * @param ctx - owning context (the plugin fiber's ctx inside `apply`).
      * @param bridge - the same `AdvisorSettingsBridge` the runtime reads, so
      *   get/set always operate on the live composed config.
+     * @param sessionControl - lazy access to the elected owner's session face
+     *   (B2); defaults to "absent" so a direct construction without the wiring
+     *   keeps the session endpoints cleanly unavailable.
      */
-    constructor(ctx: Context, bridge: AdvisorSettingsBridge);
+    constructor(ctx: Context, bridge: AdvisorSettingsBridge, sessionControl?: () => AdvisorSessionGatewayFace | undefined);
     /**
      * Read the current composed config (schema defaults → entry base → settings
      * user layer) through the hard gate.
@@ -79,8 +167,35 @@ export declare class AdvisorConfigGateway extends TypertRemoteService {
         config: ResolvedAdvisorConfig;
     };
     /**
-     * Validate a config patch and write it to the settings USER layer (live —
-     * the runtime re-applies through the bridge `onChange`; no restart needed).
+     * B2 — the authoritative snapshot for one live session
+     * (`/api/advisor/getSession`, args `{ sessionId }`). Read-only: never
+     * allocates override state (the snapshot rides the wiring's `sessionStatus`
+     * readback). Unknown/disposed targets answer `advisor/session-unknown`
+     * without touching the controller; a gateway without an elected owner
+     * answers `advisor/unavailable`. Business outcomes live in the returned
+     * data (plugin-domain tags) — nothing here throws coded failures and the
+     * dsh failure vocabulary stays frozen.
+     */
+    getSession(sessionId: string): AdvisorSessionRpcResult;
+    /**
+     * B2 — set (or reset) the per-session reviewer route for one live session
+     * (`/api/advisor/setSessionModel`, args `{ sessionId, selection }`).
+     * `selection: null` = reset (re-inherit the CURRENT global defaults; never
+     * touches the enable override). A non-null selection must be the atomic
+     * `{ provider, model }` pair and passes the SAME validation as the command
+     * face (`parseModelPair` — spec §5.3); the write itself routes through the
+     * elected owner's `AdvisorCommandController` (`setModel`/`resetModel`), so
+     * pre-commit `resolveModelInfo` validation (60 s, cancellable, no retry),
+     * per-session generation fencing, and the route-change semantics are
+     * INHERITED, not reimplemented. Unknown/disposed targets are rejected
+     * BEFORE the controller runs — no generation is allocated for a dead
+     * session. Returns the post-commit snapshot on success.
+     */
+    setSessionModel(sessionId: string, selection: unknown): Promise<AdvisorSessionRpcResult>;
+    /**
+     * Validate a config patch and write it to the advisor ENTRY config (live —
+     * the Loader commits the volatile fields and the runtime re-applies through
+     * the bridge `onChange`; no restart needed).
      * @param patch - any subset of the config keys; unknown keys are rejected
      *   by the `Config` schema before anything is written.
      * @returns the NEW composed config after the write.
@@ -91,14 +206,14 @@ export declare class AdvisorConfigGateway extends TypertRemoteService {
         config: ResolvedAdvisorConfig;
     }>;
     /**
-     * Resolve the live composed config through the hard gate. Containment
-     * (qc2 W-1): a user layer the resolver rejects (e.g. an unknown key that
-     * survived the non-strict settings schema) resolves to disabled-with-reason
-     * carrying the message — the gateway never fails the RPC on a bad user
-     * layer, and gate semantics hold (no model call can start). S1: when the
-     * raw source is still readable, the fallback seeds its scalar latches
-     * (systemPrompt / immuneTurns / maxDeltaMessages) instead of hardcoded
-     * defaults, so an invalid layer only drops the offending keys.
+     * Resolve the live entry config through the hard gate. Containment
+     * (qc2 W-1): an entry config the resolver rejects (e.g. an unknown key
+     * that survived the non-strict schemastery object merge) resolves to
+     * disabled-with-reason carrying the message — the gateway never fails the
+     * RPC on a bad config, and gate semantics hold (no model call can start).
+     * S1: when the raw source is still readable, the fallback seeds its scalar
+     * latches (systemPrompt / immuneTurns / maxDeltaMessages) instead of
+     * hardcoded defaults, so an invalid config only drops the offending keys.
      */
     private readConfig;
 }