dsh-plugin-shop 0.5.2 → 0.5.3-beta.0

package/lib/client.js

@@ -4363,7 +4363,14 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 				literal(false),
 				literal(true)
 			]).optional(),
-			"restartReason": union([_undefined(), string()]).optional(),
+			"restartReason": union([
+				_undefined(),
+				literal("no-patch"),
+				literal("not-simple"),
+				literal("host-unsupported"),
+				literal("timeout"),
+				literal("mount-failed")
+			]).optional(),
 			"detail": union([_undefined(), string()]).optional()
 		});
 		const dsh_plugin_shop_shop_restart_result$schema = union([object({ "ok": literal(true) }), object({
@@ -4427,7 +4434,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 468,
+						"line": 521,
 						"column": 9
 					}
 				},
@@ -4445,7 +4452,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 618,
+						"line": 677,
 						"column": 9
 					}
 				},
@@ -4473,7 +4480,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 494,
+						"line": 547,
 						"column": 9
 					}
 				},
@@ -4500,7 +4507,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 607,
+						"line": 666,
 						"column": 3
 					}
 				},
@@ -4518,7 +4525,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 742,
+						"line": 827,
 						"column": 9
 					}
 				},
@@ -4545,7 +4552,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 421,
+						"line": 442,
 						"column": 9
 					}
 				},
@@ -4573,7 +4580,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 689,
+						"line": 769,
 						"column": 9
 					}
 				},
@@ -4600,7 +4607,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 802,
+						"line": 887,
 						"column": 9
 					}
 				},
@@ -4618,7 +4625,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					},
 					sourceLocation: {
 						"file": "packages/dsh-plugin-shop/src/host/index.ts",
-						"line": 786,
+						"line": 871,
 						"column": 9
 					}
 				}
@@ -4626,6 +4633,19 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 		};
 		//#endregion
 		//#region src/client/present.ts
+		/** Hot-mount reason code → locale key, so the notice reads in the language
+		* the person set in dsh. An absent (or unrecognized) reason keeps the generic
+		* restart line rather than showing a bare code. */
+		function restartReasonKey(reason) {
+			switch (reason) {
+				case "no-patch": return "hotNoPatchNotice";
+				case "not-simple": return "hotNotSimpleNotice";
+				case "host-unsupported": return "hotHostUnsupportedNotice";
+				case "timeout": return "hotTimeoutNotice";
+				case "mount-failed": return "hotMountFailedNotice";
+				default: return "installedRestartNotice";
+			}
+		}
 		/** Tier → locale key, for the entry-card tier badge (§6.2). */
 		function tierKey(tier) {
 			switch (tier) {
@@ -4845,6 +4865,11 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			acknowledgementBody: ACKNOWLEDGEMENT_ZH,
 			installing: "正在安装…",
 			installedRestartNotice: "已安装；重启 dsh 后生效",
+			hotNoPatchNotice: "该插件没有可热挂载的补丁文件；重启 dsh 后生效",
+			hotNotSimpleNotice: "该插件的补丁包含无法热挂载的配置；重启 dsh 后生效",
+			hotHostUnsupportedNotice: "当前环境不支持热挂载；重启 dsh 后生效",
+			hotTimeoutNotice: "热挂载超时；重启 dsh 后生效",
+			hotMountFailedNotice: "热挂载失败；重启 dsh 后生效",
 			installedNoRestartNotice: "已安装，但 profile 未变化——目录可能已过期，请刷新后重试",
 			installFailed: "安装失败",
 			installTransportFailed: "安装请求未能送达。请稍后重试。",
@@ -4922,6 +4947,11 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			acknowledgementBody: ACKNOWLEDGEMENT_EN,
 			installing: "Installing…",
 			installedRestartNotice: "installed; restart dsh to activate",
+			hotNoPatchNotice: "no patch file to hot-mount; restart dsh to activate",
+			hotNotSimpleNotice: "the patch has config rows that cannot be hot-mounted; restart dsh to activate",
+			hotHostUnsupportedNotice: "this harness cannot hot-mount; restart dsh to activate",
+			hotTimeoutNotice: "hot-mount timed out; restart dsh to activate",
+			hotMountFailedNotice: "hot-mount failed; restart dsh to activate",
 			installedNoRestartNotice: "installed, but the profile did not change — the catalog may be stale; refresh and try again",
 			installFailed: "Install failed",
 			installTransportFailed: "The install request could not be delivered. Please retry.",
@@ -5430,7 +5460,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 						className: _dsh_plugin_shop_css_e3675a89_default.notice,
 						"data-shop-restart-notice": true,
-						children: view.needsRestart ? view.restartReason ?? t("installedRestartNotice") : t("installedNoRestartNotice")
+						children: view.needsRestart ? t(restartReasonKey(view.restartReason)) : t("installedNoRestartNotice")
 					}),
 					view.needsRestart && restartSupported && /* @__PURE__ */ (0, react_jsx_runtime.jsx)(RestartPanel, {
 						t,

package/lib/index.js

@@ -5,9 +5,9 @@ import { createHash, randomUUID } from "node:crypto";
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { basename, dirname, join } from "node:path";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { z } from "zod";
-import { dump } from "js-yaml";
+import { JSON_SCHEMA, Type, dump, load } from "js-yaml";
 //#region src/own-version.ts
 /** The shop's own published version, read from the package.json that ships
 * next to this package — the RUNNING version, not the manifest's range
@@ -432,7 +432,7 @@ function spawnPluginCli(options) {
 							restartReason = outcome?.restartReason;
 						} catch {
 							needsRestartOnDone = true;
-							restartReason = "热挂载失败,重启后生效 / hot-mount failed — restart required";
+							restartReason = "mount-failed";
 						}
 						state = "done";
 					} else state = "done";
@@ -504,13 +504,26 @@ function startUninstall(options) {
 * tree changes back to the file it read (dsh-market hot.ts; the in-tree
 * precedent is dsh's agent-presets PresetTree).
 *
+* Reasons are CODES, never copy: the host has no idea which language the
+* person reading it set in dsh, so it names what happened and the client
+* renders it through dsh's own locale service.
+*
 * Deliberate non-port: dsh-market's client-only shim (`mountClientOnlyDeps`
 * and `shimNames`, which hot-mounted a package with no server-side entry by
 * inserting a shim loader entry) is omitted. Our catalog never lists a
 * package without `dsh.bundle`, so the shim branch is unreachable here
 * (YAGNI). `hotMount` still distinguishes "no patch file / not
-* hot-mountable" from "restart will fix it" through the bilingual `reason`.
+* hot-mountable" from "restart will fix it" through the `reason` code.
 */
+/** The loader's YAML dialect: `!!js` scalars round-trip as expression nodes
+* rather than throwing, so a patch carrying one is refused for its SHAPE
+* (below) instead of being indistinguishable from malformed YAML. Nothing is
+* evaluated here — the loader evaluates at entry activation. */
+const PATCH_SCHEMA = JSON_SCHEMA.extend(new Type("tag:yaml.org,2002:js", {
+	kind: "scalar",
+	resolve: () => true,
+	construct: (data) => ({ __jsExpr: data })
+}));
 const nodeFs = {
 	read: (path) => readFileSync(path, "utf8"),
 	write: (path, data) => {
@@ -528,52 +541,43 @@ const HOT_DIR = ".dsh-shop";
 /** `hot-<n>.yml` files: the only things `cleanHotDir` wipes and the only
 * files `hotMount` writes. */
 const HOT_FILE_RE = /^hot-(\d+)\.yml$/;
-/** Reasons, bilingual, distinguishing the P0-2 categories: a transient mount
-* failure ("restart will fix it") versus a package that structurally cannot
-* hot-mount. All tell the user to restart; the head names which category. */
-const NO_PATCH_REASON = "该插件没有可热挂载的补丁文件,重启后生效 / the plugin has no patch file to hot-mount — restart required";
-const NOT_SIMPLE_REASON = "该插件的补丁包含无法热挂载的配置,重启后生效 / the plugin's patch has config rows that cannot be hot-mounted — restart required";
-const HOST_CANNOT_HOT_MOUNT_REASON = "当前环境不支持热挂载,重启后生效 / this harness cannot hot-mount — restart required";
-const TIMEOUT_REASON = "热挂载超时,重启后生效 / hot-mount timed out — restart required";
-const MOUNT_FAILED_REASON = "热挂载失败,重启后生效 / hot-mount failed — restart required";
-const ID_LINE_RE = /^- id: (.+)$/;
-const NAME_LINE_RE = /^  name: (.+)$/;
 /**
 * Parse a bundle patch into the plain insert rows a hot tree can replicate.
-* Only `- id:` / `name:` pairs parse — a row with config, an expression
-* name, or a dangling id returns null, and the caller falls back to restart
-* activation. CRLF-aware: a patch authored with Windows line endings must
-* not read as "contains config rows" (the Windows-patch regression their
-* hot.ts documents). Pure: string in, rows out.
+*
+* Only an `insert` list of plain `id`/`name` entries parses. A bare id-keyed
+* row is a TARGETING patch — the loader looks the id up in the already
+* composed tree and skips it when absent (applyEntryPatches), so it creates
+* nothing and there is nothing to replicate. A row carrying config, a group,
+* or an `!!js` expression name returns null too, and every null sends the
+* caller to restart activation. Parsed as YAML in the loader's own dialect,
+* so line endings and comments are the parser's problem, not ours, and
+* nothing in the patch is evaluated. Pure: string in, rows out.
 */
 function parseSimplePatch(patchText) {
-	const lines = patchText.split(/\r?\n/);
+	let parsed;
+	try {
+		parsed = load(patchText, { schema: PATCH_SCHEMA });
+	} catch {
+		return null;
+	}
+	if (!Array.isArray(parsed)) return null;
 	const rows = [];
-	for (let i = 0; i < lines.length; i++) {
-		const raw = lines[i] ?? "";
-		if (raw.trim() === "" || raw.trim().startsWith("#")) continue;
-		const idMatch = ID_LINE_RE.exec(raw);
-		if (idMatch === null) return null;
-		const id = idMatch[1];
-		if (id === void 0) return null;
-		let name;
-		while (i + 1 < lines.length) {
-			i++;
-			const next = lines[i] ?? "";
-			if (next === "" || next.trim().startsWith("#")) continue;
-			const nameMatch = NAME_LINE_RE.exec(next);
-			if (nameMatch === null) return null;
-			const value = nameMatch[1];
-			if (value === void 0) return null;
-			if (value.includes("!!js/expression")) return null;
-			name = value;
-			break;
+	for (const patch of parsed) {
+		if (patch === null || typeof patch !== "object" || Array.isArray(patch)) return null;
+		const keys = Object.keys(patch);
+		if (keys.length !== 1 || keys[0] !== "insert") return null;
+		const inserted = patch.insert;
+		if (!Array.isArray(inserted)) return null;
+		for (const item of inserted) {
+			if (item === null || typeof item !== "object" || Array.isArray(item)) return null;
+			const { id, name } = item;
+			if (typeof id !== "string" || typeof name !== "string") return null;
+			if (Object.keys(item).some((key) => key !== "id" && key !== "name")) return null;
+			rows.push({
+				id,
+				name
+			});
 		}
-		if (name === void 0) return null;
-		rows.push({
-			id,
-			name
-		});
 	}
 	return rows.length > 0 ? rows : null;
 }
@@ -637,7 +641,7 @@ function suppressWrite(treeClass) {
 * Include subtree: read its bundle patch, replicate the simple rows under
 * `mkt-` ids into `<profile>/.dsh-shop/hot-<n>.yml`, register the tree, and
 * race its activation against `timeoutMs`. Success returns `ok: true` with
-* no reason; any fallback returns `ok: false` with a bilingual reason
+* no reason; any fallback returns `ok: false` with a reason code
 * distinguishing "restart will fix it" (timeout, activation failure,
 * unavailable include) from "this package can never hot-mount" (no patch
 * file, or rows the hot tree cannot replicate). The plugin is installed in
@@ -654,7 +658,7 @@ async function hotMount(ctx, profileDir, packageName, deps = {}) {
 		ctx.logger?.warn(`hot-mount ${packageName}: no patch file to mount — restart will activate it`);
 		return {
 			ok: false,
-			reason: NO_PATCH_REASON
+			reason: "no-patch"
 		};
 	}
 	const rows = parseSimplePatch(patchText);
@@ -662,7 +666,7 @@ async function hotMount(ctx, profileDir, packageName, deps = {}) {
 		ctx.logger?.warn(`hot-mount ${packageName}: patch has rows that cannot be hot-mounted — restart will activate it`);
 		return {
 			ok: false,
-			reason: NOT_SIMPLE_REASON
+			reason: "not-simple"
 		};
 	}
 	let treeClass = deps.hotTreeClass;
@@ -671,7 +675,7 @@ async function hotMount(ctx, profileDir, packageName, deps = {}) {
 		ctx.logger?.warn(`hot-mount ${packageName}: the include plugin is unavailable in this harness — restart will activate it`);
 		return {
 			ok: false,
-			reason: HOST_CANNOT_HOT_MOUNT_REASON
+			reason: "host-unsupported"
 		};
 	}
 	const file = join(dir, `hot-${nextHotNumber(fs, dir)}.yml`);
@@ -684,7 +688,7 @@ async function hotMount(ctx, profileDir, packageName, deps = {}) {
 		ctx.logger?.warn(`hot-mount ${packageName}: mounting the include tree failed — restart will activate it (${String(error)})`);
 		return {
 			ok: false,
-			reason: MOUNT_FAILED_REASON
+			reason: "mount-failed"
 		};
 	}
 	const previous = hotHandles.get(packageName);
@@ -712,7 +716,7 @@ async function hotMount(ctx, profileDir, packageName, deps = {}) {
 	}
 	return {
 		ok: false,
-		reason: outcome === "timeout" ? TIMEOUT_REASON : MOUNT_FAILED_REASON
+		reason: outcome === "timeout" ? "timeout" : "mount-failed"
 	};
 }
 /** Race the fiber's activation against the deadline. The remaining time is
@@ -902,22 +906,99 @@ function realpathNearestExisting(startPath) {
 	}
 }
 /**
-* Upsert one row of the profile's user layer (`cordis.patch.yml`). Enabling
-* removes the row so the bundle default rules again; disabling writes
-* `{ id, disabled: true }` (§8: the CLI's watchUserPatches applies the change
-* hot through HMR). Existing rows for other ids are preserved verbatim.
+* Write every user-layer row of one package in a single pass.
+*
+* A package owns as many loader entries as its bundle patch inserts (see
+* {@link ownedEntryIds}), and they toggle together: writing them one at a
+* time would read-modify-write the file once per entry, so a crash between
+* two writes would leave the package half disabled.
 */
-function setUserLayerRow(options) {
+function setUserLayerRows(options) {
 	const file = join(options.profileDir, "cordis.patch.yml");
-	const others = (loadOptionalPatches("dsh-plugin-shop", file) ?? []).filter((row) => row.id !== options.row.id);
-	const next = options.row.disabled ? [...others, {
-		id: options.row.id,
+	const existing = loadOptionalPatches("dsh-plugin-shop", file) ?? [];
+	const touched = new Set(options.rows.map((row) => row.id));
+	const next = [...existing.filter((row) => !touched.has(row.id)), ...options.rows.filter((row) => row.disabled).map((row) => ({
+		id: row.id,
 		disabled: true
-	}] : others;
+	}))];
 	const tmp = `${file}.tmp`;
 	writeFileSync(tmp, dump(next, { noRefs: true }));
 	renameSync(tmp, file);
 }
+/**
+* The loader entry ids one installed package contributes to the tree.
+*
+* This — not the entry's module name — is what identifies a package's rows.
+* A package declares a bundle patch whose `insert` list may add zero, one, or
+* many entries, and an inserted entry's `name` is the MODULE it mounts, which
+* need not be the package at all: `@tt-a1i/archify-dsh` inserts a configured
+* instance of `@deepseek-ai/dsh-skill-filesystem` and registers no module of
+* its own. Matching a package to its rows by module name therefore finds
+* nothing for such a package, which is why the toggle reported it as not
+* installed. The ids the package's own patch inserts are the only honest
+* answer, and the inventory's `entryId` is exactly that id verbatim.
+*
+* Ids the patch merely TARGETS (a bare id-keyed row overriding config) are
+* not owned: those rows belong to whoever inserted them, and claiming them
+* would let one package disable another's entries.
+*
+* A package with no bundle patch, or one absent from the profile, owns
+* nothing and yields `[]` — a distinct fact from "the entry is not live",
+* which only the inventory can answer.
+*/
+function ownedEntryIds(options) {
+	const packageDir = join(options.profileDir, "node_modules", ...options.packageName.split("/"));
+	const manifestPath = join(packageDir, "package.json");
+	if (!existsSync(manifestPath)) return [];
+	let patchRelative;
+	try {
+		patchRelative = JSON.parse(readFileSync(manifestPath, "utf8")).dsh?.bundle?.patch;
+	} catch (error) {
+		throw new Error(`dsh-plugin-shop: failed to read ${manifestPath}: ${String(error)}`);
+	}
+	if (typeof patchRelative !== "string") return [];
+	const patchFile = resolve(packageDir, patchRelative);
+	const inside = relative(packageDir, patchFile);
+	if (inside === "" || inside.startsWith("..") || isAbsolute(inside)) throw new Error(`dsh-plugin-shop: ${options.packageName} declares a bundle patch outside its own directory: ${patchRelative}`);
+	const ids = [];
+	collectInsertedIds(loadOptionalPatches("dsh-plugin-shop", patchFile) ?? [], ids);
+	return [...new Set(ids)];
+}
+/** Walk a patch list, appending the id of every INSERTED entry. A patch row
+* without `insert` targets an entry someone else composed — the loader's
+* applyEntryPatches looks it up and skips it when absent, so it creates
+* nothing and owns nothing. An inserted GROUP owns its children, which the
+* loader reads from the group's own `config` array. */
+function collectInsertedIds(rows, into) {
+	for (const row of rows) {
+		if (row === null || typeof row !== "object") continue;
+		const inserted = row.insert;
+		if (Array.isArray(inserted)) collectEntryIds(inserted, into);
+	}
+}
+function collectEntryIds(entries, into) {
+	for (const entry of entries) {
+		if (entry === null || typeof entry !== "object") continue;
+		const { id, group, config } = entry;
+		if (typeof id === "string") into.push(id);
+		if (group === true && Array.isArray(config)) collectEntryIds(config, into);
+	}
+}
+/**
+* Does a live loader entry id belong to the package that owns `owned`?
+*
+* A boot-layer entry carries the bare id its bundle patch inserted. The
+* shop's own hot subtree mounts that same row as `mkt-<id>` inside an Include
+* tree, which the loader spells `include:<tree>:mkt-<id>` — the same plugin,
+* one restart earlier. Both spellings are the package's own row.
+*/
+function ownsEntryId(owned, entryId) {
+	if (owned.has(entryId)) return true;
+	const colon = entryId.lastIndexOf(":");
+	if (colon === -1) return false;
+	const tail = entryId.slice(colon + 1);
+	return tail.startsWith("mkt-") && owned.has(tail.slice(4));
+}
 //#endregion
 //#region src/host/index.ts
 /** ShopGateway: the Host half of dsh-plugin-shop (§5.1). */
@@ -1261,10 +1342,26 @@ let ShopGateway = (() => {
 		* plain re-update no-ops on the empty diff (dsh-market themes.ts:74-93).
 		* For an update swap this sequencing is mandatory, not defensive: two live
 		* instances of a service-providing plugin would collide at provision. */
-		async liveDisable(name) {
+		/** The package's owned entry ids, or none when its bundle patch cannot be
+		* read. For the paths where a live disable is an optimization and the
+		* operation must succeed regardless; `setEnabled` reports the failure
+		* instead, because there the patch IS the answer being asked for. */
+		ownedEntryIdsOrNone(packageName) {
+			try {
+				return ownedEntryIds({
+					profileDir: this.profileDirResolved(),
+					packageName
+				});
+			} catch {
+				return [];
+			}
+		}
+		async liveDisableIds(ids) {
+			if (ids.length === 0) return false;
+			const owned = new Set(ids);
 			let found = false;
 			for (const entry of this.loaderEntries()) {
-				if (entry.options.name !== name) continue;
+				if (entry.id === void 0 || !ownsEntryId(owned, entry.id)) continue;
 				for (let attempt = 0; attempt < 3; attempt++) {
 					try {
 						await entry.update({ disabled: true }, false, true);
@@ -1288,17 +1385,39 @@ let ShopGateway = (() => {
 				ok: false,
 				detail: `dsh-plugin-shop: ${args.name} is part of the harness chain and cannot be toggled from the shop`
 			};
-			const entry = (await this.listInventory()).find((entry) => entry.moduleName === args.name);
-			if (entry === void 0) return {
+			const profileDir = this.profileDirResolved();
+			if ((readProfileManifest("dsh-plugin-shop", profileDir).dependencies ?? {})[args.name] === void 0) return {
 				ok: false,
 				detail: `dsh-plugin-shop: ${args.name} is not installed`
 			};
-			setUserLayerRow({
-				profileDir: this.profileDirResolved(),
-				row: {
-					id: entry.entryId,
+			let owned;
+			try {
+				owned = ownedEntryIds({
+					profileDir,
+					packageName: args.name
+				});
+			} catch (error) {
+				return {
+					ok: false,
+					detail: `dsh-plugin-shop: ${args.name} has a bundle patch that could not be read: ${String(error)}`
+				};
+			}
+			if (owned.length === 0) return {
+				ok: false,
+				detail: `dsh-plugin-shop: ${args.name} contributes no plugin entries, so there is nothing to enable or disable`
+			};
+			const ownedSet = new Set(owned);
+			const rows = (await this.listInventory()).filter((entry) => ownsEntryId(ownedSet, entry.entryId)).map((entry) => entry.entryId);
+			if (rows.length === 0) return {
+				ok: false,
+				detail: `dsh-plugin-shop: ${args.name} is installed but its entries are not in the running plugin tree; restart dsh to compose them`
+			};
+			setUserLayerRows({
+				profileDir,
+				rows: rows.map((id) => ({
+					id,
 					disabled: !args.enabled
-				}
+				}))
 			});
 			return { ok: true };
 		}
@@ -1390,6 +1509,7 @@ let ShopGateway = (() => {
 				spec = `github:${entry.repo}#${args.version}${entry.subdir !== void 0 ? `&path:${entry.subdir}` : ""}`;
 			} else spec = `${args.name}@${args.version}`;
 			const isUpdate = (readProfileManifest("dsh-plugin-shop", this.profileDirResolved()).dependencies ?? {})[args.name] !== void 0;
+			const priorEntryIds = isUpdate ? this.ownedEntryIdsOrNone(args.name) : [];
 			const running = startInstall({
 				profile: this.profile,
 				spec,
@@ -1400,7 +1520,7 @@ let ShopGateway = (() => {
 						mount: hotMount,
 						unmount: hotUnmount
 					};
-					if (isUpdate) await this.liveDisable(args.name);
+					if (isUpdate) await this.liveDisableIds(priorEntryIds);
 					const result = await hot.mount({ plugin: (plugin, config) => this.ctx.plugin(plugin, config) }, this.profileDirResolved(), args.name);
 					return result.ok ? { needsRestart: false } : {
 						needsRestart: true,
@@ -1464,10 +1584,30 @@ let ShopGateway = (() => {
 			}
 			const dependencies = readProfileManifest("dsh-plugin-shop", this.profileDirResolved()).dependencies ?? {};
 			const pins = readRepoPins(this.pinFs, this.pinsPath());
-			let byName = /* @__PURE__ */ new Map();
+			const live = /* @__PURE__ */ new Map();
+			let haveInventory = false;
 			try {
-				byName = new Map((await this.listInventory()).map((entry) => [entry.moduleName, entry.enabled]));
+				for (const entry of await this.listInventory()) live.set(entry.entryId, entry.enabled);
+				haveInventory = true;
 			} catch {}
+			/** A package is enabled when every entry it owns and that is live is
+			* enabled. Keyed by entry id, never by module name — the entry a package
+			* inserts may mount a different package's module (see ownedEntryIds). */
+			const enabledOf = (name) => {
+				if (!haveInventory) return true;
+				let owned;
+				try {
+					owned = ownedEntryIds({
+						profileDir: this.profileDirResolved(),
+						packageName: name
+					});
+				} catch {
+					return true;
+				}
+				const ownedSet = new Set(owned);
+				const present = [...live].filter(([entryId]) => ownsEntryId(ownedSet, entryId));
+				return present.length === 0 || present.every(([, enabled]) => enabled);
+			};
 			const installed = [];
 			for (const entry of this.lastSnapshot.entries) {
 				const spec = dependencies[entry.name];
@@ -1479,14 +1619,14 @@ let ShopGateway = (() => {
 						installed: pin ?? spec,
 						latest: entry.version,
 						outdated: pin !== void 0 && pin !== entry.version,
-						enabled: byName.get(entry.name) ?? true
+						enabled: enabledOf(entry.name)
 					});
 				} else installed.push({
 					name: entry.name,
 					installed: spec,
 					latest: entry.version,
 					outdated: this.isBehind(spec, entry.version),
-					enabled: byName.get(entry.name) ?? true
+					enabled: enabledOf(entry.name)
 				});
 			}
 			return installed;
@@ -1528,6 +1668,7 @@ let ShopGateway = (() => {
 				ok: false,
 				detail: `dsh-plugin-shop: ${args.name} is not installed`
 			};
+			const priorEntryIds = this.ownedEntryIdsOrNone(args.name);
 			const running = startUninstall({
 				profile: this.profile,
 				name: args.name,
@@ -1537,7 +1678,7 @@ let ShopGateway = (() => {
 					await (this.hot ?? {
 						mount: hotMount,
 						unmount: hotUnmount
-					}).unmount(args.name) || await this.liveDisable(args.name);
+					}).unmount(args.name) || await this.liveDisableIds(priorEntryIds);
 					return { needsRestart: false };
 				}
 			});

package/lib/typert.host.js

@@ -77,7 +77,7 @@ const dsh_plugin_shop_shop_installStatus_result$schema = z.object({
   'state': z.union([z.literal("running"), z.literal("done"), z.literal("failed")]),
   'log': z.array(z.string()),
   'needsRestart': z.union([z.undefined(), z.literal(false), z.literal(true)]).optional(),
-  'restartReason': z.union([z.undefined(), z.string()]).optional(),
+  'restartReason': z.union([z.undefined(), z.literal("no-patch"), z.literal("not-simple"), z.literal("host-unsupported"), z.literal("timeout"), z.literal("mount-failed")]).optional(),
   'detail': z.union([z.undefined(), z.string()]).optional(),
 })
 const dsh_plugin_shop_shop_restart_result$schema = z.union([z.object({
@@ -151,7 +151,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopCatalogResult',
         schema: dsh_plugin_shop_shop_catalog_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":468,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":521,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installed',
@@ -166,7 +166,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop#shop/installed:result',
         schema: dsh_plugin_shop_shop_installed_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":618,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":677,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installStart',
@@ -192,7 +192,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopInstallResult',
         schema: dsh_plugin_shop_shop_installStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":494,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":547,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installStatus',
@@ -217,7 +217,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopInstallStatusResult',
         schema: dsh_plugin_shop_shop_installStatus_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":607,"column":3},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":666,"column":3},
     },
     {
       id: 'dsh-plugin-shop#shop/restart',
@@ -232,7 +232,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopRestartResult',
         schema: dsh_plugin_shop_shop_restart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":742,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":827,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/setEnabled',
@@ -257,7 +257,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopSetEnabledResult',
         schema: dsh_plugin_shop_shop_setEnabled_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":421,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":442,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/uninstallStart',
@@ -283,7 +283,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopUninstallResult',
         schema: dsh_plugin_shop_shop_uninstallStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":689,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":769,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/updateStart',
@@ -308,7 +308,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopUpdateResult',
         schema: dsh_plugin_shop_shop_updateStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":802,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":887,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/version',
@@ -323,7 +323,7 @@ export const TYPERT = {
         typeSymbol: 'dsh-plugin-shop/types#ShopVersionResult',
         schema: dsh_plugin_shop_shop_version_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":786,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":871,"column":9},
     },
   ],
   model: {
@@ -423,6 +423,10 @@ export const TYPERT = {
             "name": "DeniedEntry",
             "declaration": "export interface DeniedEntry {\n    name: string;\n    detail: string;\n    replacement?: string;\n}"
           },
+          {
+            "name": "HotRestartReason",
+            "declaration": "export type HotRestartReason = 'no-patch' | 'not-simple' | 'host-unsupported' | 'timeout' | 'mount-failed';"
+          },
           {
             "name": "InstallArgs",
             "declaration": "export interface InstallArgs {\n    name: string;\n    version: string;\n    acknowledged?: boolean;\n}"
@@ -437,7 +441,7 @@ export const TYPERT = {
           },
           {
             "name": "InstallStatus",
-            "declaration": "export interface InstallStatus {\n    state: InstallState;\n    log: string[];\n    needsRestart?: boolean;\n    restartReason?: string;\n    detail?: string;\n}"
+            "declaration": "export interface InstallStatus {\n    state: InstallState;\n    log: string[];\n    needsRestart?: boolean;\n    restartReason?: HotRestartReason;\n    detail?: string;\n}"
           },
           {
             "name": "RestartOutcome",

package/lib/typert.remote-client.js

@@ -77,7 +77,7 @@ const dsh_plugin_shop_shop_installStatus_result$schema = z.object({
   'state': z.union([z.literal("running"), z.literal("done"), z.literal("failed")]),
   'log': z.array(z.string()),
   'needsRestart': z.union([z.undefined(), z.literal(false), z.literal(true)]).optional(),
-  'restartReason': z.union([z.undefined(), z.string()]).optional(),
+  'restartReason': z.union([z.undefined(), z.literal("no-patch"), z.literal("not-simple"), z.literal("host-unsupported"), z.literal("timeout"), z.literal("mount-failed")]).optional(),
   'detail': z.union([z.undefined(), z.string()]).optional(),
 })
 const dsh_plugin_shop_shop_restart_result$schema = z.union([z.object({
@@ -148,7 +148,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopCatalogResult',
         schema: dsh_plugin_shop_shop_catalog_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":468,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":521,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installed',
@@ -163,7 +163,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop#shop/installed:result',
         schema: dsh_plugin_shop_shop_installed_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":618,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":677,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installStart',
@@ -189,7 +189,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopInstallResult',
         schema: dsh_plugin_shop_shop_installStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":494,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":547,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/installStatus',
@@ -214,7 +214,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopInstallStatusResult',
         schema: dsh_plugin_shop_shop_installStatus_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":607,"column":3},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":666,"column":3},
     },
     {
       id: 'dsh-plugin-shop#shop/restart',
@@ -229,7 +229,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopRestartResult',
         schema: dsh_plugin_shop_shop_restart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":742,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":827,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/setEnabled',
@@ -254,7 +254,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopSetEnabledResult',
         schema: dsh_plugin_shop_shop_setEnabled_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":421,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":442,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/uninstallStart',
@@ -280,7 +280,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopUninstallResult',
         schema: dsh_plugin_shop_shop_uninstallStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":689,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":769,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/updateStart',
@@ -305,7 +305,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopUpdateResult',
         schema: dsh_plugin_shop_shop_updateStart_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":802,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":887,"column":9},
     },
     {
       id: 'dsh-plugin-shop#shop/version',
@@ -320,7 +320,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: 'dsh-plugin-shop/types#ShopVersionResult',
         schema: dsh_plugin_shop_shop_version_result$schema,
       },
-      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":786,"column":9},
+      sourceLocation: {"file":"packages/dsh-plugin-shop/src/host/index.ts","line":871,"column":9},
     },
   ],
 }

package/lib/types/client/locales.d.ts

@@ -30,6 +30,11 @@ export declare const zh: {
     acknowledgementBody: string;
     installing: string;
     installedRestartNotice: string;
+    hotNoPatchNotice: string;
+    hotNotSimpleNotice: string;
+    hotHostUnsupportedNotice: string;
+    hotTimeoutNotice: string;
+    hotMountFailedNotice: string;
     installedNoRestartNotice: string;
     installFailed: string;
     installTransportFailed: string;
@@ -109,6 +114,11 @@ export declare const en: {
     acknowledgementBody: string;
     installing: string;
     installedRestartNotice: string;
+    hotNoPatchNotice: string;
+    hotNotSimpleNotice: string;
+    hotHostUnsupportedNotice: string;
+    hotTimeoutNotice: string;
+    hotMountFailedNotice: string;
     installedNoRestartNotice: string;
     installFailed: string;
     installTransportFailed: string;

package/lib/types/client/present.d.ts

@@ -2,7 +2,11 @@
  * timers, no I/O: every function here maps a value to a value, so fixtures
  * drive all of it. */
 import type { ShopLocaleKey } from './locales.ts';
-import type { CatalogEntry, InstallRejectionCode } from '../host/index.ts';
+import type { CatalogEntry, HotRestartReason, InstallRejectionCode } from '../host/index.ts';
+/** Hot-mount reason code → locale key, so the notice reads in the language
+ * the person set in dsh. An absent (or unrecognized) reason keeps the generic
+ * restart line rather than showing a bare code. */
+export declare function restartReasonKey(reason: HotRestartReason | undefined): ShopLocaleKey;
 /** Tier → locale key, for the entry-card tier badge (§6.2). */
 export declare function tierKey(tier: CatalogEntry['tier']): ShopLocaleKey;
 /** Spec §9.3 verbatim — the community-tier acknowledgement. The zh dictionary
@@ -37,7 +41,7 @@ export interface InstallStatusShape {
     state: 'running' | 'done' | 'failed';
     log: string[];
     needsRestart?: boolean;
-    restartReason?: string;
+    restartReason?: HotRestartReason;
     detail?: string;
 }
 /** The install view state machine (§7.2). */
@@ -54,7 +58,7 @@ export type InstallView = {
 } | {
     kind: 'done';
     needsRestart: boolean;
-    restartReason?: string;
+    restartReason?: HotRestartReason;
 } | {
     kind: 'failed';
     detail: string;

package/lib/types/host/executor.d.ts

@@ -2,12 +2,13 @@
  * per profile. One implementation drives both `dsh plugin add` (install) and
  * `dsh plugin remove` (uninstall); the only differences are the verb and the
  * post-exit manifest confirmation. */
+import type { HotRestartReason } from './hot.ts';
 export type InstallState = 'running' | 'done' | 'failed';
 export interface InstallStatus {
     state: InstallState;
     log: string[];
     needsRestart?: boolean;
-    restartReason?: string;
+    restartReason?: HotRestartReason;
     detail?: string;
 }
 interface RunningInstall {
@@ -29,7 +30,7 @@ export declare function startInstall(options: {
     expectedName?: string;
     afterDone?: (home: string | undefined) => Promise<{
         needsRestart: boolean;
-        restartReason?: string;
+        restartReason?: HotRestartReason;
     } | void>;
     onStatus?: (status: InstallStatus) => void;
 }): RunningInstall;
@@ -48,7 +49,7 @@ export declare function startUninstall(options: {
     expectedName?: string;
     afterDone?: (home: string | undefined) => Promise<{
         needsRestart: boolean;
-        restartReason?: string;
+        restartReason?: HotRestartReason;
     } | void>;
     onStatus?: (status: InstallStatus) => void;
 }): RunningInstall;

package/lib/types/host/hot.d.ts

@@ -16,12 +16,16 @@
  * tree changes back to the file it read (dsh-market hot.ts; the in-tree
  * precedent is dsh's agent-presets PresetTree).
  *
+ * Reasons are CODES, never copy: the host has no idea which language the
+ * person reading it set in dsh, so it names what happened and the client
+ * renders it through dsh's own locale service.
+ *
  * Deliberate non-port: dsh-market's client-only shim (`mountClientOnlyDeps`
  * and `shimNames`, which hot-mounted a package with no server-side entry by
  * inserting a shim loader entry) is omitted. Our catalog never lists a
  * package without `dsh.bundle`, so the shim branch is unreachable here
  * (YAGNI). `hotMount` still distinguishes "no patch file / not
- * hot-mountable" from "restart will fix it" through the bilingual `reason`.
+ * hot-mountable" from "restart will fix it" through the `reason` code.
  */
 /** One hot-mountable insert row: a plain `- id:` / `name:` pair. */
 export interface HotRow {
@@ -43,12 +47,17 @@ export interface PluginHandle {
     await(): Promise<unknown>;
     dispose(): Promise<unknown> | void;
 }
+/**
+ * Why a hot mount could not activate — a stable code the client turns into
+ * copy in the reader's own dsh language. It distinguishes "restart will fix
+ * it" (`timeout`, `mount-failed`) from "this package can never hot-mount"
+ * (`no-patch`, `not-simple`) and "this harness cannot" (`host-unsupported`).
+ */
+export type HotRestartReason = 'no-patch' | 'not-simple' | 'host-unsupported' | 'timeout' | 'mount-failed';
 export interface HotMountResult {
     ok: boolean;
-    /** Bilingual, distinguishing "restart will fix it" (a transient mount
-     * failure) from "this package can never hot-mount" (no patch file, or a
-     * patch the hot tree cannot replicate). null exactly when ok. */
-    reason: string | null;
+    /** null exactly when ok. */
+    reason: HotRestartReason | null;
 }
 /** Test injection for the host shell (filesystem + ctx + clock). Production
  * defaults: the real include import, node:fs, `join(profileDir, '.dsh-shop')`
@@ -71,11 +80,15 @@ export interface HotFs {
 }
 /**
  * Parse a bundle patch into the plain insert rows a hot tree can replicate.
- * Only `- id:` / `name:` pairs parse — a row with config, an expression
- * name, or a dangling id returns null, and the caller falls back to restart
- * activation. CRLF-aware: a patch authored with Windows line endings must
- * not read as "contains config rows" (the Windows-patch regression their
- * hot.ts documents). Pure: string in, rows out.
+ *
+ * Only an `insert` list of plain `id`/`name` entries parses. A bare id-keyed
+ * row is a TARGETING patch — the loader looks the id up in the already
+ * composed tree and skips it when absent (applyEntryPatches), so it creates
+ * nothing and there is nothing to replicate. A row carrying config, a group,
+ * or an `!!js` expression name returns null too, and every null sends the
+ * caller to restart activation. Parsed as YAML in the loader's own dialect,
+ * so line endings and comments are the parser's problem, not ours, and
+ * nothing in the patch is evaluated. Pure: string in, rows out.
  */
 export declare function parseSimplePatch(patchText: string): HotRow[] | null;
 /**
@@ -83,7 +96,7 @@ export declare function parseSimplePatch(patchText: string): HotRow[] | null;
  * Include subtree: read its bundle patch, replicate the simple rows under
  * `mkt-` ids into `<profile>/.dsh-shop/hot-<n>.yml`, register the tree, and
  * race its activation against `timeoutMs`. Success returns `ok: true` with
- * no reason; any fallback returns `ok: false` with a bilingual reason
+ * no reason; any fallback returns `ok: false` with a reason code
  * distinguishing "restart will fix it" (timeout, activation failure,
  * unavailable include) from "this package can never hot-mount" (no patch
  * file, or rows the hot tree cannot replicate). The plugin is installed in

package/lib/types/host/index.d.ts

@@ -9,6 +9,7 @@ import { hotMount, hotUnmount } from './hot.ts';
 import { type RestartOutcome } from './restart.ts';
 import { type RepoPinFs } from './repo-pins.ts';
 export type { InstallArgs, InstallRejectionCode } from './install.ts';
+export type { HotRestartReason } from './hot.ts';
 export type { CatalogEntry } from './types.ts';
 /** One Loader inventory entry, structurally — the shop never depends on
  * cordis-plugin-loader, whose types do not reach this package's typecheck. */
@@ -17,10 +18,11 @@ export interface InventoryEntry {
     moduleName: string;
     enabled: boolean;
 }
-/** One boot-layer Loader entry, structurally — the surface `liveDisable`
+/** One boot-layer Loader entry, structurally — the surface `liveDisableIds`
  * consumes. `fiber` is the entry's live activation (present while the plugin
  * is up); `update` flips its options. */
 export interface LoaderEntryLike {
+    id?: string;
     options: {
         name?: string;
     };
@@ -258,7 +260,12 @@ export declare class ShopGateway extends TypertRemoteService {
      * plain re-update no-ops on the empty diff (dsh-market themes.ts:74-93).
      * For an update swap this sequencing is mandatory, not defensive: two live
      * instances of a service-providing plugin would collide at provision. */
-    private liveDisable;
+    /** The package's owned entry ids, or none when its bundle patch cannot be
+     * read. For the paths where a live disable is an optimization and the
+     * operation must succeed regardless; `setEnabled` reports the failure
+     * instead, because there the patch IS the answer being asked for. */
+    private ownedEntryIdsOrNone;
+    private liveDisableIds;
     /** Enable or disable one installed plugin, hot (§8): a disable writes the
      * row to the user layer, an enable drops it again so the bundle default
      * rules — the CLI's watchUserPatches applies either through HMR. The shop's

package/lib/types/host/profile.d.ts

@@ -28,3 +28,49 @@ export declare function setUserLayerRow(options: {
     profileDir: string;
     row: UserLayerRow;
 }): void;
+/**
+ * Write every user-layer row of one package in a single pass.
+ *
+ * A package owns as many loader entries as its bundle patch inserts (see
+ * {@link ownedEntryIds}), and they toggle together: writing them one at a
+ * time would read-modify-write the file once per entry, so a crash between
+ * two writes would leave the package half disabled.
+ */
+export declare function setUserLayerRows(options: {
+    profileDir: string;
+    rows: UserLayerRow[];
+}): void;
+/**
+ * The loader entry ids one installed package contributes to the tree.
+ *
+ * This — not the entry's module name — is what identifies a package's rows.
+ * A package declares a bundle patch whose `insert` list may add zero, one, or
+ * many entries, and an inserted entry's `name` is the MODULE it mounts, which
+ * need not be the package at all: `@tt-a1i/archify-dsh` inserts a configured
+ * instance of `@deepseek-ai/dsh-skill-filesystem` and registers no module of
+ * its own. Matching a package to its rows by module name therefore finds
+ * nothing for such a package, which is why the toggle reported it as not
+ * installed. The ids the package's own patch inserts are the only honest
+ * answer, and the inventory's `entryId` is exactly that id verbatim.
+ *
+ * Ids the patch merely TARGETS (a bare id-keyed row overriding config) are
+ * not owned: those rows belong to whoever inserted them, and claiming them
+ * would let one package disable another's entries.
+ *
+ * A package with no bundle patch, or one absent from the profile, owns
+ * nothing and yields `[]` — a distinct fact from "the entry is not live",
+ * which only the inventory can answer.
+ */
+export declare function ownedEntryIds(options: {
+    profileDir: string;
+    packageName: string;
+}): string[];
+/**
+ * Does a live loader entry id belong to the package that owns `owned`?
+ *
+ * A boot-layer entry carries the bare id its bundle patch inserted. The
+ * shop's own hot subtree mounts that same row as `mkt-<id>` inside an Include
+ * tree, which the loader spells `include:<tree>:mkt-<id>` — the same plugin,
+ * one restart earlier. Both spellings are the package's own row.
+ */
+export declare function ownsEntryId(owned: ReadonlySet<string>, entryId: string): boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-shop",
-  "version": "0.5.2",
+  "version": "0.5.3-beta.0",
   "description": "The DeepSeek Harness plugin shop: browse, install, enable, and update dsh plugins from a git-auditable catalog.",
   "repository": {
     "type": "git",