dsh-molbio-tools 0.20.1 → 0.21.1

package/CHANGELOG.md

@@ -10,6 +10,167 @@
   改为按**包名**引用后模块缓存问题随之消失——没有拷贝，也就没有需要保持同步的版本目录。
   下文历史条目里出现的 `vN` 目录保持原样，作为当时的记录。
 
+## [0.21.1] — 2026-10-25（DSH STORE 提交前置：一个 patch、逐版本兼容声明、一个 tarball 一个清单）
+
+**工具数不变（60），插件运行时行为零改动。** 这一版不加任何计算能力，只把"这个包以什么形状提交"
+改成 DSH STORE 的提交预检与 DSH 自身的清单契约**都能接受、且不再互相矛盾**的那一种。三处改动都
+来自同一次上架提交：预检里能靠改包解决的两条已经解决，剩下两条的原理与请求另写在
+[docs/store-preset-exemption.md](docs/store-preset-exemption.md)。
+
+### 1. 两层 patch 合并成单个 `cordis.patch.yml`
+
+0.21.0 的 `dsh.bundle.patch` 是**有序数组**：`["./cordis.patch.yml", "./preset/molbio-lab/preset.patch.yml"]`。
+DSH 运行时接受这种写法（`@deepseek-ai/dsh-app-boot` 的 `bundlePatchPaths`：one file, or an
+ordered list of files），官方 `@deepseek-ai/dsh-web-app` 自己就列了 5 个文件；但 DSH STORE 的提交
+预检（`scripts/check-plugin-submission.mjs` 的 `safePatchPath`）只接受字符串，数组直接判
+`SUBMISSION_BUNDLE_PATCH_INVALID`。两边都自称官方契约，解法不必等预检放宽：
+
+- `build/preset-patch.mjs` 现在直接产出**根目录的 `cordis.patch.yml`**，内容是**两个 insert**：
+  `molbio-client → ./host.mjs`（惰性宿主锚点）在前，`preset-molbio-lab`（由
+  `preset/molbio-lab/agent.cordis.yml` 生成的 preset 行）在后；顺序即应用顺序。
+- 不再生成 `preset/molbio-lab/preset.patch.yml`（文件已删）；`package.json` 的
+  `dsh.bundle.patch` 是**单字符串**。
+- 四个读者改为跟单文件走：`test/preset-health.mjs`、`test/drift-probe.mjs`、
+  `preset/install.mjs`、`test/preset-rows.mjs`（后者在同一个文件的两个 insert 里找 preset 段，
+  不假设"preset.patch.yml 才是 preset"）。
+
+> 这一条同时守住一条更早的教训：**锚点行不能因为"文件变少了"而消失**。0.15.2 的两个侧栏 tab
+> 就是锚点丢失后静默消失的；`test/client-mount.mjs` 仍然逐包断言"被选中的包必须有一个宿主行
+> 能解析到它"，`test/contract.mjs` 仍然断言"产物里的每一处 `register` 都在 `inject` 里"。
+
+### 2. `engines.dsh` 与逐版本 `dshReleases`
+
+两个 manifest 各声明一份：
+
+```jsonc
+"engines": { "node": ">=26", "dsh": ">=0.2.1-rc.2 <0.3.0-0" },
+"dsh": { "compatibility": { "dshReleases": {
+  "0.2.1-rc.1": "unknown", "0.2.1-rc.2": "compatible", "0.2.1-rc.3": "unknown" } } }
+```
+
+上界写 `<0.3.0-0` 而不是 `<0.3.0`：DSH 用 `semver.satisfies(..., { includePrerelease: true })`
+判定（`@deepseek-ai/dsh-app-boot` 的 `unmetRequirements`），带 prerelease 选项时 `<0.3.0`
+会放行 `0.3.0-alpha.1`，`-0` 不会。`rc.1` 早于本包基线、`rc.3` 未取得也未验证，两者都只能
+标 `unknown`——**范围不等于验收**：`engines` 是安装时的粗筛，商城的 `dshReleases` 记录才是
+逐版本的验收结论。
+
+面板包随之 `0.1.3 → 0.1.4`：它的版本线独立于根包，但清单变了，不发这个版本号就没有能承载新
+声明的发布物。
+
+### 3. 根 tarball 不再内嵌面板包
+
+`files` 白名单去掉 `packages`。此前根 tarball 里同时躺着 `package.json` 与
+`packages/molbio-panel/package.json` 两个 DSH 插件清单，还重复携带 427 KB 相同的 `lib/client.js`；
+商城把"一个包里出现第二个插件清单"视为提交歧义是对的。现在根 tarball **只有一个插件清单**：
+**118 → 115 个文件、约 1.1 MB → 约 999 kB**（多出的 1 个文件是本次提交的
+`docs/store-preset-exemption-issue.md`）。面板没有因此消失——根包的 `lib/client.js` 本来就带着它
+（第 4 节的启动回读可以作证）；面板包继续按自己的地址单独发布。
+
+`test/contract.mjs` 的打包断言随之改向：不再要求 `files` 必须包含 `packages/`，而是断言
+**一个 tarball 里恰好只有一个 DSH 清单**（把 `packages` 加回白名单会立刻 FAIL）。
+
+### 4. 一次性 profile 证据（tarball 就是发布物）
+
+证据记录在 [docs/store-evidence.md](docs/store-evidence.md)，用临时 `DSH_HOME` 重跑，不碰真实
+`~/.dsh`：`npm pack` → `--from-default-profile web` 建 profile → `plugin add` tarball →
+`--dump-config`（`molbio-client` 解析到已安装包内，preset 行带 `tool-molbio`）→
+`--no-open --port 0` 启动 → 带 token 回读页面（**HTTP 200**，`__DSH_BOOT__` 图里有
+`dsh-molbio-tools/client.js`）→ `plugin remove` → 再 `--dump-config`（`molbio` 引用 **0** 处）。
+装 tarball 而不是目录，是因为 tarball 同时证明 `files` 白名单带全了运行文件。
+
+### 5. 未做 / 边界
+
+- **`0.2.1-rc.3` 没有验证**，因此标 `unknown`。拿到该版本后按
+  [docs/workflow.md](docs/workflow.md) 第 4 节的升级流程重跑 `preset-health` / `drift-probe` /
+  一次性 profile，再把它改成 `compatible`。
+- **预检的另外两条（保护命名空间、身份一致）不是改包能解决的**：本包已自行消掉
+  `SUBMISSION_BUNDLE_PATCH_INVALID`；剩下两条的证据、代码位置与三个可执行请求写在
+  [docs/store-preset-exemption.md](docs/store-preset-exemption.md)，可直接贴到 issue 的短版在
+  [docs/store-preset-exemption-issue.md](docs/store-preset-exemption-issue.md)。
+- **工具行为与 benchmark 一律不动**：60 个工具的输出与 0.21.0 相同，按规则 6 的"没变就不必跑
+  模型"；`bench --offline` 仍在 `npm test` 里，期望值照样逐条校验。
+
+### 6. 版本与验证
+
+- 根包 `0.21.0 → 0.21.1`；面板 `0.1.4`（见 §2）。
+- `npm test` 全绿：smoke、画面四套、客户端四套、contract 16 项、drift-probe 14 条突变、
+  preset-health 30 行、release 13 项、benchmark 四道守卫 + `bench --offline` 61 题。
+- `node build/preset-patch.mjs --check` 与 `node build/client-bundle.mjs --check` 均报告与源一致。
+- `node build/release-preflight.mjs --tag v0.21.1`：本地不变量全过；npm 上 `dsh-molbio-tools`
+  已有 0.21.0、本版按 `publish` 处理；面板 0.1.4 尚未发布。
+- 文档同步：maintainer 的版本号、roadmap 的当前状态、history 的版本一览与本段、store-evidence
+  的 tarball 名与文件数。
+
+## [0.21.0] — 2026-10-23（DSH 0.2.1-rc.2 适配；两条 benchmark 欠账清零）
+
+**工具数不变（60），插件行为零改动。** 这是一次"只跟上游走"的版本：0.20.1 之后本机 harness
+升到 0.2.1-rc.2，`npm test` 立刻红了三处——组合漂移、契约断言、以及一条依赖旧 fixture 的
+漂移探针。三处都不是插件退化，但每一处都属于**守卫在说谎**，所以按发布阻断处理。
+
+### 1. preset 行清单按 0.2.1-rc.2 逐行重抄（12 处结构差异）
+
+- 上游 `standard` **新增** `time-context`、`tool-schedule`、`tool-plugin-market`；
+- **删除** `tool-subagent-codex` / `tool-subagent-claude-code`（两个 `disabled: true` 的可选
+  provider）与 `tool-ralph`；
+- **去掉** persona 的 `suffix: Your working directory is {{cwd}}.`，以及 `tool-subagent` /
+  `tool-subagent-fork` 的 `backgroundMode: continuable`；
+- plan-mode 的段落文案改为 "until the user approves your plan through exit_plan_mode…"。
+
+`agent.cordis.yml` 现在是上游 `config.plugins:` 块的**整体去缩进** + 末尾一行 `tool-molbio`；
+0.2.1 的上游文件不带行内注释，因此行内注释随之消失，来源与升级规则集中写在文件头部。
+`preset.patch.yml` 由 `build/preset-patch.mjs` 重新生成。
+
+### 2. `test/contract.mjs`：两条断言不再锚在 minified 字面量上
+
+- **client 入口**：改为按包自己的 `exports["./client"]`（`browser` 条件）解析。
+  0.2.1-rc.2 把 `@deepseek-ai/dsh-client-connection` 移到 `lib/client.browser.js`，旧断言
+  硬编码 `lib/client.js`，会把一个加载正常的包判死；同时 Web shell 已是打包产物、不再出现
+  `require("包名")`，"seeded into the shell" 兜底只剩代码路径。新增两个对照：没有
+  `./client` 导出的包必须解析为 `undefined`，以及移动过的入口必须解析到真实文件。
+- **`presentationMeta`**：0.2.1 删除了 `exec.parent === void 0` 闸门（投影移进
+  `createSuccessResult`，对每次成功执行都做）。断言改挂到卡片真正消费的东西：投影被
+  `snapshotProjection` 记录、并以 `meta` 附到成功结果上。
+
+### 3. `drift-probe`：突变样本换成上游仍存在的行
+
+上游删掉 `tool-ralph` 后，那条"上游 `disabled: true` 被丢掉"的突变在**空转**（`withRow`
+找不到目标，什么也没改，守卫却"通过"）。改用上游仍以 `disabled: true` 发布的
+`tool-plugin-manager`；14 条突变全部仍能被抓住。
+
+### 4. benchmark：profile 重建、两条欠账清零
+
+- preset 新增的两行宿主可承载行（`time-context`、`tool-schedule`）进入 headless profile，
+  `benchmark/profile.mjs` 重建 `molbio-bench`：**12 行宿主行，仍注册 60 个工具**。
+- `methylation-block` 与 `qpcr-primers` 的冻结响应停在 0.16.0 之前，`benchmark-score` 每次
+  都点名。本版用一次完整真实模型跑重录，并用 `_freeze-trace.mjs --replace` **只替换这两条**，
+  其余 47 条保持原样；`run.amendments` 记录每条替换来自哪一次跑分。fixture 现为
+  **49 条记录、0 条 suspended**。
+- 完整跑分（2026-10-23，DSH 0.2.1-rc.2，61 题）：**58/61** 通过，tool selection **60/61**、
+  arguments **60/61**、final answer **59/61**；11.2M tokens / 2161 s。
+  - `protein-props` 的失败是**断言不认千分位逗号**（答案写 `1,490`，断言写 `/1490/`）——
+    与 0.20.0 修过的 `/3935/` 同一类，当时漏了这一条。已改为 `1[,.]?490`，`--replay` 后
+    **59/61**。
+  - 剩余两条是**真实的模型遗漏**，不是产品缺陷：`dilution-math` 答案正确（50 µL + 950 µL）
+    却从未调用 `molbio_lab_math`；`batch-analysis` 写出了 CSV，但最终回答只说"报告已生成"，
+    没有报出指令要求的长度/特征数。
+- `_freeze-trace.mjs` 新增 `--replace id[,id…]`：只重录被修复作废的条目，其余记录与顺序原样
+  保留，并在 `run.amendments` 里写明每条替换的来源跑分——**替换的是真实录制，不是手改**。
+
+### 5. 未做 / 边界
+
+- **`png_path` 仍然不做**：`contract` 的"工作区仍不能存二进制文件"断言在 0.2.1-rc.2 上**仍然
+  通过**，说明上游 fs 缝依旧是 text-only；触发条件未到。
+- **面板版本保持 0.1.3**：`lib/client.js` 逐字节未变，`release-preflight` 复核为
+  "already published with identical bytes"，因此不 bump。
+
+### 6. 版本与验证
+
+- 根包 `0.20.1 → 0.21.0`；DSH 基线钉 **0.2.1-rc.2**（`.github/workflows/{test,release}.yml`、
+  preset 头注、`docs/workflow.md`、`docs/roadmap.md`、`docs/maintainer.md`）。
+- `npm test` 全绿：contract 16/16、drift-probe 14 条突变、preset-health 30 行全过、release
+  13 项、benchmark profile/score/coverage/changed、`bench --offline` 61 题。
+- 文档：roadmap 状态、history 的 v0.21.0 段（三条教训）、workflow 的升级提示同步。
+
 ## [0.20.1] — 2026-10-18（插件专属图标）
 
 **工具数不变（60），运行时零改动；包内只多一个 746 B 的 SVG。**

package/README.md

@@ -79,7 +79,7 @@ dsh plugin --profile web update dsh-molbio-tools
 > **0.7.1 起不再需要"注册 preset 根目录"这一步。**
 > DSH 0.1.7-alpha.1 移除了 `@deepseek-ai/dsh-agent-presets` 及其目录发现机制：preset 现在是
 > bundle patch 里的一个 `@deepseek-ai/dsh-agent-preset` **行**（本包的是
-> `preset/molbio-lab/preset.patch.yml`，由 `dsh.bundle.patch` 声明）。
+> `cordis.patch.yml` 里的第二个 insert，由 `dsh.bundle.patch` 声明）。
 > 因此 preset 随 bundle 一起安装，**装完即出现**。
 >
 > 老版本遗留的两样东西可以清理（`node preset\install.mjs --profile web` 会替你查出来）：
@@ -95,12 +95,12 @@ dsh plugin --profile web update dsh-molbio-tools
 
 ### 工具只在专属模式里出现（设计如此）
 
-本包的 bundle patch 分两层，分工是固定的：
+本包的 bundle patch 是**一个文件、两层 insert**，分工是固定的：
 
-| 层 | 作用 |
+| 层（同一个 `cordis.patch.yml` 里的两段） | 作用 |
 | --- | --- |
-| `cordis.patch.yml` | 只插一行**惰性宿主锚点**（`./host.mjs`），不注册任何工具 |
-| `preset/molbio-lab/preset.patch.yml` | 声明 **Molecular Biology Lab** 模式，60 个工具在这一层里 |
+| `molbio-client` → `./host.mjs` | 只插一行**惰性宿主锚点**，不注册任何工具 |
+| `preset-molbio-lab` → `@deepseek-ai/dsh-agent-preset` | 声明 **Molecular Biology Lab** 模式，60 个工具在这一层里 |
 
 所以 60 个工具**只在选中该模式的会话里加载**，其它模式（standard / ptc / minimal / cordis）
 不带它们，不占提示预算。bundle 安装 ≠ 工具全局可见：bundle 只是把"模式"和"面板"一起装进来。
@@ -741,11 +741,11 @@ dsh-molbio-tools/
 ├── lib/client.js    # 客户端产物（exports["./client"]，由 npm run build:client 生成）
 ├── packages/molbio-panel/ # 面板专用包（只面板、不带工具）
 ├── preset/molbio-lab/     # 专属模式 preset：agent.cordis.yml 是行清单（手改这里）
-│                          #   preset.patch.yml 由 build/preset-patch.mjs 生成
+│                          #   preset.yml 是选择器文案；两者由生成器写进下面的 cordis.patch.yml
 ├── benchmark/       # 可用性评估：tasks/*.json + 判分器 + headless profile 推导（见其 README）
 ├── test/            # 冒烟 + 光栅化器 + 客户端/组合检查（含 preset 漂移与 benchmark profile 守卫）
 ├── docs/            # 维护者与实现文档（rules / workflow / roadmap / history 是本目录的骨架）
-└── cordis.patch.yml # bundle 的第一层补丁（当前为空列表；工具由 preset 层承载）
+└── cordis.patch.yml # 唯一 bundle patch（生成物）：锚点 insert + preset insert
 ```
 
 ---

package/benchmark/README.md

@@ -159,6 +159,7 @@ benchmark/
 ├── _probe.mjs         record ground truth (original suite)
 ├── _probe-all.mjs     record ground truth (the rest of the catalog)
 └── _freeze-trace.mjs  freeze a run's responses into the scorer's regression fixture
+                     (`--replace id[,id]` re-records only the named entries and keeps the rest)
 ```
 
 A task's expected text lives in `tasks/`; the input that produces it lives in
@@ -221,7 +222,7 @@ session "…" runs under agent preset "molbio-lab", which the one-shot runner do
 Presets are an agent-plane feature the Web surface composes; the one-shot runner
 drives `agents.create()` directly and never joins one. So the tools must be
 mounted as **host rows**, which is the one shape this package otherwise refuses
-to ship (`cordis.patch.yml` is deliberately an empty list).
+to ship (`cordis.patch.yml` only inserts the inert client anchor).
 
 `benchmark/profile.mjs` therefore generates a dedicated profile
 (`$DSH_HOME/profiles/molbio-bench`) whose patch layer is **derived** from

package/benchmark/_freeze-trace.mjs

@@ -12,6 +12,20 @@
  * Run this only when you WANT to move the golden fixture forward (for example
  * after deliberately changing a task). Test failures point here when a recorded
  * response stops satisfying its task.
+ *
+ * ── amending a subset (`--replace`) ─────────────────────────────────────────
+ *
+ * Re-recording the one or two entries a fix invalidated used to mean freezing a
+ * whole new run and discarding every other recording. `--replace` takes just
+ * those responses from the new report and keeps the rest, and records where each
+ * amended response came from in `run.amendments` — explicit provenance beats a
+ * fixture that pretends to be a single run:
+ *
+ *     node benchmark/_freeze-trace.mjs benchmark/reports/<stamp>-suite.json \
+ *       --replace methylation-block,qpcr-primers
+ *
+ * The replacement is a REAL recording from the named run, never a hand edit: the
+ * original ids, order and every untouched response survive.
  */
 
 import { readFile, writeFile } from 'node:fs/promises';
@@ -19,7 +33,16 @@ import { resolve } from 'node:path';
 
 const source = process.argv[2];
 if (source === undefined) {
-  console.error('usage: node benchmark/_freeze-trace.mjs <report.json>');
+  console.error('usage: node benchmark/_freeze-trace.mjs <report.json> [--replace id[,id…]]');
+  process.exit(2);
+}
+
+const replaceAt = process.argv.indexOf('--replace');
+const replaceIds = replaceAt === -1
+  ? undefined
+  : (process.argv[replaceAt + 1] ?? '').split(',').map((id) => id.trim()).filter((id) => id !== '');
+if (replaceAt !== -1 && (replaceIds === undefined || replaceIds.length === 0)) {
+  console.error('--replace needs a comma-separated list of task ids');
   process.exit(2);
 }
 
@@ -29,23 +52,74 @@ if (!Array.isArray(report.results) || report.results.length === 0) {
   process.exit(1);
 }
 
-const out = {
-  $comment:
-    'Real responses from one benchmark run, frozen so the scorer can be regression-tested without spending API budget. See test/benchmark-score.mjs for why each defect these cover was invisible to synthetic traces.',
-  run: {
-    recorded_at: report.startedAt,
-    harness_version: report.harnessVersion,
-    profile: report.profile,
-    model: report.model,
-    summary: { total: report.summary.total, passed: report.summary.passed },
-    responses: report.results.map((result) => ({
-      id: result.id,
-      tool_calls: result.toolCalls,
-      answer: result.answer,
-    })),
-  },
-};
+const responses = report.results.map((result) => ({
+  id: result.id,
+  tool_calls: result.toolCalls,
+  answer: result.answer,
+}));
 
 const target = resolve(import.meta.dirname, '..', 'test', 'fixtures', 'benchmark-traces.json');
+
+/** The whole-fixture shape: one run, every response from it. */
+function wholeRun() {
+  return {
+    $comment:
+      'Real responses from one benchmark run, frozen so the scorer can be regression-tested without spending API budget. See test/benchmark-score.mjs for why each defect these cover was invisible to synthetic traces.',
+    run: {
+      recorded_at: report.startedAt,
+      harness_version: report.harnessVersion,
+      profile: report.profile,
+      model: report.model,
+      summary: { total: report.summary.total, passed: report.summary.passed },
+      responses,
+    },
+  };
+}
+
+/** The amended shape: keep the fixture, swap the named entries, say so. */
+async function amendedRun() {
+  const existing = JSON.parse(await readFile(target, 'utf8'));
+  const byId = new Map(existing.run.responses.map((response) => [response.id, response]));
+  // Replacing the same id twice must not pile up amendment entries or repeat
+  // the provenance sentence: this command is re-run whenever a report is rebuilt.
+  const amendments = (existing.run.amendments ?? []).filter((entry) => !replaceIds.includes(entry.id));
+  for (const id of replaceIds) {
+    const fresh = responses.find((response) => response.id === id);
+    if (fresh === undefined) {
+      console.error(`--replace: the report has no result for "${id}" — nothing was written`);
+      process.exit(1);
+    }
+    if (!byId.has(id)) console.log(`  note: "${id}" was not in the fixture; appending it`);
+    byId.set(id, fresh);
+    amendments.push({
+      id,
+      recorded_at: report.startedAt,
+      harness_version: report.harnessVersion,
+      model: report.model,
+    });
+  }
+
+  const ordered = existing.run.responses.map((response) => byId.get(response.id));
+  for (const id of replaceIds) {
+    if (!existing.run.responses.some((response) => response.id === id)) ordered.push(byId.get(id));
+  }
+
+  return {
+    $comment: existing.$comment.includes('run.amendments names each one')
+      ? existing.$comment
+      : `${existing.$comment} Some responses were re-recorded later; run.amendments names each one and the run it came from, and every other response is unchanged. A replaced entry loses any suspension marker it carried, because the replacement is a fresh recording.`,
+    run: {
+      ...existing.run,
+      amendments,
+      responses: ordered,
+    },
+  };
+}
+
+const out = replaceIds === undefined ? wholeRun() : await amendedRun();
 await writeFile(target, `${JSON.stringify(out, null, 2)}\n`, 'utf8');
-console.log(`froze ${out.run.responses.length} response(s) into ${target}`);
+console.log(
+  replaceIds === undefined
+    ? `froze ${out.run.responses.length} response(s) into ${target}`
+    : `amended ${replaceIds.length} response(s) (${replaceIds.join(', ')}) in ${target}; ${out.run.responses.length} total`,
+);

package/benchmark/profile.mjs

@@ -17,7 +17,8 @@
  * agent-plane feature the Web surface composes; the one-shot runner drives
  * `agents.create()` directly and never joins one. So the tools have to be
  * mounted as HOST rows, which is the one shape this package otherwise refuses
- * to ship (`cordis.patch.yml` is deliberately empty — see the preset's header).
+ * to ship (`cordis.patch.yml` only inserts the inert client anchor — see the
+ * preset's header).
  *
  * ── What keeps the reconstruction honest ────────────────────────────────────
  *

package/benchmark/tasks/06-analysis.json

@@ -44,7 +44,8 @@
         },
         {
           "where": "answer",
-          "pattern": "1490"
+          "pattern": "1[,.]?490",
+          "note": "the extinction coefficient; the same thousands-separator tolerance the MW assertion already carries (0.20.0 fixed /3935/, not this one)"
         }
       ]
     },

package/build/preset-patch.mjs

@@ -1,35 +1,55 @@
 /**
  * dsh-molbio-tools/build/preset-patch.mjs
  *
- * Generate the AGENT-PRESET bundle patch from the canonical row list.
+ * Generate the ONE bundle patch this package ships: the client anchor plus the
+ * "Molecular Biology Lab" agent preset.
  *
- * WHY THIS EXISTS
- * ---------------
- * DSH 0.1.7-alpha.1 replaced the preset DIRECTORY mechanism. Before it, a preset
- * was an `agent.cordis.yml` the harness discovered from `<dshHome>/.agent-presets`
- * or from a configured root (`@deepseek-ai/dsh-agent-presets` scanned
- * directories). That package is gone, and the registry that replaced it "neither
- * scans directories nor accepts preset paths" — a preset is now a
- * `@deepseek-ai/dsh-agent-preset` ROW inside a bundle patch:
+ * WHY ONE FILE
+ * ------------
+ * DSH's runtime accepts `dsh.bundle.patch` as a file path or an ordered list of
+ * file paths (`@deepseek-ai/dsh-app-boot` → `bundlePatchPaths`), and the shipped
+ * `@deepseek-ai/dsh-web-app` uses the list form. DSH STORE's submission precheck
+ * only accepts a single string (`safePatchPath`), so the two layers this package
+ * used to ship as a list are emitted as one file with two top-level `insert`
+ * operations, in the same order they were applied:
  *
- *     - insert:
- *         - id: preset-molbio-lab
- *           name: '@deepseek-ai/dsh-agent-preset'
- *           config:
- *             id: molbio-lab
- *             name: Molecular Biology Lab
- *             description: ...
- *             plugins: [ ...the rows that used to be the composition... ]
+ *     1. molbio-client      → './host.mjs'  (inert host anchor; see below)
+ *     2. preset-molbio-lab  → '@deepseek-ai/dsh-agent-preset'
  *
- * The rows themselves did not change — only their container did. Keeping the
- * rows in ONE place and generating the container from them is what stops the two
- * from drifting, because `test/preset-health.mjs` validates every row against
- * the INSTALLED harness's own schemas.
+ * Nothing about either layer changes: a patch file is an ordered list of
+ * operations, and DSH applies them in file order exactly as it applied the two
+ * files in list order.
+ *
+ * WHY THE ANCHOR EXISTS
+ * ---------------------
+ * DSH's client-module scan walks the HOST Loader tree only. It reads each live
+ * host row's package manifest, takes `dsh.client` and `exports["./client"]` from
+ * it, and composes the browser graph that becomes `window.__DSH_BOOT__`. A
+ * preset's rows live in an isolated subtree that scan never visits.
+ *
+ * So when the tools moved into the preset, this package lost its only host-plane
+ * row, its bundle stopped reaching the page, and the two right-sidebar tabs
+ * (Molbio / Papers) silently disappeared. `host.mjs` restores exactly one inert
+ * row so the browser half is discoverable again — without putting any tool into
+ * a session that did not choose the molbio-lab mode.
+ *
+ * WHY THE PRESET IS GENERATED
+ * ---------------------------
+ * DSH 0.1.7-alpha.1 removed the `<dshHome>/.agent-presets` directory scan: a
+ * preset is now a `@deepseek-ai/dsh-agent-preset` ROW in a bundle patch, which
+ * is what the second insert below declares. Because the BUNDLE registers it,
+ * `dsh plugin --profile <p> add dsh-molbio-tools` puts the mode in the picker
+ * with no copy step and no preset-root patch — see README「安装」.
+ *
+ * Keeping the rows in ONE place and generating the container from them is what
+ * stops the two from drifting, because `test/preset-health.mjs` validates every
+ * row against the INSTALLED harness's own schemas.
  *
  *   source : preset/molbio-lab/agent.cordis.yml  (top-level row list, comments intact)
- *   output : preset/molbio-lab/preset.patch.yml  (the bundle patch, GENERATED)
+ *   source : preset/molbio-lab/preset.yml        (picker name + description)
+ *   output : cordis.patch.yml                    (GENERATED; anchor + preset)
  *
- * The source is emitted as-is: no re-serialization, so the comments that explain
+ * The rows are emitted as-is: no re-serialization, so the comments that explain
  * each row survive and the file stays diffable against the shipped `standard`
  * patch it descends from.
  *
@@ -55,20 +75,56 @@ export function rowBlockOf(source) {
 /** Indent every line of a block by `width` spaces. */
 const indent = (block, width) => block.split('\n').map((line) => (line === '' ? line : ' '.repeat(width) + line)).join('\n');
 
+const HEADER = [
+  '# dsh-molbio-tools bundle patch — the one file `dsh.bundle.patch` names.',
+  '#',
+  '# GENERATED by build/preset-patch.mjs. Edit the row list in',
+  '# preset/molbio-lab/agent.cordis.yml (and the picker strings in preset.yml), then',
+  '# re-run `node build/preset-patch.mjs`; hand edits here are reverted by the next',
+  '# run, and `node build/preset-patch.mjs --check` fails while the two disagree.',
+  '#',
+  '# Two top-level inserts, applied in this order:',
+  '#   1. molbio-client      — inert host anchor for the browser half (see below)',
+  '#   2. preset-molbio-lab  — the "Molecular Biology Lab" agent preset',
+].join('\n');
+
+const ANCHOR = [
+  '# ── 1. the CLIENT-BUNDLE ANCHOR ────────────────────────────────────────────',
+  '#',
+  '# `host.mjs` registers no tool and publishes no service. Its only job is to be a',
+  "# loader row DSH's client-module scan can see: that scan walks the HOST Loader",
+  "# tree, reads the row's package manifest, and takes `dsh.client` +",
+  '# `exports["./client"]` from it to compose `window.__DSH_BOOT__`. A preset\'s rows',
+  '# live in an isolated subtree the scan never visits, so a `dsh.client` package',
+  '# referenced only from inside a preset loses its only discoverable row and its',
+  '# right-sidebar tabs silently disappear.',
+  '#',
+  '# Keep the tool in the PRESET and only the anchor here. An earlier version of',
+  "# this file inserted a host row for the tool itself (`name: dsh-molbio-tools`),",
+  "# which both registered all 60 tools globally and collided with the preset's own",
+  '# copy of that row:',
+  '#',
+  '#     broken: "tool-molbio (...): never started"',
+  '- insert:',
+  '    - id: molbio-client',
+  "      name: './host.mjs'",
+].join('\n');
+
+/**
+ * Build the bundle patch: anchor first, preset second.
+ *
+ * @param {{rows: string, description: string, displayName?: string}} input
+ * @returns {string} the complete `cordis.patch.yml` text (single trailing newline)
+ */
 export function buildPatch({ rows, description, displayName = 'Molecular Biology Lab' }) {
-  const header = [
-    '# dsh-molbio-tools bundle layer: declares the "Molecular Biology Lab" agent preset.',
+  const presetHeader = [
+    '# ── 2. the MOLECULAR BIOLOGY LAB PRESET ───────────────────────────────────',
     '#',
-    '# GENERATED by build/preset-patch.mjs from preset/molbio-lab/agent.cordis.yml.',
-    '# Edit the ROW LIST there and re-run `node build/preset-patch.mjs`; editing the',
-    "# `plugins:` block below by hand will be reverted by the next run, and",
-    '# `node build/preset-patch.mjs --check` fails while the two disagree.',
-    '#',
-    '# DSH 0.1.7-alpha.1 removed the `<dshHome>/.agent-presets` directory scan: a preset is',
-    '# now a `@deepseek-ai/dsh-agent-preset` ROW in a bundle patch, which is what this',
-    '# layer inserts. Because the BUNDLE registers it, `dsh plugin --profile <p> add',
-    '# dsh-molbio-tools` puts the mode in the picker with no copy step and no',
-    '# preset-root patch — see README「安装」.',
+    '# DSH 0.1.7-alpha.1 removed the `<dshHome>/.agent-presets` directory scan: a',
+    '# preset is now a `@deepseek-ai/dsh-agent-preset` ROW in a bundle patch, which',
+    '# is what this insert declares. Because the BUNDLE registers it,',
+    '# `dsh plugin --profile <p> add dsh-molbio-tools` puts the mode in the picker',
+    '# with no copy step and no preset-root patch — see README「安装」.',
     '#',
     '# `order: 5` is deliberate: the shipped presets occupy 1..4 (standard, ptc,',
     '# minimal, cordis) and the registry sorts by `order` with an id tie-break, so a',
@@ -76,7 +132,11 @@ export function buildPatch({ rows, description, displayName = 'Molecular Biology
   ].join('\n');
 
   return [
-    header,
+    HEADER,
+    '',
+    ANCHOR,
+    '',
+    presetHeader,
     '- insert:',
     '    - id: preset-molbio-lab',
     "      name: '@deepseek-ai/dsh-agent-preset'",
@@ -95,7 +155,7 @@ function main() {
   const check = process.argv.includes('--check');
   const sourcePath = join(repoRoot, 'preset', 'molbio-lab', 'agent.cordis.yml');
   const metaPath = join(repoRoot, 'preset', 'molbio-lab', 'preset.yml');
-  const outPath = join(repoRoot, 'preset', 'molbio-lab', 'preset.patch.yml');
+  const outPath = join(repoRoot, 'cordis.patch.yml');
 
   const rows = rowBlockOf(readFileSync(sourcePath, 'utf8'));
   if (rows === undefined || !rows.includes('- id:')) {
@@ -124,16 +184,16 @@ function main() {
       process.exit(1);
     }
     if (current !== text) {
-      console.error('preset-patch: the committed preset patch is STALE — run `node build/preset-patch.mjs`');
+      console.error('preset-patch: the committed bundle patch is STALE — run `node build/preset-patch.mjs`');
       process.exit(1);
     }
-    console.log('preset patch is current');
+    console.log('bundle patch is current');
     return;
   }
 
   writeFileSync(outPath, text, 'utf8');
-  const rows_ = rows.split('\n').filter((line) => /^\s*- id:/.test(line)).length;
-  console.log(`preset patch written: ${outPath} (${rows_} rows)`);
+  const rowCount = rows.split('\n').filter((line) => /^\s*- id:/.test(line)).length;
+  console.log(`bundle patch written: ${outPath} (${rowCount} preset rows + anchor)`);
 }
 
 if (process.argv[1] !== undefined && import.meta.url === pathToFileURLSafe(process.argv[1])) main();

package/build/release-preflight.mjs

@@ -201,7 +201,7 @@ export function tagVersion(tag) {
  * `rc.10 < rc.2`, so a release of `rc.2` after `rc.10` would look like a
  * DOWNGRADE and the gate would refuse a legitimate publish (or, in the other
  * direction, wave through a stale one). This repository does cut prereleases
- * (the harness baseline itself is `0.2.0-rc.2`), so the rule is implemented
+ * (the harness baseline itself is `0.2.1-rc.2`), so the rule is implemented
  * rather than approximated.
  *
  * Semver's rule: split on dots; numeric identifiers compare numerically and rank