dsh-plugin-upgrade 0.1.3 → 2.0.1

package/docs/EVIDENCE.md

@@ -0,0 +1,423 @@
+# Evidence · `dsh-plugin-upgrade` (merged `0.1.3-alpha.1` → `0.1.5-rc.1`)
+
+Every upstream claim in the merged version card
+(`skills/plugin-upgrade/references/v0.1.3-alpha.1-to-v0.1.5-rc.1.md`) and every
+`action` string in `lib/scan.mjs` traces to a command recorded here, re-run on
+**2026-09-09** (leg A's wave) and **2026-09-10** (leg B's tag-range diff) against the read-only
+harness checkout at `D:\deepseek-harness`, the leg-A checkout at `19d2e38480`, and the
+read-only family workspace at `D:\Projects\dsh\plugins`.
+
+This file holds the records of both legs of the merged span:
+
+- **§1–§10 below are leg B's records** (`0.1.5-alpha.1 → 0.1.5-rc.1`), kept verbatim from the
+  retired `dsh-plugin-upgrade-rc1`, against the merged card's **§2 Leg B**;
+- **§A at the end is leg A's provenance pointer** (`0.1.3-alpha.1 → 0.1.5-alpha.1`), against
+  the merged card's **§1 Leg A**.
+
+Toolchain used: `node v22.22.3`, `npm 11.16.0`, `pnpm 11.21.0` (Windows).
+
+Nothing in this file is copied from another project's documentation; each block is the
+observed output of the command above it. Where a claim could not be verified it is marked
+**unverified** and is not used by the card.
+
+## 1. Anchors and range size
+
+```console
+$ git -C D:\deepseek-harness tag -l "dsh-v0.1.5*"
+dsh-v0.1.5-alpha.1
+dsh-v0.1.5-alpha.2
+dsh-v0.1.5-rc.1
+
+$ git -C D:\deepseek-harness rev-list -n1 dsh-v0.1.5-alpha.1
+5dda764ed3aa172535a7967b06ff95d9cbfe536a
+$ git -C D:\deepseek-harness rev-list -n1 dsh-v0.1.5-rc.1
+183f08e9c6dde7e36cd2318eaee70b0da08fb35e
+
+$ git -C D:\deepseek-harness log --oneline dsh-v0.1.5-alpha.1..dsh-v0.1.5-rc.1 | wc -l
+279
+$ git -C D:\deepseek-harness log --oneline dsh-v0.1.5-alpha.2..dsh-v0.1.5-rc.1 | wc -l
+17
+
+$ git -C D:\deepseek-harness diff --shortstat dsh-v0.1.5-alpha.1..dsh-v0.1.5-rc.1
+ 1506 files changed, 31725 insertions(+), 11448 deletions(-)
+
+$ git -C D:\deepseek-harness show dsh-v0.1.5-alpha.1:package.json   # .version
+0.1.5-alpha.1
+$ git -C D:\deepseek-harness show dsh-v0.1.5-rc.1:package.json      # .version
+0.1.5-rc.1
+```
+
+## 2. Client slot catalog: 57 → 61 keys, `conversation` deleted
+
+`packages/extensions/cordis-client-runner/src/client/slot-catalog.ts` is the public catalog a
+plugin author reads through Inspect `Slots.listSubTree`. Extracting every `key: '<name>'`
+and diffing the two tags:
+
+```console
+alpha1 count: 57  rc1 count: 61
+--- removed ---
+conversation
+--- added ---
+main, main.conversation, rightbar.session, sidebar.panellist, sidebar.right.tab.document
+```
+
+Implementation side, same file path at both tags
+(`packages/client/ui-conversation/src/client/apply.ts`):
+
+```console
+$ dsh-v0.1.5-alpha.1:.../apply.ts:217     name: 'conversation',
+$ dsh-v0.1.5-rc.1:.../apply.ts:220        name: 'main.conversation',
+$ dsh-v0.1.5-rc.1:.../apply.ts:388        slots.inject('main', function* () {
+$ dsh-v0.1.5-rc.1:.../apply.ts:390          name: 'main',
+$ dsh-v0.1.5-rc.1:.../apply.ts:391          key: 'conversation',
+$ dsh-v0.1.5-rc.1:.../apply.ts:392          children: { 'main.conversation': { kind: 'single', scope: 'session-maybe' } },
+```
+
+No alias survives:
+
+```console
+$ git -C D:\deepseek-harness grep -n "name: 'conversation'" dsh-v0.1.5-rc.1 -- packages
+dsh-v0.1.5-rc.1:packages/client/ui-agent-preset/tests/apply.client.spec.ts:135:    name: 'conversation',
+```
+
+That single hit is a test fixture, not an implementation. The public contract that makes the
+removal silent is quoted verbatim from the same tag's
+`packages/extensions/cordis-client-runner/src/client/api-catalog.ts` (`SERVICE_API`, key
+`slots`):
+
+> `inject(key: keyof SlotMap & string, callback: () => SlotInjectionEffect): () => void`
+> "Install an effect for each declaration lifetime of a slot. The callback runs synchronously
+> when the declaration already exists; otherwise it runs inside the declaring `register()`
+> call after the declaration is committed."
+
+Upstream ships **no** deprecation or migration note for the removal: the only
+`docs/capability-seams.md` change in the range is one added service row (§4 below), and no
+document names `conversation`.
+
+## 3. Package rename
+
+```console
+$ git show dsh-v0.1.5-alpha.1:packages/client/ui-sidebar-textpreview/package.json      # .name
+@deepseek-ai/dsh-client-ui-sidebar-textpreview
+$ git show dsh-v0.1.5-rc.1:packages/client/ui-sidebar-documentpreview/package.json     # .name
+@deepseek-ai/dsh-client-ui-sidebar-documentpreview
+
+$ git ls-tree -d --name-only dsh-v0.1.5-alpha.1 packages/client/ | Select-String sidebar
+packages/client/ui-sidebar-files
+packages/client/ui-sidebar-right
+packages/client/ui-sidebar-textpreview
+packages/client/ui-sidebar
+$ git ls-tree -d --name-only dsh-v0.1.5-rc.1 packages/client/ | Select-String sidebar
+packages/client/ui-sidebar-documentpreview
+packages/client/ui-sidebar-files
+packages/client/ui-sidebar-right
+packages/client/ui-sidebar
+```
+
+The old directory and package name are gone in rc.1 with no shim package.
+
+## 4. Host-side additions
+
+```console
+$ git diff dsh-v0.1.5-alpha.1..dsh-v0.1.5-rc.1 -- packages/core/session/src
+ known-event-types.ts | +  'deliverables/presented',
+ known-event-types.ts | +  'subagent/catalog',
+ types.ts             | -  ... In v2 the ...   +  ... The ...
+
+$ git ls-tree -d --name-only dsh-v0.1.5-rc.1 packages/fs/
+...,packages/fs/tool-present,...        # absent from the alpha.1 listing
+$ git show dsh-v0.1.5-rc.1:packages/fs/tool-present/src/index.ts   # line 39
+    name: 'present',
+
+$ git show dsh-v0.1.5-rc.1:packages/client/ui-deliverables/src/client/index.ts   # line 62
+    { name: 'tool.call.toolview', key: 'present', locale: NS }, PresentRow,
+
+# conversation.chat.node's already-taken keyDomain, both tags
+alpha.1: ... already taken: ask_user_question, bash, ..., grep, read, read_image, ...
+rc.1:    ... already taken: ask_user_question, bash, ..., grep, present, read, read_image, ...
+
+$ git diff <range> -- docs/capability-seams.md
++  pkg_command_feedback["command-feedback"]
++  svc_sessionFeedback["ctx.sessionFeedback<br/>Session-level feedback recorder"]
++ | `ctx.sessionFeedback` | `core` | [`command-feedback`](...) | ... |
+
+$ git ls-tree --name-only dsh-v0.1.5-alpha.1 docs/session-format-status.md   # (no output)
+$ git show dsh-v0.1.5-rc.1:docs/session-format-status.md                     # new file
+latestReleasedVersion: 3
+evidenceTag: dsh-v0.1.5-alpha.1
+```
+
+`docs/session-format-status.md` is **new in rc.1** and its release record still points at
+`dsh-v0.1.5-alpha.1`; it states "An alpha, beta, or release-candidate product publication
+establishes released Session-format obligations."
+
+The `ctx.layout` / `ctx.workspaces` / `TYPE_API` additions are quoted in the card; their
+source is the `api-catalog.ts` diff of the same range, which adds
+`selectPanel(panelId: MainPanelId | null): void`, `beginNavigation(): AbortSignal`,
+`openSession(sessionId: SessionId): void`,
+`openWorkspace(workspaceId: WorkspaceId, beforeOpen?: (sessionId: SessionId) => void): Promise<void>`,
+`forkSession(sessionId: SessionId): Promise<void>` and
+`export type MainPanelId = Branded<'MainPanelId'>;`.
+
+## 5. Negative evidence (what did **not** change)
+
+```console
+$ git -C D:\deepseek-harness grep -l "usePanelInfo" dsh-v0.1.5-alpha.1 -- packages apps | wc -l
+0
+$ git -C D:\deepseek-harness grep -l "usePanelInfo" dsh-v0.1.5-rc.1 -- packages apps | wc -l
+47
+
+$ git diff --stat dsh-v0.1.5-alpha.1..dsh-v0.1.5-rc.1 -- packages/client/ui-slots
+ packages/client/ui-slots/package.json | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+```
+
+The session-format seams **leg A** owns (`assistant/message.stream`, `SessionHandleReadResult`,
+`EpochHeader.system`, `ctx.agent`, `Inbox`, `SystemPrompt.persona`, the V3 log generation) have
+**no** implementation change in this range: the whole `packages/core/session/src` diff is the
+two added event-type literals and one comment line shown above. `docs/web-styling.md` (theme
+tokens) has zero changes in the range. The scanner therefore reports no leg-A hit here that is
+not also a leg-A fact, and the card says so explicitly in §2's scope statement.
+
+## 6. Peer-range semantics (semver 7.8.5, measured)
+
+```console
+$ node -e "const s=require('.../semver'); ..."
+semver version: 7.8.5
+">=0.1.2-rc.1 <0.2.0"                                    -> false
+">=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0"         -> true
+">=0.1.5-alpha.1 <0.2.0"                                -> true
+">=0.1.5-rc.1 <0.2.0"                                   -> true
+">=0.1.5-alpha.1 <0.2.0 || >=0.1.5-rc.1 <0.2.0"         -> true
+alpha.1 satisfies >=0.1.5-alpha.1 <0.2.0 -> true
+```
+
+This is npm semver's prerelease-tuple rule: a prerelease version only satisfies a set when
+some comparator on the same `[major, minor, patch]` tuple carries a prerelease. It is the
+same rule behind the workspace's recorded `>=0.1.0-rc.8 <0.2.0` incident.
+
+## 7. Real-world cross-check on the family workspace
+
+Slot usage was extracted from **tracked** sources only (`git ls-files`, production files,
+`node_modules`/`lib`/`dist`/docs snapshots excluded) across the 47 repositories under
+`D:\Projects\dsh\plugins`:
+
+```console
+== PRODUCTION: 8 distinct keys ==
+  conversation.input.left                 <- dsh-autotier, dsh-talk
+  conversation.session.header.actions     <- dsh-auto-review, dsh-session-pin, dsh-ticktick
+  settings.plugin.item                    <- dsh-github, dsh-ticktick
+  settings.plugins.tab                    <- dsh-autotier, dsh-budget, dsh-checkpoint-rewind,
+                                             dsh-draw, dsh-mcp-panel, dsh-reach, dsh-talk
+  settings.section                        <- dsh-background-agents, dsh-memento,
+                                             dsh-permission-rules, dsh-wechat
+  shell.overlay                           <- dsh-session-pin
+  sidebar.footer.action                   <- dsh-background-agents, dsh-session-pin
+  tool.call.toolview                      <- dsh-draw
+== TESTS: 1 distinct key ==
+  session-1                               <- dsh-auto-review:test/client-registration.spec.ts
+                                             (a Remote face's `options.inject(...)`, not the
+                                              slots service — false positive, excluded)
+
+$ # tracked sources across all 47 repos, same pattern
+inject('conversation'  |  name: 'conversation'  |  sidebar-textpreview
+(zero hits)
+```
+
+8 production keys across 15 repositories; the rc.1 deletion set is `{conversation}`, so all
+8 survive. This is why the family's rc.1 CHANGELOG entries are pin-only, e.g.
+`dsh-autotier/CHANGELOG.md:14`, `dsh-mcp-panel/CHANGELOG.md:16`,
+`dsh-plugin-guide/CHANGELOG.md:22`, `dsh-permission-rules/CHANGELOG.md:69` (identical
+wording). **The prior research pass recorded nine keys**; the ninth it listed,
+`conversation.chat.node`, occurs in this workspace only inside
+`dsh-plugin-guide/references/official-docs/` (a downloaded official-docs snapshot), never in
+family plugin code. The card states the measured eight.
+
+Related recorded behaviour, unchanged by this hop: `dsh-permission-rules/CHANGELOG.md:100`
+describes `isUnmarkedHostVersion` treating the `0.1.5-alpha` line as non-stamping, so an
+envelope-level `ignorable` write is silently dropped there. Since
+`packages/session` + `packages/core` carry no substantive `ignorable` change in this range,
+rc.1 inherits that behaviour.
+
+## 8. Model catalog default
+
+```console
+$ git log --oneline -1 bc5fd3b8dc
+bc5fd3b8dc feat(llm): default Chat Completions to DeepSeek V41 Flash
+
+$ git show dsh-v0.1.5-alpha.1:packages/llm/llm-deepseek/src/index.ts   # DEFAULT_MODELS ids
+id: 'deepseek-v4-flash' / 'deepseek-v4-pro' / 'deepseek-v4-flash-vision-exp'
+$ git show dsh-v0.1.5-rc.1:packages/llm/llm-deepseek/src/index.ts      # DEFAULT_MODELS ids
+id: 'deepseek-flash' (name: 'DeepSeek-V41-Flash') / 'deepseek-v4-flash' / 'deepseek-v4-pro' /
+'deepseek-v4-flash-vision-exp'
+```
+
+The rc.1 README's `models` default row reads "V41 Flash + V4 Flash + V4 Pro + V4 Flash
+Vision Exp". **Unverified:** that position 0 of the advisory catalog is *formally* the
+selection default — no `DEFAULT_MODELS[0]` read appears in the adapter source. The card
+therefore states what was measured (the catalog contents and the commit subject) and does
+not claim a selection rule.
+
+## 9. Package name availability
+
+Re-measured for the merged package name on 2026-09-11 (the merged repository keeps this
+record; the two retired names are the controls that prove the registry answers):
+
+```console
+$ npm view dsh-plugin-upgrade version
+npm error code E404
+npm error 404 Not Found - GET https://registry.npmjs.org/dsh-plugin-upgrade - Not found
+npm error 404  The requested resource 'dsh-plugin-upgrade@*' could not be found or you do not have permission to access it.
+(exit 1)
+
+$ npm view dsh-plugin-upgrade version dist-tags.latest      # control: retired leg A still exists
+version = '0.1.3'
+dist-tags.latest = '0.1.3'
+$ npm view dsh-plugin-upgrade-rc1 version dist-tags.latest  # control: retired leg B still exists
+version = '0.1.0'
+dist-tags.latest = '0.1.0'
+$ npm view @deepseek-ai/dsh-skill@0.1.5-rc.2 version         # control: the merged dev pin is published
+0.1.5-rc.2
+```
+
+### 9.1 The original name was rejected by npm (403 spam detection)
+
+The first release attempt under the name `dsh-plugin-upgrade-0.1.3-0.1.5` failed at the
+publish step of `release.yml` (run `34606797772`, 2026-09-11). The gate and the changelog
+check both passed; only the registry write was refused:
+
+```console
+$ npm publish   # inside .github/workflows/release.yml, NPM_CONFIG_USERCONFIG written from the repo secret
+npm notice name: dsh-plugin-upgrade-0.1.3-0.1.5
+npm notice version: 0.1.0
+npm notice package size: 88.5 kB
+npm notice total files: 25
+npm notice publish Signed provenance statement with source and build information from GitHub Actions
+npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=2794018273
+npm error code E403
+npm error 403 403 Forbidden - PUT https://registry.npmjs.org/dsh-plugin-upgrade-0.1.3-0.1.5 - Package name triggered spam detection; if you believe this is in error, please contact support at https://npmjs.com/support
+(exit 1)
+
+$ curl -s -o /dev/null -w '%{http_code}\n' https://registry.npmjs.org/dsh-plugin-upgrade-0.1.3-0.1.5
+404     # the 403 lands before any write, so the name was never created
+```
+
+The rejected name embedded **two dotted version numbers** (`0.1.3-0.1.5`), which npm's spam
+heuristics read as a version-shaped suffix. The package was therefore named
+`dsh-plugin-upgrade` — matching its own skill id (`plugin-upgrade`) and bin
+(`dsh-plugin-upgrade-scan`). The control is on the same account: the retired
+`dsh-plugin-upgrade-rc1` (a single non-dotted suffix) published cleanly, so the **suffix
+shape**, not the account or the plugin family, is what the detector reacted to.
+
+## 10. Not verified (kept out of the card's claims)
+
+- **L9 (real browser).** No browser assertion was executed in the environment that produced
+  this package; the card marks it as a hard requirement for the reader and records it as
+  unexecuted here.
+- **L11 (real model credentials).** Not reproducible without credentials.
+- Whether any family repository ever pinned `0.1.5-alpha.2` (not checked per repository).
+- Whether `packages/client/*` contains plugin-author-facing breakage outside the public slot
+  and service catalogs (no full export diff of the 432 changed client files).
+- Whether upstream intends to publish a migration note for the `conversation` removal; the
+  card records the absence of one as of 2026-09-10.
+
+## A. Leg A provenance (`0.1.3-alpha.1` → `0.1.5-alpha.1`)
+
+Leg A's provenance does **not** live in this file. It lives in the retired
+`dsh-plugin-upgrade` package's version card,
+`skills/plugin-upgrade/references/v0.1.3-alpha.1-to-v0.1.5-alpha.1.md`, which the merge
+brought in as the merged card's **§1 Leg A** — verbatim, including its `path:line` citations,
+its measured scale and its boundary notes.
+
+What that leg's provenance records, so a reader of this file can find it without the retired
+package:
+
+| Item | Leg A's recorded value |
+|---|---|
+| Card that holds the evidence | retired `dsh-plugin-upgrade` card, now merged card §1 Leg A |
+| Run | 2026-09-09 wave over **40 real plugin repositories** |
+| Leg-A host checkout | `0.1.5-alpha.1`, HEAD `19d2e38480`; official tag `dsh-v0.1.5-alpha.1` = `5dda764ed3` |
+| Seams measured | `S1`–`S10` + `M1` (the merged card's §1 sections 1–5, with the per-seam host path and commit) |
+| Reproduce | CLI `dsh-plugin-upgrade-scan --repo <repo>` (then `dsh-plugin-upgrade-scan`), `file:line` output |
+| `M1` scale | **11 of 40** repos hit the stale type line; fixing the paths exposed real TypeScript errors in **3** repos that had been "green" |
+| `S3` scale | one measured case (`dsh-claude-move`: import succeeded, `Session.fromRestore` refused to resume) |
+| `S8` scale | `dsh-background-agents` production code `src/tools.ts:713` (`TS2740`) plus two tests; `dsh-output-styles` `scripts/verify-session-log.mjs` threw a TypeError |
+| `S9` scale | four repos' test fixtures (`dsh-data-quality`, `dsh-industry-research`, `dsh-research-report`, `dsh-fast`; `TS2353`) |
+| Leg-A official precedent cited | `apps/cli/tests/profiles/headless/tests/harness.ts:59` |
+| Leg-A unverified | real-browser L9 and real-model L11 were not executed there either (recorded in that card's §7) |
+
+The merged repository re-measured leg A's seams against its own fixtures
+(`fixtures/leg-a-bad-repo` / `fixtures/leg-a-good-repo`) rather than re-running the 40-repo
+wave: the fixture pair pins the same error-severity seams the card names
+(`S3`, `S8`, `S9`, `S4`, `S5`, `S6`, `M1` in the bad fixture; zero error hits in the good one).
+Nothing in leg A's provenance was discarded by the merge, and nothing in it was re-derived
+here — where the two legs disagree, the leg that measured the seam wins.
+
+
+---
+
+## Section 11 - leg C (0.1.5-rc.2 -> 0.1.6-alpha.2)
+
+> Verbatim from the dsh-plugin-upgrade-016 repository's docs/EVIDENCE.md, moved here when that corridor was folded into this package as the second index row (2026-09-19). Its sub-headings keep their own numbering.
+
+# EVIDENCE · dsh-plugin-upgrade-016
+
+> 走廊方法论要求：卡片与扫描器里的每一条事实都能回溯到一条命令 + 输出。
+> 本文件记录 leg C（`0.1.5-rc.2 → 0.1.6-alpha.2`）五条接缝的出处。
+> 标注纪律：`已实测` = 本建包会话在 `D:\deepseek-harness`（tag `dsh-v0.1.6-alpha.2`，HEAD `ddefc45`）上重跑过；`转引已核实` = 方案文件 R3/A02/A01 已在研究期回源码核实，本会话不重复跑；`未验证` = 未跑。
+
+## E1 · `agent/created` 串行派发（error）— 已实测
+
+```console
+$ git -C D:\deepseek-harness grep -n "agent/created" ddefc45 -- "packages/core/agent/src/*.ts"
+ddefc45:packages/core/agent/src/index.ts:109:  * child plugins) exists before `session/created`, `agent/created`,
+ddefc45:packages/core/agent/src/index.ts:176:  * `agent/created` listeners before releasing queued work. The sequence is
+ddefc45:packages/core/agent/src/index.ts:417:  * serial `agent/created` listener fails. Emits `agent/disposed`
+ddefc45:packages/core/agent/src/index.ts:547:      await this.ctx.serial(entry.carrier, 'agent/created', {
+```
+
+断言：`:547` 的 `ctx.serial(..., 'agent/created', ...)` 证明监听器在创建链上**串行 await** —— 一个抛错的监听器直接中断创建。A1 语义转引 `[A02]`/`[A05]`（已核实）。
+
+## E2 · 异步 apply 竞态（error）— 转引已核实
+
+宿主 fiber 在卸载窗口内对迟到的 `ctx.effect` 抛 `INACTIVE_EFFECT`（抛点 `fiber.ts` 已由方案 `[A02]` 回源码核实）；`register()` 返回值丢弃 = 旧闭包继续生效（反例 doublecheck `src/guard/index.ts:664`，正例 `:685-688`）。本卡检测面 = 「`export async function apply` 首个 `await` 之后出现 `ctx.effect|ctx.on|ctx.provide|ctx.plugin|*.register`」。本会话未真机复现卸载时序（`未验证`，扫描器是静态检测）。
+
+## E3 · `settings.plugin.item` 与 `SessionListState.current`（error）— 已实测
+
+```console
+$ git -C D:\deepseek-harness grep -n "settings\.plugin\.item" ddefc45 -- "*.ts"
+ddefc45:packages/client/ui-settings-models/src/client/slot-contract.ts:11: * the namespace follows `settings.plugin.item`, and the key domain stays the
+$ git -C D:\deepseek-harness grep -n "'plugins\.item'" ddefc45 -- "*.ts"
+ddefc45:packages/client/ui-plugin-manager/src/client/slot-contract.ts:32:  'plugins.item': { kind: 'list'; scope: 'root'; owner: PluginConfigViewProps }
+ddefc45:packages/client/ui-plugin-manager/src/client/index.ts:89:  'plugins.item': { kind: 'list', scope: 'root' },
+```
+
+断言：`settings.plugin.item` 只剩一条**注释**（旧名说明），槽契约里已无该 key；新契约 = `plugins.item`（list/root）。`SessionListState.current` 的删除与 7 仓命中由 `[R3]` §② 穷尽差集核实（主控已回源码复核全部命中仓；`未验证` 本会话未重跑该差集）。
+
+## E4 · `sessions.open/openSubagent/clear`（error）— 已实测
+
+```console
+$ git -C D:\deepseek-harness grep -n "openSubagent" ddefc45 -- "*.ts"
+(no matches)
+$ git -C D:\deepseek-harness grep -n "retain" ddefc45 -- "packages/api/session-controller/src/client/sessions/manager.ts"
+ddefc45:packages/api/session-controller/src/client/sessions/manager.ts:149:  throw new Error(`sessions.retain: unknown session ${id}`)
+```
+
+断言：`openSubagent` 在 alpha.2 源码零命中；替代面 `retain` 存在。`open`/`clear` 的删除与三个消费方的形态（session-pin 响亮 TypeError、background-agents 吞错、claude-move 特性探测）由 `[R3]` §② 核实。
+
+## E5 · 模型字面量 `deepseek-v4-flash*`/`deepseek-v4-vision-exp`（error）— 已实测
+
+```console
+$ git -C D:\deepseek-harness grep -rn "deepseek-v4-flash" ddefc45 -- "packages"
+(no matches)
+$ git -C D:\deepseek-harness grep -rn "deepseek-v4-pro" ddefc45 -- "packages" | head -3
+ddefc45:packages/client/ui-model-selection/src/client/index.ts:52:  'deepseek-official/deepseek-v4-pro': 'option.deepseekV4Pro.description',
+```
+
+断言：被删 id 在 alpha.2 源码零命中，`deepseek-v4-pro` 仍在册。目录 4→2 与「未编目 id 透传 text-only」（上游 `llm-deepseek/README.md:48` 原文）由 `[A03]`/`[主控 M2]` 核实；非测试区 3 仓引用 + autotier README×5 与 8 个测试文件硬编码由 `[R4]` 新发现核实。
+
+## 家族面事实（W0 钉死，本卡前置）
+
+- 事件词表 58（+`workspace/changes`）、槽表 70 键、默认模型目录 2 条：`[A01]` §3 核实。
+- peer canonical 三段式：`dsh-plugin-kit/data/peer-range.json`（W0 0-K 合入，tripwire exit 0 已实测）。
+- 未验证项（诚实）：0.1.6 走廊卡在真实 45 仓上的全量扫描回归（等 W1 修复落地后跑）；本包真宿主冒烟（首次 publish 前执行）。

package/index.mjs

@@ -1,11 +1,14 @@
+// SPDX-License-Identifier: Apache-2.0
 // dsh-plugin-upgrade bundle entry point.
 //
-// Publishes the packaged 0.1.3-alpha.1 -> 0.1.5-alpha.1 plugin-upgrade skill as an
-// on-demand agent skill named `plugin-upgrade-015`. The skill body is this
-// package's `skills/plugin-upgrade-015/SKILL.md`; its relative references
-// (`./references/...`) and scripts (`./scripts/...`) resolve against the packaged
-// skills directory through the directory resourceBase, so the agent loads the
-// version card and the scanner only when a task needs them.
+// Publishes the merged `0.1.3-alpha.1 -> 0.1.5-rc.1` corridor as an on-demand
+// agent skill named `plugin-upgrade`. The corridor is one span carried by
+// two closed legs (leg A `0.1.3-alpha.1 -> 0.1.5-alpha.1`, leg B
+// `0.1.5-alpha.1 -> 0.1.5-rc.1`); the skill body is this package's
+// `skills/plugin-upgrade/SKILL.md`, and its relative references
+// (`./references/...`) and scripts (`./scripts/...`) resolve against the
+// packaged skills directory through the directory resourceBase, so the agent
+// loads the merged version card and the scanner only when a task needs them.
 //
 // The package imports nothing from the harness beyond the injected `skills`
 // service, so the cordis peer stays metadata-only.
@@ -28,7 +31,7 @@ export const Config = Schema.object({
   /** Register the packaged skill (default true). */
   enabled: Schema.boolean().default(true),
   /** Skill name published to the model catalog. Defaults to the packaged corridor name. */
-  skillName: Schema.string().default('plugin-upgrade-015'),
+  skillName: Schema.string().default('plugin-upgrade'),
   /** Skill root inside the package; must contain `<skillName>/SKILL.md`. */
   skillsRoot: Schema.string().default(join(packageRoot, 'skills')),
   /** Mark the skill user-invocable in addition to model-invocable (default true). */
@@ -40,8 +43,8 @@ export const Config = Schema.object({
  * and body. Line endings are normalized first: a Windows checkout with
  * `core.autocrlf=true` hands us CRLF, and the frontmatter delimiters are `\n`.
  * A missing block falls back to the full text as the body.
- * @param text - raw SKILL.md content.
- * @returns the parsed description/whenToUse (when present) and the instruction body.
+ * @param {string} text - raw SKILL.md content.
+ * @returns {{ description: string | undefined, whenToUse: string | undefined, body: string }} the parsed description/whenToUse (when present) and the instruction body.
  */
 export function splitFrontmatter(text) {
   const source = text.replace(/\r\n/g, '\n')
@@ -50,7 +53,8 @@ export function splitFrontmatter(text) {
   if (end < 0) return { description: undefined, whenToUse: undefined, body: source }
   const meta = source.slice(4, end)
   const body = source.slice(end + 4).replace(/^\n+/, '')
-  const scalar = (key) => new RegExp(`^${key}:\\s*(.+)$`, 'm').exec(meta)?.[1]?.trim()
+  /** @param {string} key @returns {string | undefined} */
+  const scalar = (key) => new RegExp(`^${key}:\\s*(.+)$`, 'm').exec(meta)?.[1]?.trim().replace(/^["']|["']$/g, '')
   return { description: scalar('description'), whenToUse: scalar('whenToUse'), body }
 }
 
@@ -58,9 +62,9 @@ export function splitFrontmatter(text) {
  * Read and validate the packaged skill bundle. Fails loud: a missing SKILL.md,
  * an empty body, or a missing frontmatter `name` aborts the mount instead of
  * registering an empty skill.
- * @param skillsRoot - root directory holding `<skillName>/SKILL.md`.
- * @param skillName - expected skill directory name.
- * @returns the frontmatter name, routing fields, body, and the skill directory.
+ * @param {string} skillsRoot - root directory holding `<skillName>/SKILL.md`.
+ * @param {string} skillName - expected skill directory name.
+ * @returns {{ frontmatterName: string, description: string | undefined, whenToUse: string | undefined, body: string, skillDir: string }} the frontmatter name, routing fields, body, and the skill directory.
  */
 export function readSkillBundle(skillsRoot, skillName) {
   const skillPath = join(skillsRoot, skillName, 'SKILL.md')
@@ -81,13 +85,13 @@ export function readSkillBundle(skillsRoot, skillName) {
 /**
  * Register the packaged skill. Registration is an effect: the disposer returned
  * by `ctx.skills.register()` removes the contribution on unload.
- * @param ctx - Cordis context with the injected `skills` service.
- * @param config - validated plugin configuration.
+ * @param {{ effect: (factory: () => unknown) => unknown, skills: { register: (registration: Record<string, unknown>) => unknown } }} ctx - Cordis context with the injected `skills` service.
+ * @param {{ enabled?: boolean, skillName?: string, skillsRoot?: string, userInvocable?: boolean }} [config] - validated plugin configuration.
  */
 export function apply(ctx, config = {}) {
   const resolved = {
     enabled: config.enabled ?? true,
-    skillName: config.skillName ?? 'plugin-upgrade-015',
+    skillName: config.skillName ?? 'plugin-upgrade',
     skillsRoot: config.skillsRoot ?? join(packageRoot, 'skills'),
     userInvocable: config.userInvocable ?? true,
   }
@@ -97,7 +101,7 @@ export function apply(ctx, config = {}) {
     ctx.skills.register({
       name: frontmatterName,
       source: 'bundled',
-      description: description ?? 'DSH plugin upgrade · 0.1.3-alpha.1 -> 0.1.5-alpha.1: seam scanner and version card.',
+      description: description ?? 'DSH plugin upgrade · 0.1.3-alpha.1 -> 0.1.5-rc.1 (merged corridor): seam scanner and corridor card.',
       ...whenToUse !== undefined ? { whenToUse } : {},
       content: body,
       // The base is the skill's own directory, so `./references/...` and

package/lib/route.mjs

@@ -0,0 +1,112 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * The corridor index: one package, one entry point, several closed corridors.
+ *
+ * Owner decision (2026-09-19): the family's earlier "a hop is a new package" rule
+ * is superseded. This package carries a corridor index instead, and the scanner
+ * picks the corridor that matches the repository under inspection. What does NOT
+ * change: each corridor keeps its OWN evidence-bound catalog module - the seam
+ * arrays are never merged, so every card claim stays traceable to its measurement.
+ *
+ * Routing is deliberately a heuristic over the target repository's declared band
+ * (`engines.dsh`, dependencies on `@deepseek-ai/dsh*`), because the scanner is
+ * read-only, dependency-free and offline: no registry lookup happens here. The
+ * "which line is newest" question belongs to the agent running the skill, not to
+ * this scanner. `--span <id>` overrides the guess, and an unknown band falls back
+ * to the older corridor, which is what a repository predating 0.1.6 needs anyway.
+ */
+import { readFileSync } from 'node:fs'
+
+/** @typedef {{ id: string, span: string, catalog: string, card: string, baselineTags: string[], evidence: string }} Corridor */
+
+/** @type {Corridor[]} */
+export const CORRIDORS = [
+  {
+    id: 'legAB',
+    span: '0.1.3-alpha.1 -> 0.1.5-rc.1',
+    catalog: '../lib/scan.mjs',
+    card: 'skills/plugin-upgrade/references/v0.1.3-alpha.1-to-v0.1.5-rc.1.md',
+    baselineTags: ['dsh-v0.1.5-alpha.1', 'dsh-v0.1.5-rc.1'],
+    evidence: 'docs/EVIDENCE.md section A (leg A provenance) and sections 1-10 (leg B records)',
+  },
+  {
+    id: 'legC',
+    span: '0.1.5-rc.2 -> 0.1.6-alpha.2',
+    catalog: '../lib/scan-0.1.6.mjs',
+    card: 'skills/plugin-upgrade/references/v0.1.5-rc.2-to-v0.1.6-alpha.2.md',
+    baselineTags: ['dsh-v0.1.6-alpha.2'],
+    evidence: 'docs/EVIDENCE.md section 11 (leg C records)',
+  },
+]
+
+/** Accepts a corridor id ('legC'), a full span, or a bare mention of a line. */
+export function corridorById(id) {
+  if (typeof id !== 'string' || id.length === 0) return undefined
+  const wanted = id.trim().toLowerCase()
+  return CORRIDORS.find(
+    c => c.id.toLowerCase() === wanted || c.span.toLowerCase() === wanted || c.span.toLowerCase().includes(wanted),
+  )
+}
+
+/** The 0.1.6 line marker. Kept as one regex so the heuristic is auditable. */
+const LEG_C_MARKER = /0\.1\.6-(alpha|beta|rc|0)/
+
+/**
+ * Reads the target repository's declared band: the text of every field that
+ * carries a dsh version, or '' when nothing declares one.
+ * @param {string} repoDir
+ * @returns {string}
+ */
+export function declaredBand(repoDir) {
+  try {
+    const manifest = JSON.parse(readFileSync(`${repoDir.replace(/[\\/]+$/, '')}/package.json`, 'utf8'))
+    const parts = []
+    if (manifest.engines && typeof manifest.engines.dsh === 'string') parts.push(manifest.engines.dsh)
+    for (const field of ['dependencies', 'devDependencies', 'peerDependencies']) {
+      const block = manifest[field]
+      if (!block || typeof block !== 'object') continue
+      for (const [name, range] of Object.entries(block)) {
+        if (name.startsWith('@deepseek-ai/dsh')) parts.push(String(range))
+      }
+    }
+    return parts.join(' ')
+  } catch {
+    return ''
+  }
+}
+
+/**
+ * Chooses the corridor for a repository, or for an explicit span.
+ * @param {{ repoDir?: string, span?: string }} [input]
+ * @returns {Corridor}
+ */
+export function resolveCorridor(input = {}) {
+  if (input.span) {
+    const explicit = corridorById(input.span)
+    if (explicit) return explicit
+  }
+  const band = input.repoDir ? declaredBand(input.repoDir) : ''
+  if (LEG_C_MARKER.test(band)) return CORRIDORS.find(c => c.id === 'legC')
+  return CORRIDORS.find(c => c.id === 'legAB')
+}
+
+/** Reads `--span <value>` out of an argv array without touching the other flags. */
+export function spanFromArgv(argv) {
+  const index = argv.findIndex(a => a === '--span')
+  if (index >= 0 && typeof argv[index + 1] === 'string' && !argv[index + 1].startsWith('--')) return argv[index + 1]
+  const inline = argv.find(a => a.startsWith('--span='))
+  return inline ? inline.slice('--span='.length) : undefined
+}
+
+/** Reads `--repo <value>` (or `--repo=<value>`) out of an argv array. */
+export function repoFromArgv(argv) {
+  const index = argv.findIndex(a => a === '--repo')
+  if (index >= 0 && typeof argv[index + 1] === 'string') return argv[index + 1]
+  const inline = argv.find(a => a.startsWith('--repo='))
+  return inline ? inline.slice('--repo='.length) : undefined
+}
+
+/** Loads the catalog module the corridor points at. */
+export async function loadCatalog(corridor) {
+  return import(new URL(corridor.catalog, import.meta.url).href)
+}