dsh-plugin-shop 0.8.3 → 0.8.4-beta.0

package/lib/index.js

@@ -1,17 +1,18 @@
 import { createRequire } from "node:module";
 import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { loadOptionalPatches, readProfileManifest, resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
-import { lt, minVersion, satisfies, valid, validRange } from "semver";
+import { lt, minVersion, parse, satisfies, valid, validRange } from "semver";
 import { createHash, randomUUID } from "node:crypto";
-import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { appendFileSync, chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { basename, delimiter, dirname, isAbsolute, join, posix, relative, resolve, win32 } from "node:path";
+import { basename, delimiter, dirname, isAbsolute, join, posix, relative, resolve, sep, win32 } from "node:path";
 import { homedir } from "node:os";
 import { z } from "zod";
 import { gunzipSync } from "node:zlib";
 import { spawn, spawnSync } from "node:child_process";
 import { StringDecoder } from "node:string_decoder";
-import { DEFAULT_SCHEMA, JSON_SCHEMA, Type, dump, load } from "js-yaml";
+import { JSON_SCHEMA, Type, dump, load } from "js-yaml";
+import { isMap, isSeq, parseDocument } from "yaml";
 //#region src/own-version.ts
 /** The shop's own published version, read from the package.json that ships
 * next to this package — the RUNNING version, not the manifest's range
@@ -22,12 +23,34 @@ import { DEFAULT_SCHEMA, JSON_SCHEMA, Type, dump, load } from "js-yaml";
 function ownManifest() {
 	return JSON.parse(readFileSync(fileURLToPath(new URL("../package.json", import.meta.url)), "utf8"));
 }
-function ownVersion() {
-	return ownManifest().version;
+/**
+* Read a version once and keep it: the answer to "which code is this".
+*
+* The file cannot answer that question later. A profile installs hoisted, so
+* a self-update rewrites package.json in the directory the RUNNING code was
+* loaded from, and every read after it names the version that will run after
+* the next restart — which the version row then printed as the one running
+* (design §7.3, 2026-09-27 amendment).
+*
+* A first read that throws is not kept: the module import must not fail over
+* a version string, so the answer falls back to reading on demand, which is
+* what the row always did.
+*/
+function versionAtLoad(read) {
+	let loaded;
+	try {
+		loaded = read();
+	} catch {
+		loaded = null;
+	}
+	return () => loaded ?? read();
 }
+/** The version of the code in this process, read when the module was first
+* evaluated — at boot, before any self-update could rewrite the file. */
+const runningVersion = versionAtLoad(() => ownManifest().version);
 /**
 * The peer ranges this build declares — the input to the load-time harness
-* self-check. Read from the same shipped manifest as `ownVersion`, so the
+* self-check. Read from the same shipped manifest as `runningVersion`, so the
 * ranges checked are the ones this build was actually published with, never
 * a second copy that can drift from them.
 *
@@ -609,6 +632,11 @@ const entrySchema = z.object({
 	}).optional(),
 	publisher: z.string().optional(),
 	peers: z.array(z.string()).optional(),
+	compatibility: z.object({
+		dsh: z.string().optional(),
+		profiles: z.array(z.string()).optional()
+	}).optional(),
+	dshPeers: z.record(z.string(), z.string()).optional(),
 	unpackedSize: z.number().int().nonnegative().optional(),
 	installSize: z.number().int().nonnegative().optional()
 }).superRefine((entry, ctx) => {
@@ -1034,6 +1062,248 @@ function validateInstall(snapshot, args, installedSpec) {
 	};
 }
 //#endregion
+//#region src/host/compatibility.ts
+/** Harness compatibility as the AUTHOR states it: which `dsh.compatibility`
+* declarations the running installation does not meet (design
+* 2026-09-01-harness-compatibility §8.2, as amended §9.9). The presence check
+* in `peers.ts` infers from what a plugin imports; this reads what its author
+* wrote down. And, from dsh 0.1.7 on, what dsh ITSELF refuses: the harness
+* peers its installer rejects an install on (`peerVerdictsOf`, design
+* 2026-09-26-dsh-017-readiness, B1).
+*
+* Pure: the running version, the running profile, the harness's own
+* template table and its peer check arrive as arguments, so fixtures drive
+* every verdict and the reads of the installation stay outside — the running
+* dsh, its template table and its peer check in `harness.ts`, the running
+* profile's bundles and exemptions in the gateway. */
+/**
+* Normalize the harness's OWN `PROFILE_TEMPLATES` into template name → bundle
+* names, or an empty record for a shape this build does not know.
+*
+* Two shapes exist and both are live: 0.1.5-rc.3 maps a name to
+* `{ bundles, patchReload }` (five templates), while the version this package
+* pins as a devDependency maps it to a bare array (two). A name whose value is
+* neither, or whose bundle list holds a non-string, is dropped rather than
+* guessed at — an unreadable table means no profile verdict, never a wrong
+* one. Copied from nowhere: the caller passes the harness's exported object.
+*
+* The record has NO PROTOTYPE, empty answer included. It is indexed by the
+* profile names a catalog entry declares, which are hostile input, and a
+* record built on `{}` answered `constructor`, `__proto__`, `toString`,
+* `hasOwnProperty` and `valueOf` from `Object.prototype`: a value that passed
+* the `undefined` guard and threw out of `compatibilityMap`, so one entry
+* declaring `profiles: ["constructor"]` rejected every `catalog()` call for
+* every user. Without a prototype there is also no `__proto__` setter, so a
+* template exported under that name stays an own key instead of replacing
+* the record's prototype. `unmetProfile` takes own keys only as well — the
+* type is exported, and a caller may hand in a plain object.
+*/
+function profileTemplatesOf(exported) {
+	const templates = Object.create(null);
+	if (exported === null || typeof exported !== "object" || Array.isArray(exported)) return templates;
+	for (const [name, value] of Object.entries(exported)) {
+		const bundles = Array.isArray(value) ? value : value !== null && typeof value === "object" ? value.bundles : void 0;
+		if (!Array.isArray(bundles)) continue;
+		if (!bundles.every((bundle) => typeof bundle === "string")) continue;
+		templates[name] = bundles;
+	}
+	return templates;
+}
+/**
+* Install identity → the half or halves of an entry's declaration this
+* installation does not meet. A key is present only when something was
+* declared AND is unmet, so an absent key means "runs here, or we could not
+* tell" — the rule `incompatibilityMap` follows, and for the same reason: one
+* false warning teaches a reader to ignore every warning.
+*
+* The halves are judged apart, and an unknown on either side silences only its
+* own half:
+*
+* - `dsh` needs a range semver can parse and a running version that is semver,
+*   and is then `satisfies` with `includePrerelease`. That option is
+*   load-bearing: the harness ships nothing but prereleases, and strict semver
+*   refuses a prerelease against any range whose comparators carry none —
+*   `0.1.5-rc.3` fails `>=0.1.0`, and even `*` — so every author who wrote a
+*   plain range would be told they exclude a harness their range includes.
+*
+*   What the option does NOT do is read a range the way its author probably
+*   meant it. Under it a prerelease is compared like any other version, and a
+*   prerelease sorts BELOW its own release (measured with semver 7.8.5; the
+*   rows are pinned in compatibility.test.ts):
+*   - An upper bound written without `-0` admits the next line's
+*     prereleases: `<0.2.0` and `>=0.1.0 <0.2.0` both admit `0.2.0-rc.1`.
+*     Only a bound that desugars to `<0.2.0-0` refuses it — `^0.1.0`,
+*     `~0.1.0` and `0.1.x` do, as does `<0.2.0-0` written out.
+*   - A floor written without `-0` refuses its own prereleases: `>=0.1.5`,
+*     `^0.1.5` and `0.1.5` all refuse `0.1.5-rc.3`, because `0.1.5` sorts
+*     above it. `>=0.1.5-0` admits every `0.1.5-rc.N`.
+*   So `>=0.1.5-0` and `<0.2.0-0` are the spellings that say what an author
+*   usually means. The comparison stays semver's own and is never rewritten
+*   here: a verdict that coerced prereleases would answer differently from
+*   semver, which is what an author checks a range against. An exact list of
+*   other versions — `@xmanrui/dsh-im`'s declaration — is refused, as it
+*   should be.
+* - `profile` is met when the running profile's NAME is one of the declared
+*   names, or when it composes every bundle of a declared template.
+*
+*   The name is trusted for the names dsh ships, because for those it is not
+*   the reader's choice. On 0.1.5-rc.3 both paths that create a missing
+*   profile build one of a shipped name from that name's template
+*   (dsh-app-boot's `loadProfile`, and `dsh plugin`), and dsh refuses a
+*   shipped name as the target of `--from-default-profile`, so a profile
+*   carrying one was built from that template. That is all the name
+*   guarantees: which template the profile was built from, not what it
+*   composes now. Nothing holds the bundle list to the template afterwards:
+*   `dsh plugin`'s reconcile, not app-boot, appends each bundle it installs,
+*   and app-boot's `normalizeShippedProfile` rewrites only a list that is
+*   exactly a retired tuple or the current one. Bundles alone could not
+*   decide there: a profile keeps the bundle list it was created with, so the
+*   first harness release that added a bundle to `web` would badge every
+*   `profiles: ["web"]` plugin (`@xmanrui/dsh-im`) on every existing `web`
+*   profile, with copy saying it supports web and this dsh was launched with
+*   web.
+*
+*   Any other name is the reader's choice — `dsh --profile rescue
+*   --from-default-profile web` builds a profile called `rescue` from the web
+*   bundles, and dsh records nothing about which template it came from — so a
+*   running name no declaration matches is judged by what the profile IS:
+*   each declared name is read as one of the harness's own templates, met
+*   when every bundle of that template is in the running profile's bundles. A
+*   declared name that is no template — an own key of the table, never an
+*   inherited one — cannot be judged, and a list with such a name and no met
+*   template gives no verdict. The half is unmet only when the running name is
+*   not declared and every declared name is a template this profile does not
+*   compose — see the amendment for the whole rule.
+*
+*   The residual, knowingly kept: a custom-named profile is still judged by
+*   bundles, so a template that later gained a bundle would badge the custom
+*   profiles created before the change. No PUBLISHED
+*   `@deepseek-ai/dsh-app-boot` had changed a template's bundle list as of
+*   2026-09-25: all 28 versions, read that day, give every template they
+*   share the same list. One list was retired before the first publish:
+*   every published app-boot, from the first, carries a retired `headless`
+*   tuple (`@deepseek-ai/dsh-base`, `@deepseek-ai/dsh-web-app`,
+*   `@deepseek-ai/dsh-headless`) in `INSTALLATION_OWNED_PROFILE_TUPLES`, and
+*   `normalizeShippedProfile` rewrites a `headless` profile carrying exactly
+*   that list to the current template when it loads.
+*/
+function compatibilityMap(entries, runtime, templates) {
+	const running = runtime.dshVersion !== null && valid(runtime.dshVersion) !== null ? runtime.dshVersion : null;
+	const out = {};
+	for (const entry of entries) {
+		const declared = entry.compatibility;
+		if (declared === void 0) continue;
+		const verdict = {};
+		const range = declared.dsh;
+		if (range !== void 0 && running !== null && validRange(range) !== null && !satisfies(running, range, { includePrerelease: true })) verdict.dsh = {
+			range,
+			running
+		};
+		const unmet = unmetProfile(declared.profiles, runtime.profile, templates);
+		if (unmet !== null) verdict.profile = {
+			declared: [...unmet],
+			running: runtime.profile.name
+		};
+		if (verdict.dsh !== void 0 || verdict.profile !== void 0) out[identityKey(entry)] = verdict;
+	}
+	return out;
+}
+/**
+* The declared profile list to report, or null when nothing is owed: met,
+* unjudgeable, or nothing declared. See `compatibilityMap` for the rule, why
+* a matching name is enough, and why bundles decide for any other name.
+*/
+function unmetProfile(declared, running, templates) {
+	if (declared === void 0 || declared.length === 0) return null;
+	if (declared.includes(running.name)) return null;
+	if (running.bundles === null) return null;
+	const composed = new Set(running.bundles);
+	let unjudged = false;
+	for (const name of declared) {
+		const bundles = Object.hasOwn(templates, name) ? templates[name] : void 0;
+		if (bundles === void 0) {
+			unjudged = true;
+			continue;
+		}
+		if (bundles.every((bundle) => composed.has(bundle))) return null;
+	}
+	return unjudged ? null : declared;
+}
+/**
+* Install identity → the refusal the running dsh will make, for each entry
+* whose harness peers it refuses and the profile has not exempted. A key is
+* present only for a refusal, so an absent key means "dsh installs it, or we
+* could not tell".
+*
+* The rule is dsh's own (`check`, from the running app-boot), handed the
+* manifest dsh's installer reads before it installs a registry spec — `pnpm
+* view <spec> name version peerDependencies`, measured in dsh-plugin-manager
+* 0.1.7-rc.2 — with the catalog's `dshPeers` for the peers. Those are the
+* only peers the rule reads, verbatim. What this cannot see errs toward
+* silence, never toward a refusal dsh would not make: a malformed peer range
+* elsewhere in the manifest, which dsh rejects only after installing, and
+* the plugins a bundle's patch rows name, which it checks then too. Those
+* reach the reader as the install's own failure (`installFailureDetail`).
+*
+* npm entries only. dsh keys an exemption by the INSTALLED manifest's
+* `name@version`, and a github entry's catalog version is a commit: its
+* exemption status cannot be read, and a refusal named here could never be
+* cleared from the shop. dsh refuses such an install itself, and says how
+* to exempt it.
+*
+* A throw from the check forms no verdict for that entry, as a resolver's
+* throw does in `incompatibilityMap`.
+*/
+function peerVerdictsOf(entries, check, exemptions, profile) {
+	const out = {};
+	for (const entry of entries) {
+		if (entry.source !== "npm" || entry.dshPeers === void 0) continue;
+		let issue;
+		try {
+			issue = check.evaluate({
+				name: entry.name,
+				version: entry.version,
+				peerDependencies: entry.dshPeers
+			}, exemptions);
+		} catch {
+			continue;
+		}
+		if (issue === void 0 || issue.exempted) continue;
+		out[identityKey(entry)] = {
+			refused: { ...issue.peers },
+			running: issue.runtimeVersion,
+			allowCommand: allowVersionCommand(profile, issue)
+		};
+	}
+	return out;
+}
+/** npm's package-name grammar as dsh's exemption records accept it, verbatim
+* from app-boot 0.1.7-rc.2 (`PACKAGE_NAME` in profile-compatibility). */
+const EXEMPTION_PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
+/** A version exactly as dsh's exemption records spell one: canonical semver,
+* build metadata included (app-boot's `isExactPluginVersion`). */
+function isExactVersion(value) {
+	const parsed = parse(value);
+	return parsed !== null && value === `${parsed.version}${parsed.build.length === 0 ? "" : `+${parsed.build.join(".")}`}`;
+}
+/**
+* The command that records dsh's exact-version exemption for one refused
+* install, spelled as dsh's own CLI prints it after a refusal — or null when
+* `dsh plugin allow-version` would refuse the package or either version,
+* which it checks against the grammar above. The name and version come from
+* the catalog, which is hostile input bound for a terminal, and the two
+* grammars admit no whitespace, quote, `$`, backtick, `;`, `|`, `&`,
+* redirection or bracket, so no catalog value can add a command to the line
+* it is pasted into.
+*
+* The profile is written as it is, as dsh prints it: it is the reader's own
+* choice of name, never catalog input.
+*/
+function allowVersionCommand(profile, issue) {
+	if (!EXEMPTION_PACKAGE_NAME.test(issue.name) || !isExactVersion(issue.version) || !isExactVersion(issue.runtimeVersion)) return null;
+	return `dsh plugin --profile ${profile} allow-version ${issue.name}@${issue.version} --dsh-version ${issue.runtimeVersion} --accept-risk`;
+}
+//#endregion
 //#region src/host/dsh-cli.ts
 /**
 * How to start the dsh CLI as a child process.
@@ -1064,6 +1334,16 @@ const DSH_PACKAGE = "@deepseek-ai/dsh";
 * also the unscoped name its plain-string `bin` form would take. */
 const DSH_BIN_NAME = "dsh";
 /**
+* Whether dsh's CLI refuses this profile outright: `desktop`, in any letter
+* case, "is managed exclusively by the Electron application" — refused for a
+* launch and for `dsh plugin` alike (`rejectElectronProfile` in the CLI's
+* `lib/bin.js`, the same in 0.1.5-rc.3 and 0.1.7-rc.2). Every command the
+* shop spawns names a profile, so none of them can run for this one.
+*/
+function isDesktopProfile(profile) {
+	return profile.toLowerCase() === "desktop";
+}
+/**
 * A `dshBin` that names a JavaScript entry rather than a program.
 *
 * Such a file cannot be spawned anywhere: Windows needs a PE image, and POSIX
@@ -1335,6 +1615,93 @@ const FAILURE_LOG_NOISE = [
 	/^\s+at /,
 	/^<anonymous(?:_script)?>/
 ];
+/** The line dsh 0.1.7 opens a refused install with (dsh-plugin-manager's
+* `rejected`), and the exemption command its CLI prints after it, one per
+* refused package (`runPlugin`). */
+const REFUSAL_OPENER = "dsh: installation rejected: ";
+const REFUSAL_COMMAND = /^dsh: to accept the risk, run: dsh plugin --profile .+ allow-version (.+)@([^@\s]+) --dsh-version (\S+) --accept-risk$/;
+const REFUSAL_FAILED = "dsh: plugin command failed";
+/** Where dsh's warning turns from the refused peers to its risk statement
+* and remedy (app-boot's `pluginCompatibilityWarning`); the detail states
+* the risk once and gives the command instead. */
+const REFUSAL_WARNING_TAIL = " Running it may cause crashes or data loss.";
+/**
+* dsh's own refusal of an install (0.1.7 on) as one detail, or null when the
+* log holds none. The install was dsh's to refuse, not pnpm's to fail: it
+* refuses before pnpm runs, when it can read the manifest — a registry spec,
+* which the catalog's peer verdict already predicts — and after pnpm
+* succeeded otherwise, restoring the profile. Reading that as a pnpm failure
+* sent the reader to `dsh plugin install`, which repairs nothing.
+*
+* The detail is what dsh refused, what it restored, and the command that
+* records its exact-version exemption, rebuilt from what dsh printed through
+* `allowVersionCommand` rather than repeated: dsh prints the INSTALLED
+* manifest's own name into it, which a tarball or git package chooses
+* itself, so only a name and versions dsh's exemption grammar accepts reach
+* a line meant for a terminal. The profile is the one this install ran in.
+* Anything dsh prints after `plugin command failed` — the diagnostics path,
+* and a hint about git build scripts dsh prints after every failed git
+* install — says nothing about this refusal.
+*/
+function refusalDetail(profile, usable) {
+	const start = usable.findIndex((line) => line.startsWith(REFUSAL_OPENER));
+	if (start === -1) return null;
+	const refusedAt = usable.slice(start);
+	const failedAt = refusedAt.findIndex((line) => line.startsWith(REFUSAL_FAILED));
+	const block = failedAt === -1 ? refusedAt : refusedAt.slice(0, failedAt);
+	const warnings = [];
+	const commands = [];
+	let restoration;
+	for (const [index, line] of block.entries()) {
+		const command = REFUSAL_COMMAND.exec(line);
+		if (command !== null) {
+			const [, name = "", version = "", runtimeVersion = ""] = command;
+			const rebuilt = allowVersionCommand(profile, {
+				name,
+				version,
+				runtimeVersion
+			});
+			if (rebuilt !== null) commands.push(rebuilt);
+		} else if (index === 0) warnings.push(line.slice(28));
+		else if (line.startsWith("dsh: ")) restoration ??= line.slice(5);
+		else if (restoration === void 0) warnings.push(line);
+	}
+	const parts = [`dsh refused the install: ${warnings.map((warning) => {
+		const tail = warning.indexOf(REFUSAL_WARNING_TAIL);
+		return tail === -1 ? warning : warning.slice(0, tail);
+	}).join(" ")}`];
+	if (restoration !== void 0) parts.push(`${restoration.charAt(0).toUpperCase()}${restoration.slice(1)}`);
+	if (commands.length > 0) parts.push(`To accept the risk of crashes or data loss for ${commands.length === 1 ? "this exact version" : "these exact versions"}, run: ${commands.join("; ")} — then install again.`);
+	return parts.join(" ");
+}
+/** What Rust's allocator prints before it aborts, which is how pnpm 12's
+* native binary dies when it cannot get the memory it asked for. Anchored at
+* both ends: node's own heap exhaustion ("Allocation failed - JavaScript heap
+* out of memory") is a different crash, from pnpm 11 or dsh itself, and the
+* pnpm 12 remedy below would be wrong for it. */
+const NATIVE_ALLOCATION_ABORT = /^memory allocation of \d+ bytes failed$/;
+/**
+* pnpm 12 aborting out of memory as one detail, or null when the log holds no
+* such abort.
+*
+* The known cause is pnpm/pnpm#15362, fixed in pnpm 12.7.0: the native peer
+* check intersected the ranges of a missing peer, doubling the intersection
+* for every package that wanted it. dsh writes `autoInstallPeers: false` into
+* every profile, so every `@deepseek-ai/dsh*` peer stays missing and plugins
+* that share one trip it. Reported on Windows with 8 GB, reproduced on Linux
+* through the real CLI of dsh 0.1.5-rc.3 and 0.1.7-rc.2 (2026-09-27). The
+* install aborted, so running it again on the same profile aborts again:
+* the detail names the way out instead of the usual recovery hint.
+*
+* Not every such abort is that bug (pnpm/pnpm#15867 is another one, with the
+* same words), so the detail says what to do if the reader's pnpm already has
+* the fix.
+*/
+function nativeAllocationAbortDetail(usable) {
+	const abort = usable.find((line) => NATIVE_ALLOCATION_ABORT.test(line.trim()));
+	if (abort === void 0) return null;
+	return `pnpm crashed: its native binary ran out of memory (${abort.trim()}), which is not caused by this plugin. pnpm 12 before 12.7.0 has a known bug that exhausts memory when many packages share a missing peer, which every dsh profile has, because dsh keeps peers uninstalled (autoInstallPeers: false; pnpm/pnpm#15362). Upgrade pnpm to 12.7.0 or later, or use pnpm 11, then install again. If your pnpm is already 12.7.0 or later, report the line above to pnpm.`;
+}
 /**
 * The one log line worth putting in front of the user, plus the recovery hint.
 *
@@ -1352,6 +1719,10 @@ const FAILURE_LOG_NOISE = [
 function installFailureDetail(profile, log) {
 	const hint = `pnpm failed in the profile. Run: dsh plugin --profile ${profile} install`;
 	const usable = log.map((line) => line.replace(/\r+$/, "")).filter((line) => !FAILURE_LOG_NOISE.some((rx) => rx.test(line)));
+	const refusal = refusalDetail(profile, usable);
+	if (refusal !== null) return refusal;
+	const abort = nativeAllocationAbortDetail(usable);
+	if (abort !== null) return abort;
 	const reversed = [...usable].reverse();
 	const pick = reversed.find((line) => /ERR_[A-Z][A-Z_]*/.test(line)) ?? reversed.find((line) => /(?:^|\s)\w*Error:/.test(line)) ?? usable[usable.length - 1];
 	if (pick === void 0) return `${hint}.`;
@@ -1753,6 +2124,47 @@ function startUninstall(options) {
 	});
 }
 //#endregion
+//#region src/host/bundle-patch.ts
+/**
+* The patch files a bundle declares, read the way dsh reads them (design
+* 2026-09-26-dsh-017-readiness, B4).
+*
+* dsh 0.1.7's app-boot (`bundlePatchFiles`) accepts `dsh.bundle.patch` as one
+* package-relative file or as a list of them, applied in order, and throws on
+* anything else. dsh 0.1.5 reads only the string form: it joins the
+* declaration onto the package directory, so a list makes the profile fail to
+* start. What the RUNNING dsh accepts is `RunningHarness.patchLists`; this
+* reads the declaration itself, for the shop's own readers of a package's
+* patch — the entries it owns, the rows a hot mount replicates.
+*/
+/**
+* The declared patch files in application order: one for a string, the
+* listed ones for a list of strings. Null for a declaration dsh refuses —
+* neither a path nor a list of paths — which is distinct from an absent one:
+* only absence means the conventional `cordis.patch.yml`, and a caller that
+* fell back to it for a refused declaration would act on a patch dsh never
+* applies. Pure, and the list is a copy.
+*/
+function bundlePatchFiles(declared) {
+	if (typeof declared === "string") return [declared];
+	if (Array.isArray(declared) && declared.every((file) => typeof file === "string")) return [...declared];
+	return null;
+}
+/**
+* Whether an installed package's `dsh.bundle.patch` would stop the profile
+* from starting at the next boot, given whether the running dsh reads a list
+* (`RunningHarness.patchLists`). An absent declaration is no hazard: dsh adds
+* a package to the profile's bundles only when it declares a patch, so
+* nothing reads the field. An unknown harness (null) forms no verdict on a
+* list — the rule for every harness read — but a malformed declaration is
+* refused by every dsh, so it is named whatever is known. Pure.
+*/
+function patchDeclarationHazard(declared, patchLists) {
+	if (declared === void 0) return null;
+	if (bundlePatchFiles(declared) === null) return "malformed";
+	return Array.isArray(declared) && patchLists === false ? "list-unsupported" : null;
+}
+//#endregion
 //#region src/host/hot.ts
 /**
 * Restart-free installs: mount a freshly installed plugin into the running
@@ -1878,15 +2290,14 @@ function nextHotNumber(fs, dir) {
 	}
 	return max + 1;
 }
-/** Read the installed package's own `dsh` section to locate its bundle patch
-* (the Include input), or null when the package or the field is absent —
-* the "no patch file" rejection names this. */
-function readPkgDsh(fs, packageDir) {
+/** The installed package's own `dsh.bundle.patch`, exactly as declared (the
+* Include input), or undefined when the package, its manifest or the field
+* is absent. */
+function declaredPatch(fs, packageDir) {
 	try {
-		const patch = JSON.parse(fs.read(join(packageDir, "package.json"))).dsh?.bundle?.patch;
-		return typeof patch === "string" ? { patch } : null;
+		return JSON.parse(fs.read(join(packageDir, "package.json"))).dsh?.bundle?.patch;
 	} catch {
-		return null;
+		return;
 	}
 }
 /** Load the Include class through a computed dynamic import, or null when
@@ -1924,33 +2335,45 @@ function suppressWrite(treeClass) {
 async function hotMount(ctx, profileDir, packageName, deps = {}) {
 	const { fs = nodeHotFs, dir = join(profileDir, HOT_DIR), timeoutMs = Number(process.env.DSH_SHOP_HOT_MOUNT_TIMEOUT_MS) || 1e4, now = Date.now } = deps;
 	const packageDir = join(profileDir, "node_modules", packageName);
-	const dsh = readPkgDsh(fs, packageDir);
-	const patchFile = resolve(packageDir, dsh?.patch ?? "cordis.patch.yml");
-	const inside = relative(packageDir, patchFile);
-	if (inside === "" || inside.startsWith("..") || isAbsolute(inside)) {
-		ctx.logger?.warn(`hot-mount ${packageName}: the declared bundle patch is outside the package directory — restart will activate it`);
-		return {
-			ok: false,
-			reason: "no-patch"
-		};
-	}
-	let patchText;
-	try {
-		patchText = fs.read(patchFile);
-	} catch {
-		ctx.logger?.warn(`hot-mount ${packageName}: no patch file to mount — restart will activate it`);
+	const declared = declaredPatch(fs, packageDir);
+	const files = declared === void 0 ? ["cordis.patch.yml"] : bundlePatchFiles(declared);
+	if (files === null || files.length === 0) {
+		ctx.logger?.warn(`hot-mount ${packageName}: the bundle patch is declared as neither a file path nor a list of them — restart will activate it`);
 		return {
 			ok: false,
 			reason: "no-patch"
 		};
 	}
-	const rows = parseSimplePatch(patchText);
-	if (rows === null) {
-		ctx.logger?.warn(`hot-mount ${packageName}: patch has rows that cannot be hot-mounted — restart will activate it`);
-		return {
-			ok: false,
-			reason: "not-simple"
-		};
+	const rows = [];
+	for (const file of files) {
+		const patchFile = resolve(packageDir, file);
+		const inside = relative(packageDir, patchFile);
+		if (inside === "" || inside.startsWith("..") || isAbsolute(inside)) {
+			ctx.logger?.warn(`hot-mount ${packageName}: the declared bundle patch is outside the package directory — restart will activate it`);
+			return {
+				ok: false,
+				reason: "no-patch"
+			};
+		}
+		let patchText;
+		try {
+			patchText = fs.read(patchFile);
+		} catch {
+			ctx.logger?.warn(`hot-mount ${packageName}: no patch file to mount — restart will activate it`);
+			return {
+				ok: false,
+				reason: "no-patch"
+			};
+		}
+		const parsed = parseSimplePatch(patchText);
+		if (parsed === null) {
+			ctx.logger?.warn(`hot-mount ${packageName}: patch has rows that cannot be hot-mounted — restart will activate it`);
+			return {
+				ok: false,
+				reason: "not-simple"
+			};
+		}
+		rows.push(...parsed);
 	}
 	let treeClass = deps.hotTreeClass;
 	if (treeClass === void 0) treeClass = await loadHotTreeClass();
@@ -2061,18 +2484,21 @@ function cleanHotDir(profileDir) {
 * - A change to the BOOT COMPOSITION — a toggle, an uninstall — moves an
 *   entry the registry already enumerates, and the served graph follows it
 *   within seconds (§2, measured 2026-09-11). `true`.
-* - A HOT MOUNT — an install or an update — adds to the live loader entries
-*   without entering that composition, so the graph a tab reloads into does
-*   not contain the package. Measured 2026-09-14 against dsh 0.1.5-rc.1 in
-*   `web-full-flow.e2e.ts`: across a reload following a hot mount the graph
-*   is byte-identical, same `rev`, while the package's host half is live the
-*   whole time. `false` — and a `restart` is then the only honest answer,
-*   because there is nothing a reload could fetch.
+* - A HOT MOUNT — an install — adds entries under the shop's own loader
+*   entry, which the registry enumerates like any other: across a reload
+*   following the mount the served graph gains the package and the page runs
+*   its browser half (measured 2026-09-26 on 0.1.5-rc.3 and 0.1.7-rc.2, in
+*   `web-full-flow.e2e.ts`). `true`.
 *
 * The asymmetry that decides every unknown still runs the same way: offering
 * a step that was not needed costs the reader one action, withholding one
-* that was needed is the defect this module exists to fix. What changed on
-* 2026-09-14 is which step is the needed one after a hot mount.
+* that was needed is the defect this module exists to fix. Which step a hot
+* mount needs has been measured twice. On 2026-09-14 the graph came back
+* byte-identical across the reload, and installs moved to `restart` — but the
+* shop then registered the tree from whichever context made the RPC call, the
+* typert gateway's, and the registry never composed a tree hung there. Once
+* the tree hung off the shop's own entry (2026-09-26), the same measurement
+* found the package in the graph, and installs moved back to `reload`.
 */
 function activationOf(input) {
 	if (!input.hostLive) return "restart";
@@ -2294,18 +2720,14 @@ function writeRepoPins(fs, path, pins) {
 //#endregion
 //#region src/host/profile.ts
 /** Profile directory discovery and user-layer writes (§8: hot enable/disable). */
-function isJsExpr(value) {
-	return typeof value === "object" && value !== null && typeof value.__jsExpr === "string";
-}
-const JS_EXPR_TYPE = new Type("tag:yaml.org,2002:js", {
-	kind: "scalar",
-	resolve: () => true,
-	construct: (data) => ({ __jsExpr: data }),
-	predicate: isJsExpr,
-	represent: (value) => value.__jsExpr
-});
-/** js-yaml's default schema plus the user-layer `!!js` round trip. */
-const USER_LAYER_SCHEMA = DEFAULT_SCHEMA.extend([JS_EXPR_TYPE]);
+/** The loader's `!!js` expression scalar, for the document edit: read as its
+* source text and written back under its own tag, never evaluated — the
+* loader evaluates it at entry activation. The same declaration the harness's
+* own writer of this file uses (`@deepseek-ai/dsh-plugin-manager` 0.1.7). */
+const USER_LAYER_TAGS = [{
+	tag: "tag:yaml.org,2002:js",
+	resolve: (source) => source
+}];
 /**
 * Find the profile directory that owns `startPath`.
 *
@@ -2364,22 +2786,78 @@ function realpathNearestExisting(startPath) {
 * {@link ownedEntryIds}), and they toggle together: writing them one at a
 * time would read-modify-write the file once per entry, so a crash between
 * two writes would leave the package half disabled.
+*
+* The edit changes one key and nothing else (design
+* 2026-09-26-market-borrowings §2). The layer is validated by the harness's
+* own parser first, so one it cannot load still throws and is never
+* rewritten; it is then edited as a YAML document, which keeps every comment,
+* every other row, every other key and every `!!js` scalar as the user wrote
+* them. The whole-file rewrite this replaced dropped each toggled id's row —
+* and with it a `config:` override the user had put there — and dumped the
+* list back through a library that models no comments, so the first toggle
+* erased the header dsh writes into every new profile.
+*
+* For each entry the row written is the LAST one carrying its id, when the
+* harness is sure to apply it: applyEntryPatches applies rows in order and
+* each key replaces the entry's value, so the last row that sets `disabled`
+* decides it. A row with `insert` is an insertion into a group, never an
+* override; a row naming another module is skipped by the harness; a named
+* row whose module the caller did not say cannot be judged. In each of those
+* cases a row is appended instead, which the harness applies last whatever
+* came before it — so appending is never wrong, only less tidy.
+*
+* An enable writes `disabled: false` rather than deleting the row, which is
+* what lost a user's row or the comment above it; it is also the harness's
+* own convention for this file from 0.1.7. The file keeps its permission bits
+* across the rename (a new one is created owner-only, as the harness's writer
+* does), because a config override can hold a credential.
 */
 function setUserLayerRows(options) {
 	const file = join(options.profileDir, "cordis.patch.yml");
-	const existing = loadOptionalPatches("dsh-plugin-shop", file) ?? [];
-	const touched = new Set(options.rows.map((row) => row.id));
-	const next = [...existing.filter((row) => !touched.has(row.id)), ...options.rows.filter((row) => row.disabled).map((row) => ({
-		id: row.id,
-		disabled: true
-	}))];
+	loadOptionalPatches("dsh-plugin-shop", file);
+	let text = "[]\n";
+	let mode = 384;
+	if (existsSync(file)) {
+		text = readFileSync(file, "utf8");
+		mode = statSync(file).mode & 511;
+	}
+	const document = parseDocument(text, { customTags: USER_LAYER_TAGS });
+	const parseError = document.errors[0];
+	if (parseError !== void 0) throw parseError;
+	const list = document.contents;
+	if (!isSeq(list)) throw new Error(`dsh-plugin-shop: ${file} is not a YAML list of patch rows`);
+	for (const row of options.rows) {
+		const target = lastRowFor(list.items, row.id);
+		if (target !== null && appliesTo(target, row.name)) {
+			target.set("disabled", row.disabled);
+			continue;
+		}
+		if (list.items.length === 0) list.flow = false;
+		document.add({
+			id: row.id,
+			disabled: row.disabled
+		});
+	}
 	const tmp = `${file}.tmp`;
-	writeFileSync(tmp, dump(next, {
-		noRefs: true,
-		schema: USER_LAYER_SCHEMA
-	}));
+	writeFileSync(tmp, document.toString({ lineWidth: 0 }), { mode });
+	chmodSync(tmp, mode);
 	renameSync(tmp, file);
 }
+/** The last override row carrying `id`, or null when there is none. A row
+* with `insert` is an insertion into group `id`, not an override of it. */
+function lastRowFor(items, id) {
+	for (let index = items.length - 1; index >= 0; index--) {
+		const item = items[index];
+		if (isMap(item) && !item.has("insert") && item.get("id") === id) return item;
+	}
+	return null;
+}
+/** Whether the harness is sure to apply `row` to the entry mounting
+* `moduleName`: a row with no `name`, or one naming that very module. */
+function appliesTo(row, moduleName) {
+	if (!row.has("name")) return true;
+	return moduleName !== void 0 && row.get("name") === moduleName;
+}
 /**
 * The loader entry ids one installed package contributes to the tree.
 *
@@ -2402,41 +2880,73 @@ function setUserLayerRows(options) {
 * which only the inventory can answer.
 */
 function ownedEntryIds(options) {
+	return ownedEntries(options).map((entry) => entry.id);
+}
+/**
+* {@link ownedEntryIds} with the module each entry mounts beside its id. The
+* name is what the harness judges a NAMED user-layer row by — a row naming a
+* different module is skipped (applyEntryPatches) — so it is what lets the
+* toggle write a user's own named row rather than append one beside it. It is
+* read through the harness's parser, so a relative name arrives anchored to a
+* file URL exactly as the composed entry carries it; an `!!js` name has no
+* plain value and reads as undefined. Throws where `ownedEntryIds` does.
+*/
+function ownedEntries(options) {
 	const packageDir = join(options.profileDir, "node_modules", ...options.packageName.split("/"));
 	const manifestPath = join(packageDir, "package.json");
 	if (!existsSync(manifestPath)) return [];
-	let patchRelative;
+	let declared;
 	try {
-		patchRelative = JSON.parse(readFileSync(manifestPath, "utf8")).dsh?.bundle?.patch;
+		declared = JSON.parse(readFileSync(manifestPath, "utf8")).dsh?.bundle?.patch;
 	} catch (error) {
 		throw new Error(`dsh-plugin-shop: failed to read ${manifestPath}: ${String(error)}`);
 	}
-	if (typeof patchRelative !== "string") return [];
-	const patchFile = resolve(packageDir, patchRelative);
-	const inside = relative(packageDir, patchFile);
-	if (inside === "" || inside.startsWith("..") || isAbsolute(inside)) throw new Error(`dsh-plugin-shop: ${options.packageName} declares a bundle patch outside its own directory: ${patchRelative}`);
-	const ids = [];
-	collectInsertedIds(loadOptionalPatches("dsh-plugin-shop", patchFile) ?? [], ids);
-	return [...new Set(ids)];
+	const files = bundlePatchFiles(declared);
+	if (files === null) return [];
+	const entries = [];
+	for (const file of files) {
+		const patchFile = resolve(packageDir, file);
+		const inside = relative(packageDir, patchFile);
+		if (inside === "" || inside.startsWith("..") || isAbsolute(inside)) throw new Error(`dsh-plugin-shop: ${options.packageName} declares a bundle patch outside its own directory: ${file}`);
+		collectInsertedEntries(loadOptionalPatches("dsh-plugin-shop", patchFile) ?? [], entries);
+	}
+	const seen = /* @__PURE__ */ new Set();
+	return entries.filter((entry) => !seen.has(entry.id) && seen.add(entry.id) !== void 0);
 }
-/** Walk a patch list, appending the id of every INSERTED entry. A patch row
-* without `insert` targets an entry someone else composed — the loader's
+/**
+* An installed package's own `dsh.bundle.patch`, exactly as declared, or
+* undefined when the package, its manifest or the field is absent — or the
+* manifest cannot be read, which no post-install check can judge either.
+*/
+function declaredBundlePatch(options) {
+	const manifestPath = join(options.profileDir, "node_modules", ...options.packageName.split("/"), "package.json");
+	try {
+		return JSON.parse(readFileSync(manifestPath, "utf8")).dsh?.bundle?.patch;
+	} catch {
+		return;
+	}
+}
+/** Walk a patch list, appending every INSERTED entry. A patch row without
+* `insert` targets an entry someone else composed — the loader's
 * applyEntryPatches looks it up and skips it when absent, so it creates
 * nothing and owns nothing. An inserted GROUP owns its children, which the
 * loader reads from the group's own `config` array. */
-function collectInsertedIds(rows, into) {
+function collectInsertedEntries(rows, into) {
 	for (const row of rows) {
 		if (row === null || typeof row !== "object") continue;
 		const inserted = row.insert;
-		if (Array.isArray(inserted)) collectEntryIds(inserted, into);
+		if (Array.isArray(inserted)) collectEntries(inserted, into);
 	}
 }
-function collectEntryIds(entries, into) {
+function collectEntries(entries, into) {
 	for (const entry of entries) {
 		if (entry === null || typeof entry !== "object") continue;
-		const { id, group, config } = entry;
-		if (typeof id === "string") into.push(id);
-		if (group === true && Array.isArray(config)) collectEntryIds(config, into);
+		const { id, name, group, config } = entry;
+		if (typeof id === "string") into.push({
+			id,
+			name: typeof name === "string" ? name : void 0
+		});
+		if (group === true && Array.isArray(config)) collectEntries(config, into);
 	}
 }
 /**
@@ -2820,25 +3330,240 @@ function createPrefetcher(options = {}) {
 * not provide (design 2026-09-01-harness-compatibility), and — for the
 * shop's OWN declared peers — which ones it provides at a version outside
 * the declared range. */
+const NODE_LOOKUP_FS = {
+	stat: (path) => statSync(path),
+	readFile: (path) => readFileSync(path, "utf8")
+};
+/**
+* One segment of a bare package name, about to be spliced into a path.
+*
+* A leading `.` refuses the segment whole: `.` and `..` would walk the path
+* out of `node_modules`, and `.bin` or `.pnpm` are directories an install
+* carries that no package can be. The ESM resolver agrees as far as it goes:
+* it refuses an unscoped name that starts with `.`, and any name holding `%`
+* or `\`, with ERR_INVALID_MODULE_SPECIFIER (measured on Node 26.6.0 with
+* `.bin`, `a%2e`, `a\b`). `\` is also a separator on Windows, `:` names a
+* drive, an NTFS stream or a URL scheme (`node:fs`, `file:`), and NUL is a
+* byte no path may carry.
+*/
+function isNameSegment(segment) {
+	return segment.length > 0 && !segment.startsWith(".") && !/[\\:%\0]/.test(segment);
+}
 /**
-* The production resolver: the same question the harness's own
-* ClientModuleRegistry asks, through a require anchored at the profile. Asking
-* what the loader asks is what keeps this verdict and the runtime's behaviour
-* from drifting apart.
+* Whether `spec` is a bare package name — `name`, or `@scope/name` — and so
+* safe to look up. Peer names are catalog input, and hostile; this check is
+* what keeps one from becoming a path. The lookup this replaced resolved
+* `'../x/package.json'` relative to the profile and an absolute name as
+* itself, so a peer name could point it at any path on the reader's disk.
+*/
+function isBarePackageName(spec) {
+	const segments = spec.split("/");
+	const [first, second] = segments;
+	if (first === void 0) return false;
+	if (!first.startsWith("@")) return segments.length === 1 && isNameSegment(first);
+	return segments.length === 2 && second !== void 0 && isNameSegment(first.slice(1)) && isNameSegment(second);
+}
+/** Whether `path` stats as a directory. Every stat failure answers false —
+* see `findPackageDir` for why that is Node's rule and not a shortcut. */
+function isDirectoryAt(fs, path) {
+	try {
+		return fs.stat(path).isDirectory();
+	} catch {
+		return false;
+	}
+}
+/** Whether `path` stats as a regular file. Every stat failure answers false,
+* for the reason `isDirectoryAt` gives. */
+function isFileAt(fs, path) {
+	try {
+		return fs.stat(path).isFile();
+	} catch {
+		return false;
+	}
+}
+/**
+* The directory the ESM resolver MATCHES for `spec` from `fromDir`, or null
+* when the walk reaches the filesystem root without one: for each ancestor
+* `dir`, the candidate `dir/node_modules/<spec>`, and the first that stats as
+* a DIRECTORY is the match. A candidate that is anything else — absent, a
+* file, or a path whose stat fails for ANY reason — is "not here", and the
+* walk moves on to the next ancestor.
+*
+* That is Node's own rule, copied from its reader rather than from the spec
+* prose. Node 26.6.0 `internal/modules/package_json_reader.js`
+* (`getPackageJSONURL`) does
+* `const stat = internalModuleStat(...); if (stat !== 1) { ...; continue }`:
+* 1 is "directory", and a failed stat is a negative errno, so EACCES and
+* ELOOP keep walking exactly like ENOENT. Measured on 26.6.0: a self-link
+* (ELOOP) at `node_modules/<name>` in front of an ancestor's real copy makes
+* the import load the ancestor's copy. This walk used to throw on every
+* failure but ENOENT and ENOTDIR, and `incompatibilityMap` turned the throw
+* into no verdict — so a missing peer, whose walk runs all the way to the
+* root, met any unsearchable or looping `node_modules` on the way (a
+* `~/node_modules` made by `sudo npm i` under umask 027, say), and every
+* missing-peer badge in the catalog went silent while those plugins still
+* failed to import.
+*
+* The walk stops at the first match whatever it finds inside: the loader
+* imports from that directory or fails there, and never falls through to an
+* ancestor (measured on 26.6.0: an empty `node_modules/<name>` in front of an
+* ancestor's working copy fails the import with ERR_MODULE_NOT_FOUND).
+* Whether the match is a PACKAGE is `packageDirectory`'s question.
+*
+* Throws only for a `spec` that is not a bare package name. No state of the
+* filesystem can make it throw.
+*/
+function findPackageDir(fromDir, spec, fs) {
+	if (!isBarePackageName(spec)) throw new TypeError(`not a bare package name: ${JSON.stringify(spec)}`);
+	const segments = spec.split("/");
+	for (let dir = fromDir;;) {
+		const candidate = join(dir, "node_modules", ...segments);
+		if (isDirectoryAt(fs, candidate)) return candidate;
+		const parent = dirname(dir);
+		if (parent === dir) return null;
+		dir = parent;
+	}
+}
+/**
+* The directory `spec` is installed at as seen from `fromDir`, or null when
+* it is not installed there: the walk's match (`findPackageDir`), and only
+* when that directory holds a `package.json` that stats as a FILE. Anything
+* else is ABSENT — a match with no manifest, a manifest that is not a file,
+* one whose stat fails — because the loader matches that directory and the
+* import fails there. The case this exists for: an uninstall that stops
+* part-way (on Windows a locked file is enough) can leave
+* `<profile>/node_modules/L/` holding nothing but a nested `node_modules/`,
+* and a plugin declaring L then fails with ERR_MODULE_NOT_FOUND; while any
+* directory counted as present, the badge naming L disappeared. The lookup
+* before that one, `require.resolve('<spec>/package.json')`, required the
+* manifest too.
+*
+* The manifest is stat-ed and never read here: presence is the file, and
+* what it says is the version resolver's question. So a manifest that exists
+* but cannot be read or parsed is a present package with no readable version.
+*
+* One edge is knowingly given up: a directory holding `index.js` and no
+* manifest DOES import — Node's legacy main resolution tries `index.js` in a
+* match without a manifest — but reads absent here. No package manager
+* installs that shape.
+*
+* Throws only for a `spec` that is not a bare package name. This one lookup
+* is behind the presence resolver, the version resolver, and the running
+* harness's own `@deepseek-ai/dsh-app-boot` (`harness.ts`).
+*/
+function packageDirectory(fromDir, spec, fs = NODE_LOOKUP_FS) {
+	const match = findPackageDir(fromDir, spec, fs);
+	return match !== null && isFileAt(fs, join(match, "package.json")) ? match : null;
+}
+/**
+* The directory the walk starts from. `createRequire` took a file URL or an
+* absolute path and so does this — the production anchor is
+* `<profile>/cordis.yml` as a file URL — and, like `createRequire`, a
+* trailing separator names the directory itself rather than a file in its
+* parent. Anything else throws here, at construction, which the gateway's
+* call sites already treat as "no anchor, no verdict".
+*/
+function anchorDirectory(baseUrl) {
+	const path = isAbsolute(baseUrl) ? baseUrl : fileURLToPath(baseUrl);
+	return path.endsWith("/") || path.endsWith(sep) ? path : dirname(path);
+}
+/** `nodeResolver` over an injected filesystem, walking up from `fromDir` —
+* the seam fixtures drive the lookup through. */
+function packageResolver(fromDir, fs) {
+	return (spec) => packageDirectory(fromDir, spec, fs) !== null;
+}
+/**
+* The production resolver, anchored at the profile. A peer is present when
+* the first ancestor `node_modules/<spec>` that is a directory holds a
+* `package.json` file — the directory the ESM resolver that loads plugins'
+* host halves matches for a bare package, and a manifest in it
+* (`findPackageDir`, `packageDirectory`). From `<profile>/cordis.yml` the
+* walk reads `<profile>/node_modules`, then `$DSH_HOME/profiles/node_modules`
+* — the link farm dsh-app-boot's `healProfilesModuleFallback` keeps, pointing
+* into the global dsh install, on 0.1.5; 0.1.7 keeps none, and on a harness
+* that serves its packages another way `harnessPackageResolver` asks it in
+* front of this walk — and so on up to the root, past any candidate
+* it cannot stat, as Node's reader walks past one (measured on Node 26.6.0
+* with a looping link in front of a real copy: the import loads the copy).
+* The one shape where this and the loader knowingly disagree is a directory
+* holding `index.js` and no manifest, which imports and reads absent here;
+* no package manager installs it (`packageDirectory`).
+*
+* It used to ask `require.resolve('<spec>/package.json')`, a question that
+* answered wrongly twice:
+*
+*  - Under a packaged dsh executable (`process.pkg`) the link farm holds ESM
+*    proxy packages instead of symlinks, and a proxy's `exports` leaves
+*    `./package.json` out on purpose, so resolving it threw
+*    ERR_PACKAGE_PATH_NOT_EXPORTED for every proxied peer. Presence read that
+*    as present; the version resolver below could read nothing. Reproduced:
+*    a proxy at `0.2.0-rc.1` against a declared `^0.1.1-rc.2` gave presence
+*    true, version null, mismatches `[]` — the load-time self-check could
+*    never fire under a packaged dsh.
+*  - Node caches a SUCCESSFUL CJS resolution for the life of the process
+*    (`Module._pathCache`, keyed on request + lookup paths) and hands the
+*    cached filename back without looking at the disk; a failure is not
+*    cached. Measured on Node 26.6.0 in one process: absent → false,
+*    installed → true, uninstalled → STILL true. A peer the reader removed
+*    left every plugin declaring it unflagged until dsh restarted.
+*
+* So nothing is cached and `exports` is never consulted: every call stats
+* afresh, and a package with a manifest is present whatever its `exports`
+* says. `stat` follows symlinks, so a link to nothing reads absent — which
+* matters, because the link farm adds links and never prunes them: 29 of its
+* 511 dangled on the machine this was measured on, after upgrades.
+*
+* The global folders — `NODE_PATH`, `~/.node_modules`, `~/.node_libraries`,
+* `$PREFIX/lib/node` — are deliberately not searched: the ESM resolver that
+* loads plugin host code does not search them either. That is not academic.
+* pnpm's bin shims export `NODE_PATH` (this repo's own `node_modules/.bin/
+* vitest` points it into the virtual store), and under one the old lookup
+* found harness packages from any anchor at all, a temp directory included.
+*
+* It throws only for a `spec` that is not a bare package name, and
+* `incompatibilityMap` turns the throw into no verdict: a hostile name is not
+* a fact about this installation, and false is an accusation. Nothing on the
+* filesystem makes it throw. It used to throw on a stat failure other than
+* ENOENT or ENOTDIR as well, reasoning that such a candidate "may hold the
+* package" — but the loader never asks what a candidate it cannot stat holds;
+* it walks on (`findPackageDir`), so the throw silenced true badges and
+* established nothing.
 */
 function nodeResolver(baseUrl) {
-	const require = createRequire(baseUrl);
-	return (spec) => {
-		try {
-			require.resolve(`${spec}/package.json`);
-			return true;
-		} catch (error) {
-			const code = error.code;
-			if (code === "MODULE_NOT_FOUND") return false;
-			if (code === "ERR_PACKAGE_PATH_NOT_EXPORTED") return true;
-			throw error;
-		}
-	};
+	return packageResolver(anchorDirectory(baseUrl), NODE_LOOKUP_FS);
+}
+/**
+* The manifest of the package the harness reaches for `spec` from
+* `parentURL`, or null when it reaches none, or one whose manifest no longer
+* stats as a file. The stat is fresh on every call for the reason §9.4 gives:
+* the service remembers a package it once found, and an uninstalled peer
+* must stop reading as present. Throws what the service throws, and a
+* TypeError for a name that is not a bare package name — which never reaches
+* the service, because peer names are catalog text.
+*/
+function harnessManifest(lookup, spec, parentURL, fs) {
+	if (!isBarePackageName(spec)) throw new TypeError(`not a bare package name: ${JSON.stringify(spec)}`);
+	const manifestPath = lookup.packageOf(spec, parentURL)?.manifestPath;
+	return typeof manifestPath === "string" && isFileAt(fs, manifestPath) ? manifestPath : null;
+}
+/**
+* Presence on a harness that serves its packages through its runtime
+* resolution (`HarnessPackageLookup`): present when the harness reaches a
+* package for `spec` from `parentURL`, the profile anchor, and otherwise
+* whatever `walk` answers — `nodeResolver` over the same anchor, in
+* production. Asking the harness first asks the loader's own question, since
+* a plugin's import goes through the same resolution. The walk stays behind
+* it because either answer can only clear a badge, never raise one, and a
+* false badge is the failure this module exists to avoid.
+*
+* Throws, which `incompatibilityMap` turns into no verdict for the entries
+* declaring `spec`, for a name that is not a bare package name and for
+* anything the service throws. A harness that cannot answer is silence:
+* falling back to the walk alone would read every package it serves as
+* missing.
+*/
+function harnessPackageResolver(walk, lookup, parentURL, fs = NODE_LOOKUP_FS) {
+	return (spec) => harnessManifest(lookup, spec, parentURL, fs) !== null || walk(spec);
 }
 /**
 * Package name → the peer names that did not resolve. A key is present only
@@ -2876,29 +3601,79 @@ function incompatibilityMap(entries, resolve) {
 	}
 	return out;
 }
-/**
-* The production resolver: `nodeResolver`'s own resolution, kept this time
-* instead of collapsed to a boolean. Anything that leaves no version to read
-* answers null — a peer that is absent, one that restricts `./package.json`
-* in its exports, an unreadable or malformed manifest, a manifest with no
-* `version`. Absence is deliberately NOT reported as a version violation:
-* `incompatibilityMap` is what covers a missing peer.
-*/
-function nodeVersionResolver(baseUrl) {
-	const require = createRequire(baseUrl);
+/** `nodeVersionResolver` over an injected filesystem, walking up from
+* `fromDir` — the seam fixtures drive the lookup through. */
+function packageVersionResolver(fromDir, fs) {
 	return (spec) => {
-		let manifestPath;
+		let dir;
 		try {
-			manifestPath = require.resolve(`${spec}/package.json`);
+			dir = packageDirectory(fromDir, spec, fs);
 		} catch {
 			return null;
 		}
+		return dir === null ? null : manifestVersion(fs, join(dir, "package.json"));
+	};
+}
+/** The non-empty `version` string of the manifest at `manifestPath`, or null
+* for anything else. */
+function manifestVersion(fs, manifestPath) {
+	let manifest;
+	try {
+		manifest = JSON.parse(fs.readFile(manifestPath));
+	} catch {
+		return null;
+	}
+	const version = typeof manifest === "object" && manifest !== null ? manifest.version : void 0;
+	return typeof version === "string" && version.length > 0 ? version : null;
+}
+/**
+* The production version resolver: `nodeResolver`'s lookup, then the matched
+* directory's own `package.json`, read directly. Reading it directly is the
+* fix, not a shortcut: resolving `<spec>/package.json` is what an exports map
+* can refuse, and a packaged dsh's module proxy refuses it by construction
+* while carrying the proxied package's version in exactly that file (see
+* `nodeResolver`).
+*
+* The directory is the one the presence resolver finds present — the walk's
+* first directory match, holding a `package.json` file (`packageDirectory`;
+* `findPackageDir` cites Node's reader) — so the two never disagree about
+* which copy is installed: a candidate nobody can stat is walked past to the
+* copy further up, whose version is then the answer, exactly as the loader
+* imports that copy (measured on Node 26.6.0 with a looping link in front of
+* it); a match without a manifest is absent, and shadows every copy above
+* it. An `index.js`-only directory, which the loader would import, has no
+* manifest to read a version from either way.
+*
+* Anything that leaves no version to read answers null: a spec that is not a
+* bare package name, a peer that is absent, a manifest that is unreadable or
+* malformed, a `version` that is not a non-empty string. Absence is
+* deliberately NOT reported as a version violation: `incompatibilityMap` is
+* what covers a missing peer.
+*/
+function nodeVersionResolver(baseUrl) {
+	return packageVersionResolver(anchorDirectory(baseUrl), NODE_LOOKUP_FS);
+}
+/**
+* `harnessPackageResolver`'s twin for versions: read afresh from the manifest
+* of the package the harness reaches for `spec` — the copy a plugin's import
+* loads, which the walk cannot see on dsh 0.1.7 — and `walk`'s answer only
+* when the harness reaches none. A manifest the harness names but nobody can
+* read or parse answers null, never the walk's version: the walk may match
+* another copy, and the version must describe the copy presence found (see
+* `nodeVersionResolver`).
+*
+* Null for a name that is not a bare package name and for a service that
+* throws, as null is already this resolver's no-verdict signal.
+*/
+function harnessPackageVersionResolver(walk, lookup, parentURL, fs = NODE_LOOKUP_FS) {
+	return (spec) => {
+		let manifestPath;
 		try {
-			const version = JSON.parse(readFileSync(manifestPath, "utf8")).version;
-			return typeof version === "string" ? version : null;
+			manifestPath = harnessManifest(lookup, spec, parentURL, fs);
 		} catch {
 			return null;
 		}
+		return manifestPath === null ? walk(spec) : manifestVersion(fs, manifestPath);
 	};
 }
 /**
@@ -2974,6 +3749,186 @@ function createPeerVersionCheck(deps) {
 	};
 }
 //#endregion
+//#region src/host/harness.ts
+/**
+* The harness this process runs: which `@deepseek-ai/dsh` it is, and that
+* dsh's own profile-template table — the running side of the
+* `dsh.compatibility` verdict (design 2026-09-01-harness-compatibility §9.9).
+*
+* Both used to be read from somewhere that is not the running harness, and
+* both were wrong there:
+*
+* - The version was the first `node_modules/@deepseek-ai/dsh` found walking up
+*   from the profile: what the profile can IMPORT, not what RUNS. A plugin
+*   that depends on the dsh package gets its copy hoisted into
+*   `<profile>/node_modules` — the listed `dsh-claude-tui@0.1.6` pulls
+*   0.1.2-rc.1 — a second install sharing DSH_HOME re-points the link farm,
+*   and under a packaged dsh the bin-only package gets no link-farm proxy at
+*   all, so the read was dead or stale. The first was reproduced with real
+*   installs on 2026-09-25 (the design's section 9.9 amendment): every
+*   verdict said "running 0.1.2-rc.1" while 0.1.5-rc.3 ran.
+* - The templates came from the shop's own `import * as appBoot`, which
+*   resolves from the SHOP's real path: under a `link:` install that is this
+*   repository's devDependency, 0.1.1-rc.2 with two templates, while
+*   0.1.5-rc.3 with five runs — and in production a copy hoisted from some
+*   plugin's dependencies can shadow it the same way.
+*
+* Both now come from the one thing that names the running harness: the script
+* this process was started with. Resolved through symlinks, the package that
+* owns it IS the dsh CLI that is running, if it is one at all; its manifest
+* says its version, and the app-boot it imports says its templates.
+*/
+/** The package whose `PROFILE_TEMPLATES` the running dsh composes profiles
+* from. */
+const APP_BOOT = "@deepseek-ai/dsh-app-boot";
+/** What is known when nothing says which harness runs. */
+function noHarness() {
+	return {
+		dshVersion: null,
+		templates: profileTemplatesOf(void 0),
+		patchLists: null,
+		peerCheck: null
+	};
+}
+/** Whether `path` stats as a regular file. */
+function isFile(path) {
+	try {
+		return statSync(path).isFile();
+	} catch {
+		return false;
+	}
+}
+/**
+* The package that owns `start`: the FIRST directory at or above it holding a
+* `package.json` file, and its parsed manifest — or null when there is none
+* up to the root, or when that manifest cannot be read or parsed. The walk
+* stops at the first manifest whatever it names, the rule `owningEntry` in
+* `dsh-cli.ts` follows: a script owned by some other package is not dsh's,
+* and climbing on would find an unrelated ancestor — a workspace root, or dsh
+* itself above a package vendored inside it.
+*/
+function owningPackage(start) {
+	for (let dir = start;;) {
+		const manifestPath = join(dir, "package.json");
+		if (isFile(manifestPath)) try {
+			return {
+				dir,
+				manifest: JSON.parse(readFileSync(manifestPath, "utf8"))
+			};
+		} catch {
+			return null;
+		}
+		const parent = dirname(dir);
+		if (parent === dir) return null;
+		dir = parent;
+	}
+}
+/**
+* What the app-boot the dsh at `dshDir` imports says about that dsh: its
+* template table, and whether it reads a list-valued bundle patch. Null when
+* no app-boot is on the resolution path.
+*
+* Found with the node_modules walk the peer check uses (`packageDirectory`)
+* from the dsh package directory — the copy nested under dsh first, then one
+* beside it, as dsh's own import finds it — and never through `NODE_PATH`:
+* pnpm's bin shims export one, and a bare CJS lookup finds a package through
+* it from any directory at all. Only the ABSOLUTE directory then reaches
+* Node's CJS resolver, which reads its `main` (an `exports` map applies to
+* bare specifiers only), and the entry is imported by file URL, which Windows
+* requires of an absolute path. Under the dsh that runs, that URL is the one
+* dsh itself loaded — the CJS resolver realpaths as the ESM loader does, and
+* app-boot's `main` and `exports` name the same file — so the import is a
+* cache hit, not a second instance. Measured against a global npm install of
+* 0.1.5-rc.3: this chain and the ESM resolution from dsh's own `lib/bin.js`
+* give the same URL, and the reader, handed `<prefix>/bin/dsh`, answers
+* 0.1.5-rc.3 with all five templates.
+*
+* Throws for whatever that chain cannot do; `readRunningHarness` turns any
+* throw into an empty table, an unknown `patchLists` and no peer check.
+*/
+async function appBootFacts(dshDir) {
+	const appBootDir = packageDirectory(dshDir, APP_BOOT);
+	if (appBootDir === null) return null;
+	const entry = createRequire(import.meta.url).resolve(appBootDir);
+	const exported = await import(pathToFileURL(entry).href);
+	return {
+		templates: profileTemplatesOf(exported.PROFILE_TEMPLATES),
+		patchLists: typeof exported.bundlePatchFiles === "function",
+		peerCheck: peerCheckOf(exported, appBootDir)
+	};
+}
+/**
+* The peer check an app-boot exports, bound to its own version (see
+* `PeerCheck.evaluate`), or null when it exports only part of one — a rule
+* without the exemptions would refuse what a profile has already allowed —
+* or when its manifest carries no version, which is the one `evaluate`
+* judges by. Never throws, so a check that cannot be formed costs the
+* templates and the patch-list answer nothing.
+*/
+function peerCheckOf(exported, appBootDir) {
+	const { evaluatePluginCompatibility: evaluate, readProfileVersionExemptions: exemptions } = exported;
+	if (typeof evaluate !== "function" || typeof exemptions !== "function") return null;
+	let version;
+	try {
+		version = JSON.parse(readFileSync(join(appBootDir, "package.json"), "utf8")).version;
+	} catch {
+		return null;
+	}
+	if (typeof version !== "string" || version.length === 0) return null;
+	const runtime = version;
+	const judge = evaluate;
+	return {
+		evaluate: (manifest, profileExemptions) => judge(manifest, profileExemptions, runtime),
+		exemptions
+	};
+}
+/**
+* The harness this process runs, identified from `script` — the gateway's
+* `restartScript`, `process.argv[1]` in production — or nothing, never a
+* guess:
+*
+* 1. `script` is resolved through symlinks, because `argv[1]` is the path the
+*    shell ran — `<prefix>/bin/dsh`, a link — and only its target lies inside
+*    the dsh package. No script, or one that does not resolve: nothing known.
+*    An empty path is no script either: `realpathSync('')` answers the
+*    working directory, which says where dsh was started, not what it is.
+* 2. The package that owns it (`owningPackage`) must be `@deepseek-ai/dsh`.
+*    Anything else — a test runner, another host embedding the shop — means
+*    nothing here can say which harness runs, and both halves of the verdict
+*    stay silent.
+* 3. `dshVersion` is that manifest's `version` when it is a non-empty string.
+* 4. `templates`, `patchLists` and `peerCheck` come from that dsh's own
+*    app-boot (`appBootFacts`). Any failure there costs all three and keeps
+*    the version.
+*
+* Never throws and never rejects: a harness nobody could identify forms no
+* verdict, and must never be the reason the catalog fails to load.
+*/
+async function readRunningHarness(script) {
+	try {
+		if (script === void 0 || script === "") return noHarness();
+		const owner = owningPackage(dirname(realpathSync(script)));
+		if (owner === null || typeof owner.manifest !== "object" || owner.manifest === null) return noHarness();
+		const { name, version } = owner.manifest;
+		if (name !== "@deepseek-ai/dsh") return noHarness();
+		const dshVersion = typeof version === "string" && version.length > 0 ? version : null;
+		let facts;
+		try {
+			facts = await appBootFacts(owner.dir);
+		} catch {
+			facts = null;
+		}
+		return {
+			dshVersion,
+			templates: facts?.templates ?? profileTemplatesOf(void 0),
+			patchLists: facts?.patchLists ?? null,
+			peerCheck: facts?.peerCheck ?? null
+		};
+	} catch {
+		return noHarness();
+	}
+}
+//#endregion
 //#region src/host/index.ts
 /** ShopGateway: the Host half of dsh-plugin-shop (§5.1). */
 var __runInitializers = function(thisArg, initializers, value) {
@@ -3026,10 +3981,16 @@ var __esDecorate = function(ctor, descriptorIn, decorators, contextIn, initializ
 * service and to set an override that the platform check, being the first gate
 * of the three, could never reach. */
 const RESTART_BLOCKED_DETAIL = {
+	desktop: "dsh-plugin-shop: the desktop profile is managed by the DeepSeek Harness desktop app, and dsh refuses to restart it from here; restart the app to apply the change",
 	windows: "dsh-plugin-shop: restart is not supported on Windows yet; restart dsh manually to apply the change",
 	systemd: "dsh-plugin-shop: restart is disabled because this process is a systemd service — a restart would kill the takeover helper along with the unit, and the service would not come back. Set allowRestart: true in the shop row config to override.",
 	"port-zero": "dsh-plugin-shop: restart is not supported when dsh was launched with --port 0; restart dsh manually"
 };
+/** Why the shop changes nothing in the desktop profile, for every mutation
+* that spawns dsh's CLI: install, uninstall and self-update. dsh refuses
+* the profile before any of them would run (`isDesktopProfile`), and the
+* failure that surfaced instead read "pnpm failed in the profile". */
+const DESKTOP_PROFILE_DETAIL = "dsh-plugin-shop: the desktop profile is managed by the DeepSeek Harness desktop app, and dsh refuses to change it from the command line the shop runs; add and remove its plugins from the app instead";
 /** How many bytes a release tarball may be at the integrity check. The
 * registry already refuses to publish a tarball over 32 MiB, so 64 MiB is
 * headroom, not a gate of its own. */
@@ -3087,6 +4048,25 @@ async function verifyTarballSha256(fetchTarball, url, recordedSha256, maxBytes =
 function ownDependencySpec(dependencies, name) {
 	return Object.hasOwn(dependencies, name) ? dependencies[name] : void 0;
 }
+/**
+* Package names whose module this PROCESS may already hold in Node's module
+* cache (design 2026-09-26-market-borrowings §1.2).
+*
+* A hot mount can only deliver code the process has not imported yet. The hot
+* tree imports through the loader's `internal.import`, which is Node's own ESM
+* loader and caches a module by its URL, and an install rewrites a package's
+* files at the URL it already had (`nodeLinker: hoisted`). Once a name is in
+* here, a mount of it would re-run the cached module under whatever version is
+* now on disk.
+*
+* Module scope rather than a gateway field, because the cache it models is the
+* process's: a gateway rebuilt inside a running dsh — a restarted shop fiber —
+* must not forget what the process imported before it existed. Every gateway
+* seeds it with the profile's dependencies at construction (the boot
+* composition) and extends it with every name the hot path mounts. Nothing is
+* ever removed: an uninstall disposes the fiber, not the module record.
+*/
+const importedThisProcess = /* @__PURE__ */ new Set();
 /** Remote-only service exposing the shop Remote methods of §7.3.
 *
 * @typert service shop */
@@ -3234,6 +4214,17 @@ let ShopGateway = (() => {
 			});
 		}
 		options = __runInitializers(this, _instanceExtraInitializers);
+		/** The context this gateway was built with: the shop's own fiber. Inside an
+		* RPC method `this.ctx` is NOT that — cordis hands a service out with `ctx`
+		* rebound to the context that looked it up, so a call arriving over the
+		* wire sees the caller's, the typert gateway's (measured on 0.1.5-rc.3 and
+		* 0.1.7-rc.2). Anything whose PARENT matters is registered from here. The
+		* hot tree above all: registered from the gateway's context it was owned by
+		* the gateway's fiber rather than the shop's, was listed under the gateway's
+		* loader entry, and — the part a reader saw — sat where dsh's client
+		* registry never composed it, so a hot-installed browser half needed a
+		* restart that a reload now does (design 2026-09-26-dsh-017-readiness). */
+		home;
 		/** The profile dsh installs into; discovered from this module's own
 		* location when the caller does not supply one. */
 		profile;
@@ -3269,6 +4260,8 @@ let ShopGateway = (() => {
 		/** One pump for the whole gateway: batching is per profile and lives inside
 		* it, so a second instance would race the first for the same store. */
 		prefetcher;
+		/** What this process may already have imported (see `importedThisProcess`). */
+		imported;
 		/** The install gate runs against the last loaded snapshot, never a fresh
 		* fetch per request (§7.2: the Host's cached snapshot is the truth). */
 		/** Finished install records retained, so a poll sees the true terminal
@@ -3288,22 +4281,18 @@ let ShopGateway = (() => {
 		/** The user's own `registry=` from `~/.npmrc`, read at most once per
 		* gateway. A wrapper distinguishes a genuine `null` from an unread value. */
 		npmRegistryCache = null;
-		/** The incompatibility map already computed for `lastSnapshot`, keyed by
-		* that snapshot's own object identity. Design §3 asks for the verdict
-		* once per loaded snapshot, not once per RPC call: `loadCatalog` serves
-		* the same snapshot from its on-disk cache for minutes at a time, so
-		* without this, reopening the tab within that window would re-walk
-		* `node_modules` for every distinct peer name again — and Node only
-		* caches a SUCCESSFUL resolution, so a genuinely missing peer pays a full
-		* failed walk on every single call. Recomputed only when `catalog()`
-		* loads a snapshot that is not this exact object. */
-		incompatibleCache = null;
+		/** The harness this process runs, read at most once per gateway: which dsh
+		* is running cannot change while it runs, and the read imports a module. A
+		* promise, so concurrent first calls share one read; `readRunningHarness`
+		* never rejects, so there is no failure to retry. */
+		harnessRead = null;
 		/** Install records, running and finished; a poll finds one here or reports not found. */
 		installs = /* @__PURE__ */ new Map();
 		/** Every install id in insertion order, oldest first; finished-record eviction walks this from the front. */
 		installOrder = [];
 		constructor(ctx, options = {}) {
 			super(ctx, "shop");
+			this.home = ctx;
 			this.options = options;
 			this.profile = options.profile ?? discoverProfile(fileURLToPath(import.meta.url), this.bootBaseDir()).name;
 			this.profileDir = options.profileDir;
@@ -3332,6 +4321,8 @@ let ShopGateway = (() => {
 			this.ppid = options.ppid ?? process.ppid;
 			this.fetchTarball = options.fetchTarball ?? ((url) => fetch(url));
 			this.prefetcher = options.prefetcher ?? createPrefetcher();
+			this.imported = options.importedModules ?? importedThisProcess;
+			for (const name of Object.keys(this.profileDependenciesOrNone() ?? {})) this.imported.add(name);
 			try {
 				cleanHotDir(this.profileDirResolved());
 			} catch {}
@@ -3347,7 +4338,7 @@ let ShopGateway = (() => {
 			try {
 				createPeerVersionCheck({
 					ranges: this.options.peerRanges ?? ownPeerRanges(),
-					resolve: this.options.resolvePeerVersion ?? nodeVersionResolver(pathToFileURL(join(this.profileDirResolved(), "cordis.yml")).href),
+					resolve: this.options.resolvePeerVersion ?? this.peerVersionResolver(this.profileAnchor()),
 					warn: (message) => {
 						const logger = this.ctx.logger;
 						if (logger === void 0) console.warn(message);
@@ -3379,6 +4370,64 @@ let ShopGateway = (() => {
 			if (this.profileDir !== void 0) return this.profileDir;
 			return discoverProfile(fileURLToPath(import.meta.url), this.bootBaseDir()).dir;
 		}
+		/** Where every "what can this installation's plugins import?" question
+		* resolves from: the profile's own Loader root, which is where the harness
+		* resolves plugins from. One definition for the peer presence check and the
+		* load-time self-check, so neither can drift onto a different notion of
+		* "the installation". NOT where the running harness is read from: a copy
+		* of `@deepseek-ai/dsh` a plugin's dependencies hoist into the profile is
+		* importable from here and is not what runs (`harness.ts`). Throws when no
+		* profile directory can be discovered and none is given. */
+		profileAnchor(profileDir = this.profileDirResolved()) {
+			return pathToFileURL(join(profileDir, "cordis.yml")).href;
+		}
+		/** dsh's `pluginPackages` service, when the running harness provides one
+		* (0.1.7 and later), else null. Read on each use, like `pluginInventory`.
+		* It is how such a harness serves its own packages to plugins, which no
+		* walk of the profile's disk can see (design
+		* 2026-09-01-harness-compatibility §11). */
+		harnessPackages() {
+			const service = this.ctx.get?.("pluginPackages");
+			return typeof service?.packageOf === "function" ? service : null;
+		}
+		/** dsh's `pluginManager` service, when the running harness provides one
+		* (0.1.7 and later), else null. Read on each use, like `pluginPackages`.
+		* It is the only way back for a bundle its Plugins page deselected: the
+		* 0.1.7 CLI does not select an installed package again on `add`, while
+		* 0.1.5's does (both measured 2026-09-27). */
+		pluginManager() {
+			const service = this.ctx.get?.("pluginManager");
+			return typeof service?.setBundleEnabled === "function" ? service : null;
+		}
+		/** "Does this installation provide `spec`?", asked from `anchor`: the
+		* harness's own resolution in front of the walk where the harness has one,
+		* the walk alone where it has not. */
+		peerResolver(anchor) {
+			const walk = nodeResolver(anchor);
+			const packages = this.harnessPackages();
+			return packages === null ? walk : harnessPackageResolver(walk, packages, anchor);
+		}
+		/** `peerResolver`'s twin for the versions the load-time self-check reads. */
+		peerVersionResolver(anchor) {
+			const walk = nodeVersionResolver(anchor);
+			const packages = this.harnessPackages();
+			return packages === null ? walk : harnessPackageVersionResolver(walk, packages, anchor);
+		}
+		/** `profileDirResolved`, or null when no profile directory can be
+		* discovered — for the reads that answer "cannot tell" rather than fail. */
+		profileDirOrNone() {
+			try {
+				return this.profileDirResolved();
+			} catch {
+				return null;
+			}
+		}
+		/** The harness this process runs, read once (see `harnessRead`). */
+		runningHarness() {
+			const read = this.options.readHarness ?? readRunningHarness;
+			this.harnessRead ??= read(this.restartScript);
+			return this.harnessRead;
+		}
 		/** The inventory, through the wire remote: an envelope `{ ok, value }` or
 		* `{ ok: false, error }`. Each row is re-validated before trust (same
 		* discipline as the rowConfig cast). */
@@ -3403,8 +4452,9 @@ let ShopGateway = (() => {
 		* down. A disable can land while the entry's init is still in flight: the
 		* options flip but the finishing init brings the fiber up anyway, and a
 		* plain re-update no-ops on the empty diff (dsh-market themes.ts:74-93).
-		* For an update swap this sequencing is mandatory, not defensive: two live
-		* instances of a service-providing plugin would collide at provision. */
+		* The uninstall path is the one caller: an update used to swap its running
+		* instance for a hot mount through here, and no longer mounts at all
+		* (design 2026-09-26-market-borrowings §1). */
 		/** The package's owned entry ids, or none when its bundle patch cannot be
 		* read. For the paths where a live disable is an optimization and the
 		* operation must succeed regardless; `setEnabled` reports the failure
@@ -3438,8 +4488,8 @@ let ShopGateway = (() => {
 		* Through `ownDependencySpec` for the reason spelled out there: a bare index
 		* read answers for `Object.prototype`, and `constructor` is a legal npm
 		* name. The cost on this path is behavioural twice over — the gate would
-		* weigh a function as the installed spec, and a phantom `isUpdate` would run
-		* `liveDisableIds` against something absent.
+		* weigh a function as the installed spec, and a phantom `isUpdate` would
+		* refuse a hot mount to a package this process never imported.
 		*/
 		installedSpecOf(name) {
 			const dependencies = this.profileDependenciesOrNone();
@@ -3503,11 +4553,12 @@ let ShopGateway = (() => {
 			}
 			return allDown;
 		}
-		/** Enable or disable one installed plugin, hot (§8): a disable writes the
-		* row to the user layer, an enable drops it again so the bundle default
-		* rules — the CLI's watchUserPatches applies either through HMR. The shop's
-		* own row and the framework's bundles are never toggleable: disabling the
-		* host chain would break HMR itself. */
+		/** Enable or disable one installed plugin, hot (§8): the write sets the
+		* `disabled` key of each owned entry's row in the user layer and changes
+		* nothing else there (design 2026-09-26-market-borrowings §2) — the CLI's
+		* watchUserPatches applies it through HMR. The shop's own row and the
+		* framework's bundles are never toggleable: disabling the host chain would
+		* break HMR itself. */
 		async setEnabled(args) {
 			if (args.name === "dsh-plugin-shop" || args.name.startsWith("@deepseek-ai/")) return {
 				ok: false,
@@ -3521,7 +4572,7 @@ let ShopGateway = (() => {
 			};
 			let owned;
 			try {
-				owned = ownedEntryIds({
+				owned = ownedEntries({
 					profileDir,
 					packageName: args.name
 				});
@@ -3535,16 +4586,19 @@ let ShopGateway = (() => {
 				ok: false,
 				detail: `dsh-plugin-shop: ${args.name} contributes no plugin entries, so there is nothing to enable or disable`
 			};
-			const ownedSet = new Set(owned);
+			const selected = this.runningProfileBundles(profileDir);
+			if (selected !== null && !selected.includes(args.name)) return this.setDeselectedEnabled(args.name, args.enabled, profileDir, owned);
+			const ownedSet = new Set(owned.map((entry) => entry.id));
 			if ((await this.listInventory()).filter((entry) => ownsEntryId(ownedSet, entry.entryId)).length === 0) return {
 				ok: false,
 				detail: `dsh-plugin-shop: ${args.name} is installed but its entries are not in the running plugin tree; restart dsh to compose them`
 			};
 			setUserLayerRows({
 				profileDir,
-				rows: owned.map((id) => ({
+				rows: owned.map(({ id, name }) => ({
 					id,
-					disabled: !args.enabled
+					disabled: !args.enabled,
+					...name !== void 0 ? { name } : {}
 				}))
 			});
 			return {
@@ -3556,6 +4610,70 @@ let ShopGateway = (() => {
 				})
 			};
 		}
+		/**
+		* `setEnabled` for an installed package whose bundle the profile does not
+		* select.
+		*
+		* Switching it off writes the plugin-level rows and nothing else: none of
+		* it runs, and the rows keep it off if dsh selects the bundle again.
+		* Switching it on selects the bundle through dsh's own `pluginManager`, the
+		* writer behind the switch that deselected it, and then clears the
+		* plugin-level rows as an ordinary enable does. A harness without that
+		* service gets the way back in words instead. `dsh plugin add <name>` is
+		* not printed: it selects the bundle again only on 0.1.5, and it lets pnpm
+		* float a registry package to `latest`.
+		*/
+		async setDeselectedEnabled(name, enabled, profileDir, owned) {
+			const rows = owned.map(({ id, name: moduleName }) => ({
+				id,
+				disabled: !enabled,
+				...moduleName !== void 0 ? { name: moduleName } : {}
+			}));
+			if (!enabled) {
+				setUserLayerRows({
+					profileDir,
+					rows
+				});
+				return {
+					ok: true,
+					activation: "live"
+				};
+			}
+			const manager = this.pluginManager();
+			if (manager === null) return {
+				ok: false,
+				detail: `dsh-plugin-shop: ${name} is installed but switched off at the bundle level: dsh.profile.bundles in ${join(profileDir, "package.json")} does not list it, so dsh composes none of it, and a restart will not change that. This dsh has no pluginManager service to select it again: add "${name}" back to that list and restart dsh, or uninstall it and install it again from the shop.`
+			};
+			let change;
+			try {
+				change = await manager.setBundleEnabled(name, true);
+			} catch (error) {
+				return {
+					ok: false,
+					detail: `dsh-plugin-shop: dsh could not select ${name} again: ${String(error)}`
+				};
+			}
+			if (change.application === "failed" || change.application === "cancelled" || change.error !== void 0) return {
+				ok: false,
+				detail: `dsh-plugin-shop: dsh refused to select ${name} again (${typeof change.error?.code === "string" ? change.error.code : String(change.application)})${typeof change.error?.diagnostic === "string" ? `: ${change.error.diagnostic}` : ""}`
+			};
+			setUserLayerRows({
+				profileDir,
+				rows
+			});
+			if (change.application === "restart-required") return {
+				ok: true,
+				activation: "restart"
+			};
+			return {
+				ok: true,
+				activation: activationOf({
+					hostLive: true,
+					clientLive: true,
+					hasClientHalf: this.packageHasClientHalf(name)
+				})
+			};
+		}
 		rowConfig() {
 			if (this.options.catalogUrl !== void 0 && this.options.cacheDir !== void 0) return {
 				catalogUrl: this.options.catalogUrl,
@@ -3635,11 +4753,16 @@ let ShopGateway = (() => {
 		* static does. One ordered list, read by `restart()` before it commits and
 		* by `version()` so the client can say the same thing up front.
 		*
-		* The order is the order the refusals were written in and is load-bearing
-		* for the copy a reader sees: Windows first, because the platform check has
-		* no override and reporting the systemd one there sends a Windows user to
-		* set `allowRestart: true`, which this gate would still refuse.
+		* The order is load-bearing for the copy a reader sees. The desktop
+		* profile first: dsh itself refuses to launch it, so no platform,
+		* supervisor or port could make a restart possible there. Then Windows,
+		* because the platform check has no override and reporting the systemd one
+		* there sends a Windows user to set `allowRestart: true`, which this gate
+		* would still refuse.
 		*
+		* - `desktop`: dsh's CLI refuses `--profile desktop` ("managed exclusively
+		*   by the Electron application"), so the relaunch would exit at once and
+		*   leave nothing on the port; the app restarts it.
 		* - `windows`: the handoff helper is a POSIX shell one-liner (restart.ts)
 		*   and there is no `sh` on Windows. That spawn fails ASYNCHRONOUSLY, so
 		*   committing would answer `ok: true`, exit this process, and leave nothing
@@ -3651,6 +4774,7 @@ let ShopGateway = (() => {
 		* - `port-zero`: the OS hands the NEW process a fresh port the browser
 		*   cannot know, so a restart would strand the client on a dead origin. */
 		staticRestartBlock() {
+			if (isDesktopProfile(this.profile)) return "desktop";
 			if (!this.restartPlatformSupported()) return "windows";
 			if (detectSupervisor(this.env, { ppid: this.ppid }) === "systemd" && !this.allowRestartConfigured()) return "systemd";
 			const portIndex = this.restartArgv.indexOf("--port");
@@ -3664,20 +4788,31 @@ let ShopGateway = (() => {
 		/** Browse the catalog (§7.3): cached snapshot, refreshed on demand. */
 		async catalog(args) {
 			const { snapshot, stale } = await this.loadCatalogOnce(args?.refresh ?? false);
-			let incompatible;
-			if (this.incompatibleCache !== null && this.incompatibleCache.snapshot === snapshot) incompatible = this.incompatibleCache.map;
-			else {
-				try {
-					const resolve = this.options.resolvePeer ?? nodeResolver(pathToFileURL(join(this.profileDirResolved(), "cordis.yml")).href);
-					incompatible = incompatibilityMap(snapshot.entries, resolve);
-				} catch {
-					incompatible = {};
-				}
-				this.incompatibleCache = {
-					snapshot,
-					map: incompatible
-				};
+			const harness = await this.runningHarness();
+			const profileDir = this.profileDirOrNone();
+			let incompatible = {};
+			if (profileDir !== null) try {
+				const resolve = this.options.resolvePeer ?? this.peerResolver(this.profileAnchor(profileDir));
+				incompatible = incompatibilityMap(snapshot.entries, resolve);
+			} catch {
+				incompatible = {};
+			}
+			let incompatibleHarness;
+			try {
+				incompatibleHarness = compatibilityMap(snapshot.entries, {
+					dshVersion: harness.dshVersion,
+					profile: {
+						name: this.profile,
+						bundles: profileDir === null ? null : this.runningProfileBundles(profileDir)
+					}
+				}, harness.templates);
+			} catch {
+				incompatibleHarness = {};
 			}
+			for (const [key, peers] of Object.entries(this.refusedByHarness(snapshot.entries, harness, profileDir))) incompatibleHarness[key] = {
+				...incompatibleHarness[key],
+				peers
+			};
 			return {
 				schemaVersion: snapshot.schemaVersion,
 				builtAt: snapshot.builtAt,
@@ -3686,15 +4821,56 @@ let ShopGateway = (() => {
 				denied: snapshot.denied,
 				notAShop: snapshot.notAShop ?? [],
 				stars: snapshot.stars,
-				incompatible
+				incompatible,
+				incompatibleHarness
 			};
 		}
 		/**
+		* The installs the running dsh will refuse on their harness peers
+		* (`peerVerdictsOf`), judged against the exemptions this profile holds —
+		* read on every call like the other verdicts, because recording one is
+		* exactly the event that must clear a card: the reader runs the command
+		* the card shows, presses Refresh, and the install is allowed. Empty when
+		* the running dsh has no such check (before 0.1.7) or no profile was
+		* found, and when either read throws: a refusal nobody could establish is
+		* never shown, least of all as a disabled button.
+		*/
+		refusedByHarness(entries, harness, profileDir) {
+			if (harness.peerCheck === null || profileDir === null) return {};
+			try {
+				return peerVerdictsOf(entries, harness.peerCheck, harness.peerCheck.exemptions(profileDir), this.profile);
+			} catch {
+				return {};
+			}
+		}
+		/**
+		* The bundles the profile at `profileDir` composes, or null when its
+		* manifest cannot be read — which is no verdict on the profile half rather
+		* than an accusation. `dsh.profile.bundles` is the same list
+		* `discoverProfile` uses to recognize a profile directory, read through the
+		* harness's own parser so a profile this shop was booted inside is read the
+		* way dsh reads it.
+		*/
+		runningProfileBundles(profileDir) {
+			try {
+				const bundles = readProfileManifest("dsh-plugin-shop", profileDir).dsh?.profile?.bundles;
+				if (!Array.isArray(bundles) || !bundles.every((bundle) => typeof bundle === "string")) return null;
+				return bundles;
+			} catch {
+				return null;
+			}
+		}
+		/**
 		* Install one cataloged version into the profile (§7.2). The rejection
 		* paths run against this Host's snapshot before anything is spawned; only a
 		* passing request reaches the executor.
 		*/
 		async install(args) {
+			if (isDesktopProfile(this.profile)) return {
+				ok: false,
+				code: "desktop-profile",
+				detail: DESKTOP_PROFILE_DETAIL
+			};
 			const snapshot = await this.snapshotNow();
 			const installedSpec = this.installedSpecOf(args.name);
 			const verdict = validateInstall(snapshot, args, installedSpec);
@@ -3721,9 +4897,8 @@ let ShopGateway = (() => {
 				};
 				spec = `github:${entry.repo}#${args.version}${entry.subdir !== void 0 ? `&path:${entry.subdir}` : ""}`;
 			} else spec = `${args.name}@${args.version}`;
-			const isUpdate = installedSpec !== void 0;
-			const priorEntryIds = isUpdate ? this.ownedEntryIdsOrNone(args.name) : [];
-			const priorClientHalf = isUpdate && this.packageHasClientHalf(args.name);
+			const alreadyImported = installedSpec !== void 0 || this.imported.has(args.name);
+			const harness = await this.runningHarness();
 			const running = startInstall({
 				profile: this.profile,
 				spec,
@@ -3736,29 +4911,37 @@ let ShopGateway = (() => {
 						packageName: args.name,
 						dependencies: Object.keys(this.profileDependenciesOrNone() ?? {})
 					});
-					if (clash === null) return null;
-					return `dsh-plugin-shop: ${args.name} declares the loader entry id "${clash.id}", which ${clash.holder} already declares. dsh refuses to load a plugin tree holding a duplicate entry id, so the profile would not start. It is on disk: run \`dsh plugin --profile ${this.profile} remove ${args.name}\` to undo this install.`;
+					const undo = ` It is on disk: run \`dsh plugin --profile ${this.profile} remove ${args.name}\` to undo this install.`;
+					if (clash !== null) return `dsh-plugin-shop: ${args.name} declares the loader entry id "${clash.id}", which ${clash.holder} already declares. dsh refuses to load a plugin tree holding a duplicate entry id, so the profile would not start.` + undo;
+					switch (patchDeclarationHazard(declaredBundlePatch({
+						profileDir: this.profileDirResolved(),
+						packageName: args.name
+					}), harness.patchLists)) {
+						case null: return null;
+						case "list-unsupported": return `dsh-plugin-shop: ${args.name} lists its bundle patch as several files, which dsh reads from 0.1.7 on; this dsh${harness.dshVersion === null ? "" : ` (${harness.dshVersion})`} reads one and would not start with it installed.` + undo;
+						case "malformed": return `dsh-plugin-shop: ${args.name} declares its bundle patch as neither a file path nor a list of them, which dsh refuses to load, so the profile would not start.` + undo;
+					}
 				},
 				afterDone: async () => {
+					if (alreadyImported) return {
+						activation: "restart",
+						restartReason: "already-loaded"
+					};
 					const hot = this.hot ?? {
 						mount: hotMount,
 						unmount: hotUnmount
 					};
-					if (isUpdate) await this.liveEntriesDown(priorEntryIds);
-					const result = await hot.mount({ plugin: (plugin, config) => this.ctx.plugin(plugin, config) }, this.profileDirResolved(), args.name);
+					this.imported.add(args.name);
+					const result = await hot.mount({ plugin: (plugin, config) => this.home.plugin(plugin, config) }, this.profileDirResolved(), args.name);
 					if (!result.ok) return {
 						activation: "restart",
 						...result.reason !== null ? { restartReason: result.reason } : {}
 					};
-					const activation = activationOf({
+					return { activation: activationOf({
 						hostLive: true,
-						clientLive: false,
-						hasClientHalf: priorClientHalf || this.packageHasClientHalf(args.name)
-					});
-					return activation === "restart" ? {
-						activation,
-						restartReason: "client-half"
-					} : { activation };
+						clientLive: true,
+						hasClientHalf: this.packageHasClientHalf(args.name)
+					}) };
 				}
 			});
 			if (entry.source === "github") {
@@ -3844,10 +5027,13 @@ let ShopGateway = (() => {
 				for (const entry of await this.listInventory()) live.set(entry.entryId, entry.enabled);
 				haveInventory = true;
 			} catch {}
-			/** A package is enabled when every entry it owns and that is live is
-			* enabled. Keyed by entry id, never by module name — the entry a package
-			* inserts may mount a different package's module (see ownedEntryIds). */
+			const selected = this.runningProfileBundles(this.profileDirResolved());
+			/** A package is enabled when the profile selects its bundle and every
+			* entry it owns and that is live is enabled. Keyed by entry id, never by
+			* module name: the entry a package inserts may mount a different
+			* package's module (see ownedEntryIds). */
 			const enabledOf = (name) => {
+				if (selected !== null && !selected.includes(name)) return false;
 				if (!haveInventory) return true;
 				let owned;
 				try {
@@ -3914,6 +5100,10 @@ let ShopGateway = (() => {
 		* dependencies the shop does not manage (the base bundle, the shop
 		* itself). The same install records/polling serve the client. */
 		async uninstall(args) {
+			if (isDesktopProfile(this.profile)) return {
+				ok: false,
+				detail: DESKTOP_PROFILE_DETAIL
+			};
 			const named = (await this.snapshotNow()).entries.filter((entry) => entry.name === args.name);
 			if (named.length === 0) return {
 				ok: false,
@@ -3975,6 +5165,7 @@ let ShopGateway = (() => {
 				ok: false,
 				detail: RESTART_BLOCKED_DETAIL[blocked]
 			};
+			let logFile;
 			try {
 				const { cacheDir } = this.rowConfig();
 				const { command, args } = restartCommand({
@@ -3984,11 +5175,12 @@ let ShopGateway = (() => {
 					execArgv: process.execArgv,
 					script: this.restartScript
 				});
+				logFile = join(cacheDir, "restart.log");
 				startRestart({
 					command,
 					args,
 					parentPid: this.restartParentPid,
-					logFile: join(cacheDir, "restart.log"),
+					logFile,
 					env: process.env
 				});
 			} catch (error) {
@@ -3998,27 +5190,57 @@ let ShopGateway = (() => {
 				};
 			}
 			setTimeout(() => this.exit(0), this.restartExitDelayMs);
-			return { ok: true };
+			return {
+				ok: true,
+				logFile
+			};
 		}
 		/** The shop's own version and whether npm has a newer one (§7.3). The
 		* check is advisory: a registry that cannot answer leaves `latest` null
 		* and the client shows the version alone. `installed` is the RUNNING
 		* version (own-version.ts), not the manifest's range spec. */
 		async version() {
-			const installed = ownVersion();
+			const installed = this.options.runningVersion ?? runningVersion();
 			const latest = await this.latestVersion();
 			return {
 				installed,
 				latest,
 				outdated: latest !== null && lt(installed, latest),
-				restartBlocked: this.staticRestartBlock()
+				restartBlocked: this.staticRestartBlock(),
+				pendingVersion: this.pendingVersion(installed)
 			};
 		}
+		/**
+		* The version of the shop the profile has installed, when it is not the
+		* one this process runs; null when they match or the copy cannot be read.
+		*
+		* Read from the profile's own copy — the directory `dsh plugin add` writes
+		* and the next boot loads — rather than from the file beside this module.
+		* For the hoisted install those are one directory, but a `link:` install
+		* runs from its link target, which an update replaces in the profile and
+		* never touches at the target, so reading beside the module would never see
+		* the update land.
+		*
+		* Unreadable is null, never a throw: the version check is advisory, and a
+		* missing field would tell the client this host predates it.
+		*/
+		pendingVersion(running) {
+			try {
+				const manifest = JSON.parse(readFileSync(join(this.profileDirResolved(), "node_modules", "dsh-plugin-shop", "package.json"), "utf8"));
+				return typeof manifest.version === "string" && manifest.version !== running ? manifest.version : null;
+			} catch {
+				return null;
+			}
+		}
 		/** Update the shop itself to a published version (§7.3): the explicit pin
 		* is the only install form that bypasses pnpm's release cooldown. The
 		* version is re-validated as plain semver at the boundary — the spec
 		* `dsh-plugin-shop@<version>` is built here, never from the wire. */
 		async updateStart(args) {
+			if (isDesktopProfile(this.profile)) return {
+				ok: false,
+				detail: DESKTOP_PROFILE_DETAIL
+			};
 			if (valid(args.version) === null) return {
 				ok: false,
 				detail: `dsh-plugin-shop: ${args.version} is not a valid version`