dsh-plugin-shop 0.8.3 → 0.8.4-beta.1

package/lib/index.js

@@ -1,17 +1,18 @@
 import { createRequire } from "node:module";
 import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { loadOptionalPatches, readProfileManifest, resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
-import { lt, minVersion, satisfies, valid, validRange } from "semver";
+import { lt, minVersion, parse, satisfies, valid, validRange } from "semver";
 import { createHash, randomUUID } from "node:crypto";
-import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { appendFileSync, chmodSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { basename, delimiter, dirname, isAbsolute, join, posix, relative, resolve, win32 } from "node:path";
+import { basename, delimiter, dirname, isAbsolute, join, posix, relative, resolve, sep, win32 } from "node:path";
 import { homedir } from "node:os";
 import { z } from "zod";
 import { gunzipSync } from "node:zlib";
 import { spawn, spawnSync } from "node:child_process";
 import { StringDecoder } from "node:string_decoder";
-import { DEFAULT_SCHEMA, JSON_SCHEMA, Type, dump, load } from "js-yaml";
+import { JSON_SCHEMA, Type, dump, load } from "js-yaml";
+import { isMap, isSeq, parseDocument } from "yaml";
 //#region src/own-version.ts
 /** The shop's own published version, read from the package.json that ships
 * next to this package — the RUNNING version, not the manifest's range
@@ -22,12 +23,34 @@ import { DEFAULT_SCHEMA, JSON_SCHEMA, Type, dump, load } from "js-yaml";
 function ownManifest() {
 	return JSON.parse(readFileSync(fileURLToPath(new URL("../package.json", import.meta.url)), "utf8"));
 }
-function ownVersion() {
-	return ownManifest().version;
+/**
+* Read a version once and keep it: the answer to "which code is this".
+*
+* The file cannot answer that question later. A profile installs hoisted, so
+* a self-update rewrites package.json in the directory the RUNNING code was
+* loaded from, and every read after it names the version that will run after
+* the next restart — which the version row then printed as the one running
+* (design §7.3, 2026-09-27 amendment).
+*
+* A first read that throws is not kept: the module import must not fail over
+* a version string, so the answer falls back to reading on demand, which is
+* what the row always did.
+*/
+function versionAtLoad(read) {
+	let loaded;
+	try {
+		loaded = read();
+	} catch {
+		loaded = null;
+	}
+	return () => loaded ?? read();
 }
+/** The version of the code in this process, read when the module was first
+* evaluated — at boot, before any self-update could rewrite the file. */
+const runningVersion = versionAtLoad(() => ownManifest().version);
 /**
 * The peer ranges this build declares — the input to the load-time harness
-* self-check. Read from the same shipped manifest as `ownVersion`, so the
+* self-check. Read from the same shipped manifest as `runningVersion`, so the
 * ranges checked are the ones this build was actually published with, never
 * a second copy that can drift from them.
 *
@@ -609,6 +632,11 @@ const entrySchema = z.object({
 	}).optional(),
 	publisher: z.string().optional(),
 	peers: z.array(z.string()).optional(),
+	compatibility: z.object({
+		dsh: z.string().optional(),
+		profiles: z.array(z.string()).optional()
+	}).optional(),
+	dshPeers: z.record(z.string(), z.string()).optional(),
 	unpackedSize: z.number().int().nonnegative().optional(),
 	installSize: z.number().int().nonnegative().optional()
 }).superRefine((entry, ctx) => {
@@ -1034,6 +1062,248 @@ function validateInstall(snapshot, args, installedSpec) {
 	};
 }
 //#endregion
+//#region src/host/compatibility.ts
+/** Harness compatibility as the AUTHOR states it: which `dsh.compatibility`
+* declarations the running installation does not meet (design
+* 2026-09-01-harness-compatibility §8.2, as amended §9.9). The presence check
+* in `peers.ts` infers from what a plugin imports; this reads what its author
+* wrote down. And, from dsh 0.1.7 on, what dsh ITSELF refuses: the harness
+* peers its installer rejects an install on (`peerVerdictsOf`, design
+* 2026-09-26-dsh-017-readiness, B1).
+*
+* Pure: the running version, the running profile, the harness's own
+* template table and its peer check arrive as arguments, so fixtures drive
+* every verdict and the reads of the installation stay outside — the running
+* dsh, its template table and its peer check in `harness.ts`, the running
+* profile's bundles and exemptions in the gateway. */
+/**
+* Normalize the harness's OWN `PROFILE_TEMPLATES` into template name → bundle
+* names, or an empty record for a shape this build does not know.
+*
+* Two shapes exist and both are live: 0.1.5-rc.3 maps a name to
+* `{ bundles, patchReload }` (five templates), while the version this package
+* pins as a devDependency maps it to a bare array (two). A name whose value is
+* neither, or whose bundle list holds a non-string, is dropped rather than
+* guessed at — an unreadable table means no profile verdict, never a wrong
+* one. Copied from nowhere: the caller passes the harness's exported object.
+*
+* The record has NO PROTOTYPE, empty answer included. It is indexed by the
+* profile names a catalog entry declares, which are hostile input, and a
+* record built on `{}` answered `constructor`, `__proto__`, `toString`,
+* `hasOwnProperty` and `valueOf` from `Object.prototype`: a value that passed
+* the `undefined` guard and threw out of `compatibilityMap`, so one entry
+* declaring `profiles: ["constructor"]` rejected every `catalog()` call for
+* every user. Without a prototype there is also no `__proto__` setter, so a
+* template exported under that name stays an own key instead of replacing
+* the record's prototype. `unmetProfile` takes own keys only as well — the
+* type is exported, and a caller may hand in a plain object.
+*/
+function profileTemplatesOf(exported) {
+	const templates = Object.create(null);
+	if (exported === null || typeof exported !== "object" || Array.isArray(exported)) return templates;
+	for (const [name, value] of Object.entries(exported)) {
+		const bundles = Array.isArray(value) ? value : value !== null && typeof value === "object" ? value.bundles : void 0;
+		if (!Array.isArray(bundles)) continue;
+		if (!bundles.every((bundle) => typeof bundle === "string")) continue;
+		templates[name] = bundles;
+	}
+	return templates;
+}
+/**
+* Install identity → the half or halves of an entry's declaration this
+* installation does not meet. A key is present only when something was
+* declared AND is unmet, so an absent key means "runs here, or we could not
+* tell" — the rule `incompatibilityMap` follows, and for the same reason: one
+* false warning teaches a reader to ignore every warning.
+*
+* The halves are judged apart, and an unknown on either side silences only its
+* own half:
+*
+* - `dsh` needs a range semver can parse and a running version that is semver,
+*   and is then `satisfies` with `includePrerelease`. That option is
+*   load-bearing: the harness ships nothing but prereleases, and strict semver
+*   refuses a prerelease against any range whose comparators carry none —
+*   `0.1.5-rc.3` fails `>=0.1.0`, and even `*` — so every author who wrote a
+*   plain range would be told they exclude a harness their range includes.
+*
+*   What the option does NOT do is read a range the way its author probably
+*   meant it. Under it a prerelease is compared like any other version, and a
+*   prerelease sorts BELOW its own release (measured with semver 7.8.5; the
+*   rows are pinned in compatibility.test.ts):
+*   - An upper bound written without `-0` admits the next line's
+*     prereleases: `<0.2.0` and `>=0.1.0 <0.2.0` both admit `0.2.0-rc.1`.
+*     Only a bound that desugars to `<0.2.0-0` refuses it — `^0.1.0`,
+*     `~0.1.0` and `0.1.x` do, as does `<0.2.0-0` written out.
+*   - A floor written without `-0` refuses its own prereleases: `>=0.1.5`,
+*     `^0.1.5` and `0.1.5` all refuse `0.1.5-rc.3`, because `0.1.5` sorts
+*     above it. `>=0.1.5-0` admits every `0.1.5-rc.N`.
+*   So `>=0.1.5-0` and `<0.2.0-0` are the spellings that say what an author
+*   usually means. The comparison stays semver's own and is never rewritten
+*   here: a verdict that coerced prereleases would answer differently from
+*   semver, which is what an author checks a range against. An exact list of
+*   other versions — `@xmanrui/dsh-im`'s declaration — is refused, as it
+*   should be.
+* - `profile` is met when the running profile's NAME is one of the declared
+*   names, or when it composes every bundle of a declared template.
+*
+*   The name is trusted for the names dsh ships, because for those it is not
+*   the reader's choice. On 0.1.5-rc.3 both paths that create a missing
+*   profile build one of a shipped name from that name's template
+*   (dsh-app-boot's `loadProfile`, and `dsh plugin`), and dsh refuses a
+*   shipped name as the target of `--from-default-profile`, so a profile
+*   carrying one was built from that template. That is all the name
+*   guarantees: which template the profile was built from, not what it
+*   composes now. Nothing holds the bundle list to the template afterwards:
+*   `dsh plugin`'s reconcile, not app-boot, appends each bundle it installs,
+*   and app-boot's `normalizeShippedProfile` rewrites only a list that is
+*   exactly a retired tuple or the current one. Bundles alone could not
+*   decide there: a profile keeps the bundle list it was created with, so the
+*   first harness release that added a bundle to `web` would badge every
+*   `profiles: ["web"]` plugin (`@xmanrui/dsh-im`) on every existing `web`
+*   profile, with copy saying it supports web and this dsh was launched with
+*   web.
+*
+*   Any other name is the reader's choice — `dsh --profile rescue
+*   --from-default-profile web` builds a profile called `rescue` from the web
+*   bundles, and dsh records nothing about which template it came from — so a
+*   running name no declaration matches is judged by what the profile IS:
+*   each declared name is read as one of the harness's own templates, met
+*   when every bundle of that template is in the running profile's bundles. A
+*   declared name that is no template — an own key of the table, never an
+*   inherited one — cannot be judged, and a list with such a name and no met
+*   template gives no verdict. The half is unmet only when the running name is
+*   not declared and every declared name is a template this profile does not
+*   compose — see the amendment for the whole rule.
+*
+*   The residual, knowingly kept: a custom-named profile is still judged by
+*   bundles, so a template that later gained a bundle would badge the custom
+*   profiles created before the change. No PUBLISHED
+*   `@deepseek-ai/dsh-app-boot` had changed a template's bundle list as of
+*   2026-09-25: all 28 versions, read that day, give every template they
+*   share the same list. One list was retired before the first publish:
+*   every published app-boot, from the first, carries a retired `headless`
+*   tuple (`@deepseek-ai/dsh-base`, `@deepseek-ai/dsh-web-app`,
+*   `@deepseek-ai/dsh-headless`) in `INSTALLATION_OWNED_PROFILE_TUPLES`, and
+*   `normalizeShippedProfile` rewrites a `headless` profile carrying exactly
+*   that list to the current template when it loads.
+*/
+function compatibilityMap(entries, runtime, templates) {
+	const running = runtime.dshVersion !== null && valid(runtime.dshVersion) !== null ? runtime.dshVersion : null;
+	const out = {};
+	for (const entry of entries) {
+		const declared = entry.compatibility;
+		if (declared === void 0) continue;
+		const verdict = {};
+		const range = declared.dsh;
+		if (range !== void 0 && running !== null && validRange(range) !== null && !satisfies(running, range, { includePrerelease: true })) verdict.dsh = {
+			range,
+			running
+		};
+		const unmet = unmetProfile(declared.profiles, runtime.profile, templates);
+		if (unmet !== null) verdict.profile = {
+			declared: [...unmet],
+			running: runtime.profile.name
+		};
+		if (verdict.dsh !== void 0 || verdict.profile !== void 0) out[identityKey(entry)] = verdict;
+	}
+	return out;
+}
+/**
+* The declared profile list to report, or null when nothing is owed: met,
+* unjudgeable, or nothing declared. See `compatibilityMap` for the rule, why
+* a matching name is enough, and why bundles decide for any other name.
+*/
+function unmetProfile(declared, running, templates) {
+	if (declared === void 0 || declared.length === 0) return null;
+	if (declared.includes(running.name)) return null;
+	if (running.bundles === null) return null;
+	const composed = new Set(running.bundles);
+	let unjudged = false;
+	for (const name of declared) {
+		const bundles = Object.hasOwn(templates, name) ? templates[name] : void 0;
+		if (bundles === void 0) {
+			unjudged = true;
+			continue;
+		}
+		if (bundles.every((bundle) => composed.has(bundle))) return null;
+	}
+	return unjudged ? null : declared;
+}
+/**
+* Install identity → the refusal the running dsh will make, for each entry
+* whose harness peers it refuses and the profile has not exempted. A key is
+* present only for a refusal, so an absent key means "dsh installs it, or we
+* could not tell".
+*
+* The rule is dsh's own (`check`, from the running app-boot), handed the
+* manifest dsh's installer reads before it installs a registry spec — `pnpm
+* view <spec> name version peerDependencies`, measured in dsh-plugin-manager
+* 0.1.7-rc.2 — with the catalog's `dshPeers` for the peers. Those are the
+* only peers the rule reads, verbatim. What this cannot see errs toward
+* silence, never toward a refusal dsh would not make: a malformed peer range
+* elsewhere in the manifest, which dsh rejects only after installing, and
+* the plugins a bundle's patch rows name, which it checks then too. Those
+* reach the reader as the install's own failure (`installFailureDetail`).
+*
+* npm entries only. dsh keys an exemption by the INSTALLED manifest's
+* `name@version`, and a github entry's catalog version is a commit: its
+* exemption status cannot be read, and a refusal named here could never be
+* cleared from the shop. dsh refuses such an install itself, and says how
+* to exempt it.
+*
+* A throw from the check forms no verdict for that entry, as a resolver's
+* throw does in `incompatibilityMap`.
+*/
+function peerVerdictsOf(entries, check, exemptions, profile) {
+	const out = {};
+	for (const entry of entries) {
+		if (entry.source !== "npm" || entry.dshPeers === void 0) continue;
+		let issue;
+		try {
+			issue = check.evaluate({
+				name: entry.name,
+				version: entry.version,
+				peerDependencies: entry.dshPeers
+			}, exemptions);
+		} catch {
+			continue;
+		}
+		if (issue === void 0 || issue.exempted) continue;
+		out[identityKey(entry)] = {
+			refused: { ...issue.peers },
+			running: issue.runtimeVersion,
+			allowCommand: allowVersionCommand(profile, issue)
+		};
+	}
+	return out;
+}
+/** npm's package-name grammar as dsh's exemption records accept it, verbatim
+* from app-boot 0.1.7-rc.2 (`PACKAGE_NAME` in profile-compatibility). */
+const EXEMPTION_PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/;
+/** A version exactly as dsh's exemption records spell one: canonical semver,
+* build metadata included (app-boot's `isExactPluginVersion`). */
+function isExactVersion(value) {
+	const parsed = parse(value);
+	return parsed !== null && value === `${parsed.version}${parsed.build.length === 0 ? "" : `+${parsed.build.join(".")}`}`;
+}
+/**
+* The command that records dsh's exact-version exemption for one refused
+* install, spelled as dsh's own CLI prints it after a refusal — or null when
+* `dsh plugin allow-version` would refuse the package or either version,
+* which it checks against the grammar above. The name and version come from
+* the catalog, which is hostile input bound for a terminal, and the two
+* grammars admit no whitespace, quote, `$`, backtick, `;`, `|`, `&`,
+* redirection or bracket, so no catalog value can add a command to the line
+* it is pasted into.
+*
+* The profile is written as it is, as dsh prints it: it is the reader's own
+* choice of name, never catalog input.
+*/
+function allowVersionCommand(profile, issue) {
+	if (!EXEMPTION_PACKAGE_NAME.test(issue.name) || !isExactVersion(issue.version) || !isExactVersion(issue.runtimeVersion)) return null;
+	return `dsh plugin --profile ${profile} allow-version ${issue.name}@${issue.version} --dsh-version ${issue.runtimeVersion} --accept-risk`;
+}
+//#endregion
 //#region src/host/dsh-cli.ts
 /**
 * How to start the dsh CLI as a child process.
@@ -1064,6 +1334,16 @@ const DSH_PACKAGE = "@deepseek-ai/dsh";
 * also the unscoped name its plain-string `bin` form would take. */
 const DSH_BIN_NAME = "dsh";
 /**
+* Whether dsh's CLI refuses this profile outright: `desktop`, in any letter
+* case, "is managed exclusively by the Electron application" — refused for a
+* launch and for `dsh plugin` alike (`rejectElectronProfile` in the CLI's
+* `lib/bin.js`, the same in 0.1.5-rc.3 and 0.1.7-rc.2). Every command the
+* shop spawns names a profile, so none of them can run for this one.
+*/
+function isDesktopProfile(profile) {
+	return profile.toLowerCase() === "desktop";
+}
+/**
 * A `dshBin` that names a JavaScript entry rather than a program.
 *
 * Such a file cannot be spawned anywhere: Windows needs a PE image, and POSIX
@@ -1229,6 +1509,35 @@ function chain(profile, task) {
 	profileQueues.set(profile, next.catch(() => {}));
 	return next;
 }
+/** Run `task` in `profile`'s queue, after every command already in it: the
+* queue `spawnPluginCli` uses, shared with the plugin manager's runner so the
+* two paths are never concurrent in one profile. `ahead` is how many commands
+* were queued or running when the slot was taken. */
+function inProfileQueue(profile, task) {
+	return {
+		ahead: enterQueue(profile),
+		finished: chain(profile, task).finally(() => {
+			leaveQueue(profile);
+		})
+	};
+}
+/** An install record's log: the newest lines within MAX_LOG_LINES and
+* MAX_LOG_BYTES, never dropping the newest one. */
+function createBoundedLog() {
+	const lines = [];
+	let bytes = 0;
+	return {
+		push(line) {
+			lines.push(line);
+			bytes += Buffer.byteLength(line);
+			while ((lines.length > MAX_LOG_LINES || bytes > MAX_LOG_BYTES) && lines.length > 1) {
+				const oldest = lines.shift();
+				if (oldest !== void 0) bytes -= Buffer.byteLength(oldest);
+			}
+		},
+		lines: () => [...lines]
+	};
+}
 /**
 * Why a zero-exit install left `dsh.profile.bundles` without the entry.
 *
@@ -1335,6 +1644,94 @@ const FAILURE_LOG_NOISE = [
 	/^\s+at /,
 	/^<anonymous(?:_script)?>/
 ];
+/** The line dsh 0.1.7 opens a refused install with (dsh-plugin-manager's
+* `rejected`), and the exemption command its CLI prints after it, one per
+* refused package (`runPlugin`). The opener is exported for the plugin
+* manager's answer, whose output carries the same block. */
+const REFUSAL_OPENER = "dsh: installation rejected: ";
+const REFUSAL_COMMAND = /^dsh: to accept the risk, run: dsh plugin --profile .+ allow-version (.+)@([^@\s]+) --dsh-version (\S+) --accept-risk$/;
+const REFUSAL_FAILED = "dsh: plugin command failed";
+/** Where dsh's warning turns from the refused peers to its risk statement
+* and remedy (app-boot's `pluginCompatibilityWarning`); the detail states
+* the risk once and gives the command instead. */
+const REFUSAL_WARNING_TAIL = " Running it may cause crashes or data loss.";
+/**
+* dsh's own refusal of an install (0.1.7 on) as one detail, or null when the
+* log holds none. The install was dsh's to refuse, not pnpm's to fail: it
+* refuses before pnpm runs, when it can read the manifest — a registry spec,
+* which the catalog's peer verdict already predicts — and after pnpm
+* succeeded otherwise, restoring the profile. Reading that as a pnpm failure
+* sent the reader to `dsh plugin install`, which repairs nothing.
+*
+* The detail is what dsh refused, what it restored, and the command that
+* records its exact-version exemption, rebuilt from what dsh printed through
+* `allowVersionCommand` rather than repeated: dsh prints the INSTALLED
+* manifest's own name into it, which a tarball or git package chooses
+* itself, so only a name and versions dsh's exemption grammar accepts reach
+* a line meant for a terminal. The profile is the one this install ran in.
+* Anything dsh prints after `plugin command failed` — the diagnostics path,
+* and a hint about git build scripts dsh prints after every failed git
+* install — says nothing about this refusal.
+*/
+function refusalDetail(profile, usable) {
+	const start = usable.findIndex((line) => line.startsWith(REFUSAL_OPENER));
+	if (start === -1) return null;
+	const refusedAt = usable.slice(start);
+	const failedAt = refusedAt.findIndex((line) => line.startsWith(REFUSAL_FAILED));
+	const block = failedAt === -1 ? refusedAt : refusedAt.slice(0, failedAt);
+	const warnings = [];
+	const commands = [];
+	let restoration;
+	for (const [index, line] of block.entries()) {
+		const command = REFUSAL_COMMAND.exec(line);
+		if (command !== null) {
+			const [, name = "", version = "", runtimeVersion = ""] = command;
+			const rebuilt = allowVersionCommand(profile, {
+				name,
+				version,
+				runtimeVersion
+			});
+			if (rebuilt !== null) commands.push(rebuilt);
+		} else if (index === 0) warnings.push(line.slice(28));
+		else if (line.startsWith("dsh: ")) restoration ??= line.slice(5);
+		else if (restoration === void 0) warnings.push(line);
+	}
+	const parts = [`dsh refused the install: ${warnings.map((warning) => {
+		const tail = warning.indexOf(REFUSAL_WARNING_TAIL);
+		return tail === -1 ? warning : warning.slice(0, tail);
+	}).join(" ")}`];
+	if (restoration !== void 0) parts.push(`${restoration.charAt(0).toUpperCase()}${restoration.slice(1)}`);
+	if (commands.length > 0) parts.push(`To accept the risk of crashes or data loss for ${commands.length === 1 ? "this exact version" : "these exact versions"}, run: ${commands.join("; ")} — then install again.`);
+	return parts.join(" ");
+}
+/** What Rust's allocator prints before it aborts, which is how pnpm 12's
+* native binary dies when it cannot get the memory it asked for. Anchored at
+* both ends: node's own heap exhaustion ("Allocation failed - JavaScript heap
+* out of memory") is a different crash, from pnpm 11 or dsh itself, and the
+* pnpm 12 remedy below would be wrong for it. */
+const NATIVE_ALLOCATION_ABORT = /^memory allocation of \d+ bytes failed$/;
+/**
+* pnpm 12 aborting out of memory as one detail, or null when the log holds no
+* such abort.
+*
+* The known cause is pnpm/pnpm#15362, fixed in pnpm 12.7.0: the native peer
+* check intersected the ranges of a missing peer, doubling the intersection
+* for every package that wanted it. dsh writes `autoInstallPeers: false` into
+* every profile, so every `@deepseek-ai/dsh*` peer stays missing and plugins
+* that share one trip it. Reported on Windows with 8 GB, reproduced on Linux
+* through the real CLI of dsh 0.1.5-rc.3 and 0.1.7-rc.2 (2026-09-27). The
+* install aborted, so running it again on the same profile aborts again:
+* the detail names the way out instead of the usual recovery hint.
+*
+* Not every such abort is that bug (pnpm/pnpm#15867 is another one, with the
+* same words), so the detail says what to do if the reader's pnpm already has
+* the fix.
+*/
+function nativeAllocationAbortDetail(usable) {
+	const abort = usable.find((line) => NATIVE_ALLOCATION_ABORT.test(line.trim()));
+	if (abort === void 0) return null;
+	return `pnpm crashed: its native binary ran out of memory (${abort.trim()}), which is not caused by this plugin. pnpm 12 before 12.7.0 has a known bug that exhausts memory when many packages share a missing peer, which every dsh profile has, because dsh keeps peers uninstalled (autoInstallPeers: false; pnpm/pnpm#15362). Upgrade pnpm to 12.7.0 or later, or use pnpm 11, then install again. If your pnpm is already 12.7.0 or later, report the line above to pnpm.`;
+}
 /**
 * The one log line worth putting in front of the user, plus the recovery hint.
 *
@@ -1349,9 +1746,12 @@ const FAILURE_LOG_NOISE = [
 * Scanning from the end: a pnpm error code first, then any thrown error, then
 * the last line that is not noise.
 */
-function installFailureDetail(profile, log) {
-	const hint = `pnpm failed in the profile. Run: dsh plugin --profile ${profile} install`;
+function installFailureDetail(profile, log, hint = `pnpm failed in the profile. Run: dsh plugin --profile ${profile} install`) {
 	const usable = log.map((line) => line.replace(/\r+$/, "")).filter((line) => !FAILURE_LOG_NOISE.some((rx) => rx.test(line)));
+	const refusal = refusalDetail(profile, usable);
+	if (refusal !== null) return refusal;
+	const abort = nativeAllocationAbortDetail(usable);
+	if (abort !== null) return abort;
 	const reversed = [...usable].reverse();
 	const pick = reversed.find((line) => /ERR_[A-Z][A-Z_]*/.test(line)) ?? reversed.find((line) => /(?:^|\s)\w*Error:/.test(line)) ?? usable[usable.length - 1];
 	if (pick === void 0) return `${hint}.`;
@@ -1454,6 +1854,23 @@ function dshScript() {
 * the spawned command line is the one we add ourselves, after this gate. */
 const UNSAFE_TARGET = /[\s"'`|<>^$();\\{}]|[\u0000-\u001f\u007f]/;
 /**
+* The operand gate, one function for every caller: it refuses, by throwing,
+* an operand the dsh CLI would parse as a flag, and one carrying the shell
+* punctuation `UNSAFE_TARGET` names. A legitimate operand (a catalog name for
+* a removal; a `name@version`, `github:` or tarball spec for an install)
+* never begins with `-`, so the first refusal cannot reject a real install or
+* uninstall, and failing loudly beats letting the CLI reinterpret an operand
+* as an option. `spawnPluginCli` runs it before it spawns anything or takes a
+* queue slot; the gateway's plugin manager path runs it before a spec reaches
+* `installBundle` or the download phase, whose pump relies on it (see
+* `requestDownloadPhase`). Returns the operand, known to be present.
+*/
+function gateOperand(target) {
+	if (target === void 0 || target.startsWith("-")) throw new Error(`dsh-plugin-shop: refusing to spawn with a flag-like operand: ${target ?? "(none)"}`);
+	if (UNSAFE_TARGET.test(target)) throw new Error(`dsh-plugin-shop: refusing to spawn with an unsafe operand: ${JSON.stringify(target)}`);
+	return target;
+}
+/**
 * The operand as the downstream dsh must receive it for pnpm to see it whole.
 *
 * dsh spawns pnpm with `shell: process.platform === 'win32'`
@@ -1491,6 +1908,32 @@ function shellSafeTarget(target, platform) {
 	if (platform !== "win32" || !target.includes("&")) return target;
 	return `"${target}"`;
 }
+const DOWNLOAD_PHASE_FAILED_PREFIX = "dsh-plugin-shop: the download phase could not start — ";
+const DOWNLOAD_PHASE_NO_PNPM = "dsh-plugin-shop: no download phase — pnpm not found on PATH";
+const DOWNLOAD_PHASE_UNSUPPORTED = "dsh-plugin-shop: no download phase for this spec form; the install fetches it directly";
+/**
+* Ask the pump to warm `spec` while an operation waits its turn, and say in
+* that operation's log why there is no download phase when there is none.
+* Shared by the CLI executor and the plugin manager runner.
+*/
+function requestDownloadPhase(options) {
+	const { prefetcher, profile, spec, env, log } = options;
+	let prefetch;
+	try {
+		prefetch = prefetcher.request({
+			profile,
+			spec,
+			cwd: resolveProfileDir(profile, env?.DSH_HOME),
+			env,
+			log
+		});
+	} catch (error) {
+		log(`${DOWNLOAD_PHASE_FAILED_PREFIX}${error.message}`);
+		return null;
+	}
+	if (!prefetch.started) log(prefetch.reason === "no-pnpm" ? DOWNLOAD_PHASE_NO_PNPM : DOWNLOAD_PHASE_UNSUPPORTED);
+	return prefetch;
+}
 /** Run one `dsh plugin --profile <profile> <verb> <target>` and track it.
 * Never rolls back; a failure surfaces stderr verbatim plus the recovery hint
 * (§10). The shop never passes build-script flags: `allowBuilds` stays the
@@ -1507,14 +1950,11 @@ function shellSafeTarget(target, platform) {
 * package IS installed; it reports `done` with the restart fallback. */
 function spawnPluginCli(options) {
 	const { profile, argv, dshBin, env, platform = process.platform, beforeSpawn, prefetcher, confirm, afterDone, onStatus, timeoutMs = INSTALL_TIMEOUT_MS } = options;
-	const target = argv[1];
-	if (target === void 0 || target.startsWith("-")) throw new Error(`dsh-plugin-shop: refusing to spawn with a flag-like operand: ${target ?? "(none)"}`);
-	if (UNSAFE_TARGET.test(target)) throw new Error(`dsh-plugin-shop: refusing to spawn with an unsafe operand: ${JSON.stringify(target)}`);
+	const target = gateOperand(argv[1]);
 	const spawnArgv = [...argv];
 	spawnArgv[1] = shellSafeTarget(target, platform);
 	const installId = randomUUID();
-	const log = [];
-	let logBytes = 0;
+	const log = createBoundedLog();
 	const ahead = enterQueue(profile);
 	let state = "running";
 	let activationOnDone = "restart";
@@ -1522,7 +1962,7 @@ function spawnPluginCli(options) {
 	let detail;
 	const status = () => ({
 		state,
-		log: [...log],
+		log: log.lines(),
 		...state === "done" ? {
 			activation: activationOnDone,
 			...restartReason !== void 0 ? { restartReason } : {}
@@ -1532,11 +1972,6 @@ function spawnPluginCli(options) {
 	const append = (line) => {
 		if (isTerminalInstallState(state)) return;
 		log.push(line);
-		logBytes += Buffer.byteLength(line);
-		while ((log.length > MAX_LOG_LINES || logBytes > MAX_LOG_BYTES) && log.length > 1) {
-			const oldest = log.shift();
-			if (oldest !== void 0) logBytes -= Buffer.byteLength(oldest);
-		}
 		onStatus?.(status());
 	};
 	const failToStart = (error) => {
@@ -1546,19 +1981,14 @@ function spawnPluginCli(options) {
 		return status();
 	};
 	let prefetch = null;
-	if (ahead > 0 && prefetcher !== void 0) try {
-		prefetch = prefetcher.request({
-			profile,
-			spec: target,
-			cwd: resolveProfileDir(profile, env?.DSH_HOME),
-			env,
-			log: append
-		});
-	} catch (error) {
-		append(`dsh-plugin-shop: the download phase could not start — ${error.message}`);
-	}
+	if (ahead > 0 && prefetcher !== void 0) prefetch = requestDownloadPhase({
+		prefetcher,
+		profile,
+		spec: target,
+		env,
+		log: append
+	});
 	if (prefetch?.started === true) state = "downloading";
-	else if (prefetch !== null) append(prefetch.reason === "no-pnpm" ? "dsh-plugin-shop: no download phase — pnpm not found on PATH" : "dsh-plugin-shop: no download phase for this spec form; the install fetches it directly");
 	const finished = chain(profile, () => new Promise((resolve) => {
 		state = "running";
 		onStatus?.(status());
@@ -1627,7 +2057,7 @@ function spawnPluginCli(options) {
 				} else state = "done";
 			} else {
 				state = "failed";
-				detail = installFailureDetail(profile, log);
+				detail = installFailureDetail(profile, log.lines());
 			}
 			onStatus?.(status());
 			resolve(status());
@@ -1753,6 +2183,47 @@ function startUninstall(options) {
 	});
 }
 //#endregion
+//#region src/host/bundle-patch.ts
+/**
+* The patch files a bundle declares, read the way dsh reads them (design
+* 2026-09-26-dsh-017-readiness, B4).
+*
+* dsh 0.1.7's app-boot (`bundlePatchFiles`) accepts `dsh.bundle.patch` as one
+* package-relative file or as a list of them, applied in order, and throws on
+* anything else. dsh 0.1.5 reads only the string form: it joins the
+* declaration onto the package directory, so a list makes the profile fail to
+* start. What the RUNNING dsh accepts is `RunningHarness.patchLists`; this
+* reads the declaration itself, for the shop's own readers of a package's
+* patch — the entries it owns, the rows a hot mount replicates.
+*/
+/**
+* The declared patch files in application order: one for a string, the
+* listed ones for a list of strings. Null for a declaration dsh refuses —
+* neither a path nor a list of paths — which is distinct from an absent one:
+* only absence means the conventional `cordis.patch.yml`, and a caller that
+* fell back to it for a refused declaration would act on a patch dsh never
+* applies. Pure, and the list is a copy.
+*/
+function bundlePatchFiles(declared) {
+	if (typeof declared === "string") return [declared];
+	if (Array.isArray(declared) && declared.every((file) => typeof file === "string")) return [...declared];
+	return null;
+}
+/**
+* Whether an installed package's `dsh.bundle.patch` would stop the profile
+* from starting at the next boot, given whether the running dsh reads a list
+* (`RunningHarness.patchLists`). An absent declaration is no hazard: dsh adds
+* a package to the profile's bundles only when it declares a patch, so
+* nothing reads the field. An unknown harness (null) forms no verdict on a
+* list — the rule for every harness read — but a malformed declaration is
+* refused by every dsh, so it is named whatever is known. Pure.
+*/
+function patchDeclarationHazard(declared, patchLists) {
+	if (declared === void 0) return null;
+	if (bundlePatchFiles(declared) === null) return "malformed";
+	return Array.isArray(declared) && patchLists === false ? "list-unsupported" : null;
+}
+//#endregion
 //#region src/host/hot.ts
 /**
 * Restart-free installs: mount a freshly installed plugin into the running
@@ -1878,15 +2349,14 @@ function nextHotNumber(fs, dir) {
 	}
 	return max + 1;
 }
-/** Read the installed package's own `dsh` section to locate its bundle patch
-* (the Include input), or null when the package or the field is absent —
-* the "no patch file" rejection names this. */
-function readPkgDsh(fs, packageDir) {
+/** The installed package's own `dsh.bundle.patch`, exactly as declared (the
+* Include input), or undefined when the package, its manifest or the field
+* is absent. */
+function declaredPatch(fs, packageDir) {
 	try {
-		const patch = JSON.parse(fs.read(join(packageDir, "package.json"))).dsh?.bundle?.patch;
-		return typeof patch === "string" ? { patch } : null;
+		return JSON.parse(fs.read(join(packageDir, "package.json"))).dsh?.bundle?.patch;
 	} catch {
-		return null;
+		return;
 	}
 }
 /** Load the Include class through a computed dynamic import, or null when
@@ -1924,33 +2394,45 @@ function suppressWrite(treeClass) {
 async function hotMount(ctx, profileDir, packageName, deps = {}) {
 	const { fs = nodeHotFs, dir = join(profileDir, HOT_DIR), timeoutMs = Number(process.env.DSH_SHOP_HOT_MOUNT_TIMEOUT_MS) || 1e4, now = Date.now } = deps;
 	const packageDir = join(profileDir, "node_modules", packageName);
-	const dsh = readPkgDsh(fs, packageDir);
-	const patchFile = resolve(packageDir, dsh?.patch ?? "cordis.patch.yml");
-	const inside = relative(packageDir, patchFile);
-	if (inside === "" || inside.startsWith("..") || isAbsolute(inside)) {
-		ctx.logger?.warn(`hot-mount ${packageName}: the declared bundle patch is outside the package directory — restart will activate it`);
-		return {
-			ok: false,
-			reason: "no-patch"
-		};
-	}
-	let patchText;
-	try {
-		patchText = fs.read(patchFile);
-	} catch {
-		ctx.logger?.warn(`hot-mount ${packageName}: no patch file to mount — restart will activate it`);
+	const declared = declaredPatch(fs, packageDir);
+	const files = declared === void 0 ? ["cordis.patch.yml"] : bundlePatchFiles(declared);
+	if (files === null || files.length === 0) {
+		ctx.logger?.warn(`hot-mount ${packageName}: the bundle patch is declared as neither a file path nor a list of them — restart will activate it`);
 		return {
 			ok: false,
 			reason: "no-patch"
 		};
 	}
-	const rows = parseSimplePatch(patchText);
-	if (rows === null) {
-		ctx.logger?.warn(`hot-mount ${packageName}: patch has rows that cannot be hot-mounted — restart will activate it`);
-		return {
-			ok: false,
-			reason: "not-simple"
-		};
+	const rows = [];
+	for (const file of files) {
+		const patchFile = resolve(packageDir, file);
+		const inside = relative(packageDir, patchFile);
+		if (inside === "" || inside.startsWith("..") || isAbsolute(inside)) {
+			ctx.logger?.warn(`hot-mount ${packageName}: the declared bundle patch is outside the package directory — restart will activate it`);
+			return {
+				ok: false,
+				reason: "no-patch"
+			};
+		}
+		let patchText;
+		try {
+			patchText = fs.read(patchFile);
+		} catch {
+			ctx.logger?.warn(`hot-mount ${packageName}: no patch file to mount — restart will activate it`);
+			return {
+				ok: false,
+				reason: "no-patch"
+			};
+		}
+		const parsed = parseSimplePatch(patchText);
+		if (parsed === null) {
+			ctx.logger?.warn(`hot-mount ${packageName}: patch has rows that cannot be hot-mounted — restart will activate it`);
+			return {
+				ok: false,
+				reason: "not-simple"
+			};
+		}
+		rows.push(...parsed);
 	}
 	let treeClass = deps.hotTreeClass;
 	if (treeClass === void 0) treeClass = await loadHotTreeClass();
@@ -2061,18 +2543,21 @@ function cleanHotDir(profileDir) {
 * - A change to the BOOT COMPOSITION — a toggle, an uninstall — moves an
 *   entry the registry already enumerates, and the served graph follows it
 *   within seconds (§2, measured 2026-09-11). `true`.
-* - A HOT MOUNT — an install or an update — adds to the live loader entries
-*   without entering that composition, so the graph a tab reloads into does
-*   not contain the package. Measured 2026-09-14 against dsh 0.1.5-rc.1 in
-*   `web-full-flow.e2e.ts`: across a reload following a hot mount the graph
-*   is byte-identical, same `rev`, while the package's host half is live the
-*   whole time. `false` — and a `restart` is then the only honest answer,
-*   because there is nothing a reload could fetch.
+* - A HOT MOUNT — an install — adds entries under the shop's own loader
+*   entry, which the registry enumerates like any other: across a reload
+*   following the mount the served graph gains the package and the page runs
+*   its browser half (measured 2026-09-26 on 0.1.5-rc.3 and 0.1.7-rc.2, in
+*   `web-full-flow.e2e.ts`). `true`.
 *
 * The asymmetry that decides every unknown still runs the same way: offering
 * a step that was not needed costs the reader one action, withholding one
-* that was needed is the defect this module exists to fix. What changed on
-* 2026-09-14 is which step is the needed one after a hot mount.
+* that was needed is the defect this module exists to fix. Which step a hot
+* mount needs has been measured twice. On 2026-09-14 the graph came back
+* byte-identical across the reload, and installs moved to `restart` — but the
+* shop then registered the tree from whichever context made the RPC call, the
+* typert gateway's, and the registry never composed a tree hung there. Once
+* the tree hung off the shop's own entry (2026-09-26), the same measurement
+* found the package in the graph, and installs moved back to `reload`.
 */
 function activationOf(input) {
 	if (!input.hostLive) return "restart";
@@ -2294,18 +2779,14 @@ function writeRepoPins(fs, path, pins) {
 //#endregion
 //#region src/host/profile.ts
 /** Profile directory discovery and user-layer writes (§8: hot enable/disable). */
-function isJsExpr(value) {
-	return typeof value === "object" && value !== null && typeof value.__jsExpr === "string";
-}
-const JS_EXPR_TYPE = new Type("tag:yaml.org,2002:js", {
-	kind: "scalar",
-	resolve: () => true,
-	construct: (data) => ({ __jsExpr: data }),
-	predicate: isJsExpr,
-	represent: (value) => value.__jsExpr
-});
-/** js-yaml's default schema plus the user-layer `!!js` round trip. */
-const USER_LAYER_SCHEMA = DEFAULT_SCHEMA.extend([JS_EXPR_TYPE]);
+/** The loader's `!!js` expression scalar, for the document edit: read as its
+* source text and written back under its own tag, never evaluated — the
+* loader evaluates it at entry activation. The same declaration the harness's
+* own writer of this file uses (`@deepseek-ai/dsh-plugin-manager` 0.1.7). */
+const USER_LAYER_TAGS = [{
+	tag: "tag:yaml.org,2002:js",
+	resolve: (source) => source
+}];
 /**
 * Find the profile directory that owns `startPath`.
 *
@@ -2364,22 +2845,78 @@ function realpathNearestExisting(startPath) {
 * {@link ownedEntryIds}), and they toggle together: writing them one at a
 * time would read-modify-write the file once per entry, so a crash between
 * two writes would leave the package half disabled.
+*
+* The edit changes one key and nothing else (design
+* 2026-09-26-market-borrowings §2). The layer is validated by the harness's
+* own parser first, so one it cannot load still throws and is never
+* rewritten; it is then edited as a YAML document, which keeps every comment,
+* every other row, every other key and every `!!js` scalar as the user wrote
+* them. The whole-file rewrite this replaced dropped each toggled id's row —
+* and with it a `config:` override the user had put there — and dumped the
+* list back through a library that models no comments, so the first toggle
+* erased the header dsh writes into every new profile.
+*
+* For each entry the row written is the LAST one carrying its id, when the
+* harness is sure to apply it: applyEntryPatches applies rows in order and
+* each key replaces the entry's value, so the last row that sets `disabled`
+* decides it. A row with `insert` is an insertion into a group, never an
+* override; a row naming another module is skipped by the harness; a named
+* row whose module the caller did not say cannot be judged. In each of those
+* cases a row is appended instead, which the harness applies last whatever
+* came before it — so appending is never wrong, only less tidy.
+*
+* An enable writes `disabled: false` rather than deleting the row, which is
+* what lost a user's row or the comment above it; it is also the harness's
+* own convention for this file from 0.1.7. The file keeps its permission bits
+* across the rename (a new one is created owner-only, as the harness's writer
+* does), because a config override can hold a credential.
 */
 function setUserLayerRows(options) {
 	const file = join(options.profileDir, "cordis.patch.yml");
-	const existing = loadOptionalPatches("dsh-plugin-shop", file) ?? [];
-	const touched = new Set(options.rows.map((row) => row.id));
-	const next = [...existing.filter((row) => !touched.has(row.id)), ...options.rows.filter((row) => row.disabled).map((row) => ({
-		id: row.id,
-		disabled: true
-	}))];
+	loadOptionalPatches("dsh-plugin-shop", file);
+	let text = "[]\n";
+	let mode = 384;
+	if (existsSync(file)) {
+		text = readFileSync(file, "utf8");
+		mode = statSync(file).mode & 511;
+	}
+	const document = parseDocument(text, { customTags: USER_LAYER_TAGS });
+	const parseError = document.errors[0];
+	if (parseError !== void 0) throw parseError;
+	const list = document.contents;
+	if (!isSeq(list)) throw new Error(`dsh-plugin-shop: ${file} is not a YAML list of patch rows`);
+	for (const row of options.rows) {
+		const target = lastRowFor(list.items, row.id);
+		if (target !== null && appliesTo(target, row.name)) {
+			target.set("disabled", row.disabled);
+			continue;
+		}
+		if (list.items.length === 0) list.flow = false;
+		document.add({
+			id: row.id,
+			disabled: row.disabled
+		});
+	}
 	const tmp = `${file}.tmp`;
-	writeFileSync(tmp, dump(next, {
-		noRefs: true,
-		schema: USER_LAYER_SCHEMA
-	}));
+	writeFileSync(tmp, document.toString({ lineWidth: 0 }), { mode });
+	chmodSync(tmp, mode);
 	renameSync(tmp, file);
 }
+/** The last override row carrying `id`, or null when there is none. A row
+* with `insert` is an insertion into group `id`, not an override of it. */
+function lastRowFor(items, id) {
+	for (let index = items.length - 1; index >= 0; index--) {
+		const item = items[index];
+		if (isMap(item) && !item.has("insert") && item.get("id") === id) return item;
+	}
+	return null;
+}
+/** Whether the harness is sure to apply `row` to the entry mounting
+* `moduleName`: a row with no `name`, or one naming that very module. */
+function appliesTo(row, moduleName) {
+	if (!row.has("name")) return true;
+	return moduleName !== void 0 && row.get("name") === moduleName;
+}
 /**
 * The loader entry ids one installed package contributes to the tree.
 *
@@ -2402,41 +2939,73 @@ function setUserLayerRows(options) {
 * which only the inventory can answer.
 */
 function ownedEntryIds(options) {
+	return ownedEntries(options).map((entry) => entry.id);
+}
+/**
+* {@link ownedEntryIds} with the module each entry mounts beside its id. The
+* name is what the harness judges a NAMED user-layer row by — a row naming a
+* different module is skipped (applyEntryPatches) — so it is what lets the
+* toggle write a user's own named row rather than append one beside it. It is
+* read through the harness's parser, so a relative name arrives anchored to a
+* file URL exactly as the composed entry carries it; an `!!js` name has no
+* plain value and reads as undefined. Throws where `ownedEntryIds` does.
+*/
+function ownedEntries(options) {
 	const packageDir = join(options.profileDir, "node_modules", ...options.packageName.split("/"));
 	const manifestPath = join(packageDir, "package.json");
 	if (!existsSync(manifestPath)) return [];
-	let patchRelative;
+	let declared;
 	try {
-		patchRelative = JSON.parse(readFileSync(manifestPath, "utf8")).dsh?.bundle?.patch;
+		declared = JSON.parse(readFileSync(manifestPath, "utf8")).dsh?.bundle?.patch;
 	} catch (error) {
 		throw new Error(`dsh-plugin-shop: failed to read ${manifestPath}: ${String(error)}`);
 	}
-	if (typeof patchRelative !== "string") return [];
-	const patchFile = resolve(packageDir, patchRelative);
-	const inside = relative(packageDir, patchFile);
-	if (inside === "" || inside.startsWith("..") || isAbsolute(inside)) throw new Error(`dsh-plugin-shop: ${options.packageName} declares a bundle patch outside its own directory: ${patchRelative}`);
-	const ids = [];
-	collectInsertedIds(loadOptionalPatches("dsh-plugin-shop", patchFile) ?? [], ids);
-	return [...new Set(ids)];
+	const files = bundlePatchFiles(declared);
+	if (files === null) return [];
+	const entries = [];
+	for (const file of files) {
+		const patchFile = resolve(packageDir, file);
+		const inside = relative(packageDir, patchFile);
+		if (inside === "" || inside.startsWith("..") || isAbsolute(inside)) throw new Error(`dsh-plugin-shop: ${options.packageName} declares a bundle patch outside its own directory: ${file}`);
+		collectInsertedEntries(loadOptionalPatches("dsh-plugin-shop", patchFile) ?? [], entries);
+	}
+	const seen = /* @__PURE__ */ new Set();
+	return entries.filter((entry) => !seen.has(entry.id) && seen.add(entry.id) !== void 0);
+}
+/**
+* An installed package's own `dsh.bundle.patch`, exactly as declared, or
+* undefined when the package, its manifest or the field is absent — or the
+* manifest cannot be read, which no post-install check can judge either.
+*/
+function declaredBundlePatch(options) {
+	const manifestPath = join(options.profileDir, "node_modules", ...options.packageName.split("/"), "package.json");
+	try {
+		return JSON.parse(readFileSync(manifestPath, "utf8")).dsh?.bundle?.patch;
+	} catch {
+		return;
+	}
 }
-/** Walk a patch list, appending the id of every INSERTED entry. A patch row
-* without `insert` targets an entry someone else composed — the loader's
+/** Walk a patch list, appending every INSERTED entry. A patch row without
+* `insert` targets an entry someone else composed — the loader's
 * applyEntryPatches looks it up and skips it when absent, so it creates
 * nothing and owns nothing. An inserted GROUP owns its children, which the
 * loader reads from the group's own `config` array. */
-function collectInsertedIds(rows, into) {
+function collectInsertedEntries(rows, into) {
 	for (const row of rows) {
 		if (row === null || typeof row !== "object") continue;
 		const inserted = row.insert;
-		if (Array.isArray(inserted)) collectEntryIds(inserted, into);
+		if (Array.isArray(inserted)) collectEntries(inserted, into);
 	}
 }
-function collectEntryIds(entries, into) {
+function collectEntries(entries, into) {
 	for (const entry of entries) {
 		if (entry === null || typeof entry !== "object") continue;
-		const { id, group, config } = entry;
-		if (typeof id === "string") into.push(id);
-		if (group === true && Array.isArray(config)) collectEntryIds(config, into);
+		const { id, name, group, config } = entry;
+		if (typeof id === "string") into.push({
+			id,
+			name: typeof name === "string" ? name : void 0
+		});
+		if (group === true && Array.isArray(config)) collectEntries(config, into);
 	}
 }
 /**
@@ -2820,25 +3389,240 @@ function createPrefetcher(options = {}) {
 * not provide (design 2026-09-01-harness-compatibility), and — for the
 * shop's OWN declared peers — which ones it provides at a version outside
 * the declared range. */
+const NODE_LOOKUP_FS = {
+	stat: (path) => statSync(path),
+	readFile: (path) => readFileSync(path, "utf8")
+};
+/**
+* One segment of a bare package name, about to be spliced into a path.
+*
+* A leading `.` refuses the segment whole: `.` and `..` would walk the path
+* out of `node_modules`, and `.bin` or `.pnpm` are directories an install
+* carries that no package can be. The ESM resolver agrees as far as it goes:
+* it refuses an unscoped name that starts with `.`, and any name holding `%`
+* or `\`, with ERR_INVALID_MODULE_SPECIFIER (measured on Node 26.6.0 with
+* `.bin`, `a%2e`, `a\b`). `\` is also a separator on Windows, `:` names a
+* drive, an NTFS stream or a URL scheme (`node:fs`, `file:`), and NUL is a
+* byte no path may carry.
+*/
+function isNameSegment(segment) {
+	return segment.length > 0 && !segment.startsWith(".") && !/[\\:%\0]/.test(segment);
+}
+/**
+* Whether `spec` is a bare package name — `name`, or `@scope/name` — and so
+* safe to look up. Peer names are catalog input, and hostile; this check is
+* what keeps one from becoming a path. The lookup this replaced resolved
+* `'../x/package.json'` relative to the profile and an absolute name as
+* itself, so a peer name could point it at any path on the reader's disk.
+*/
+function isBarePackageName(spec) {
+	const segments = spec.split("/");
+	const [first, second] = segments;
+	if (first === void 0) return false;
+	if (!first.startsWith("@")) return segments.length === 1 && isNameSegment(first);
+	return segments.length === 2 && second !== void 0 && isNameSegment(first.slice(1)) && isNameSegment(second);
+}
+/** Whether `path` stats as a directory. Every stat failure answers false —
+* see `findPackageDir` for why that is Node's rule and not a shortcut. */
+function isDirectoryAt(fs, path) {
+	try {
+		return fs.stat(path).isDirectory();
+	} catch {
+		return false;
+	}
+}
+/** Whether `path` stats as a regular file. Every stat failure answers false,
+* for the reason `isDirectoryAt` gives. */
+function isFileAt(fs, path) {
+	try {
+		return fs.stat(path).isFile();
+	} catch {
+		return false;
+	}
+}
+/**
+* The directory the ESM resolver MATCHES for `spec` from `fromDir`, or null
+* when the walk reaches the filesystem root without one: for each ancestor
+* `dir`, the candidate `dir/node_modules/<spec>`, and the first that stats as
+* a DIRECTORY is the match. A candidate that is anything else — absent, a
+* file, or a path whose stat fails for ANY reason — is "not here", and the
+* walk moves on to the next ancestor.
+*
+* That is Node's own rule, copied from its reader rather than from the spec
+* prose. Node 26.6.0 `internal/modules/package_json_reader.js`
+* (`getPackageJSONURL`) does
+* `const stat = internalModuleStat(...); if (stat !== 1) { ...; continue }`:
+* 1 is "directory", and a failed stat is a negative errno, so EACCES and
+* ELOOP keep walking exactly like ENOENT. Measured on 26.6.0: a self-link
+* (ELOOP) at `node_modules/<name>` in front of an ancestor's real copy makes
+* the import load the ancestor's copy. This walk used to throw on every
+* failure but ENOENT and ENOTDIR, and `incompatibilityMap` turned the throw
+* into no verdict — so a missing peer, whose walk runs all the way to the
+* root, met any unsearchable or looping `node_modules` on the way (a
+* `~/node_modules` made by `sudo npm i` under umask 027, say), and every
+* missing-peer badge in the catalog went silent while those plugins still
+* failed to import.
+*
+* The walk stops at the first match whatever it finds inside: the loader
+* imports from that directory or fails there, and never falls through to an
+* ancestor (measured on 26.6.0: an empty `node_modules/<name>` in front of an
+* ancestor's working copy fails the import with ERR_MODULE_NOT_FOUND).
+* Whether the match is a PACKAGE is `packageDirectory`'s question.
+*
+* Throws only for a `spec` that is not a bare package name. No state of the
+* filesystem can make it throw.
+*/
+function findPackageDir(fromDir, spec, fs) {
+	if (!isBarePackageName(spec)) throw new TypeError(`not a bare package name: ${JSON.stringify(spec)}`);
+	const segments = spec.split("/");
+	for (let dir = fromDir;;) {
+		const candidate = join(dir, "node_modules", ...segments);
+		if (isDirectoryAt(fs, candidate)) return candidate;
+		const parent = dirname(dir);
+		if (parent === dir) return null;
+		dir = parent;
+	}
+}
+/**
+* The directory `spec` is installed at as seen from `fromDir`, or null when
+* it is not installed there: the walk's match (`findPackageDir`), and only
+* when that directory holds a `package.json` that stats as a FILE. Anything
+* else is ABSENT — a match with no manifest, a manifest that is not a file,
+* one whose stat fails — because the loader matches that directory and the
+* import fails there. The case this exists for: an uninstall that stops
+* part-way (on Windows a locked file is enough) can leave
+* `<profile>/node_modules/L/` holding nothing but a nested `node_modules/`,
+* and a plugin declaring L then fails with ERR_MODULE_NOT_FOUND; while any
+* directory counted as present, the badge naming L disappeared. The lookup
+* before that one, `require.resolve('<spec>/package.json')`, required the
+* manifest too.
+*
+* The manifest is stat-ed and never read here: presence is the file, and
+* what it says is the version resolver's question. So a manifest that exists
+* but cannot be read or parsed is a present package with no readable version.
+*
+* One edge is knowingly given up: a directory holding `index.js` and no
+* manifest DOES import — Node's legacy main resolution tries `index.js` in a
+* match without a manifest — but reads absent here. No package manager
+* installs that shape.
+*
+* Throws only for a `spec` that is not a bare package name. This one lookup
+* is behind the presence resolver, the version resolver, and the running
+* harness's own `@deepseek-ai/dsh-app-boot` (`harness.ts`).
+*/
+function packageDirectory(fromDir, spec, fs = NODE_LOOKUP_FS) {
+	const match = findPackageDir(fromDir, spec, fs);
+	return match !== null && isFileAt(fs, join(match, "package.json")) ? match : null;
+}
+/**
+* The directory the walk starts from. `createRequire` took a file URL or an
+* absolute path and so does this — the production anchor is
+* `<profile>/cordis.yml` as a file URL — and, like `createRequire`, a
+* trailing separator names the directory itself rather than a file in its
+* parent. Anything else throws here, at construction, which the gateway's
+* call sites already treat as "no anchor, no verdict".
+*/
+function anchorDirectory(baseUrl) {
+	const path = isAbsolute(baseUrl) ? baseUrl : fileURLToPath(baseUrl);
+	return path.endsWith("/") || path.endsWith(sep) ? path : dirname(path);
+}
+/** `nodeResolver` over an injected filesystem, walking up from `fromDir` —
+* the seam fixtures drive the lookup through. */
+function packageResolver(fromDir, fs) {
+	return (spec) => packageDirectory(fromDir, spec, fs) !== null;
+}
 /**
-* The production resolver: the same question the harness's own
-* ClientModuleRegistry asks, through a require anchored at the profile. Asking
-* what the loader asks is what keeps this verdict and the runtime's behaviour
-* from drifting apart.
+* The production resolver, anchored at the profile. A peer is present when
+* the first ancestor `node_modules/<spec>` that is a directory holds a
+* `package.json` file — the directory the ESM resolver that loads plugins'
+* host halves matches for a bare package, and a manifest in it
+* (`findPackageDir`, `packageDirectory`). From `<profile>/cordis.yml` the
+* walk reads `<profile>/node_modules`, then `$DSH_HOME/profiles/node_modules`
+* — the link farm dsh-app-boot's `healProfilesModuleFallback` keeps, pointing
+* into the global dsh install, on 0.1.5; 0.1.7 keeps none, and on a harness
+* that serves its packages another way `harnessPackageResolver` asks it in
+* front of this walk — and so on up to the root, past any candidate
+* it cannot stat, as Node's reader walks past one (measured on Node 26.6.0
+* with a looping link in front of a real copy: the import loads the copy).
+* The one shape where this and the loader knowingly disagree is a directory
+* holding `index.js` and no manifest, which imports and reads absent here;
+* no package manager installs it (`packageDirectory`).
+*
+* It used to ask `require.resolve('<spec>/package.json')`, a question that
+* answered wrongly twice:
+*
+*  - Under a packaged dsh executable (`process.pkg`) the link farm holds ESM
+*    proxy packages instead of symlinks, and a proxy's `exports` leaves
+*    `./package.json` out on purpose, so resolving it threw
+*    ERR_PACKAGE_PATH_NOT_EXPORTED for every proxied peer. Presence read that
+*    as present; the version resolver below could read nothing. Reproduced:
+*    a proxy at `0.2.0-rc.1` against a declared `^0.1.1-rc.2` gave presence
+*    true, version null, mismatches `[]` — the load-time self-check could
+*    never fire under a packaged dsh.
+*  - Node caches a SUCCESSFUL CJS resolution for the life of the process
+*    (`Module._pathCache`, keyed on request + lookup paths) and hands the
+*    cached filename back without looking at the disk; a failure is not
+*    cached. Measured on Node 26.6.0 in one process: absent → false,
+*    installed → true, uninstalled → STILL true. A peer the reader removed
+*    left every plugin declaring it unflagged until dsh restarted.
+*
+* So nothing is cached and `exports` is never consulted: every call stats
+* afresh, and a package with a manifest is present whatever its `exports`
+* says. `stat` follows symlinks, so a link to nothing reads absent — which
+* matters, because the link farm adds links and never prunes them: 29 of its
+* 511 dangled on the machine this was measured on, after upgrades.
+*
+* The global folders — `NODE_PATH`, `~/.node_modules`, `~/.node_libraries`,
+* `$PREFIX/lib/node` — are deliberately not searched: the ESM resolver that
+* loads plugin host code does not search them either. That is not academic.
+* pnpm's bin shims export `NODE_PATH` (this repo's own `node_modules/.bin/
+* vitest` points it into the virtual store), and under one the old lookup
+* found harness packages from any anchor at all, a temp directory included.
+*
+* It throws only for a `spec` that is not a bare package name, and
+* `incompatibilityMap` turns the throw into no verdict: a hostile name is not
+* a fact about this installation, and false is an accusation. Nothing on the
+* filesystem makes it throw. It used to throw on a stat failure other than
+* ENOENT or ENOTDIR as well, reasoning that such a candidate "may hold the
+* package" — but the loader never asks what a candidate it cannot stat holds;
+* it walks on (`findPackageDir`), so the throw silenced true badges and
+* established nothing.
 */
 function nodeResolver(baseUrl) {
-	const require = createRequire(baseUrl);
-	return (spec) => {
-		try {
-			require.resolve(`${spec}/package.json`);
-			return true;
-		} catch (error) {
-			const code = error.code;
-			if (code === "MODULE_NOT_FOUND") return false;
-			if (code === "ERR_PACKAGE_PATH_NOT_EXPORTED") return true;
-			throw error;
-		}
-	};
+	return packageResolver(anchorDirectory(baseUrl), NODE_LOOKUP_FS);
+}
+/**
+* The manifest of the package the harness reaches for `spec` from
+* `parentURL`, or null when it reaches none, or one whose manifest no longer
+* stats as a file. The stat is fresh on every call for the reason §9.4 gives:
+* the service remembers a package it once found, and an uninstalled peer
+* must stop reading as present. Throws what the service throws, and a
+* TypeError for a name that is not a bare package name — which never reaches
+* the service, because peer names are catalog text.
+*/
+function harnessManifest(lookup, spec, parentURL, fs) {
+	if (!isBarePackageName(spec)) throw new TypeError(`not a bare package name: ${JSON.stringify(spec)}`);
+	const manifestPath = lookup.packageOf(spec, parentURL)?.manifestPath;
+	return typeof manifestPath === "string" && isFileAt(fs, manifestPath) ? manifestPath : null;
+}
+/**
+* Presence on a harness that serves its packages through its runtime
+* resolution (`HarnessPackageLookup`): present when the harness reaches a
+* package for `spec` from `parentURL`, the profile anchor, and otherwise
+* whatever `walk` answers — `nodeResolver` over the same anchor, in
+* production. Asking the harness first asks the loader's own question, since
+* a plugin's import goes through the same resolution. The walk stays behind
+* it because either answer can only clear a badge, never raise one, and a
+* false badge is the failure this module exists to avoid.
+*
+* Throws, which `incompatibilityMap` turns into no verdict for the entries
+* declaring `spec`, for a name that is not a bare package name and for
+* anything the service throws. A harness that cannot answer is silence:
+* falling back to the walk alone would read every package it serves as
+* missing.
+*/
+function harnessPackageResolver(walk, lookup, parentURL, fs = NODE_LOOKUP_FS) {
+	return (spec) => harnessManifest(lookup, spec, parentURL, fs) !== null || walk(spec);
 }
 /**
 * Package name → the peer names that did not resolve. A key is present only
@@ -2876,41 +3660,91 @@ function incompatibilityMap(entries, resolve) {
 	}
 	return out;
 }
-/**
-* The production resolver: `nodeResolver`'s own resolution, kept this time
-* instead of collapsed to a boolean. Anything that leaves no version to read
-* answers null — a peer that is absent, one that restricts `./package.json`
-* in its exports, an unreadable or malformed manifest, a manifest with no
-* `version`. Absence is deliberately NOT reported as a version violation:
-* `incompatibilityMap` is what covers a missing peer.
-*/
-function nodeVersionResolver(baseUrl) {
-	const require = createRequire(baseUrl);
+/** `nodeVersionResolver` over an injected filesystem, walking up from
+* `fromDir` — the seam fixtures drive the lookup through. */
+function packageVersionResolver(fromDir, fs) {
 	return (spec) => {
-		let manifestPath;
-		try {
-			manifestPath = require.resolve(`${spec}/package.json`);
-		} catch {
-			return null;
-		}
+		let dir;
 		try {
-			const version = JSON.parse(readFileSync(manifestPath, "utf8")).version;
-			return typeof version === "string" ? version : null;
+			dir = packageDirectory(fromDir, spec, fs);
 		} catch {
 			return null;
 		}
+		return dir === null ? null : manifestVersion(fs, join(dir, "package.json"));
 	};
 }
+/** The non-empty `version` string of the manifest at `manifestPath`, or null
+* for anything else. */
+function manifestVersion(fs, manifestPath) {
+	let manifest;
+	try {
+		manifest = JSON.parse(fs.readFile(manifestPath));
+	} catch {
+		return null;
+	}
+	const version = typeof manifest === "object" && manifest !== null ? manifest.version : void 0;
+	return typeof version === "string" && version.length > 0 ? version : null;
+}
 /**
-* The declared peers whose provided version is outside the declared range,
-* ordered by peer name. Pure: the module graph arrives through `resolve`.
+* The production version resolver: `nodeResolver`'s lookup, then the matched
+* directory's own `package.json`, read directly. Reading it directly is the
+* fix, not a shortcut: resolving `<spec>/package.json` is what an exports map
+* can refuse, and a packaged dsh's module proxy refuses it by construction
+* while carrying the proxied package's version in exactly that file (see
+* `nodeResolver`).
 *
-* `includePrerelease` is load-bearing, not a convenience. The harness ships
-* nothing but `-rc` versions, so under strict semver `^0.1.1-rc.2` excludes
-* every later rc on the same 0.1 line — including whichever one is installed
-* and working, named as a property because that version moves and a comment
-* naming it goes stale in place — and every future rc bump would raise a
-* false alarm. With it on, the range still excludes an older prerelease
+* The directory is the one the presence resolver finds present — the walk's
+* first directory match, holding a `package.json` file (`packageDirectory`;
+* `findPackageDir` cites Node's reader) — so the two never disagree about
+* which copy is installed: a candidate nobody can stat is walked past to the
+* copy further up, whose version is then the answer, exactly as the loader
+* imports that copy (measured on Node 26.6.0 with a looping link in front of
+* it); a match without a manifest is absent, and shadows every copy above
+* it. An `index.js`-only directory, which the loader would import, has no
+* manifest to read a version from either way.
+*
+* Anything that leaves no version to read answers null: a spec that is not a
+* bare package name, a peer that is absent, a manifest that is unreadable or
+* malformed, a `version` that is not a non-empty string. Absence is
+* deliberately NOT reported as a version violation: `incompatibilityMap` is
+* what covers a missing peer.
+*/
+function nodeVersionResolver(baseUrl) {
+	return packageVersionResolver(anchorDirectory(baseUrl), NODE_LOOKUP_FS);
+}
+/**
+* `harnessPackageResolver`'s twin for versions: read afresh from the manifest
+* of the package the harness reaches for `spec` — the copy a plugin's import
+* loads, which the walk cannot see on dsh 0.1.7 — and `walk`'s answer only
+* when the harness reaches none. A manifest the harness names but nobody can
+* read or parse answers null, never the walk's version: the walk may match
+* another copy, and the version must describe the copy presence found (see
+* `nodeVersionResolver`).
+*
+* Null for a name that is not a bare package name and for a service that
+* throws, as null is already this resolver's no-verdict signal.
+*/
+function harnessPackageVersionResolver(walk, lookup, parentURL, fs = NODE_LOOKUP_FS) {
+	return (spec) => {
+		let manifestPath;
+		try {
+			manifestPath = harnessManifest(lookup, spec, parentURL, fs);
+		} catch {
+			return null;
+		}
+		return manifestPath === null ? walk(spec) : manifestVersion(fs, manifestPath);
+	};
+}
+/**
+* The declared peers whose provided version is outside the declared range,
+* ordered by peer name. Pure: the module graph arrives through `resolve`.
+*
+* `includePrerelease` is load-bearing, not a convenience. The harness ships
+* nothing but `-rc` versions, so under strict semver `^0.1.1-rc.2` excludes
+* every later rc on the same 0.1 line — including whichever one is installed
+* and working, named as a property because that version moves and a comment
+* naming it goes stale in place — and every future rc bump would raise a
+* false alarm. With it on, the range still excludes an older prerelease
 * (`0.1.1-rc.1`) and a minor- or major-line move
 * (`0.2.0-rc.1`, `1.0.0`), which are the moves that actually break a plugin
 * path. Discrimination on both sides is the whole point: one false warning
@@ -2974,6 +3808,700 @@ function createPeerVersionCheck(deps) {
 	};
 }
 //#endregion
+//#region src/host/harness.ts
+/**
+* The harness this process runs: which `@deepseek-ai/dsh` it is, and that
+* dsh's own profile-template table — the running side of the
+* `dsh.compatibility` verdict (design 2026-09-01-harness-compatibility §9.9).
+*
+* Both used to be read from somewhere that is not the running harness, and
+* both were wrong there:
+*
+* - The version was the first `node_modules/@deepseek-ai/dsh` found walking up
+*   from the profile: what the profile can IMPORT, not what RUNS. A plugin
+*   that depends on the dsh package gets its copy hoisted into
+*   `<profile>/node_modules` — the listed `dsh-claude-tui@0.1.6` pulls
+*   0.1.2-rc.1 — a second install sharing DSH_HOME re-points the link farm,
+*   and under a packaged dsh the bin-only package gets no link-farm proxy at
+*   all, so the read was dead or stale. The first was reproduced with real
+*   installs on 2026-09-25 (the design's section 9.9 amendment): every
+*   verdict said "running 0.1.2-rc.1" while 0.1.5-rc.3 ran.
+* - The templates came from the shop's own `import * as appBoot`, which
+*   resolves from the SHOP's real path: under a `link:` install that is this
+*   repository's devDependency, 0.1.1-rc.2 with two templates, while
+*   0.1.5-rc.3 with five runs — and in production a copy hoisted from some
+*   plugin's dependencies can shadow it the same way.
+*
+* Both now come from the one thing that names the running harness: the script
+* this process was started with. Resolved through symlinks, the package that
+* owns it IS the dsh CLI that is running, if it is one at all; its manifest
+* says its version, and the app-boot it imports says its templates.
+*/
+/** The package whose `PROFILE_TEMPLATES` the running dsh composes profiles
+* from. */
+const APP_BOOT = "@deepseek-ai/dsh-app-boot";
+/** What is known when nothing says which harness runs. */
+function noHarness() {
+	return {
+		dshVersion: null,
+		templates: profileTemplatesOf(void 0),
+		patchLists: null,
+		peerCheck: null
+	};
+}
+/** Whether `path` stats as a regular file. */
+function isFile(path) {
+	try {
+		return statSync(path).isFile();
+	} catch {
+		return false;
+	}
+}
+/**
+* The package that owns `start`: the FIRST directory at or above it holding a
+* `package.json` file, and its parsed manifest — or null when there is none
+* up to the root, or when that manifest cannot be read or parsed. The walk
+* stops at the first manifest whatever it names, the rule `owningEntry` in
+* `dsh-cli.ts` follows: a script owned by some other package is not dsh's,
+* and climbing on would find an unrelated ancestor — a workspace root, or dsh
+* itself above a package vendored inside it.
+*/
+function owningPackage(start) {
+	for (let dir = start;;) {
+		const manifestPath = join(dir, "package.json");
+		if (isFile(manifestPath)) try {
+			return {
+				dir,
+				manifest: JSON.parse(readFileSync(manifestPath, "utf8"))
+			};
+		} catch {
+			return null;
+		}
+		const parent = dirname(dir);
+		if (parent === dir) return null;
+		dir = parent;
+	}
+}
+/**
+* What the app-boot the dsh at `dshDir` imports says about that dsh: its
+* template table, and whether it reads a list-valued bundle patch. Null when
+* no app-boot is on the resolution path.
+*
+* Found with the node_modules walk the peer check uses (`packageDirectory`)
+* from the dsh package directory — the copy nested under dsh first, then one
+* beside it, as dsh's own import finds it — and never through `NODE_PATH`:
+* pnpm's bin shims export one, and a bare CJS lookup finds a package through
+* it from any directory at all. Only the ABSOLUTE directory then reaches
+* Node's CJS resolver, which reads its `main` (an `exports` map applies to
+* bare specifiers only), and the entry is imported by file URL, which Windows
+* requires of an absolute path. Under the dsh that runs, that URL is the one
+* dsh itself loaded — the CJS resolver realpaths as the ESM loader does, and
+* app-boot's `main` and `exports` name the same file — so the import is a
+* cache hit, not a second instance. Measured against a global npm install of
+* 0.1.5-rc.3: this chain and the ESM resolution from dsh's own `lib/bin.js`
+* give the same URL, and the reader, handed `<prefix>/bin/dsh`, answers
+* 0.1.5-rc.3 with all five templates.
+*
+* Throws for whatever that chain cannot do; `readRunningHarness` turns any
+* throw into an empty table, an unknown `patchLists` and no peer check.
+*/
+async function appBootFacts(dshDir) {
+	const appBootDir = packageDirectory(dshDir, APP_BOOT);
+	if (appBootDir === null) return null;
+	const entry = createRequire(import.meta.url).resolve(appBootDir);
+	const exported = await import(pathToFileURL(entry).href);
+	return {
+		templates: profileTemplatesOf(exported.PROFILE_TEMPLATES),
+		patchLists: typeof exported.bundlePatchFiles === "function",
+		peerCheck: peerCheckOf(exported, appBootDir)
+	};
+}
+/**
+* The peer check an app-boot exports, bound to its own version (see
+* `PeerCheck.evaluate`), or null when it exports only part of one — a rule
+* without the exemptions would refuse what a profile has already allowed —
+* or when its manifest carries no version, which is the one `evaluate`
+* judges by. Never throws, so a check that cannot be formed costs the
+* templates and the patch-list answer nothing.
+*/
+function peerCheckOf(exported, appBootDir) {
+	const { evaluatePluginCompatibility: evaluate, readProfileVersionExemptions: exemptions } = exported;
+	if (typeof evaluate !== "function" || typeof exemptions !== "function") return null;
+	let version;
+	try {
+		version = JSON.parse(readFileSync(join(appBootDir, "package.json"), "utf8")).version;
+	} catch {
+		return null;
+	}
+	if (typeof version !== "string" || version.length === 0) return null;
+	const runtime = version;
+	const judge = evaluate;
+	return {
+		evaluate: (manifest, profileExemptions) => judge(manifest, profileExemptions, runtime),
+		exemptions
+	};
+}
+/**
+* The harness this process runs, identified from `script` — the gateway's
+* `restartScript`, `process.argv[1]` in production — or nothing, never a
+* guess:
+*
+* 1. `script` is resolved through symlinks, because `argv[1]` is the path the
+*    shell ran — `<prefix>/bin/dsh`, a link — and only its target lies inside
+*    the dsh package. No script, or one that does not resolve: nothing known.
+*    An empty path is no script either: `realpathSync('')` answers the
+*    working directory, which says where dsh was started, not what it is.
+* 2. The package that owns it (`owningPackage`) must be `@deepseek-ai/dsh`.
+*    Anything else — a test runner, another host embedding the shop — means
+*    nothing here can say which harness runs, and both halves of the verdict
+*    stay silent.
+* 3. `dshVersion` is that manifest's `version` when it is a non-empty string.
+* 4. `templates`, `patchLists` and `peerCheck` come from that dsh's own
+*    app-boot (`appBootFacts`). Any failure there costs all three and keeps
+*    the version.
+*
+* Never throws and never rejects: a harness nobody could identify forms no
+* verdict, and must never be the reason the catalog fails to load.
+*/
+async function readRunningHarness(script) {
+	try {
+		if (script === void 0 || script === "") return noHarness();
+		const owner = owningPackage(dirname(realpathSync(script)));
+		if (owner === null || typeof owner.manifest !== "object" || owner.manifest === null) return noHarness();
+		const { name, version } = owner.manifest;
+		if (name !== "@deepseek-ai/dsh") return noHarness();
+		const dshVersion = typeof version === "string" && version.length > 0 ? version : null;
+		let facts;
+		try {
+			facts = await appBootFacts(owner.dir);
+		} catch {
+			facts = null;
+		}
+		return {
+			dshVersion,
+			templates: facts?.templates ?? profileTemplatesOf(void 0),
+			patchLists: facts?.patchLists ?? null,
+			peerCheck: facts?.peerCheck ?? null
+		};
+	} catch {
+		return noHarness();
+	}
+}
+//#endregion
+//#region src/host/plugin-manager.ts
+/**
+* dsh's `pluginManager` service (0.1.7 on), as far as this shop calls it:
+* design 2026-09-26-plugin-manager-delegation. Structural throughout: the
+* build compiles against the 0.1.1-rc.2 harness floor, where
+* `@deepseek-ai/dsh-plugin-manager` does not exist.
+*/
+const REQUIRED = [
+	"installBundle",
+	"removeBundle",
+	"setPluginEnabled",
+	"setBundleEnabled"
+];
+/** The service, when `service` offers every required operation; else null.
+* All or nothing: half a service would take an install and fail its
+* uninstall. */
+function asPluginManager(service) {
+	if (typeof service !== "object" || service === null) return null;
+	const candidate = service;
+	if (!REQUIRED.every((method) => typeof candidate[method] === "function")) return null;
+	if (candidate.cancelInstall !== void 0 && typeof candidate.cancelInstall !== "function") return null;
+	return service;
+}
+const text = (value) => typeof value === "string" ? value : null;
+const record = (value) => typeof value === "object" && value !== null ? value : {};
+function incompatibleList(value) {
+	if (!Array.isArray(value)) return [];
+	return value.flatMap((item) => {
+		const entry = record(item);
+		const name = text(entry.name);
+		const version = text(entry.version);
+		const runtimeVersion = text(entry.runtimeVersion);
+		if (name === null || version === null || runtimeVersion === null) return [];
+		return [{
+			name,
+			version,
+			runtimeVersion,
+			peers: Object.fromEntries(Object.entries(record(entry.peers)).filter((pair) => typeof pair[1] === "string"))
+		}];
+	});
+}
+/** Read one `ChangeResult`. Every field is optional: one a later harness
+* drops reads as absent, never as a crash. */
+function readChange(raw) {
+	const result = record(raw);
+	const error = record(result.error);
+	const run = record(result.packageResult);
+	const fromError = incompatibleList(error.incompatible);
+	return {
+		application: text(result.application),
+		stage: text(result.stage),
+		errorCode: text(error.code),
+		diagnostic: text(error.diagnostic),
+		incompatible: fromError.length > 0 ? fromError : incompatibleList(run.incompatible),
+		kind: text(run.kind),
+		output: text(run.output) ?? "",
+		pendingBuilds: Array.isArray(result.pendingBuilds) ? result.pendingBuilds.filter((name) => typeof name === "string") : [],
+		failedAt: text(result.failedAt),
+		changed: typeof result.changed === "boolean" ? result.changed : null,
+		truncated: run.truncated === true
+	};
+}
+/** True when `sentence` names a `dsh plugin` command. */
+function namesCliCommand(sentence) {
+	return sentence.includes("dsh plugin");
+}
+const isTerminal = (character) => character === "." || character === "!" || character === "?";
+const isSpace = (character) => /\s/.test(character);
+/** Splits `line` into sentences, each still carrying whatever whitespace
+* followed its `.`, `!` or `?`, so joining every piece back together
+* reproduces `line` exactly. A sentence ends after a run of terminal
+* punctuation that whitespace or the end of the line follows; the text after
+* the last such run is one more piece, so a line with no terminal
+* punctuation at all is one sentence spanning the whole line, and an empty
+* line gives none. One pass from left to right: the regex this replaced
+* backtracked quadratically on a long run of punctuation with no whitespace
+* after it, and dsh's output holds up to 16 KB of whatever pnpm printed. */
+function sentencesIn(line) {
+	const pieces = [];
+	let start = 0;
+	let index = 0;
+	while (index < line.length) {
+		if (!isTerminal(line.charAt(index))) {
+			index += 1;
+			continue;
+		}
+		let runEnd = index;
+		while (runEnd < line.length && isTerminal(line.charAt(runEnd))) runEnd += 1;
+		if (runEnd < line.length && !isSpace(line.charAt(runEnd))) {
+			index = runEnd;
+			continue;
+		}
+		let end = runEnd;
+		while (end < line.length && isSpace(line.charAt(end))) end += 1;
+		pieces.push(line.slice(start, end));
+		start = end;
+		index = end;
+	}
+	if (start < line.length) pieces.push(line.slice(start));
+	return pieces;
+}
+/** Where `sentence`'s terminator starts: its closing punctuation and the
+* whitespace after it. Scanned back from the end, so no run in dsh's output
+* can make it slow. */
+function terminatorStart(sentence) {
+	let end = sentence.length;
+	while (end > 0 && /\s/.test(sentence.charAt(end - 1))) end -= 1;
+	while (end > 0 && ".!?".includes(sentence.charAt(end - 1))) end -= 1;
+	return end;
+}
+/** `sentence`, with every clause that names a `dsh plugin` command removed.
+* A clause is a run between `; ` separators, and what is kept keeps the
+* sentence's terminator. A sentence with nothing to remove is returned
+* unchanged; one that loses every clause is dropped (null). */
+function scrubSentence(sentence) {
+	if (!namesCliCommand(sentence)) return sentence;
+	const end = terminatorStart(sentence);
+	const kept = sentence.slice(0, end).split("; ").filter((clause) => !namesCliCommand(clause));
+	return kept.length === 0 ? null : `${kept.join("; ")}${sentence.slice(end)}`;
+}
+/** `line`, with every clause that names a `dsh plugin` command removed (see
+* `scrubSentence`). A line with nothing to remove is returned unchanged (so
+* it stays exactly what it was); one that loses every sentence is dropped
+* (null). */
+function scrubLine(line) {
+	const sentences = sentencesIn(line);
+	if (sentences.length === 0) return line;
+	const kept = sentences.map(scrubSentence).filter((sentence) => sentence !== null);
+	return kept.length === 0 ? null : kept.join("");
+}
+function scrubText(value) {
+	return value.split("\n").map(scrubLine).filter((line) => line !== null).join("\n");
+}
+/** `change`, with every clause naming a `dsh plugin` command removed from
+* `diagnostic` and `output`: dsh's CLI refuses every `plugin` subcommand for
+* the desktop profile, so a step dsh wrote assuming that command exists must
+* not reach a reader there. Two dsh texts this exists for: dsh-app-boot's
+* `pluginCompatibilityWarning` ("... with `dsh plugin allow-version` or the
+* plugin manager ..."), whose sentence goes whole, and the restoration line
+* after a failed repair ("..., but node_modules could not be reinstalled;
+* run 'dsh plugin install'"), which keeps what it says dsh restored. A
+* clause is a run between `; ` separators within a sentence; a sentence left
+* with no clause is dropped, and so is a line left with no sentence. Every
+* other line stays untouched, and a diagnostic left empty afterward reads as
+* absent, the same way `codeReason` already treats one. */
+function forDesktopReader(change) {
+	return {
+		...change,
+		diagnostic: change.diagnostic === null ? null : scrubText(change.diagnostic),
+		output: scrubText(change.output)
+	};
+}
+/** The end of a detail that passes on what a service call threw: `: ` and
+* the message, scrubbed for a desktop reader as `forDesktopReader` scrubs
+* dsh's answer, since a thrown message is dsh's text as well. A message left
+* with nothing to say ends the detail with a period instead. */
+function thrownTail(message, desktop) {
+	const said = desktop ? scrubText(message) : message;
+	return said.trim() === "" ? "." : `: ${said}`;
+}
+/** What each management code means, in dsh 0.1.7-rc.2's own terms (the
+* implementation plan of 2026-09-27, Task 2, records where each is raised). */
+const CODE_SENTENCE = {
+	"unknown-plugin": "dsh lists no plugin entry by that id",
+	"invalid-spec": "dsh could not read the install spec",
+	"ambiguous-install": "dsh could not tell which package the install added",
+	"not-bundle": "the package is not a dsh bundle",
+	"not-removable": "dsh does not allow removing this bundle",
+	"stop-profile": "the bundle is running and this dsh cannot unload it live, so the profile has to be stopped first",
+	"bundle-in-use": "the bundle was switched off, but some of its plugins are still running",
+	"stale-approval": "a build approval names a package pnpm no longer holds",
+	"management-required": "the plugin belongs to dsh itself",
+	unaddressable: "the plugin is not a row of the profile's own patch, so dsh cannot address it",
+	"operation-error": "dsh hit an unexpected error"
+};
+/** What each classified pnpm failure was, as dsh classifies it. */
+const KIND_SENTENCE = {
+	"pnpm-missing": "pnpm could not be started",
+	timeout: "pnpm did not finish within dsh's own time bound",
+	"not-found": "no such package was found",
+	"no-matching-version": "no version matching the requested one was found",
+	network: "the network failed",
+	"disk-full": "the disk is full",
+	permission: "permission was denied",
+	integrity: "the downloaded package failed its integrity check"
+};
+const WHERE = {
+	registry: " at the registry",
+	"spec-host": " at the host the package is fetched from"
+};
+/** An own-property read of one of the three tables above. They are object
+* literals, so a bare index read answers for Object.prototype, and a code of
+* `toString` would publish a function's source as dsh's reason (R43). */
+const lookup = (table, key) => Object.hasOwn(table, key) ? table[key] : void 0;
+/** The pnpm-failure hint a desktop reader gets: it names no command, which
+* the CLI would refuse for that profile. */
+const DESKTOP_FAILURE_HINT = "pnpm failed in the profile";
+/** What dsh says it restored after refusing, from its own restoration line:
+* the first `dsh: ` line after the one opening the refusal
+* (dsh-plugin-manager's `rejected`), read as the CLI path's `refusalDetail`
+* reads it, capitalized and ending in dsh's own period. Null when the output
+* holds no such line, being empty or cut short. */
+function restorationSentence(output) {
+	const lines = output.split(/\r?\n/);
+	const start = lines.findIndex((line) => line.startsWith(REFUSAL_OPENER));
+	if (start === -1) return null;
+	const said = lines.slice(start + 1).find((later) => later.startsWith("dsh: "))?.slice(5).trim() ?? "";
+	return said === "" ? null : `${said.charAt(0).toUpperCase()}${said.slice(1)}`;
+}
+/** The refusal of a package the running dsh rejects on its peers, for the
+* operation dsh refused: an install, an update, or an uninstall whose pnpm
+* run touched an incompatible sibling. What dsh restored is dsh's to say,
+* so its restoration line is passed on. Without one, an install or update
+* says what dsh's own pre-check says, and an uninstall says nothing of it. */
+function versionRefusalDetail(context, change) {
+	const refused = change.incompatible.map((issue) => `${issue.name}@${issue.version} declares ${Object.entries(issue.peers).map(([peer, range]) => `${peer} ${range}`).join(", ")}, which dsh ${issue.runtimeVersion} does not satisfy`);
+	const restored = restorationSentence(change.output) ?? (context.operation === "uninstall" || change.truncated ? null : "Nothing was installed.");
+	const base = `dsh-plugin-shop: dsh refused the ${context.operation}: ${refused.join("; ")}.${restored === null ? "" : ` ${restored}`}`;
+	if (context.desktop) return `${base} dsh's CLI, which grants version exemptions, does not manage the desktop profile, and this shop grants none.`;
+	const commands = change.incompatible.map((issue) => allowVersionCommand(context.profile, issue)).filter((command) => command !== null);
+	if (commands.length === 0) return base;
+	return `${base} To accept the risk of crashes or data loss for ${commands.length === 1 ? "this exact version" : "these exact versions"}, run: ${commands.join("; ")} - then ${context.operation} again.`;
+}
+/** The sentence a management code gets, plus dsh's own diagnostic. The
+* diagnostic is trimmed and stripped of one trailing period so one that
+* already ends in a period is not doubled; empty after that reads as
+* absent. Exported: Task 7 builds the same tail for a non-terminal notice. */
+function codeReason(change, code) {
+	const sentence = lookup(CODE_SENTENCE, code);
+	const diagnostic = change.diagnostic !== null ? change.diagnostic.trim().replace(/\.$/, "") : "";
+	const said = diagnostic !== "" ? ` dsh reported: ${diagnostic}.` : "";
+	return `${sentence !== void 0 ? `: ${sentence}` : ""}.${said}`;
+}
+/** A desktop reader's detail for build scripts pnpm held. The app bundles
+* its own package manager, so `pnpm approve-builds` is no step for this
+* reader, and the shop never allows build scripts itself. dsh's own Plugins
+* page offers "Allow these scripts and retry" on the failed screen of an
+* install it runs, listing the held packages (dsh-client-ui-plugin-manager
+* 0.1.7-rc.2: `installApproveAndRetry` in lib/client.js, and its README), so
+* that is named, but only for an install whose held builds dsh listed. Its
+* Add plugin dialog refuses a name the profile already holds, so it cannot
+* rerun an update, and with no name listed it offers no such button. */
+function desktopBuildsDetail(context, change, held) {
+	const base = `dsh-plugin-shop: pnpm is holding the build scripts of ${held}, which it blocks by default, and this shop never allows them.`;
+	if (context.operation !== "install" || change.pendingBuilds.length === 0) return base;
+	return `${base} dsh's Plugins page offers "Allow these scripts and retry" when an install it runs stops on them.`;
+}
+/** What a `cancelled` answer means, for every reader: the shop's deadline
+* asked dsh to stop the operation, and dsh answers `cancelled` only once its
+* repository check or pnpm has exited and package.json and pnpm-lock.yaml
+* are back as they were (dsh-plugin-manager 0.1.7-rc.2: cancelInstall, and
+* InstallCancelledError, thrown after the files are restored). Nothing was
+* installed, so the detail names no command: the CLI's `install`, which the
+* CLI path's own timeout detail names, would no longer involve the package.
+* Only installBundle can be cancelled, so the operation is an install or an
+* update. */
+function cancelledDetail(context) {
+	const seconds = Math.max(1, Math.round(context.timeoutMs / 1e3));
+	return `dsh-plugin-shop: the ${context.operation} did not finish within ${seconds}s, so the shop cancelled it. dsh stopped it, restored the profile's package.json and pnpm-lock.yaml, and installed nothing. Try the ${context.operation} again from the shop.`;
+}
+/** A `ChangeResult` as the shop's terminal install record: design
+* 2026-09-26-plugin-manager-delegation, section 5, read by the first rule
+* that matches. A removal that failed after dsh changed the profile says,
+* after whichever rule read it, that the package is still installed and
+* switched off. */
+function managerOutcome(raw, context) {
+	const change = context.desktop ? forDesktopReader(readChange(raw)) : readChange(raw);
+	const outcome = outcomeByRule(change, context);
+	if (context.operation === "uninstall" && outcome.state === "failed" && change.changed === true) {
+		const switchedOff = `${context.name} is still installed, but dsh has switched it off.`;
+		if (outcome.detail === void 0) return {
+			...outcome,
+			detail: switchedOff
+		};
+		const needsPeriod = !/[.!?]$/.test(outcome.detail);
+		return {
+			...outcome,
+			detail: `${outcome.detail}${needsPeriod ? "." : ""} ${switchedOff}`
+		};
+	}
+	return outcome;
+}
+/** The section 5 rules, in order; the first that matches wins. */
+function outcomeByRule(change, context) {
+	if (change.errorCode === "incompatible-version" || change.errorCode === "operation-error" && change.incompatible.length > 0) return {
+		state: "failed",
+		detail: versionRefusalDetail(context, change)
+	};
+	if (change.application === "failed" && change.stage === "enable") {
+		const code = change.errorCode ?? "failed";
+		return {
+			state: "failed",
+			detail: `dsh-plugin-shop: ${context.name} is installed, but dsh could not enable it (${code})${codeReason(change, code)} Uninstall it from the shop to undo the install.`
+		};
+	}
+	if (change.application === "failed" && change.kind !== null && (change.errorCode === null || change.errorCode === "operation-error")) {
+		if (change.kind === "build-blocked") {
+			const held = change.pendingBuilds.length > 0 ? change.pendingBuilds.join(", ") : "a dependency";
+			if (context.desktop) return {
+				state: "failed",
+				detail: desktopBuildsDetail(context, change, held)
+			};
+			return {
+				state: "failed",
+				detail: `dsh-plugin-shop: pnpm is holding the build scripts of ${held}, which it blocks by default: run \`pnpm approve-builds\` in the profile directory to allow them, then ${context.operation} again.`
+			};
+		}
+		if (change.kind === "timeout" && change.failedAt === "spec-host") return {
+			state: "failed",
+			detail: `dsh-plugin-shop: the ${context.operation} failed at the host the package is fetched from: dsh checks that a GitHub repository is reachable before pnpm runs, and that check did not finish within its bound (5 s by default), so pnpm never ran.`
+		};
+		const sentence = lookup(KIND_SENTENCE, change.kind);
+		if (sentence !== void 0) {
+			const where = change.failedAt === null ? "" : lookup(WHERE, change.failedAt) ?? "";
+			return {
+				state: "failed",
+				detail: `dsh-plugin-shop: the ${context.operation} failed${where}: ${sentence}.`
+			};
+		}
+		const lines = change.output.split(/\r?\n/).filter((line) => line !== "");
+		return {
+			state: "failed",
+			detail: context.desktop ? installFailureDetail(context.profile, lines, DESKTOP_FAILURE_HINT) : installFailureDetail(context.profile, lines)
+		};
+	}
+	if (change.errorCode !== null) return {
+		state: "failed",
+		detail: `dsh-plugin-shop: dsh ${change.errorCode === "operation-error" ? `could not ${context.operation} ${context.name}` : `refused the ${context.operation} of ${context.name}`} (${change.errorCode})${codeReason(change, change.errorCode)}`
+	};
+	if (change.application === "cancelled") return {
+		state: "failed",
+		detail: cancelledDetail(context)
+	};
+	if (change.application === "restart-required") return context.operation === "update" ? {
+		state: "done",
+		activation: "restart",
+		restartReason: "already-loaded"
+	} : {
+		state: "done",
+		activation: "restart"
+	};
+	if (change.application === "applied" || change.application === "overridden") {
+		const note = change.application === "overridden" ? { detail: "Saved, but a higher-priority layer (the home or invocation patch) decides whether it runs." } : {};
+		if (context.operation !== "uninstall" && context.alreadyImported) return {
+			state: "done",
+			activation: "restart",
+			restartReason: "already-loaded",
+			...note
+		};
+		return {
+			state: "done",
+			activation: activationOf({
+				hostLive: true,
+				clientLive: true,
+				hasClientHalf: context.hasClientHalf
+			}),
+			...note
+		};
+	}
+	return {
+		state: "failed",
+		detail: `dsh-plugin-shop: dsh answered the ${context.operation} with "${change.application ?? "nothing"}", which this shop does not know how to read.`
+	};
+}
+//#endregion
+//#region src/host/manager-runner.ts
+/**
+* One package operation through dsh's `pluginManager` service, tracked as the
+* same `RunningInstall` the CLI executor produces: design
+* 2026-09-26-plugin-manager-delegation, section 6. It runs in the same
+* per-profile queue as CLI commands, so the two paths are never concurrent in
+* one profile.
+*/
+/** The first line of every record this runner writes. The shop's log panel
+* shows it and the 0.1.7 e2e asserts it, so a silent fall back to the CLI
+* fails a case instead of passing it. */
+const MECHANISM_PREFIX = "via dsh's plugin manager:";
+/** Routes the service's `plugin-manager/install-log` chunks to the record
+* whose request id they carry. A chunk for any other id is dropped. dsh
+* tags each chunk with the stream it came from; a non-string stream reads
+* as `stdout`, matching a harness that predates the tag. */
+var ManagerLogs = class {
+	sinks = /* @__PURE__ */ new Map();
+	open(requestId, sink) {
+		this.sinks.set(requestId, sink);
+		return () => {
+			this.sinks.delete(requestId);
+		};
+	}
+	chunk(requestId, text, stream) {
+		if (typeof requestId !== "string" || typeof text !== "string") return;
+		this.sinks.get(requestId)?.(text, typeof stream === "string" ? stream : "stdout");
+	}
+};
+/** What every value this cannot describe reads as. */
+const UNREADABLE = "an error with no readable message";
+/** What a thrown value says about itself, and total: describing an error is
+* never itself the reason a settle fails. An `Error` gives its `message`,
+* anything else `String(value)`. A message that is not a string, or a
+* description that throws anywhere, reads as one fixed string: a Proxy whose
+* getPrototypeOf trap throws defeats `instanceof` itself, a `message` getter
+* can throw, and a null-prototype object has no conversion to a string. */
+const messageOf = (error) => {
+	try {
+		const said = error instanceof Error ? error.message : String(error);
+		if (typeof said === "string") return said;
+	} catch {}
+	return UNREADABLE;
+};
+function startManagerOperation(options) {
+	const { profile, requestId, mechanism, logs, run, cancel, outcome, alsoConfirm, prefetcher, spec, env, desktop = false } = options;
+	const timeoutMs = options.timeoutMs ?? INSTALL_TIMEOUT_MS;
+	const mechanismLine = `${MECHANISM_PREFIX} ${mechanism}`;
+	const log = createBoundedLog();
+	let state = "running";
+	let settled = null;
+	let streamed = false;
+	const status = () => ({
+		state,
+		log: [mechanismLine, ...log.lines()],
+		...settled?.state === "done" && settled.activation !== void 0 ? { activation: settled.activation } : {},
+		...settled?.state === "done" && settled.restartReason !== void 0 ? { restartReason: settled.restartReason } : {},
+		...settled?.detail !== void 0 ? { detail: settled.detail } : {}
+	});
+	const append = (line) => {
+		if (isTerminalInstallState(state)) return;
+		log.push(line);
+	};
+	const streams = /* @__PURE__ */ new Map();
+	const streamFor = (stream) => {
+		let sink = streams.get(stream);
+		if (sink === void 0) {
+			sink = lineSink(append);
+			streams.set(stream, sink);
+		}
+		return sink;
+	};
+	const flushStreams = () => {
+		for (const sink of streams.values()) sink.flush();
+	};
+	const close = logs.open(requestId, (text, stream) => {
+		streamed = true;
+		streamFor(stream).write(Buffer.from(text, "utf8"));
+	});
+	const queued = inProfileQueue(profile, async () => {
+		state = "running";
+		let deadline;
+		if (cancel !== void 0) deadline = setTimeout(() => {
+			Promise.resolve().then(() => cancel(requestId)).catch(() => {});
+		}, timeoutMs);
+		let raw;
+		try {
+			raw = await run(requestId);
+		} catch (error) {
+			flushStreams();
+			settled = {
+				state: "failed",
+				detail: `dsh-plugin-shop: dsh's plugin manager failed${thrownTail(messageOf(error), desktop)}`
+			};
+			state = "failed";
+			return status();
+		} finally {
+			clearTimeout(deadline);
+		}
+		let result;
+		try {
+			flushStreams();
+			if (!streamed) {
+				for (const line of readChange(raw).output.split(/\r?\n/)) if (line !== "") append(line);
+			}
+			result = outcome(raw);
+		} catch (error) {
+			settled = {
+				state: "failed",
+				detail: `dsh-plugin-shop: the shop could not read dsh's answer: ${messageOf(error)}`
+			};
+			state = "failed";
+			return status();
+		}
+		if (result.state === "done" && alsoConfirm !== void 0) try {
+			const objection = alsoConfirm();
+			if (objection !== null) result = {
+				state: "failed",
+				detail: objection
+			};
+		} catch (error) {
+			result = {
+				state: "failed",
+				detail: `dsh-plugin-shop: the shop could not check what dsh installed: ${messageOf(error)}`
+			};
+		}
+		settled = result;
+		state = result.state;
+		return status();
+	});
+	if ((queued.ahead > 0 && prefetcher !== void 0 && spec !== void 0 ? requestDownloadPhase({
+		prefetcher,
+		profile,
+		spec,
+		env,
+		log: append
+	}) : null)?.started === true && !isTerminalInstallState(state)) state = "downloading";
+	const finished = queued.finished.finally(() => {
+		close();
+		if (prefetcher !== void 0 && spec !== void 0) prefetcher.release(profile, spec);
+	});
+	finished.catch(() => {});
+	return {
+		installId: requestId,
+		status,
+		finished
+	};
+}
+//#endregion
 //#region src/host/index.ts
 /** ShopGateway: the Host half of dsh-plugin-shop (§5.1). */
 var __runInitializers = function(thisArg, initializers, value) {
@@ -3026,10 +4554,25 @@ var __esDecorate = function(ctor, descriptorIn, decorators, contextIn, initializ
 * service and to set an override that the platform check, being the first gate
 * of the three, could never reach. */
 const RESTART_BLOCKED_DETAIL = {
+	desktop: "dsh-plugin-shop: the desktop profile is managed by the DeepSeek Harness desktop app, and dsh refuses to restart it from here; restart the app to apply the change",
 	windows: "dsh-plugin-shop: restart is not supported on Windows yet; restart dsh manually to apply the change",
 	systemd: "dsh-plugin-shop: restart is disabled because this process is a systemd service — a restart would kill the takeover helper along with the unit, and the service would not come back. Set allowRestart: true in the shop row config to override.",
 	"port-zero": "dsh-plugin-shop: restart is not supported when dsh was launched with --port 0; restart dsh manually"
 };
+/** Why the shop changes nothing in the desktop profile, for every mutation
+* that spawns dsh's CLI: install, uninstall and self-update. dsh refuses
+* the profile before any of them would run (`isDesktopProfile`), and the
+* failure that surfaced instead read "pnpm failed in the profile". */
+const DESKTOP_PROFILE_DETAIL = "dsh-plugin-shop: the desktop profile is managed by the DeepSeek Harness desktop app, and dsh refuses to change it from the command line the shop runs; add and remove its plugins from the app instead";
+/** Why a switch through dsh's `pluginManager` waits for an operation this
+* gateway started: dsh holds its profile lock for a whole install or removal
+* (`change()` wraps pnpm) and makes any other change wait for it up to its
+* `lockWaitMs`, 120 s, so a switch clicked mid-install would spin for two
+* minutes and then fail on the lock. The check is F-5's, `hasRunningCommand`.
+* The shop's own row writer takes no dsh lock, so what it writes alone (the
+* CLI path's switch, and switching a deselected package off) is not
+* refused. */
+const switchWhileBusyDetail = (name) => `dsh-plugin-shop: an install, update or uninstall is still running in this profile, and dsh holds the profile until it ends; switch ${name} after it finishes.`;
 /** How many bytes a release tarball may be at the integrity check. The
 * registry already refuses to publish a tarball over 32 MiB, so 64 MiB is
 * headroom, not a gate of its own. */
@@ -3087,6 +4630,29 @@ async function verifyTarballSha256(fetchTarball, url, recordedSha256, maxBytes =
 function ownDependencySpec(dependencies, name) {
 	return Object.hasOwn(dependencies, name) ? dependencies[name] : void 0;
 }
+/**
+* Package names whose module this PROCESS may already hold in Node's module
+* cache (design 2026-09-26-market-borrowings §1.2).
+*
+* A hot mount can only deliver code the process has not imported yet. The hot
+* tree imports through the loader's `internal.import`, which is Node's own ESM
+* loader and caches a module by its URL, and an install rewrites a package's
+* files at the URL it already had (`nodeLinker: hoisted`). Once a name is in
+* here, a mount of it would re-run the cached module under whatever version is
+* now on disk.
+*
+* Module scope rather than a gateway field, because the cache it models is the
+* process's: a gateway rebuilt inside a running dsh — a restarted shop fiber —
+* must not forget what the process imported before it existed. Every gateway
+* seeds it with the profile's dependencies at construction (the boot
+* composition) and extends it with every name the hot path mounts. It extends
+* it again with every name one of its own installs through dsh's
+* `pluginManager` brought to the enable stage, and with the profile's
+* dependencies whenever that service reports an install: dsh's own Plugins
+* page installs through it, and the report names no package. Nothing is ever
+* removed: an uninstall disposes the fiber, not the module record.
+*/
+const importedThisProcess = /* @__PURE__ */ new Set();
 /** Remote-only service exposing the shop Remote methods of §7.3.
 *
 * @typert service shop */
@@ -3234,6 +4800,17 @@ let ShopGateway = (() => {
 			});
 		}
 		options = __runInitializers(this, _instanceExtraInitializers);
+		/** The context this gateway was built with: the shop's own fiber. Inside an
+		* RPC method `this.ctx` is NOT that — cordis hands a service out with `ctx`
+		* rebound to the context that looked it up, so a call arriving over the
+		* wire sees the caller's, the typert gateway's (measured on 0.1.5-rc.3 and
+		* 0.1.7-rc.2). Anything whose PARENT matters is registered from here. The
+		* hot tree above all: registered from the gateway's context it was owned by
+		* the gateway's fiber rather than the shop's, was listed under the gateway's
+		* loader entry, and — the part a reader saw — sat where dsh's client
+		* registry never composed it, so a hot-installed browser half needed a
+		* restart that a reload now does (design 2026-09-26-dsh-017-readiness). */
+		home;
 		/** The profile dsh installs into; discovered from this module's own
 		* location when the caller does not supply one. */
 		profile;
@@ -3253,6 +4830,11 @@ let ShopGateway = (() => {
 		exit;
 		restartExitDelayMs;
 		restartParentPid;
+		/** The restart this process committed, once it has: every later
+		* `shop/restart` answers with it. A page that lost the first answer to an
+		* HMR swap asks again (client/restart-monitor.ts), and inside the exit
+		* delay that ask reaches this same process. */
+		committedRestart = null;
 		latestVersion;
 		pinFs;
 		allowRestart;
@@ -3269,6 +4851,11 @@ let ShopGateway = (() => {
 		/** One pump for the whole gateway: batching is per profile and lives inside
 		* it, so a second instance would race the first for the same store. */
 		prefetcher;
+		/** What this process may already have imported (see `importedThisProcess`). */
+		imported;
+		/** Routes the output dsh's `pluginManager` streams to the record whose
+		* request id it carries (see the constructor). */
+		managerLogs;
 		/** The install gate runs against the last loaded snapshot, never a fresh
 		* fetch per request (§7.2: the Host's cached snapshot is the truth). */
 		/** Finished install records retained, so a poll sees the true terminal
@@ -3288,22 +4875,19 @@ let ShopGateway = (() => {
 		/** The user's own `registry=` from `~/.npmrc`, read at most once per
 		* gateway. A wrapper distinguishes a genuine `null` from an unread value. */
 		npmRegistryCache = null;
-		/** The incompatibility map already computed for `lastSnapshot`, keyed by
-		* that snapshot's own object identity. Design §3 asks for the verdict
-		* once per loaded snapshot, not once per RPC call: `loadCatalog` serves
-		* the same snapshot from its on-disk cache for minutes at a time, so
-		* without this, reopening the tab within that window would re-walk
-		* `node_modules` for every distinct peer name again — and Node only
-		* caches a SUCCESSFUL resolution, so a genuinely missing peer pays a full
-		* failed walk on every single call. Recomputed only when `catalog()`
-		* loads a snapshot that is not this exact object. */
-		incompatibleCache = null;
-		/** Install records, running and finished; a poll finds one here or reports not found. */
+		/** The harness this process runs, read at most once per gateway: which dsh
+		* is running cannot change while it runs, and the read imports a module. A
+		* promise, so concurrent first calls share one read; `readRunningHarness`
+		* never rejects, so there is no failure to retry. */
+		harnessRead = null;
+		/** Install records, running and finished, from the CLI and from dsh's
+		* `pluginManager` alike; a poll finds one here or reports not found. */
 		installs = /* @__PURE__ */ new Map();
 		/** Every install id in insertion order, oldest first; finished-record eviction walks this from the front. */
 		installOrder = [];
 		constructor(ctx, options = {}) {
 			super(ctx, "shop");
+			this.home = ctx;
 			this.options = options;
 			this.profile = options.profile ?? discoverProfile(fileURLToPath(import.meta.url), this.bootBaseDir()).name;
 			this.profileDir = options.profileDir;
@@ -3332,6 +4916,17 @@ let ShopGateway = (() => {
 			this.ppid = options.ppid ?? process.ppid;
 			this.fetchTarball = options.fetchTarball ?? ((url) => fetch(url));
 			this.prefetcher = options.prefetcher ?? createPrefetcher();
+			this.imported = options.importedModules ?? importedThisProcess;
+			this.recordDependenciesImported();
+			this.managerLogs = new ManagerLogs();
+			const on = this.ctx.on;
+			on?.call(this.ctx, "plugin-manager/install-log", (payload) => {
+				const chunk = payload;
+				this.managerLogs.chunk(chunk?.requestId, chunk?.text, chunk?.stream);
+			});
+			on?.call(this.ctx, "plugin-manager/changed", (payload) => {
+				if (payload?.reason === "install") this.recordDependenciesImported();
+			});
 			try {
 				cleanHotDir(this.profileDirResolved());
 			} catch {}
@@ -3347,7 +4942,7 @@ let ShopGateway = (() => {
 			try {
 				createPeerVersionCheck({
 					ranges: this.options.peerRanges ?? ownPeerRanges(),
-					resolve: this.options.resolvePeerVersion ?? nodeVersionResolver(pathToFileURL(join(this.profileDirResolved(), "cordis.yml")).href),
+					resolve: this.options.resolvePeerVersion ?? this.peerVersionResolver(this.profileAnchor()),
 					warn: (message) => {
 						const logger = this.ctx.logger;
 						if (logger === void 0) console.warn(message);
@@ -3379,6 +4974,65 @@ let ShopGateway = (() => {
 			if (this.profileDir !== void 0) return this.profileDir;
 			return discoverProfile(fileURLToPath(import.meta.url), this.bootBaseDir()).dir;
 		}
+		/** Where every "what can this installation's plugins import?" question
+		* resolves from: the profile's own Loader root, which is where the harness
+		* resolves plugins from. One definition for the peer presence check and the
+		* load-time self-check, so neither can drift onto a different notion of
+		* "the installation". NOT where the running harness is read from: a copy
+		* of `@deepseek-ai/dsh` a plugin's dependencies hoist into the profile is
+		* importable from here and is not what runs (`harness.ts`). Throws when no
+		* profile directory can be discovered and none is given. */
+		profileAnchor(profileDir = this.profileDirResolved()) {
+			return pathToFileURL(join(profileDir, "cordis.yml")).href;
+		}
+		/** dsh's `pluginPackages` service, when the running harness provides one
+		* (0.1.7 and later), else null. Read on each use, like `pluginInventory`.
+		* It is how such a harness serves its own packages to plugins, which no
+		* walk of the profile's disk can see (design
+		* 2026-09-01-harness-compatibility §11). */
+		harnessPackages() {
+			const service = this.ctx.get?.("pluginPackages");
+			return typeof service?.packageOf === "function" ? service : null;
+		}
+		/** dsh's `pluginManager` service, when the running harness provides all of
+		* it (0.1.7 and later), else null. Never cached across calls, like
+		* `pluginPackages`, but read once per RPC, at its start, and passed down:
+		* read again after an await, a service disposed in between would let a
+		* desktop mutation past the desktop gate and onto the CLI path, which dsh
+		* refuses for that profile. Design 2026-09-26-plugin-manager-delegation,
+		* section 3.1. */
+		pluginManager() {
+			return asPluginManager(this.ctx.get?.("pluginManager"));
+		}
+		/** "Does this installation provide `spec`?", asked from `anchor`: the
+		* harness's own resolution in front of the walk where the harness has one,
+		* the walk alone where it has not. */
+		peerResolver(anchor) {
+			const walk = nodeResolver(anchor);
+			const packages = this.harnessPackages();
+			return packages === null ? walk : harnessPackageResolver(walk, packages, anchor);
+		}
+		/** `peerResolver`'s twin for the versions the load-time self-check reads. */
+		peerVersionResolver(anchor) {
+			const walk = nodeVersionResolver(anchor);
+			const packages = this.harnessPackages();
+			return packages === null ? walk : harnessPackageVersionResolver(walk, packages, anchor);
+		}
+		/** `profileDirResolved`, or null when no profile directory can be
+		* discovered — for the reads that answer "cannot tell" rather than fail. */
+		profileDirOrNone() {
+			try {
+				return this.profileDirResolved();
+			} catch {
+				return null;
+			}
+		}
+		/** The harness this process runs, read once (see `harnessRead`). */
+		runningHarness() {
+			const read = this.options.readHarness ?? readRunningHarness;
+			this.harnessRead ??= read(this.restartScript);
+			return this.harnessRead;
+		}
 		/** The inventory, through the wire remote: an envelope `{ ok, value }` or
 		* `{ ok: false, error }`. Each row is re-validated before trust (same
 		* discipline as the rowConfig cast). */
@@ -3403,8 +5057,9 @@ let ShopGateway = (() => {
 		* down. A disable can land while the entry's init is still in flight: the
 		* options flip but the finishing init brings the fiber up anyway, and a
 		* plain re-update no-ops on the empty diff (dsh-market themes.ts:74-93).
-		* For an update swap this sequencing is mandatory, not defensive: two live
-		* instances of a service-providing plugin would collide at provision. */
+		* The uninstall path is the one caller: an update used to swap its running
+		* instance for a hot mount through here, and no longer mounts at all
+		* (design 2026-09-26-market-borrowings §1). */
 		/** The package's owned entry ids, or none when its bundle patch cannot be
 		* read. For the paths where a live disable is an optimization and the
 		* operation must succeed regardless; `setEnabled` reports the failure
@@ -3438,13 +5093,20 @@ let ShopGateway = (() => {
 		* Through `ownDependencySpec` for the reason spelled out there: a bare index
 		* read answers for `Object.prototype`, and `constructor` is a legal npm
 		* name. The cost on this path is behavioural twice over — the gate would
-		* weigh a function as the installed spec, and a phantom `isUpdate` would run
-		* `liveDisableIds` against something absent.
+		* weigh a function as the installed spec, and a phantom `isUpdate` would
+		* refuse a hot mount to a package this process never imported.
 		*/
 		installedSpecOf(name) {
 			const dependencies = this.profileDependenciesOrNone();
 			return dependencies === void 0 ? void 0 : ownDependencySpec(dependencies, name);
 		}
+		/** Add every dependency the profile manifest holds to the `imported`
+		* record (see `importedThisProcess`): each is a package dsh's loader may
+		* have loaded in this process, at boot or by an install since. An
+		* unreadable manifest adds nothing. */
+		recordDependenciesImported() {
+			for (const name of Object.keys(this.profileDependenciesOrNone() ?? {})) this.imported.add(name);
+		}
 		ownedEntryIdsOrNone(packageName) {
 			try {
 				return ownedEntryIds({
@@ -3503,16 +5165,18 @@ let ShopGateway = (() => {
 			}
 			return allDown;
 		}
-		/** Enable or disable one installed plugin, hot (§8): a disable writes the
-		* row to the user layer, an enable drops it again so the bundle default
-		* rules — the CLI's watchUserPatches applies either through HMR. The shop's
-		* own row and the framework's bundles are never toggleable: disabling the
-		* host chain would break HMR itself. */
+		/** Enable or disable one installed plugin, hot (§8): the write sets the
+		* `disabled` key of each owned entry's row in the user layer and changes
+		* nothing else there (design 2026-09-26-market-borrowings §2) — the CLI's
+		* watchUserPatches applies it through HMR. The shop's own row and the
+		* framework's bundles are never toggleable: disabling the host chain would
+		* break HMR itself. */
 		async setEnabled(args) {
 			if (args.name === "dsh-plugin-shop" || args.name.startsWith("@deepseek-ai/")) return {
 				ok: false,
 				detail: `dsh-plugin-shop: ${args.name} is part of the harness chain and cannot be toggled from the shop`
 			};
+			const manager = this.pluginManager();
 			const profileDir = this.profileDirResolved();
 			const manifest = readProfileManifest("dsh-plugin-shop", profileDir);
 			if (!Object.hasOwn(manifest.dependencies ?? {}, args.name)) return {
@@ -3521,7 +5185,7 @@ let ShopGateway = (() => {
 			};
 			let owned;
 			try {
-				owned = ownedEntryIds({
+				owned = ownedEntries({
 					profileDir,
 					packageName: args.name
 				});
@@ -3535,16 +5199,66 @@ let ShopGateway = (() => {
 				ok: false,
 				detail: `dsh-plugin-shop: ${args.name} contributes no plugin entries, so there is nothing to enable or disable`
 			};
-			const ownedSet = new Set(owned);
-			if ((await this.listInventory()).filter((entry) => ownsEntryId(ownedSet, entry.entryId)).length === 0) return {
+			const selected = this.runningProfileBundles(profileDir);
+			if (selected !== null && !selected.includes(args.name)) return this.setDeselectedEnabled(args.name, args.enabled, profileDir, owned, manager);
+			const ownedSet = new Set(owned.map((entry) => entry.id));
+			const live = (await this.listInventory()).filter((entry) => ownsEntryId(ownedSet, entry.entryId));
+			if (live.length === 0) return {
 				ok: false,
 				detail: `dsh-plugin-shop: ${args.name} is installed but its entries are not in the running plugin tree; restart dsh to compose them`
 			};
+			if (manager !== null) {
+				if (this.hasRunningCommand()) return {
+					ok: false,
+					detail: switchWhileBusyDetail(args.name)
+				};
+				let restart = false;
+				let switched = 0;
+				const failed = (detail) => {
+					if (switched === 0) return {
+						ok: false,
+						detail
+					};
+					return {
+						ok: false,
+						detail: `${/[.!?]$/.test(detail) ? detail : `${detail}.`} ${switched} of its ${live.length} plugins had already switched ${args.enabled ? "on" : "off"}.`
+					};
+				};
+				for (const entry of live) {
+					let raw;
+					try {
+						raw = await manager.setPluginEnabled(entry.entryId, args.enabled);
+					} catch (error) {
+						return failed(`dsh-plugin-shop: dsh could not switch ${args.name}${thrownTail(messageOf(error), isDesktopProfile(this.profile))}`);
+					}
+					const { change, failure } = this.readManagerAnswer(raw, {
+						act: `switch ${args.name}`,
+						request: `the switch for ${args.name}`,
+						stays: args.enabled ? "off" : "on"
+					});
+					if (failure !== null) return failed(failure);
+					switched += 1;
+					if (change.application === "restart-required") restart = true;
+				}
+				if (restart) return {
+					ok: true,
+					activation: "restart"
+				};
+				return {
+					ok: true,
+					activation: activationOf({
+						hostLive: true,
+						clientLive: true,
+						hasClientHalf: this.packageHasClientHalf(args.name)
+					})
+				};
+			}
 			setUserLayerRows({
 				profileDir,
-				rows: owned.map((id) => ({
+				rows: owned.map(({ id, name }) => ({
 					id,
-					disabled: !args.enabled
+					disabled: !args.enabled,
+					...name !== void 0 ? { name } : {}
 				}))
 			});
 			return {
@@ -3556,6 +5270,119 @@ let ShopGateway = (() => {
 				})
 			};
 		}
+		/**
+		* `setEnabled` for an installed package whose bundle the profile does not
+		* select.
+		*
+		* Switching it off writes the plugin-level rows and nothing else: none of
+		* it runs, and the rows keep it off if dsh selects the bundle again.
+		* Switching it on selects the bundle through dsh's own `pluginManager`, the
+		* writer behind the switch that deselected it, and then clears the
+		* plugin-level rows as an ordinary enable does. A harness without that
+		* service gets the way back in words instead. `dsh plugin add <name>` is
+		* not printed: it selects the bundle again only on 0.1.5, and it lets pnpm
+		* float a registry package to `latest`.
+		*/
+		async setDeselectedEnabled(name, enabled, profileDir, owned, manager) {
+			const rows = owned.map(({ id, name: moduleName }) => ({
+				id,
+				disabled: !enabled,
+				...moduleName !== void 0 ? { name: moduleName } : {}
+			}));
+			if (!enabled) {
+				setUserLayerRows({
+					profileDir,
+					rows
+				});
+				return {
+					ok: true,
+					activation: "live"
+				};
+			}
+			if (manager === null) return {
+				ok: false,
+				detail: `dsh-plugin-shop: ${name} is installed but switched off at the bundle level: dsh.profile.bundles in ${join(profileDir, "package.json")} does not list it, so dsh composes none of it, and a restart will not change that. This dsh has no pluginManager service to select it again: add "${name}" back to that list and restart dsh, or uninstall it and install it again from the shop.`
+			};
+			if (this.hasRunningCommand()) return {
+				ok: false,
+				detail: switchWhileBusyDetail(name)
+			};
+			let raw;
+			try {
+				raw = await manager.setBundleEnabled(name, true);
+			} catch (error) {
+				return {
+					ok: false,
+					detail: `dsh-plugin-shop: dsh could not select ${name} again${thrownTail(messageOf(error), isDesktopProfile(this.profile))}`
+				};
+			}
+			const { change, failure } = this.readManagerAnswer(raw, {
+				act: `select ${name} again`,
+				request: `the selection of ${name}`,
+				stays: "off"
+			});
+			if (failure !== null) return {
+				ok: false,
+				detail: failure
+			};
+			setUserLayerRows({
+				profileDir,
+				rows
+			});
+			if (change.application === "restart-required") return {
+				ok: true,
+				activation: "restart"
+			};
+			return {
+				ok: true,
+				activation: activationOf({
+					hostLive: true,
+					clientLive: true,
+					hasClientHalf: this.packageHasClientHalf(name)
+				})
+			};
+		}
+		/**
+		* dsh's answer to a switch or a bundle selection, read the one way both
+		* callers need it (R32): the change, scrubbed for a desktop reader, and the
+		* detail that fails the request, or null when dsh applied it. `act` is what
+		* was asked, as "switch <name>", `request` names the request itself, as
+		* "the switch for <name>", and `stays` is the state the plugin keeps when
+		* the request does not take effect. An application this shop does not know
+		* fails rather than reading as applied: a later harness may answer
+		* something new.
+		*
+		* `overridden` fails too (R39). dsh answers it when, after it wrote the row
+		* and reloaded, the live entry still differs from the request
+		* (dsh-plugin-manager 0.1.7-rc.2, setPluginEnabled), and its README names
+		* what outranks the profile's own patch: home and invocation patches keep
+		* their higher priority. The change is saved and the plugin runs as it
+		* did, so a success would flip the client's switch over a plugin that did
+		* not change, and that switch never re-reads the live state.
+		* setBundleEnabled never answers it; a selection reads it the same way.
+		*/
+		readManagerAnswer(raw, words) {
+			const change = isDesktopProfile(this.profile) ? forDesktopReader(readChange(raw)) : readChange(raw);
+			if (change.application === "failed" || change.application === "cancelled" || change.errorCode !== null) {
+				const code = change.errorCode ?? change.application ?? "failed";
+				return {
+					change,
+					failure: `dsh-plugin-shop: dsh ${code === "operation-error" ? "could not" : "refused to"} ${words.act} (${code})${codeReason(change, code)}`
+				};
+			}
+			if (change.application === "overridden") return {
+				change,
+				failure: `dsh-plugin-shop: dsh saved ${words.request}, but a home or invocation patch, which outranks the profile's own, keeps it ${words.stays}.`
+			};
+			if (change.application === "applied" || change.application === "restart-required") return {
+				change,
+				failure: null
+			};
+			return {
+				change,
+				failure: `dsh-plugin-shop: dsh answered ${words.request} with "${change.application ?? "nothing"}", which this shop does not know how to read.`
+			};
+		}
 		rowConfig() {
 			if (this.options.catalogUrl !== void 0 && this.options.cacheDir !== void 0) return {
 				catalogUrl: this.options.catalogUrl,
@@ -3635,11 +5462,16 @@ let ShopGateway = (() => {
 		* static does. One ordered list, read by `restart()` before it commits and
 		* by `version()` so the client can say the same thing up front.
 		*
-		* The order is the order the refusals were written in and is load-bearing
-		* for the copy a reader sees: Windows first, because the platform check has
-		* no override and reporting the systemd one there sends a Windows user to
-		* set `allowRestart: true`, which this gate would still refuse.
+		* The order is load-bearing for the copy a reader sees. The desktop
+		* profile first: dsh itself refuses to launch it, so no platform,
+		* supervisor or port could make a restart possible there. Then Windows,
+		* because the platform check has no override and reporting the systemd one
+		* there sends a Windows user to set `allowRestart: true`, which this gate
+		* would still refuse.
 		*
+		* - `desktop`: dsh's CLI refuses `--profile desktop` ("managed exclusively
+		*   by the Electron application"), so the relaunch would exit at once and
+		*   leave nothing on the port; the app restarts it.
 		* - `windows`: the handoff helper is a POSIX shell one-liner (restart.ts)
 		*   and there is no `sh` on Windows. That spawn fails ASYNCHRONOUSLY, so
 		*   committing would answer `ok: true`, exit this process, and leave nothing
@@ -3651,6 +5483,7 @@ let ShopGateway = (() => {
 		* - `port-zero`: the OS hands the NEW process a fresh port the browser
 		*   cannot know, so a restart would strand the client on a dead origin. */
 		staticRestartBlock() {
+			if (isDesktopProfile(this.profile)) return "desktop";
 			if (!this.restartPlatformSupported()) return "windows";
 			if (detectSupervisor(this.env, { ppid: this.ppid }) === "systemd" && !this.allowRestartConfigured()) return "systemd";
 			const portIndex = this.restartArgv.indexOf("--port");
@@ -3664,20 +5497,31 @@ let ShopGateway = (() => {
 		/** Browse the catalog (§7.3): cached snapshot, refreshed on demand. */
 		async catalog(args) {
 			const { snapshot, stale } = await this.loadCatalogOnce(args?.refresh ?? false);
-			let incompatible;
-			if (this.incompatibleCache !== null && this.incompatibleCache.snapshot === snapshot) incompatible = this.incompatibleCache.map;
-			else {
-				try {
-					const resolve = this.options.resolvePeer ?? nodeResolver(pathToFileURL(join(this.profileDirResolved(), "cordis.yml")).href);
-					incompatible = incompatibilityMap(snapshot.entries, resolve);
-				} catch {
-					incompatible = {};
-				}
-				this.incompatibleCache = {
-					snapshot,
-					map: incompatible
-				};
+			const harness = await this.runningHarness();
+			const profileDir = this.profileDirOrNone();
+			let incompatible = {};
+			if (profileDir !== null) try {
+				const resolve = this.options.resolvePeer ?? this.peerResolver(this.profileAnchor(profileDir));
+				incompatible = incompatibilityMap(snapshot.entries, resolve);
+			} catch {
+				incompatible = {};
+			}
+			let incompatibleHarness;
+			try {
+				incompatibleHarness = compatibilityMap(snapshot.entries, {
+					dshVersion: harness.dshVersion,
+					profile: {
+						name: this.profile,
+						bundles: profileDir === null ? null : this.runningProfileBundles(profileDir)
+					}
+				}, harness.templates);
+			} catch {
+				incompatibleHarness = {};
 			}
+			for (const [key, peers] of Object.entries(this.refusedByHarness(snapshot.entries, harness, profileDir))) incompatibleHarness[key] = {
+				...incompatibleHarness[key],
+				peers
+			};
 			return {
 				schemaVersion: snapshot.schemaVersion,
 				builtAt: snapshot.builtAt,
@@ -3686,15 +5530,57 @@ let ShopGateway = (() => {
 				denied: snapshot.denied,
 				notAShop: snapshot.notAShop ?? [],
 				stars: snapshot.stars,
-				incompatible
+				incompatible,
+				incompatibleHarness
 			};
 		}
 		/**
+		* The installs the running dsh will refuse on their harness peers
+		* (`peerVerdictsOf`), judged against the exemptions this profile holds —
+		* read on every call like the other verdicts, because recording one is
+		* exactly the event that must clear a card: the reader runs the command
+		* the card shows, presses Refresh, and the install is allowed. Empty when
+		* the running dsh has no such check (before 0.1.7) or no profile was
+		* found, and when either read throws: a refusal nobody could establish is
+		* never shown, least of all as a disabled button.
+		*/
+		refusedByHarness(entries, harness, profileDir) {
+			if (harness.peerCheck === null || profileDir === null) return {};
+			try {
+				return peerVerdictsOf(entries, harness.peerCheck, harness.peerCheck.exemptions(profileDir), this.profile);
+			} catch {
+				return {};
+			}
+		}
+		/**
+		* The bundles the profile at `profileDir` composes, or null when its
+		* manifest cannot be read — which is no verdict on the profile half rather
+		* than an accusation. `dsh.profile.bundles` is the same list
+		* `discoverProfile` uses to recognize a profile directory, read through the
+		* harness's own parser so a profile this shop was booted inside is read the
+		* way dsh reads it.
+		*/
+		runningProfileBundles(profileDir) {
+			try {
+				const bundles = readProfileManifest("dsh-plugin-shop", profileDir).dsh?.profile?.bundles;
+				if (!Array.isArray(bundles) || !bundles.every((bundle) => typeof bundle === "string")) return null;
+				return bundles;
+			} catch {
+				return null;
+			}
+		}
+		/**
 		* Install one cataloged version into the profile (§7.2). The rejection
 		* paths run against this Host's snapshot before anything is spawned; only a
 		* passing request reaches the executor.
 		*/
 		async install(args) {
+			const manager = this.pluginManager();
+			if (isDesktopProfile(this.profile) && manager === null) return {
+				ok: false,
+				code: "desktop-profile",
+				detail: DESKTOP_PROFILE_DETAIL
+			};
 			const snapshot = await this.snapshotNow();
 			const installedSpec = this.installedSpecOf(args.name);
 			const verdict = validateInstall(snapshot, args, installedSpec);
@@ -3722,61 +5608,160 @@ let ShopGateway = (() => {
 				spec = `github:${entry.repo}#${args.version}${entry.subdir !== void 0 ? `&path:${entry.subdir}` : ""}`;
 			} else spec = `${args.name}@${args.version}`;
 			const isUpdate = installedSpec !== void 0;
-			const priorEntryIds = isUpdate ? this.ownedEntryIdsOrNone(args.name) : [];
-			const priorClientHalf = isUpdate && this.packageHasClientHalf(args.name);
+			const alreadyImported = isUpdate || this.imported.has(args.name);
+			const harness = await this.runningHarness();
+			if (manager !== null) {
+				const running = this.startManagerInstall(manager, spec, `install ${spec}`, (raw) => {
+					if (!isUpdate && readChange(raw).stage === "enable") this.imported.add(args.name);
+					return managerOutcome(raw, this.outcomeContext(args.name, isUpdate ? "update" : "install", alreadyImported, this.packageHasClientHalf(args.name)));
+				}, () => this.postInstallHazard(args.name, harness, " It is on disk: uninstall it from the shop to undo this install."));
+				this.track(running);
+				this.recordGithubPin(entry);
+				return {
+					ok: true,
+					installId: running.installId,
+					state: running.status().state
+				};
+			}
 			const running = startInstall({
 				profile: this.profile,
 				spec,
 				dshBin: this.dshBin,
 				expectedName: args.name,
 				prefetcher: this.prefetcher,
-				alsoConfirm: () => {
-					const clash = collidingEntryId({
-						profileDir: this.profileDirResolved(),
-						packageName: args.name,
-						dependencies: Object.keys(this.profileDependenciesOrNone() ?? {})
-					});
-					if (clash === null) return null;
-					return `dsh-plugin-shop: ${args.name} declares the loader entry id "${clash.id}", which ${clash.holder} already declares. dsh refuses to load a plugin tree holding a duplicate entry id, so the profile would not start. It is on disk: run \`dsh plugin --profile ${this.profile} remove ${args.name}\` to undo this install.`;
-				},
+				alsoConfirm: () => this.postInstallHazard(args.name, harness, ` It is on disk: run \`dsh plugin --profile ${this.profile} remove ${args.name}\` to undo this install.`),
 				afterDone: async () => {
+					if (alreadyImported) return {
+						activation: "restart",
+						restartReason: "already-loaded"
+					};
 					const hot = this.hot ?? {
 						mount: hotMount,
 						unmount: hotUnmount
 					};
-					if (isUpdate) await this.liveEntriesDown(priorEntryIds);
-					const result = await hot.mount({ plugin: (plugin, config) => this.ctx.plugin(plugin, config) }, this.profileDirResolved(), args.name);
+					this.imported.add(args.name);
+					const result = await hot.mount({ plugin: (plugin, config) => this.home.plugin(plugin, config) }, this.profileDirResolved(), args.name);
 					if (!result.ok) return {
 						activation: "restart",
 						...result.reason !== null ? { restartReason: result.reason } : {}
 					};
-					const activation = activationOf({
+					return { activation: activationOf({
 						hostLive: true,
-						clientLive: false,
-						hasClientHalf: priorClientHalf || this.packageHasClientHalf(args.name)
-					});
-					return activation === "restart" ? {
-						activation,
-						restartReason: "client-half"
-					} : { activation };
+						clientLive: true,
+						hasClientHalf: this.packageHasClientHalf(args.name)
+					}) };
 				}
 			});
-			if (entry.source === "github") {
-				const pins = readRepoPins(this.pinFs, this.pinsPath());
-				writeRepoPins(this.pinFs, this.pinsPath(), {
-					...pins,
-					[identityKey(entry)]: entry.version
-				});
-			}
-			this.installs.set(running.installId, running);
-			this.installOrder.push(running.installId);
-			this.evictFinishedInstalls();
+			this.recordGithubPin(entry);
+			this.track(running);
 			return {
 				ok: true,
 				installId: running.installId,
 				state: running.status().state
 			};
 		}
+		/**
+		* What would stop the profile from starting now that `name`'s files are on
+		* disk, or null: an entry id another installed package already declares,
+		* or a bundle patch declaration this dsh cannot read. Neither is knowable
+		* before the files land. The package stays on disk either way, so each
+		* detail ends with `undo`, the sentence that says how to take the install
+		* back on the path that made it.
+		*/
+		postInstallHazard(name, harness, undo) {
+			const clash = collidingEntryId({
+				profileDir: this.profileDirResolved(),
+				packageName: name,
+				dependencies: Object.keys(this.profileDependenciesOrNone() ?? {})
+			});
+			if (clash !== null) return `dsh-plugin-shop: ${name} declares the loader entry id "${clash.id}", which ${clash.holder} already declares. dsh refuses to load a plugin tree holding a duplicate entry id, so the profile would not start.` + undo;
+			switch (patchDeclarationHazard(declaredBundlePatch({
+				profileDir: this.profileDirResolved(),
+				packageName: name
+			}), harness.patchLists)) {
+				case null: return null;
+				case "list-unsupported": return `dsh-plugin-shop: ${name} lists its bundle patch as several files, which dsh reads from 0.1.7 on; this dsh${harness.dshVersion === null ? "" : ` (${harness.dshVersion})`} reads one and would not start with it installed.` + undo;
+				case "malformed": return `dsh-plugin-shop: ${name} declares its bundle patch as neither a file path nor a list of them, which dsh refuses to load, so the profile would not start.` + undo;
+			}
+		}
+		/** Remember a github entry's pinned commit: the manifest records only
+		* `github:owner/slug`, so the pins file is how `installed()` reports
+		* outdated honestly. A failed install leaves a pin behind, but the
+		* manifest presence gate keeps it invisible. */
+		recordGithubPin(entry) {
+			if (entry.source !== "github") return;
+			const pins = readRepoPins(this.pinFs, this.pinsPath());
+			writeRepoPins(this.pinFs, this.pinsPath(), {
+				...pins,
+				[identityKey(entry)]: entry.version
+			});
+		}
+		/** Forget an uninstalled package's pins: its own, and its identity pin when
+		* a catalog row matched the installed spec. Both uninstall paths call this
+		* once their operation has started, so a stale pin never outlives the
+		* uninstall in the shop's cache either way. The plugin manager path tracks
+		* its record first, so a write here that throws cannot hide an operation
+		* already queued. */
+		forgetPins(name, installedEntry) {
+			const pins = readRepoPins(this.pinFs, this.pinsPath());
+			const stalePins = [name, ...installedEntry === void 0 ? [] : [identityKey(installedEntry)]];
+			let forgot = false;
+			for (const key of stalePins) {
+				if (pins[key] === void 0) continue;
+				delete pins[key];
+				forgot = true;
+			}
+			if (forgot) writeRepoPins(this.pinFs, this.pinsPath(), pins);
+		}
+		/** What `managerOutcome` reads dsh's answer against. The gateway's own
+		* facts are set here once, for every operation through the service: the
+		* profile, whether it is the desktop one, and the deadline a timeout
+		* detail names. */
+		outcomeContext(name, operation, alreadyImported, hasClientHalf) {
+			return {
+				profile: this.profile,
+				name,
+				operation,
+				alreadyImported,
+				hasClientHalf,
+				desktop: isDesktopProfile(this.profile),
+				timeoutMs: INSTALL_TIMEOUT_MS
+			};
+		}
+		/**
+		* One install-shaped operation through dsh's `pluginManager` (design
+		* 2026-09-26-plugin-manager-delegation, section 6): `installBundle(spec)`
+		* under the record's own id as its request id, so the output dsh streams
+		* for it reaches this record, in the profile's queue with the download
+		* phase the CLI path has. At the shop's deadline dsh is asked to cancel it;
+		* a service that offers no `cancelInstall` gets no deadline, and its record
+		* settles when dsh answers. `install` and `updateStart` differ only in the
+		* mechanism line and in how they read the answer.
+		*/
+		startManagerInstall(manager, spec, mechanism, outcome, alsoConfirm) {
+			gateOperand(spec);
+			const cancel = manager.cancelInstall?.bind(manager);
+			return startManagerOperation({
+				profile: this.profile,
+				requestId: randomUUID(),
+				mechanism,
+				logs: this.managerLogs,
+				run: (requestId) => manager.installBundle(spec, { requestId }),
+				...cancel !== void 0 ? { cancel } : {},
+				outcome,
+				...alsoConfirm !== void 0 ? { alsoConfirm } : {},
+				prefetcher: this.prefetcher,
+				spec,
+				desktop: isDesktopProfile(this.profile)
+			});
+		}
+		/** Keep a started record where `installStatus`, the restart gate and
+		* eviction find it, then bound the finished ones. */
+		track(running) {
+			this.installs.set(running.installId, running);
+			this.installOrder.push(running.installId);
+			this.evictFinishedInstalls();
+		}
 		/** Bound retained finished records at MAX_FINISHED_INSTALLS, evicting the
 		* oldest finished ones (insertion order, oldest first). Live records —
 		* running AND queued — are never evicted; an id absent from the map reports
@@ -3844,10 +5829,13 @@ let ShopGateway = (() => {
 				for (const entry of await this.listInventory()) live.set(entry.entryId, entry.enabled);
 				haveInventory = true;
 			} catch {}
-			/** A package is enabled when every entry it owns and that is live is
-			* enabled. Keyed by entry id, never by module name — the entry a package
-			* inserts may mount a different package's module (see ownedEntryIds). */
+			const selected = this.runningProfileBundles(this.profileDirResolved());
+			/** A package is enabled when the profile selects its bundle and every
+			* entry it owns and that is live is enabled. Keyed by entry id, never by
+			* module name: the entry a package inserts may mount a different
+			* package's module (see ownedEntryIds). */
 			const enabledOf = (name) => {
+				if (selected !== null && !selected.includes(name)) return false;
 				if (!haveInventory) return true;
 				let owned;
 				try {
@@ -3914,6 +5902,11 @@ let ShopGateway = (() => {
 		* dependencies the shop does not manage (the base bundle, the shop
 		* itself). The same install records/polling serve the client. */
 		async uninstall(args) {
+			const manager = this.pluginManager();
+			if (isDesktopProfile(this.profile) && manager === null) return {
+				ok: false,
+				detail: DESKTOP_PROFILE_DETAIL
+			};
 			const named = (await this.snapshotNow()).entries.filter((entry) => entry.name === args.name);
 			if (named.length === 0) return {
 				ok: false,
@@ -3927,6 +5920,23 @@ let ShopGateway = (() => {
 			const installedEntry = named.find((entry) => installedSpecMatches(entry, spec));
 			const priorEntryIds = this.ownedEntryIdsOrNone(args.name);
 			const hadClientHalf = this.packageHasClientHalf(args.name);
+			if (manager !== null) {
+				const running = startManagerOperation({
+					profile: this.profile,
+					requestId: randomUUID(),
+					mechanism: `remove ${args.name}`,
+					logs: this.managerLogs,
+					run: () => manager.removeBundle(args.name),
+					outcome: (raw) => managerOutcome(raw, this.outcomeContext(args.name, "uninstall", false, hadClientHalf)),
+					desktop: isDesktopProfile(this.profile)
+				});
+				this.track(running);
+				this.forgetPins(args.name, installedEntry);
+				return {
+					ok: true,
+					installId: running.installId
+				};
+			}
 			const running = startUninstall({
 				profile: this.profile,
 				name: args.name,
@@ -3943,18 +5953,8 @@ let ShopGateway = (() => {
 					}) };
 				}
 			});
-			const pins = readRepoPins(this.pinFs, this.pinsPath());
-			const stalePins = [args.name, ...installedEntry === void 0 ? [] : [identityKey(installedEntry)]];
-			let forgot = false;
-			for (const key of stalePins) {
-				if (pins[key] === void 0) continue;
-				delete pins[key];
-				forgot = true;
-			}
-			if (forgot) writeRepoPins(this.pinFs, this.pinsPath(), pins);
-			this.installs.set(running.installId, running);
-			this.installOrder.push(running.installId);
-			this.evictFinishedInstalls();
+			this.forgetPins(args.name, installedEntry);
+			this.track(running);
 			return {
 				ok: true,
 				installId: running.installId
@@ -3966,6 +5966,10 @@ let ShopGateway = (() => {
 		* response is out. The browser monitors the origin and refreshes when the
 		* new server answers. Refusals are issued before anything is torn down. */
 		async restart() {
+			if (this.committedRestart !== null) return {
+				ok: true,
+				logFile: this.committedRestart.logFile
+			};
 			if (this.hasRunningCommand()) return {
 				ok: false,
 				detail: "dsh-plugin-shop: an install is still running in this profile; a restart now would boot the new dsh against a half-written profile. Wait for it to finish and try again."
@@ -3975,6 +5979,7 @@ let ShopGateway = (() => {
 				ok: false,
 				detail: RESTART_BLOCKED_DETAIL[blocked]
 			};
+			let logFile;
 			try {
 				const { cacheDir } = this.rowConfig();
 				const { command, args } = restartCommand({
@@ -3984,11 +5989,12 @@ let ShopGateway = (() => {
 					execArgv: process.execArgv,
 					script: this.restartScript
 				});
+				logFile = join(cacheDir, "restart.log");
 				startRestart({
 					command,
 					args,
 					parentPid: this.restartParentPid,
-					logFile: join(cacheDir, "restart.log"),
+					logFile,
 					env: process.env
 				});
 			} catch (error) {
@@ -3997,42 +6003,82 @@ let ShopGateway = (() => {
 					detail: `dsh-plugin-shop: restart could not be started: ${error.message}`
 				};
 			}
+			this.committedRestart = { logFile };
 			setTimeout(() => this.exit(0), this.restartExitDelayMs);
-			return { ok: true };
+			return {
+				ok: true,
+				logFile
+			};
 		}
 		/** The shop's own version and whether npm has a newer one (§7.3). The
 		* check is advisory: a registry that cannot answer leaves `latest` null
 		* and the client shows the version alone. `installed` is the RUNNING
 		* version (own-version.ts), not the manifest's range spec. */
 		async version() {
-			const installed = ownVersion();
+			const installed = this.options.runningVersion ?? runningVersion();
 			const latest = await this.latestVersion();
 			return {
 				installed,
 				latest,
 				outdated: latest !== null && lt(installed, latest),
-				restartBlocked: this.staticRestartBlock()
+				restartBlocked: this.staticRestartBlock(),
+				pendingVersion: this.pendingVersion(installed)
 			};
 		}
+		/**
+		* The version of the shop the profile has installed, when it is not the
+		* one this process runs; null when they match or the copy cannot be read.
+		*
+		* Read from the profile's own copy — the directory `dsh plugin add` writes
+		* and the next boot loads — rather than from the file beside this module.
+		* For the hoisted install those are one directory, but a `link:` install
+		* runs from its link target, which an update replaces in the profile and
+		* never touches at the target, so reading beside the module would never see
+		* the update land.
+		*
+		* Unreadable is null, never a throw: the version check is advisory, and a
+		* missing field would tell the client this host predates it.
+		*/
+		pendingVersion(running) {
+			try {
+				const manifest = JSON.parse(readFileSync(join(this.profileDirResolved(), "node_modules", "dsh-plugin-shop", "package.json"), "utf8"));
+				return typeof manifest.version === "string" && manifest.version !== running ? manifest.version : null;
+			} catch {
+				return null;
+			}
+		}
 		/** Update the shop itself to a published version (§7.3): the explicit pin
 		* is the only install form that bypasses pnpm's release cooldown. The
 		* version is re-validated as plain semver at the boundary — the spec
 		* `dsh-plugin-shop@<version>` is built here, never from the wire. */
 		async updateStart(args) {
+			const manager = this.pluginManager();
+			if (isDesktopProfile(this.profile) && manager === null) return {
+				ok: false,
+				detail: DESKTOP_PROFILE_DETAIL
+			};
 			if (valid(args.version) === null) return {
 				ok: false,
 				detail: `dsh-plugin-shop: ${args.version} is not a valid version`
 			};
+			const spec = `dsh-plugin-shop@${args.version}`;
+			if (manager !== null) {
+				const running = this.startManagerInstall(manager, spec, `update ${spec}`, (raw) => managerOutcome(raw, this.outcomeContext("dsh-plugin-shop", "update", true, true)));
+				this.track(running);
+				return {
+					ok: true,
+					installId: running.installId,
+					state: running.status().state
+				};
+			}
 			const running = startInstall({
 				profile: this.profile,
-				spec: `dsh-plugin-shop@${args.version}`,
+				spec,
 				dshBin: this.dshBin,
 				expectedName: "dsh-plugin-shop",
 				prefetcher: this.prefetcher
 			});
-			this.installs.set(running.installId, running);
-			this.installOrder.push(running.installId);
-			this.evictFinishedInstalls();
+			this.track(running);
 			return {
 				ok: true,
 				installId: running.installId,