dsh-plugin-shop 0.8.3 → 0.8.4-beta.0

package/lib/types/client/locales.d.ts

@@ -6,6 +6,10 @@ export declare const zh: {
     error: string;
     installedError: string;
     retry: string;
+    /** The shop's own error boundary caught a render error; the error's message
+     * follows on its own line, and Retry remounts the tab (design
+     * 2026-09-26-market-borrowings §4). */
+    tabCrashed: string;
     search: string;
     all: string;
     catalog: string;
@@ -35,12 +39,29 @@ export declare const zh: {
     installedRestartNotice: string;
     incompatibleBadge: string;
     incompatibleDetail: string;
+    /** The author's own `dsh.compatibility`, unmet on this machine (design
+     * 2026-09-01 §8.2). Each names BOTH sides — what the author declared and
+     * what this dsh runs — because the host sends both, and a bare
+     * "unsupported" leaves the reader guessing which side is off. */
+    harnessRangeDetail: string;
+    harnessProfileDetail: string;
+    /** dsh's OWN refusal (0.1.7 on), not the author's claim: the install button
+     * is disabled beside it (design 2026-09-26-dsh-017-readiness, B1). `{peers}`
+     * is each refused peer with the range the package declared. The remedy
+     * leads into the exemption command, rendered on its own line after it, and
+     * names the Refresh button by its label. */
+    harnessPeersDetail: string;
+    harnessPeersRemedy: string;
     hotNoPatchNotice: string;
     hotNotSimpleNotice: string;
     hotHostUnsupportedNotice: string;
     hotTimeoutNotice: string;
     hotMountFailedNotice: string;
-    hotClientHalfNotice: string;
+    /** No mount was tried: this dsh already loaded the package once, and Node
+     * will not load a second copy from the same place (design
+     * 2026-09-26-market-borrowings §1). Covers an update and a reinstall alike,
+     * so it names the new files rather than a "new version". */
+    hotAlreadyLoadedNotice: string;
     installedNoRestartNotice: string;
     installedReloadNotice: string;
     reload: string;
@@ -65,6 +86,9 @@ export declare const zh: {
     /** The incompatible filter's label. FIXED — the switch beside it carries the
      * state, so the words name what the switch does and never flip with it. */
     hideIncompatible: string;
+    /** What the filter takes away is every card whose badge reads 不兼容 —
+     * missing components OR an author's declaration this dsh does not meet —
+     * so these three name the badge, not one of its reasons. */
     incompatibleFilterTitle: string;
     showIncompatibleTitle: string;
     emptyIncompatibleFiltered: string;
@@ -79,6 +103,7 @@ export declare const zh: {
     tarballIntegrityCode: string;
     ambiguousIdentityCode: string;
     nameTakenCode: string;
+    desktopProfileCode: string;
     nameTakenBadge: string;
     nameTakenDetail: string;
     npmSource: string;
@@ -101,7 +126,14 @@ export declare const zh: {
     restartConfirm: string;
     restarting: string;
     restartFailedNotice: string;
+    /** The same failure, when the host said where the new process writes —
+     * which is where a boot that died explains itself (design
+     * 2026-09-26-market-borrowings §3). "Or did not stay up": the page now
+     * waits for the new server to keep answering, so this also covers a boot
+     * that answered and then died. */
+    restartFailedLogNotice: string;
     restartTransportFailed: string;
+    restartBlockedDesktopNotice: string;
     restartBlockedWindowsNotice: string;
     restartBlockedSystemdNotice: string;
     restartBlockedPortZeroNotice: string;
@@ -124,6 +156,7 @@ export declare const en: {
     error: string;
     installedError: string;
     retry: string;
+    tabCrashed: string;
     search: string;
     all: string;
     catalog: string;
@@ -153,12 +186,16 @@ export declare const en: {
     installedRestartNotice: string;
     incompatibleBadge: string;
     incompatibleDetail: string;
+    harnessRangeDetail: string;
+    harnessProfileDetail: string;
+    harnessPeersDetail: string;
+    harnessPeersRemedy: string;
     hotNoPatchNotice: string;
     hotNotSimpleNotice: string;
     hotHostUnsupportedNotice: string;
     hotTimeoutNotice: string;
     hotMountFailedNotice: string;
-    hotClientHalfNotice: string;
+    hotAlreadyLoadedNotice: string;
     installedNoRestartNotice: string;
     installedReloadNotice: string;
     reload: string;
@@ -189,6 +226,7 @@ export declare const en: {
     tarballIntegrityCode: string;
     ambiguousIdentityCode: string;
     nameTakenCode: string;
+    desktopProfileCode: string;
     nameTakenBadge: string;
     nameTakenDetail: string;
     npmSource: string;
@@ -211,7 +249,9 @@ export declare const en: {
     restartConfirm: string;
     restarting: string;
     restartFailedNotice: string;
+    restartFailedLogNotice: string;
     restartTransportFailed: string;
+    restartBlockedDesktopNotice: string;
     restartBlockedWindowsNotice: string;
     restartBlockedSystemdNotice: string;
     restartBlockedPortZeroNotice: string;

package/lib/types/client/module-table.d.ts

@@ -0,0 +1,131 @@
+/**
+ * The browser half of the peer verdict (design 2026-09-01-harness-compatibility
+ * §9): a declared peer is missing only if NEITHER the host NOR this page's
+ * module table provides it.
+ *
+ * The host judges each entry's peers by node resolution from the profile
+ * (`host/peers.ts`), and that answers only half of how a client plugin's
+ * `require(x)` is served. The module table in `@deepseek-ai/dsh-client-modules`
+ * answers in this order: a platform SEED word; an already materialized module
+ * (`loadCache`); a graph row (`manifest.modules` — a `dsh.client` package in
+ * this profile's boot graph); a registered factory; otherwise it throws. Seed
+ * words never touch node resolution, and of the nine the 0.1.5-rc.3 web shell
+ * seeds only `@deepseek-ai/cordis` exists as a package on disk — so the host
+ * reports the other eight missing for every plugin that declares them, which
+ * on the live catalog made most of the host's badges false — `react` among
+ * them, the very module this shop's own client runs with. Design
+ * 2026-09-01-harness-compatibility §9.1 owns the measurement.
+ *
+ * So the host's list is never rendered as it arrives: every name the live
+ * table provides is removed first (`index.ts`, at the moment a result is
+ * handed to the tab). A pure core, `refineIncompatible`, driven by any oracle;
+ * and a thin shell, `moduleTableOracle`, over the harness's live object.
+ */
+/** What the module table says about one specifier: `true` provided, `false`
+ * absent, `null` unknown. Injected, so fixtures drive every verdict and only
+ * one oracle ever touches the harness. */
+export type ModuleOracle = (spec: string) => Promise<boolean | null>;
+/**
+ * How long one probe may take before its answer counts as unknown.
+ *
+ * The work a probe can actually reach is a microtask: a seed-word lookup, or a
+ * factory this page already registered. So this bounds a harness that never
+ * answers, not work — and it exists because the cost of the alternative is the
+ * whole shelf. `refineAgainstModuleTable` promises that a table in any state
+ * cannot cost the reader the catalog, and an `import()` that never settles
+ * would have made that promise false by leaving the tab with nothing to render
+ * (§9's degradation rule: an unavailable fact is silence, never an accusation).
+ * A probe per name, not one deadline for the whole refinement: every other
+ * name is still judged, and the tab waits at most this long however many names
+ * there are.
+ */
+export declare const MODULE_PROBE_TIMEOUT_MS = 2000;
+/**
+ * The host's verdict less every name the oracle provides.
+ *
+ * An entry whose list empties is dropped, and an entry ANY of whose names
+ * comes back unknown gets no verdict at all — the rule `incompatibilityMap`
+ * follows on the host, for the host's reason: an unavailable fact must never
+ * read as an accusation, and keeping the rest of a list whose one unknown name
+ * was dropped would publish a partial answer as the whole one. Each distinct
+ * name is asked once, however many entries declare it. Never rejects: any
+ * failure of the oracle is an unknown.
+ */
+export declare function refineIncompatible(incompatible: Readonly<Record<string, readonly string[]>>, provides: ModuleOracle, timeoutMs?: number): Promise<Record<string, string[]>>;
+/**
+ * An oracle over the live `modules` service, or null when the page offers no
+ * usable table.
+ *
+ * The service is the harness's `ClientModuleLoader`, published to client
+ * plugins as `ctx.reflect.provide('modules', …)`. It arrives as unknown-typed
+ * foreign state, so only its PUBLIC contract is read, and only after
+ * narrowing: `manifest.modules` must be an array, `loadCache` a Map and
+ * `import` a function. `seed`, `factories` and `graphRows` exist on the
+ * instance too, but they are TypeScript-`private` in the harness's own
+ * declarations, and nothing here names them.
+ *
+ * Per spec, in the table's own order but with every side effect kept out:
+ * 1. A graph row provides it, and `import` is NOT called — for a row it
+ *    fetches the bundle and runs the module body, and a probe must never be
+ *    what loads a plugin. `manifest.modules` is the row index, but it is not
+ *    fixed for the page's whole life on every harness build. On 0.1.5-rc.3
+ *    `this.manifest = options.manifest` is the constructor's only write, so a
+ *    row placed at boot stands unchanged for as long as the page lives. On
+ *    0.1.7-rc.2 (`next`) `updateManifest` REPLACES `this.manifest` outright
+ *    with a new manifest that no longer lists an uninstalled package, and
+ *    `reconcile` removes the plugin from the loader — so UNTIL this page's own
+ *    uninstall reconciles, the OLD row still stands in `manifest.modules` and
+ *    this step clears the entry falsely; AFTER it reconciles, this step can no
+ *    longer be the false clear, because `manifest.modules` has already dropped
+ *    the package. The false clear then comes from `prune`, which keeps the
+ *    removed id only in the PRIVATE `graphRows` and in `loadCache`, and only
+ *    while some retained module still references it — that is step 2 below,
+ *    or the side effect of `import` in step 3 (a private graph row this
+ *    function cannot see).
+ * 2. A `loadCache` record provides it, again without `import`.
+ * 3. Otherwise `import(spec, '', {})`, with the spec as written — the seed
+ *    holds `react-dom/client` itself, not its stripped form. Resolving means a
+ *    seed word, whose lookup has no side effect; rejecting with the
+ *    "cannot resolve" message means absent; any other rejection is unknown.
+ *
+ * A kept-but-unmaterialized row is this function's own remaining blind spot:
+ * asked about here, it still reaches step 3's `import` probe, which fetches
+ * and runs it — the one side effect this module promises never to cause on
+ * its own account. `refineAgainstModuleTable`'s page-removed set is the fix
+ * for the one case a page can know about on its own — a name uninstalled
+ * through THIS shop, on THIS page, since it loaded — by bypassing this oracle
+ * for that name entirely rather than trusting a row that may only be kept. An
+ * uninstall made from another tab, another window, or the CLI is not in that
+ * set and stays unknown to this page until it reloads.
+ *
+ * One side-effect path remains: a registered page-local factory that is
+ * neither a graph row nor yet materialized, which `import` materializes. That
+ * is reachable only for a name the host could not resolve AND the page
+ * registered without a row — the shell's own page-local modules are
+ * node-resolvable, so the host never lists them. And what it does is what the
+ * first real `require` of that name does anyway: run a factory this page
+ * registered precisely so it would be materialized, once, memoized in
+ * `loadCache`, fetching nothing. It moves that moment earlier; it runs nothing
+ * the page did not already hold.
+ */
+export declare function moduleTableOracle(service: unknown): ModuleOracle | null;
+/**
+ * The host's verdict as this page can stand behind it: refined against the
+ * live table, or `{}` — no verdicts at all — when there is no usable table.
+ *
+ * Never the host's list unrefined. Measured, that list is majority-false on
+ * this harness line (see the header), so showing it whenever the table cannot
+ * be read would hand the reader a verdict already known to be unreliable;
+ * silence is this project's documented degradation — an unavailable fact must
+ * never read as an accusation. Never rejects, so a table in any state cannot
+ * cost the reader the catalog.
+ *
+ * `removed` is the page-removed set (design 2026-09-01-harness-compatibility
+ * section 9.1): package names this page has uninstalled since it loaded.
+ * Every name in it is reported missing exactly
+ * as the host said, WITHOUT ever reaching the table — not the rows check, not
+ * `loadCache`, not `import` — because a row or a cache record can outlive a
+ * restart-free uninstall (`moduleTableOracle`'s header), and the table's own
+ * "provided" would be precisely the false clear this set exists to prevent.
+ */
+export declare function refineAgainstModuleTable(incompatible: Readonly<Record<string, readonly string[]>>, service: unknown, removed?: ReadonlySet<string>, timeoutMs?: number): Promise<Record<string, string[]>>;

package/lib/types/client/present.d.ts

@@ -5,7 +5,7 @@ export { isShopLike } from '../shared/shop-like.ts';
 export { identityKey, type EntryIdentity } from '../shared/identity.ts';
 import { type EntryIdentity } from '../shared/identity.ts';
 import type { ShopLocaleKey } from './locales.ts';
-import type { CatalogEntry, HotRestartReason, InstallRejectionCode, RestartBlockedReason } from '../host/index.ts';
+import type { CatalogEntry, HarnessVerdict, HotRestartReason, InstallRejectionCode, RestartBlockedReason } from '../host/index.ts';
 import type { Activation } from '../host/activation.ts';
 import { type InstallState } from '../shared/install-state.ts';
 export type { Activation };
@@ -50,6 +50,105 @@ export declare function tierKey(tier: CatalogEntry['tier']): ShopLocaleKey;
  * both rendered as no warning at all. The map is keyed by install identity,
  * never by name, because two entries can share a name. */
 export declare function missingPeersOf(incompatible: Record<string, string[]>, key: string): string[];
+/** The author's own `dsh.compatibility` that this installation does not meet
+ * (design 2026-09-01 §8.2), or undefined when the host gave no verdict. Keyed
+ * by install identity, never by name, for the reason `missingPeersOf` is.
+ *
+ * The map itself may be absent, whatever the result type says: a tab can
+ * outlive a shop self-update by one reload and then be talking to the OLD
+ * in-process host until dsh restarts, which answers the shape from before the
+ * key existed. That is "no verdict", never a crash. */
+export declare function harnessVerdictOf(verdicts: Readonly<Record<string, HarnessVerdict>> | undefined, key: string): HarnessVerdict | undefined;
+/**
+ * One thing standing between an entry and a working install, carrying the
+ * facts its copy names — never the copy, which the tab localizes (§4: no copy
+ * crosses the RPC).
+ *
+ * Refusals and warnings, each with its own remedy. Two are refusals, and
+ * disable the button (`refusesInstall`): a taken name, which the host WILL
+ * refuse and the reader fixes by uninstalling a plugin; and harness peers the
+ * running dsh WILL refuse (0.1.7 on), fixed by dsh's exact-version exemption,
+ * whose command the host sends when dsh would accept one. Everything else is
+ * about this harness and is advisory — the host installs anyway: components
+ * node resolution and the page's module table both lack, and an author's
+ * declared range or profile list this dsh falls outside of.
+ */
+export type Blocker = {
+    kind: 'name-taken';
+    holder: string;
+} | {
+    kind: 'harness-peers';
+    refused: Readonly<Record<string, string>>;
+    running: string;
+    allowCommand: string | null;
+} | {
+    kind: 'missing-peers';
+    modules: readonly string[];
+} | {
+    kind: 'harness-range';
+    range: string;
+    running: string;
+} | {
+    kind: 'harness-profile';
+    declared: readonly string[];
+    running: string;
+};
+export type BlockerKind = Blocker['kind'];
+/**
+ * Everything standing in one entry's way, in the order every surface renders
+ * it — the card's detail lines, the badge's accessible name, the outdated
+ * row's refusal — and the one list the incompatible filter reads, through
+ * `readsIncompatible`, and the install button, through `refusesInstall`.
+ *
+ * The refusals read first. The name conflict leads: it is about a plugin the
+ * reader chose and would lose. Then dsh's own refusal, then what this machine
+ * is measured to lack, then what the author declared, range before profiles —
+ * the order the host's verdict carries its halves.
+ */
+export declare function blockersOf(missing: readonly string[], harness: HarnessVerdict | undefined, nameTakenBy: string | undefined): Blocker[];
+/**
+ * The badge's visible word for these blockers, or null when there are none.
+ *
+ * "Incompatible" for anything about this harness, whichever reason put it
+ * there. A taken name is the more serious condition and names a different
+ * remedy, so it decides the word whenever it holds — the card is perfectly
+ * compatible, and a different plugin is in the way.
+ */
+export declare function blockerBadgeKey(blockers: readonly {
+    kind: BlockerKind;
+}[]): ShopLocaleKey | null;
+/** Whether the badge reads "Incompatible" — exactly the set the incompatible
+ * filter counts and takes away. Derived from the badge's own rule, never
+ * restated beside it: the filter used to test the peer list by hand, which
+ * held only while missing peers were the one reason for the word — a card
+ * badged for its declared range would have read "Incompatible" and survived
+ * the filter that names it. */
+export declare function readsIncompatible(blockers: readonly {
+    kind: BlockerKind;
+}[]): boolean;
+/**
+ * Whether this install is refused before it starts, so its button is
+ * disabled rather than opening the acknowledgement gate for an install that
+ * cannot proceed: by the host, for a taken name, or by the running dsh, for
+ * its harness peers.
+ *
+ * The second is the one harness reason that blocks (design
+ * 2026-09-26-dsh-017-readiness, B1, amending "warn, never block"): dsh 0.1.7
+ * refuses the install itself, before pnpm runs, and the shop cannot install
+ * past it. The verdict is dsh's own rule on the profile's own exemptions, so
+ * a disabled button is dsh's answer given early, never the shop's opinion —
+ * and recording the exemption the card shows is what enables it again.
+ */
+export declare function refusesInstall(blockers: readonly {
+    kind: BlockerKind;
+}[]): boolean;
+/**
+ * The refused peers as the refusal's copy names them: each peer and the range
+ * the package declared, in the order dsh reported them. A blank range — which
+ * dsh refuses — is quoted, or the sentence would name the peer and nothing
+ * it asked for.
+ */
+export declare function refusedPeersText(refused: Readonly<Record<string, string>>): string;
 /**
  * The plugin already holding this entry's bundle name, if a DIFFERENT one is,
  * named the way the host's refusal names it.
@@ -160,8 +259,33 @@ export declare const INSTALL_POLL_MS = 1000;
  * the NEW server, never the dying old one. */
 export declare const RESTART_GRACE_MS = 3000;
 /** §8 restart handoff: how long the client waits for the new server to
- * answer before reporting the manual restart command. */
+ * START answering before reporting the manual restart command. A run of good
+ * answers that began inside it may finish after it (see
+ * `restartMonitorVerdict`). */
 export declare const RESTART_WAIT_MS = 30000;
+/** §8 restart handoff: how long the new server must keep answering before the
+ * page reloads into it (design 2026-09-26-market-borrowings §3). The Loader
+ * mounts entries concurrently, so a boot that is about to fail can bind the
+ * port and answer before the settled tree is audited and the process exits;
+ * dsh-market measured that window inside 8 s. */
+export declare const RESTART_STABLE_MS = 8000;
+/**
+ * The restart monitor's decision after a probe of the origin.
+ *
+ * `stableSinceMs` is when the current unbroken run of good answers began —
+ * null when the last probe failed, or none has succeeded yet — and both times
+ * count from the moment the restart was committed. One answer is not enough:
+ * reloading on it is what landed a reader on a boot that died a moment later,
+ * a blank page in place of the notice naming the log. So the page reloads
+ * only once the run has lasted `RESTART_STABLE_MS`, and the monitor gives up
+ * only when no run is under way past `RESTART_WAIT_MS` — which bounds the
+ * whole wait at the sum of the two, since a run that began in time either
+ * completes or breaks after the deadline.
+ */
+export declare function restartMonitorVerdict(input: {
+    elapsedMs: number;
+    stableSinceMs: number | null;
+}): 'wait' | 'reload' | 'failed';
 /** How long the check-update button reports "up to date" after a re-check
  * finds no newer release, before reverting to its idle label. */
 export declare const CHECK_UP_TO_DATE_MS = 3000;

package/lib/types/client/restart-monitor.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The restart handoff's browser half (design §8), held by the page rather
+ * than by the tab that confirmed the restart.
+ *
+ * It lived in a RestartPanel effect until 2026-09-27, and a self-update
+ * killed it. dsh's client HMR (`@deepseek-ai/dsh-client-hmr`, mounted by the
+ * web bundle unconditionally) stat-polls every client bundle and hot-swaps
+ * one whose file changed; a self-update rewrites this package's own
+ * `lib/client.js`, so the swap disposes the tab's fiber and mounts a fresh
+ * instance of a freshly imported module. The effect's cleanup then stopped
+ * the probe, and once the restart finished nothing reloaded the page: it sat
+ * on the old process's answers while dsh's socket quietly reconnected to the
+ * new one. Measured on dsh 0.1.5-rc.3 updating 0.8.2 to 0.8.3; with the
+ * `/plugins/events` channel blocked the same flow reloaded.
+ *
+ * So the state sits on `globalThis` under a registry symbol — the one thing a
+ * swapped-in module instance shares with the one it replaced — and the probe
+ * loop is plain timers owned by no fiber. Any tab reads the state, so the
+ * replacement renders the restart under way instead of offering another.
+ */
+/** A restart this page committed: still waiting for the new server, or
+ * given up on it. `logFile` is where the host said the new process writes;
+ * a host older than that field sends none. */
+export type RestartMonitorState = {
+    kind: 'restarting';
+    logFile?: string;
+} | {
+    kind: 'failed';
+    logFile?: string;
+};
+/** The page's restart, or null when it has committed none. The same object
+ * until the state changes, as `useSyncExternalStore` requires. */
+export declare function readRestartMonitor(): RestartMonitorState | null;
+/** Be told when the page's restart changes state. */
+export declare function subscribeRestartMonitor(listener: () => void): () => void;
+/**
+ * Watch the origin for the restarted server and reload into it: probe once
+ * the grace period is over (the host exits within it, so an answer is the NEW
+ * server), and reload only after it has KEPT answering for the stable window.
+ * A boot that is about to fail can bind the port and answer before its plugin
+ * tree is audited and it exits; reloading on that one answer left the reader
+ * on a blank page instead of the notice naming the log (design
+ * 2026-09-26-market-borrowings §3). `restartMonitorVerdict` decides; this
+ * loop only probes. Probes never overlap: each is scheduled one poll interval
+ * after the previous one settled.
+ *
+ * A restart already being watched is left alone — every offer on the page
+ * renders this state, so a second press can only come from a panel that has
+ * not re-rendered yet, and a second loop would probe the same origin twice.
+ */
+export declare function startRestartMonitor(options: {
+    reload: () => void;
+    logFile?: string;
+}): void;
+/** Stop the probe loop and forget the page's restart. Nothing in the page
+ * calls this — a committed restart ends in a reload or a failure — so its
+ * caller is a test isolating one case from the next. */
+export declare function resetRestartMonitor(): void;

package/lib/types/host/activation.d.ts

@@ -35,18 +35,21 @@ export type Activation = 'live' | 'reload' | 'restart';
  * - A change to the BOOT COMPOSITION — a toggle, an uninstall — moves an
  *   entry the registry already enumerates, and the served graph follows it
  *   within seconds (§2, measured 2026-09-11). `true`.
- * - A HOT MOUNT — an install or an update — adds to the live loader entries
- *   without entering that composition, so the graph a tab reloads into does
- *   not contain the package. Measured 2026-09-14 against dsh 0.1.5-rc.1 in
- *   `web-full-flow.e2e.ts`: across a reload following a hot mount the graph
- *   is byte-identical, same `rev`, while the package's host half is live the
- *   whole time. `false` — and a `restart` is then the only honest answer,
- *   because there is nothing a reload could fetch.
+ * - A HOT MOUNT — an install — adds entries under the shop's own loader
+ *   entry, which the registry enumerates like any other: across a reload
+ *   following the mount the served graph gains the package and the page runs
+ *   its browser half (measured 2026-09-26 on 0.1.5-rc.3 and 0.1.7-rc.2, in
+ *   `web-full-flow.e2e.ts`). `true`.
  *
  * The asymmetry that decides every unknown still runs the same way: offering
  * a step that was not needed costs the reader one action, withholding one
- * that was needed is the defect this module exists to fix. What changed on
- * 2026-09-14 is which step is the needed one after a hot mount.
+ * that was needed is the defect this module exists to fix. Which step a hot
+ * mount needs has been measured twice. On 2026-09-14 the graph came back
+ * byte-identical across the reload, and installs moved to `restart` — but the
+ * shop then registered the tree from whichever context made the RPC call, the
+ * typert gateway's, and the registry never composed a tree hung there. Once
+ * the tree hung off the shop's own entry (2026-09-26), the same measurement
+ * found the package in the graph, and installs moved back to `reload`.
  */
 export declare function activationOf(input: {
     hostLive: boolean;

package/lib/types/host/bundle-patch.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The patch files a bundle declares, read the way dsh reads them (design
+ * 2026-09-26-dsh-017-readiness, B4).
+ *
+ * dsh 0.1.7's app-boot (`bundlePatchFiles`) accepts `dsh.bundle.patch` as one
+ * package-relative file or as a list of them, applied in order, and throws on
+ * anything else. dsh 0.1.5 reads only the string form: it joins the
+ * declaration onto the package directory, so a list makes the profile fail to
+ * start. What the RUNNING dsh accepts is `RunningHarness.patchLists`; this
+ * reads the declaration itself, for the shop's own readers of a package's
+ * patch — the entries it owns, the rows a hot mount replicates.
+ */
+/**
+ * The declared patch files in application order: one for a string, the
+ * listed ones for a list of strings. Null for a declaration dsh refuses —
+ * neither a path nor a list of paths — which is distinct from an absent one:
+ * only absence means the conventional `cordis.patch.yml`, and a caller that
+ * fell back to it for a refused declaration would act on a patch dsh never
+ * applies. Pure, and the list is a copy.
+ */
+export declare function bundlePatchFiles(declared: unknown): string[] | null;
+/** Why a bundle patch declaration would stop the profile from starting:
+ * `list-unsupported` is a list on a dsh that reads one file, `malformed` a
+ * declaration no dsh loads. */
+export type PatchHazard = 'list-unsupported' | 'malformed';
+/**
+ * Whether an installed package's `dsh.bundle.patch` would stop the profile
+ * from starting at the next boot, given whether the running dsh reads a list
+ * (`RunningHarness.patchLists`). An absent declaration is no hazard: dsh adds
+ * a package to the profile's bundles only when it declares a patch, so
+ * nothing reads the field. An unknown harness (null) forms no verdict on a
+ * list — the rule for every harness read — but a malformed declaration is
+ * refused by every dsh, so it is named whatever is known. Pure.
+ */
+export declare function patchDeclarationHazard(declared: unknown, patchLists: boolean | null): PatchHazard | null;

package/lib/types/host/catalog.d.ts

@@ -5,9 +5,15 @@ import type { CatalogEntry, DeniedEntry } from './types.ts';
  * 3 adds `source` and repo entries (github install channel); 4 adds `subdir`
  * for monorepo-subpackage entries (2026-08-31 hub-borrowings A); 5 adds
  * `added`, `tarball` (release rescue), the `theme` category, and
- * `denied[].replacement` (2026-08-31 market borrowings);
- * 6 adds `peers`, the package's declared peer dependency names
- * (2026-09-01 harness compatibility). */
+ * `denied[].replacement` (2026-08-31 market borrowings).
+ *
+ * 6 adds nothing. It was reserved for `peers` (2026-09-01 harness
+ * compatibility), and that gate came off on 2026-09-03 without ever being
+ * opened: `peers` rides 5, as every additive optional key does, because this
+ * schema strips a key it does not know while a higher version NUMBER is what
+ * a capped client refuses outright. Every shop built since this constant
+ * became 6 accepts a 6 without knowing what one would mean, so a change those
+ * shops must refuse has to be 7. */
 export declare const SUPPORTED_SCHEMA_VERSION = 6;
 export interface CatalogSnapshot {
     schemaVersion: number;