dsh-ntr 0.3.1 → 0.3.3

package/src/client/index.tsx

@@ -13,13 +13,21 @@ import type {} from '@deepseek-ai/dsh-client-ui-layout/client'
 import type {} from '@deepseek-ai/dsh-client-ui-sidebar/client'
 import type {} from '@deepseek-ai/dsh-client-ui-settings/client'
 import type {} from '@deepseek-ai/dsh-client-ui-conversation/client'
+// The chat package's client types carry the SlotMap augmentation for
+// `conversation.chat.assistant-actions` (the branch entry's seat). Type-only:
+// erased at build, and the seat is owned by the host's chat module at runtime.
+import type {} from '@deepseek-ai/dsh-client-ui-chat/client'
 import { AcpStore, type RpcCall } from './store.ts'
 import { AcpSettingsSection } from './panel.tsx'
 import { AcpComposerMode } from './composer-mode.tsx'
+import { AcpContextMeter } from './context-meter.tsx'
 import { AcpComposerAgentTag, AcpSessionControls, AcpSessionMenu } from './session-controls.tsx'
 import { AcpConversationView } from './acp-view.tsx'
 import { AcpSettingsDialog } from './settings-dialog.tsx'
 import { PermissionDock } from './permission-dock.tsx'
+import { ReleasedBanner } from './released-banner.tsx'
+import { AcpBranchAction, resolveHostFork } from './branch-action.tsx'
+import { createActivityPillClaim, DOCK_SLOT } from './activity-pill.tsx'
 import {
   createModelSeatClaim,
   createPermissionSeatClaim,
@@ -28,9 +36,9 @@ import {
 } from './model-seat.tsx'
 import type { ModelSeatClaim, SeatSlots } from './model-seat.tsx'
 import {
-  acpModeFromPresetEvent, rowAgentPreset, stagedIsAcpMode, stagedSessionOf,
+  acpModeFromPresetEvent, ACP_PRESET_ID, rowAgentPreset, stagedIsAcpMode, stagedSessionOf,
 } from './acp-ui.tsx'
-import type { AcpChatInjected, AcpSessionFace, AcpSessionsSnapshot, SessionListSource } from './acp-ui.tsx'
+import type { AcpChatInjected, AcpHostForkFace, AcpSessionFace, AcpSessionsSnapshot, SessionListSource } from './acp-ui.tsx'
 import { createSlashIsolation, slashAcpVerdict } from './slash-isolation.ts'
 import type { SlashSource } from './slash-isolation.ts'
 
@@ -58,11 +66,78 @@ interface StructuralServices {
     binding(sessionId: string): { session?: unknown } | undefined
     /** The client runtime's session list store (see `AcpSessionsSnapshot`). */
     list?: SessionListSource
+    /**
+     * The runtime's own branching primitive (`forkAt`'s engine): forks the DSH
+     * session tree at the latest completed turn and resolves the child id.
+     * Read structurally and used under try/catch — an absent `fork` is the
+     * branch button's `hostUnavailable` state, never a load failure.
+     */
+    fork?: (options: { sessionId: string; increaseTitle?: boolean }) => Promise<unknown>
+  }
+  /**
+   * The renderer's Session scope adapter (`uiSession.adapter`). Its `current`
+   * observable is the host's own selection — the session the composer is
+   * actually staged on — while the list can retain more than one row in a
+   * multi-view layout. Read structurally and used under try/catch: a host
+   * without it falls back to the list's main-view scan.
+   */
+  uiSession: {
+    adapter?: {
+      current?: {
+        getSnapshot(): { key?: unknown } | undefined
+        subscribe?(listener: () => void): () => void
+      }
+    }
+  }
+  /**
+   * The shell workspace service (`ctx.get("uiWorkspace")`): `openSession`
+   * focuses a session in the main view — the branch click's final step.
+   */
+  uiWorkspace: {
+    openSession?(sessionId: string): void
   }
 }
 
 const browserPrefersZh = typeof navigator !== 'undefined' && /^zh\b/i.test(navigator.language)
 
+/**
+ * The NTR scope marker (`html[data-ntr-acp]`): the ONLY hook the message-action
+ * hiding CSS keys on, so the host's like / dislike / branch icons disappear in
+ * exactly the conversations this gate has confirmed to run the ACP preset —
+ * and reappear the moment the evidence stops answering (every `standDown`
+ * clears it; non-ACP sessions never see it). Idempotent per call.
+ */
+const setScopeMarker = (active: boolean): void => {
+  if (typeof document === 'undefined') return
+  document.documentElement.toggleAttribute('data-ntr-acp', active)
+}
+
+/**
+ * One-shot sanity probe for the aria-label hiding: the host's action buttons
+ * carry LOCALIZED labels and no data-* hook, so a copy change (or a third
+ * language) silently un-hides them while everything else keeps working. Once
+ * the marker is on and a turn tail is actually on screen, check that at least
+ * one label the rules key on still exists and leave one console line for
+ * whoever debugs "the icons came back" — dev-visible, never user UI.
+ */
+let probedHostLabels = false
+const probeHostActionLabels = (): void => {
+  if (probedHostLabels || typeof document === 'undefined') return
+  // No turn tail rendered yet: the check would answer from nothing, so leave
+  // the probe armed for the next activation instead of burning it once.
+  if (document.querySelector('[data-turn-tail]') === null) return
+  probedHostLabels = true
+  const found = document.querySelector([
+    'button:not([data-ntr-branch])[aria-label="在新对话中分支"]',
+    'button:not([data-ntr-branch])[aria-label="Branch into a new conversation"]',
+    'button[aria-label="好的回答"]',
+    'button[aria-label="Good response"]',
+  ].join(', '))
+  if (found === null) {
+    console.warn('[dsh-ntr] none of the host message-action labels matched; the like/dislike/branch icons may not be hidden in NTR conversations')
+  }
+}
+
 /**
  * Structural view of the shell's locale service (`@deepseek-ai/dsh-client-locale`).
  *
@@ -160,11 +235,36 @@ export function apply(ctx: Context): void {
     }
   }
 
+  /**
+   * The runtime's `sessions.fork`, resolved per call: `undefined` renders the
+   * branch button disabled (`hostUnavailable`) instead of hiding it, so a
+   * host that gains the primitive later is picked up on the next render.
+   */
+  const hostFork = (): AcpHostForkFace | undefined => {
+    try {
+      return resolveHostFork(service<StructuralServices['sessions']>('sessions'))
+    } catch {
+      return undefined
+    }
+  }
+
+  /** Focus a session in the workspace (the branch click's last step). */
+  const openSession = (sessionId: string): void => {
+    try {
+      service<StructuralServices['uiWorkspace']>('uiWorkspace')?.openSession?.(sessionId)
+    } catch {
+      // Opening is presentation; a host without the workspace service leaves
+      // the branched session in the sidebar list, reachable by hand.
+    }
+  }
+
   /** The injected face every ACP conversation entry receives. */
   const chatFace = (sessionId: unknown): AcpChatInjected & { sessionId: string } => ({
     acp: store,
     sessionId: String(sessionId),
     faceFor,
+    hostFork,
+    openSession,
   })
 
   ctx.effect(() => ctx.slots.inject('settings.section', () => ctx.slots.register({
@@ -207,6 +307,13 @@ export function apply(ctx: Context): void {
     // (see the note there). Runtime passes the real shares either way.
   }, AcpComposerMode as unknown as SlotComponent<any>)), 'dsh-ntr: composer agent-mode control')
 
+  // The agent's OWN context occupancy in the composer's bottom info row
+  // (`conversation.composer.dock` — the dock below the input card where the
+  // host renders its native ContextMeter) is installed by the ACP-mode gate
+  // below, with the same lifetime as the NTR view tab and the seats. It is
+  // NOT registered unconditionally: in an ordinary conversation this row must
+  // hold the host's native meter and nothing of ours (see `holdAuxEntries`).
+
   // Its picker rides the composer's overlay seat — the platform's home for
   // menus, so the popup floats above the card instead of being clipped by it.
   ctx.effect(() => ctx.slots.inject('conversation.input.overlay', () => ctx.slots.register({
@@ -248,6 +355,34 @@ export function apply(ctx: Context): void {
     inject: (sessionId: unknown) => chatFace(sessionId),
   }, PermissionDock as unknown as SlotComponent<any>)), 'dsh-ntr: conversation permission dock')
 
+  // The released-session banner in the same dock seat: when this
+  // conversation's agent process is parked (idle release or crash), one row
+  // says so and offers the explicit resume — the gesture form of the
+  // "next message resumes it" promise. Gated inside the component on the
+  // chat-list rows (released banner renders iff nothing live is left).
+  ctx.effect(() => ctx.slots.inject('conversation.input.dock', () => ctx.slots.register({
+    name: 'conversation.input.dock',
+    id: 'acp-released-banner',
+    order: 20,
+    inject: (sessionId: unknown) => chatFace(sessionId),
+  }, ReleasedBanner as unknown as SlotComponent<any>)), 'dsh-ntr: released-session banner')
+
+  // The NTR branch entry riding the host's own assistant-actions row
+  // (`conversation.chat.assistant-actions` — list, session scope; the
+  // positional inject argument is the chat session id, like every other
+  // session slot). Registered for EVERY conversation; the component gates
+  // itself on the confirmed ACP verdict (non-ACP renders nothing), and the
+  // `data-ntr-branch` attribute it stamps is the CSS pass that keeps the
+  // hiding rules from swallowing the plugin's own button (same aria-label as
+  // the host's). Order 20 puts it after the (hidden) feedback entry's 10 —
+  // visually the spot the host's own branch button occupied.
+  ctx.effect(() => ctx.slots.inject('conversation.chat.assistant-actions', () => ctx.slots.register({
+    name: 'conversation.chat.assistant-actions',
+    id: 'ntr-branch',
+    order: 20,
+    inject: (sessionId: unknown) => chatFace(sessionId),
+  }, AcpBranchAction as unknown as SlotComponent<any>)), 'dsh-ntr: message branch action')
+
   /**
    * The client runtime's session list store, read structurally. Used to find
    * the session the composer is staged on and whether it runs the ACP preset —
@@ -259,6 +394,30 @@ export function apply(ctx: Context): void {
     return list
   }
 
+  /**
+   * The renderer's current Session scope observable, when this host exposes it.
+   * This is the source the host's own main-view picker prefers; the list's
+   * retained rows are only the fallback for hosts without the adapter.
+   */
+  const currentScopeSource = (): NonNullable<StructuralServices['uiSession']['adapter']>['current'] => {
+    try {
+      const current = service<StructuralServices['uiSession']>('uiSession')?.adapter?.current
+      return current !== undefined && typeof current.getSnapshot === 'function' ? current : undefined
+    } catch {
+      return undefined
+    }
+  }
+
+  /** The session the composer is actually staged on, if the runtime can say. */
+  const currentScopeSessionId = (): string | undefined => {
+    try {
+      const key = currentScopeSource()?.getSnapshot?.()?.key
+      return typeof key === 'string' && key !== '' ? key : undefined
+    } catch {
+      return undefined
+    }
+  }
+
   /**
    * Chat session ids the ACP-mode tracker has already asked the host about (the
    * `session/chat-list` fallback), mapped to WHEN the last ask went out. The
@@ -286,6 +445,8 @@ export function apply(ctx: Context): void {
 
   ctx.effect(() => {
     let stopWatch: (() => void) | undefined
+    /** Subscription to the renderer's current Session binding (see `currentScopeSource`). */
+    let stopCurrent: (() => void) | undefined
     /**
      * The claim on the host's model seat, held while the staged conversation
      * runs the ACP preset. That cell is where the host's own base sits (the
@@ -321,6 +482,72 @@ export function apply(ctx: Context): void {
      * available yet.
      */
     let permissionClaim: ModelSeatClaim | undefined
+    /**
+     * Claim on the dock's `activity` cell (`conversation.composer.dock`, id
+     * `activity`), held for the same ACP-mode spell as the two seats. The
+     * occupant renders the HOST's ActivityPill with the plugin's burst speed
+     * patched into its `sessionStats`; it is a list cell, so the claim is
+     * identified by id rather than by the slot's heads[0]. If the host shape is
+     * not one this bundle knows, no claim is created and the native pill stays.
+     */
+    let activityClaim: ModelSeatClaim | undefined
+    let activityDiag = 'idle'
+    const noteActivityDiag = (line: string): void => {
+      if (line === activityDiag) return
+      activityDiag = line
+      // Success and the ordinary older-host "no activity entry" are silent; a
+      // shape mismatch or a lost registration must leave a breadcrumb. The ACP
+      // view has no line for this surface, and a missing speed fix is otherwise
+      // invisible.
+      if (!/failed|missing|taken|gave up|still held/.test(line)) return
+      console.warn(`[dsh-ntr] ${line}`)
+    }
+    /**
+     * ACP-only auxiliary entries: the NTR view tab and the composer's context
+     * ring. Unlike the two seats these are `list` slots with no visibility
+     * predicate of their own, so "self-hide in the component" cannot remove a
+     * tab from the header or free the native bottom row. They are installed by
+     * this gate for exactly the same lifetime as the claims and disposed on
+     * every stand-down — a standard conversation then has no NTR tab at all,
+     * and the host's native context meter sits alone in its dock row.
+     */
+    let viewEntry: (() => void) | undefined
+    let meterEntry: (() => void) | undefined
+    const releaseAuxEntries = (): void => {
+      try { viewEntry?.() } catch {}
+      viewEntry = undefined
+      try { meterEntry?.() } catch {}
+      meterEntry = undefined
+    }
+    const holdAuxEntries = (): void => {
+      // A refused registration leaves the native surface in place (fail-open);
+      // the next evaluation retries when the slot is declared.
+      if (viewEntry === undefined) {
+        try {
+          viewEntry = ctx.slots.inject('conversation.view', () => ctx.slots.register({
+            name: 'conversation.view',
+            id: 'acp',
+            order: 20,
+            label: () => label('NTR', 'NTR'),
+            inject: (sessionId: unknown) => chatFace(sessionId),
+          }, AcpConversationView as unknown as SlotComponent<any>))
+        } catch {
+          viewEntry = undefined
+        }
+      }
+      if (meterEntry === undefined) {
+        try {
+          meterEntry = ctx.slots.inject('conversation.composer.dock', () => ctx.slots.register({
+            name: 'conversation.composer.dock',
+            id: 'acp-context-meter',
+            order: 10,
+            inject: (sessionId: unknown) => chatFace(sessionId),
+          }, AcpContextMeter as unknown as SlotComponent<any>))
+        } catch {
+          meterEntry = undefined
+        }
+      }
+    }
     /**
      * Last diagnostic line from {@link syncAcpMode}. Every way this gate can
      * end with the native seat still on screen used to be silent — an inner
@@ -333,7 +560,8 @@ export function apply(ctx: Context): void {
     let seatDiag = 'idle'
     let permissionSeatDiag = 'idle'
     /**
-     * Hand BOTH cells back to their shipped occupants.
+     * Hand every ACP-only surface back: both composer cells, the NTR view tab
+     * and the context ring.
      *
      * Every path that is not "this staged conversation is CONFIRMED to run the
      * ACP preset" ends here — including the paths that carry no verdict at all
@@ -355,8 +583,11 @@ export function apply(ctx: Context): void {
       // read identically in the one place either is observable.
       permissionSeatDiag = `${reason} (released)`
       disarmVerdictReask()
+      setScopeMarker(false)
+      releaseAuxEntries()
       if (claim !== undefined) { claim.release(); claim = undefined }
       if (permissionClaim !== undefined) { permissionClaim.release(); permissionClaim = undefined }
+      if (activityClaim !== undefined) { activityClaim.release(); activityClaim = undefined }
     }
     /**
      * Re-ask timer for the staged session, armed while the row is silent and a
@@ -388,7 +619,13 @@ export function apply(ctx: Context): void {
         standDown('no session list service')
         return
       }
-      const staged = stagedSessionOf(snapshot)
+      // Prefer the renderer's own current selection; the list's retained rows
+      // are the fallback for hosts without the scope adapter. A multi-view
+      // layout can leave several rows retained, and judging the first one (or
+      // the one the previous switch left behind) would hold the ACP chrome
+      // while an ordinary conversation is on screen — the reported drift.
+      const current = currentScopeSessionId()
+      const staged = stagedSessionOf(snapshot, current)
       if (staged === undefined) {
         standDown('no staged session (nothing retains the main view)')
         return
@@ -444,13 +681,23 @@ export function apply(ctx: Context): void {
       // nothing. Both cells follow the same evidence — the staged
       // conversation's preset — through one {@link standDown}, so neither can
       // stay claimed after the evidence for it stops answering.
-      if (!stagedIsAcpMode(snapshot, acpModeVerdict)) {
+      if (!stagedIsAcpMode(snapshot, acpModeVerdict, current)) {
+        // The row's own verdict is authoritative even when it says no: fold it
+        // into the store so every per-conversation surface (the branch
+        // button's ACP gate included) stops rendering without waiting for a
+        // host read. A silent row folds nothing — that case is the ask path's.
+        if (rowAgentPreset(staged.row) !== undefined) store.noteAcpMode(staged.sessionId, false)
         standDown(`staged ${staged.sessionId} is not in ACP mode`)
         return
       }
       // The row speaks, so the host verdict is not this gate's only fact
-      // source and no re-ask timer is needed.
-      if (rowAgentPreset(staged.row) !== undefined) disarmVerdictReask()
+      // source and no re-ask timer is needed. The same fold in the affirmative
+      // direction: the runtime row IS the preset truth, and the branch
+      // button's gate reads the folded map, not the snapshot.
+      if (rowAgentPreset(staged.row) !== undefined) {
+        store.noteAcpMode(staged.sessionId, rowAgentPreset(staged.row) === ACP_PRESET_ID)
+        disarmVerdictReask()
+      }
       // Stays re-runnable on purpose: the seat is not declared before the
       // composer bar mounts, a registration can be refused, and the cell can be
       // taken from us later. The claim reports each of those through the
@@ -458,6 +705,8 @@ export function apply(ctx: Context): void {
       // next evaluation (store mutation, list notification, preset frame, or a
       // change to the cell itself) simply tries again.
       seatDiag = `staged ${staged.sessionId} is ACP mode`
+      setScopeMarker(true)
+      probeHostActionLabels()
       claim ??= createModelSeatClaim({
         slots: ctx.slots as unknown as SeatSlots,
         occupant: () => AcpSessionControls,
@@ -478,6 +727,21 @@ export function apply(ctx: Context): void {
         onDiag: (line) => { permissionSeatDiag = `staged ${staged.sessionId} · ${line}` },
       })
       permissionClaim.sync()
+      // The dock's activity pill is a list CELL, not a whole slot: this claim
+      // shadows the shipped `activity` entry by id and renders it back with the
+      // plugin's burst speed. No host entry / inject / locale -> undefined and
+      // the native pill is untouched; the next evaluation retries.
+      activityClaim ??= createActivityPillClaim({
+        slots: ctx.slots as unknown as SeatSlots,
+        inject: (sessionId: unknown) => chatFace(sessionId),
+        onDiag: noteActivityDiag,
+      })
+      activityClaim?.sync()
+      // The tab and the occupancy ring have the same lifetime as the claims:
+      // they exist only while this staged conversation is an ACP one, and a
+      // stand-down disposes them (a standard conversation must not see an NTR
+      // tab, and the host's native bottom row must stand alone there).
+      holdAuxEntries()
       // Confirmed ACP on a silent row: the verdict is all the evidence there
       // is, so it gets a re-ask deadline (see {@link ACP_MODE_VERDICT_TTL_MS}).
       if (rowAgentPreset(staged.row) === undefined) armVerdictReask()
@@ -531,6 +795,18 @@ export function apply(ctx: Context): void {
     const attach = (): void => {
       const list = sessionsList()
       if (list !== undefined && stopWatch === undefined) stopWatch = list.subscribe(runGate)
+      // The selection can move without the list changing (a tab or sidebar
+      // click), and `uiSession.current` is the host's own answer to "which
+      // conversation is on screen". Re-run the gate on that transition so the
+      // ACP chrome leaves before the newly staged ordinary conversation paints.
+      const current = currentScopeSource()
+      if (current?.subscribe !== undefined && stopCurrent === undefined) {
+        try {
+          stopCurrent = current.subscribe(runGate)
+        } catch {
+          stopCurrent = undefined
+        }
+      }
       attachPresetFrames()
       runGate()
     }
@@ -581,7 +857,7 @@ export function apply(ctx: Context): void {
     // retakes the cell only when it is actually holding something that is not
     // ours — so this is evidence-driven, not a poll.
     const stopCell = ctx.on('slots/changed', (...args: unknown[]) => {
-      if (args[0] !== MODEL_SEAT_KEY && args[0] !== PERMISSION_SEAT_KEY) return
+      if (args[0] !== MODEL_SEAT_KEY && args[0] !== PERMISSION_SEAT_KEY && args[0] !== DOCK_SLOT) return
       runGate()
     })
     // Late services: the runtime's session list normally exists before this
@@ -594,9 +870,15 @@ export function apply(ctx: Context): void {
       stopCell()
       stopPreset?.()
       stopWatch?.()
+      stopCurrent?.()
       disarmVerdictReask()
+      // The scope marker dies with the gate: a reload (HMR) must not leave the
+      // hiding CSS pointed at conversations nothing confirms anymore.
+      setScopeMarker(false)
+      releaseAuxEntries()
       if (claim !== undefined) { claim.release(); claim = undefined }
       if (permissionClaim !== undefined) { permissionClaim.release(); permissionClaim = undefined }
+      if (activityClaim !== undefined) { activityClaim.release(); activityClaim = undefined }
       store.noteSeatDiag('gate disposed')
       store.notePermissionSeatDiag('gate disposed')
     }
@@ -636,12 +918,14 @@ export function apply(ctx: Context): void {
         sessionsList()?.getSnapshot(),
         sessionId,
         id => store.getSnapshot().acpMode[id],
+        currentScopeSessionId(),
       ),
       ensureVerdict: async (sessionId) => {
         const held = (): boolean | undefined => slashAcpVerdict(
           sessionsList()?.getSnapshot(),
           sessionId,
           id => store.getSnapshot().acpMode[id],
+          currentScopeSessionId(),
         )
         const known = held()
         if (known !== undefined) return known
@@ -724,11 +1008,10 @@ export function apply(ctx: Context): void {
   // diffs). Session-scope list entry; the view ring renders it one tab at a
   // time. Meanwhile the agent's prose and thinking ride the NATIVE chat plane
   // through the LLM adapter — see docs/acp-convergence.md §2.1.
-  ctx.effect(() => ctx.slots.inject('conversation.view', () => ctx.slots.register({
-    name: 'conversation.view',
-    id: 'acp',
-    order: 20,
-    label: () => 'NTR',
-    inject: (sessionId: unknown) => chatFace(sessionId),
-  }, AcpConversationView as unknown as SlotComponent<any>)), 'dsh-ntr: ACP view tab')
+  //
+  // It is installed by the ACP-mode gate above (`holdAuxEntries`) and NOT at
+  // plugin load: the host projects every registered `conversation.view` entry
+  // into EVERY session's tab strip, so an unconditional registration showed
+  // the NTR tab on ordinary conversations too. The gate's lifetime is the
+  // only per-session seam the host offers.
 }

package/src/client/model-seat.tsx

@@ -128,7 +128,11 @@ export const MAX_SEAT_CLAIMS = 4
 /** One live entry in the cell, narrowed to what the claim reads. */
 export interface SeatEntry {
   component?: unknown
-  options?: { priority?: number; registrant?: string }
+  options?: { priority?: number; registrant?: string; id?: string; order?: number }
+  /** Entry-owned inject face; needed when the claim reuses a shipped occupant. */
+  inject?: (...args: unknown[]) => unknown
+  /** Locale namespace the occupant's `t` is bound to; needed for the same reuse. */
+  locale?: string
 }
 
 /** The slot-registry face this module uses (structural: the registry is not a dependency of this bundle). */
@@ -148,6 +152,12 @@ export interface SeatSlots {
  */
 export interface SeatRegisterOptions {
   name: string
+  /** List-slot cell to shadow; omitted for single/keyed registers. */
+  id?: string
+  /** Display position within the list; only meaningful with `id`. */
+  order?: number
+  /** Locale namespace the occupant's `t` is bound to. */
+  locale?: string
   priority?: number
   /**
    * The session-scoped face factory the renderer calls with the scope binding's
@@ -227,6 +237,15 @@ export interface PermissionSeatClaimOptions {
 export interface SeatClaimOptions {
   slots: SeatSlots
   slotKey: string
+  /**
+   * List-slot cell id to hold. Omitted for single/keyed seats; a list slot
+   * needs it because its winner view is one entry PER id, not one per slot.
+   */
+  entryId?: string
+  /** Display order for the installed list entry (same cell, so usually the shipped order). */
+  order?: number
+  /** Locale namespace the installed occupant resolves `t` against. */
+  locale?: string
   basePriority: number
   occupant(): unknown
   inject?(sessionId: unknown, actions?: unknown): unknown
@@ -265,7 +284,7 @@ interface CellView {
  * `entriesOfSlot` and performing bounded retakes if displaced by later registrations.
  */
 export function createSeatClaim(options: SeatClaimOptions): ModelSeatClaim {
-  const { slots, slotKey, basePriority, occupant, inject } = options
+  const { slots, slotKey, basePriority, occupant, inject, entryId } = options
   const label = options.label ?? slotKey
   const onDiag = options.onDiag
   const maxClaims = options.maxClaims ?? MAX_SEAT_CLAIMS
@@ -293,7 +312,10 @@ export function createSeatClaim(options: SeatClaimOptions): ModelSeatClaim {
     if (typeof slots.entriesOfSlot !== 'function') return { declared: isDeclared, verified: false }
     try {
       const heads = slots.entriesOfSlot(slotKey) ?? []
-      return { declared: isDeclared, verified: true, ...heads[0] === undefined ? {} : { entry: heads[0] } }
+      // A list slot projects one winner per id, so the cell this claim owns is
+      // the head WITH that id — not heads[0], which may be a sibling cell.
+      const entry = entryId === undefined ? heads[0] : heads.find(head => head.options?.id === entryId)
+      return { declared: isDeclared, verified: true, ...entry === undefined ? {} : { entry } }
     } catch {
       return { declared: isDeclared, verified: false }
     }
@@ -312,6 +334,9 @@ export function createSeatClaim(options: SeatClaimOptions): ModelSeatClaim {
     try {
       installed.push(slots.inject(slotKey, () => slots.register({
         name: slotKey,
+        ...(entryId === undefined ? {} : { id: entryId }),
+        ...(options.order === undefined ? {} : { order: options.order }),
+        ...(options.locale === undefined ? {} : { locale: options.locale }),
         priority: rank,
         ...(inject ? { inject } : {}),
       }, component)))