dsh-ptc-plus 0.4.3 → 0.4.8

package/README.en.md

@@ -41,6 +41,8 @@ With the default interface settings, the session has a **REPL** tab; wide screen
 
 Once installed, describe your task to the model as usual. The `run_code` and `edit_run_code` examples below show how the model uses these features. See the [installation guide](docs/installation.md) for other installation methods, Desktop, the local development launcher, upgrades, and troubleshooting.
 
+For Windows source testing, double-click `scripts\run-upstream-dsh.cmd` to fetch the official DSH default branch, reuse an isolated build cache, and load this plugin checkout. The first run installs dependencies and builds DSH; see [upstream source testing](docs/installation.md#upstream-source-development-launcher-windows).
+
 ## Feature overview
 
 Default PTC mode starts every execution in a fresh environment: variables from the previous call are gone, and a change that depends on earlier results means resending the setup code. PTC Plus turns `run_code` into a session-bound TypeScript REPL and closes the gaps below.
@@ -52,6 +54,7 @@ Default PTC mode starts every execution in a fresh environment: variables from t
 | Change a small part of the code | A one-line change means resending the complete source | Submit a delta through `edit_run_code`, then execute the complete revised cell |
 | Use module syntax | Static `import` and `export` are invalid inside the function body | Write them directly in a cell; the plugin adapts the module syntax |
 | Omit a call summary | Missing `run_code.description` fails validation | Supply a display summary automatically so otherwise valid code proceeds |
+| Provider rejects malformed tool JSON | The whole turn ends with a provider error | Repair or preserve a buffered tool-call tail containing only tool framing and at most one usage event; route every other buffered tail through schema rejection so the model continues |
 | Recover a misplaced top-level tool call | Undeclared top-level calls are rejected in PTC mode | Convert the call to `run_code` when the live tool definitions uniquely identify the target and validate its arguments |
 | Locate a code error | Return the native error and stack | Map the error to the cell source; suggest an edit when a missing trailing delimiter has one verified correction |
 | Work with the current project | Relative Node paths depend on the host process directory | Resolve file paths, session module imports, and default child-process directories from the session project directory |
@@ -131,6 +134,7 @@ An edit **reruns the entire cell**; this example returns `12`. Earlier state cha
 | --- | --- |
 | `run_code` omits its outer `description` | Supply a display summary so code with otherwise valid arguments can execute |
 | The model calls a native tool outside the PTC direct-tool list | Convert it to the corresponding `run_code` when current tool definitions uniquely identify the target and validate the arguments |
+| Argument validation reports a missing `description` | Distinguish outer and nested tool arguments and provide correction guidance, saved as a complete message so session history remains loadable |
 | Code fails to parse | Identify the source position; at EOF, suggest a target-bound edit if appending one or two closing delimiters has exactly one validated correction |
 
 The first two behaviors default to on and can be disabled in settings. Syntax suggestions do not execute automatically or establish that the code matches the task's intent.

package/README.md

@@ -41,6 +41,8 @@ dsh plugin --profile <profile> add dsh-ptc-plus
 
 安装完成后正常向模型描述任务即可，下面的 `run_code` 和 `edit_run_code` 示例说明模型如何使用这些能力。其他安装方式、Desktop、本地开发启动器、升级和故障排查见[安装指南](docs/installation.md)。
 
+Windows 源码测试：双击 `scripts\run-upstream-dsh.cmd`，拉取官方 DSH 默认分支并复用隔离的构建缓存，加载当前插件工作区。首次运行需要安装依赖和构建；详见[上游源码测试](docs/installation.md#upstream-source-development-launcher-windows)。
+
 ## 功能概览
 
 默认 PTC 模式的每次调用都从新环境开始：上次的变量不再存在，改动依赖前面的结果时只能重发准备代码。PTC Plus 把 `run_code` 变成会话级的 TypeScript REPL，补上下面的落差。
@@ -52,6 +54,7 @@ dsh plugin --profile <profile> add dsh-ptc-plus
 | 只改一小段代码 | 改动一行也要重新发送整段源码 | `edit_run_code` 只提交差异，再执行修改后的完整代码 |
 | 使用模块语法 | 函数体里不能直接写静态 `import` / `export` | 在 cell 中直接写，插件自动适配模块语法 |
 | 调用漏填摘要 | 缺少 `run_code.description` 时校验失败 | 自动补充显示摘要，其余参数合法的代码继续执行 |
+| 提供方拒绝畸形工具 JSON | 整个 turn 以 provider 错误终止 | 缓冲的工具调用尾部仅含工具块和至多一个用量事件时可修复或保留参数；其他缓冲尾部转为 schema 拒绝结果，模型继续下一步 |
 | 误发顶层工具调用 | PTC 模式下未声明的顶层调用被拒绝 | 当前工具定义能唯一确认目标且参数合法时，转为对应的 `run_code` |
 | 定位代码错误 | 只返回原生错误与堆栈 | 对应到 cell 源码位置；末尾缺少闭合符且修正可唯一验证时给出编辑建议 |
 | 访问当前项目 | 相对路径按宿主进程目录解析 | 按会话项目目录解析文件路径、会话模块导入和默认子进程目录 |
@@ -131,6 +134,7 @@ edit_run_code({
 | --- | --- |
 | `run_code` 漏填外层 `description` | 补充显示摘要，让其余参数合法的代码继续执行 |
 | 模型误发 PTC 直接工具列表之外的原生工具调用 | 当前工具定义能唯一确认目标且参数合法时，转为对应的 `run_code` |
+| 参数校验报告缺少 `description` | 区分外层与嵌套工具参数并给出修正提示；提示以完整消息保存，保持会话历史可加载 |
 | 代码解析失败 | 标出源码位置；若错误在末尾，且追加一到两个闭合符只有一种通过验证的修正，给出绑定原调用的编辑建议 |
 
 前两项默认开启，可在设置中关闭。语法建议不会自动执行，也不代表插件能判断代码是否符合任务意图。

package/client.js

@@ -31321,10 +31321,12 @@
       const content2 = React.useRef(null);
       const localReturnFocus = React.useRef(null);
       const returnFocus = returnFocusRef ?? localReturnFocus;
-      React.useEffect(() => {
+      const attachContent = React.useCallback((element) => {
+        content2.current = element;
+        if (element === null) return;
         const previous = document.activeElement;
-        if (!content2.current.contains(previous) && canReturnFocus(previous)) returnFocus.current = previous;
-        content2.current.querySelector("button")?.focus();
+        if (!element.contains(previous) && canReturnFocus(previous)) returnFocus.current = previous;
+        element.querySelector("button")?.focus();
       }, [returnFocus]);
       const close = () => {
         const target = canReturnFocus(returnFocus.current) ? returnFocus.current : getReturnFocus?.();
@@ -31347,7 +31349,7 @@
         { open: true, onClose: close, title: t2("bindings.title"), headless: true, className: "ptcPlusBindingsModal" },
         h(
           "div",
-          { className: "ptcPlusBindingsDialog", ref: content2, onKeyDown: trapFocus },
+          { className: "ptcPlusBindingsDialog", ref: attachContent, onKeyDown: trapFocus },
           h(
             "div",
             { className: "ptcPlusBindingsDialogHead" },

package/docs/README.md

@@ -27,4 +27,5 @@
 - [Focused Verification](verification-optimization-work.md): bounded coverage diagnostics and their relationship to the final verification gate.
 - [Semantic Validation](semantic-validation.md): pinned Test262 cases, dialect contracts, native differential matrices and their limits.
 - [Publishing](publishing.md): release checks, package contents, permissions, and platform validation.
+- [GitHub Release Notes](release-notes.md): user-perspective priority order, required sections, bilingual style, and a worked example for release notes.
 - [Client UI](client-ui.md): current UI boundary and reevaluation criteria.

package/docs/adr/0005-temporary-rejected-cell-edit-transport.md

@@ -68,8 +68,10 @@ session-log projection captures the eligible target at the edit call event and a
 source only when its target sequence matches that snapshot and its journal is valid and non-noop,
 so live and recovered eligibility derive from the same persisted relation.
 
-The caller sends exactly one of `edits` or `regex_edits`, plus an optional non-negative
-`expected_target_call_seq` precondition. The precondition must equal the call sequence of the target
+The public schema is one closed object with optional `edits`, `regex_edits`, and
+`expected_target_call_seq` properties, avoiding duplicated object alternatives in the provider
+prompt. Runtime validation still requires exactly one of `edits` or `regex_edits`, plus an optional
+non-negative `expected_target_call_seq` precondition. The precondition must equal the call sequence of the target
 captured for the persisted edit event; a mismatch returns an unedited result before derived
 dispatch. Ordinary model-authored edits omit it and retain latest-target selection. Exact edits
 contain at most 16 items; each
@@ -95,11 +97,43 @@ tool/result:          { edited: true, value?, error?, logs }
 The complete derived source, its journal, and its target call sequence are stored only in private tool-result metadata, including
 when the derived cell fails after entering the runtime. Cold
 recovery folds that explicitly marked derived run into the durable REPL history. The source is not
-copied into the model-visible edit result, and assistant stream chunks for the two declared
+copied into the model-visible edit result. Valid assistant stream chunks for the two declared
 transports pass through unchanged.
 Consequently the UI and later model requests do not attribute a generated `run_code` call to the
 model.
 
+The stream owner handles one bounded provider protocol failure before DSH assembles the assistant
+message. It buffers tool-call material until the terminal event. If the response reports the exact
+invalid-tool-JSON `MALFORMED_RESPONSE` as a terminal chunk or stream exception, it changes that
+terminal reason to `tool-calls`.
+DSH's existing Agent Loop
+then preserves an unparseable argument as a string and routes it through ordinary tool validation,
+execution, and result recording, after which the model receives another step. A malformed tool argument therefore
+cannot become a turn-ending provider failure merely because this adapter parses it earlier than the
+Agent Loop.
+
+The stream owner preserves calls only when the buffered body consists entirely of
+tool-call-specific framing plus at most one `usage` event. When that trusted body contains exactly
+one complete, internally consistent declared `run_code` or `edit_run_code` block, the stream owner
+first considers one correction: delete exactly one final `}`. The block index, call ID, name,
+concatenated deltas, and final arguments must agree, and the candidate must parse as an object
+accepted by that request's live direct-tool schema. A successful correction changes the final delta
+and final block arguments before the same `tool-calls` settlement. Without that proof, trusted
+internally consistent complete blocks retain their original identity and argument bytes for the
+ordinary tool-error path. The owner re-emits those calls with canonical
+`block-start`, full-argument delta, and `block-end` framing so provider variants tolerated by the
+assembler also satisfy DSH's stream invariant. A final `block-end` is canonical even when the
+provider emitted no deltas; when deltas exist, their supplied identity fields and accumulated
+arguments must agree with it. An already visible open text or reasoning block is closed from its
+accumulated content before the synthetic call. If any tool block is incomplete or inconsistent, or no tool block was
+emitted, more than one usage event appears, or any other event occurs in the buffered body, the owner
+removes unsafe block and unknown events, retains at most the first protocol-valid `usage`, and emits
+one deterministic `run_code` call with an argument string that cannot parse as a JSON object. That
+call can only fail DSH's ordinary schema
+validation, so no untrusted partial call executes and the model still receives another step. Valid streams and every
+other provider failure pass through unchanged. The rule does not insert missing delimiters, search
+arbitrary edits, reinterpret native calls, or retry effects.
+
 No edit-specific runtime context is emitted. The truthful call/result pair already carries the
 operation and outcome; changing an aggregate runtime-context snapshot merely to restate that fact
 would repeat unrelated policy context. Rewrite feedback and unrelated recovery tips retain their
@@ -140,7 +174,10 @@ claim that the earlier execution was undone or idempotent.
 out-of-surface call are different protocol facts. Rewriting a real `edit_run_code` destroys a valid
 identity; normalizing a live-schema-proven native miscall to the declared `run_code` transport gives
 an otherwise invalid call its executable representation. Native-call canonicalization therefore
-remains available while the two declared transports pass through unchanged.
+remains available. The bounded malformed-input correction likewise retains a declared call's identity.
+Fallback settlement preserves arguments for trusted complete internally consistent blocks. Unsafe,
+partial, or mixed buffered material is replaced by a validation-rejected `run_code` call only after
+the provider itself reports the exact terminal protocol failure.
 
 ## Consequences
 

package/docs/adr/0017-track-the-latest-dsh-public-surface.md

@@ -10,6 +10,10 @@ PTC Plus must remain independently installable on unmodified official DSH distri
 
 The compatibility target is the latest available DSH release. Production behavior, configuration, tests, installation guidance, and current compatibility claims depend on public extension contracts and observed live schemas, never on a DSH version allowlist or comparison. An upstream default projection is not an extension ceiling: when public scoped registration and presentation support a plugin-owned capability, PTC Plus preserves that capability and its model-visible identity instead of deleting or renaming it to match the default. Deterministic normalization remains valid for a call that is outside the declared direct surface when the live schema proves one native target and the lowering preserves arguments, call identity, authority, and result semantics. Deterministic tests exercise the consumed contracts; model-backed and packaging acceptance runners use the installed DSH and record `dsh --version` in generated reports so failures remain attributable without turning the observed value into policy. Concrete DSH release numbers may appear only in source comments that identify historical integration or evaluation evidence and cannot influence execution or acceptance.
 
+Release discovery is separated from candidate verification. The root manifest declares the official `next` channel for the DSH packages used by development and freezes the resolved cohort in the root lockfile. `compat/latest` declares only the official DSH meta-package on `latest` and freezes that complete graph in its own lockfile. Resolved versions in these generated lock snapshots are reproducibility evidence selected by the channel declarations; they are not compatibility allowlists or runtime branches. Ordinary `verify` and `check` runs make no registry request and fail quickly when the installed root graph differs from the root lock.
+
+The scheduled baseline refresh queries the official registry. When either channel moves, it updates both lock snapshots on an automation-owned branch, opens or updates one pull request, and dispatches the normal CI workflow once for that frozen candidate. GitHub suppresses workflow runs from branch and pull-request events produced by the workflow's `GITHUB_TOKEN`, so the explicit dispatch is the candidate's only CI run. If neither tag moved, it does not resolve or install the dependency graph. The Host contract suite tests the packed plugin against the root `next` graph and creates a repository-external consumer from the tracked `latest` lock. That consumer exposes the public packages from the selected Host graph to the plugin and runs the execution-seam, RPC-codec, and compressed Session persistence contracts. No compatibility run independently selects tags for DSH service packages, because their dist-tags need not move as one cohort.
+
 Preceding public contracts remain supported where capability detection is
 unambiguous. Tools presentation is selected by the installed public schema;
 Client contributions depend on their slots and supplied hooks rather than unused
@@ -69,4 +73,4 @@ capability, storage and observation rules independently of transport.
 
 Feature completion requires evidence from the actual packaged plugin running on the selected unmodified Host, including the affected user flow. Component fixtures and public-interface unit tests validate narrower properties; they do not prove that a required renderer exists or is loaded in that distribution. A clean code review and passing deterministic checks are separate from product acceptance. Both must cover the final change before a feature is described as delivered; commit and publish authorization remain separate user decisions.
 
-Each upstream DSH release becomes the immediate compatibility target and must pass the public-surface, packaging, and model-backed checks appropriate to the change. Users are not blocked by stale version metadata. Historical reports remain attributable through generated runtime metadata or source comments, while a passing older run never substitutes for validation against the latest release.
+Each upstream DSH release becomes the immediate compatibility target and must pass the public-surface, packaging, and model-backed checks appropriate to the change. The automated pull request makes an upstream tag movement an explicit source candidate; the lockfile and CI result keep its proof reproducible after the registry moves again. Users are not blocked by stale version metadata. Historical reports remain attributable through generated runtime metadata or source comments, while a passing older run never substitutes for validation against the latest release.

package/docs/adr/0019-plugin-settings-and-kill-switch.md

@@ -8,7 +8,7 @@ Accepted
 
 ## Context
 
-PTC Plus 0.1.0 deliberately had no Client UI. The runtime surface was the DSH PTC mode `run_code`/`edit_run_code` transport, and adding a settings bundle was judged not to improve the core REPL path. The plugin also lacked a user-facing way to disable its runtime without removing the Cordis entry, and enabling/disabling state was invisible outside the session log. PTC Plus requires a plugin settings UI containing every Host Config field, a kill switch, and an explicit enabled marker. DSH's public settings service registers a namespace; the browser half contributes a card through the generation's settings seat, and the client reads the installed generation's settings transport (`configForms` on the current alpha, `settingsScope` on the preceding RC).
+PTC Plus 0.1.0 deliberately had no Client UI. The runtime surface was the DSH PTC mode `run_code`/`edit_run_code` transport, and adding a settings bundle was judged not to improve the core REPL path. The plugin also lacked a user-facing way to disable its runtime without removing the Cordis entry, and enabling/disabling state was invisible outside the session log. PTC Plus requires a plugin settings UI containing every Host Config field, a kill switch, and an explicit enabled marker. DSH's public settings service registers a namespace; the browser half contributes a card through the generation's settings seat, and the client reads whichever public settings transport the installed Host exposes (`configForms` or `settingsScope`).
 
 ## Decision
 

package/docs/adr/0020-optional-cordis-tools-in-ptc-mode.md

@@ -14,7 +14,7 @@ Tool registration must finish before the prompt assembly returned to the agent;
 
 ## Decision
 
-Add `cordisToolsEnabled: boolean`, default `false`, as a live PTC Plus setting. When enabled, PTC Plus mounts the official `@deepseek-ai/dsh-tool-cordis` plugin and a maintained `@deepseek-ai/dsh-skill-filesystem` provider in each agent scope that exposes every surface the mount publishes through: `run_code`, the `skill` tool, and the public `agentPresets` and `skills` services; disabling it disposes both fibers immediately. The provider resolves the shipped `cordis` preset through the public `agentPresets` service and reads its sibling `skills` root without including default roots. At the public `skills.registerProvider` seam, PTC Plus transparently filters discovery and loading to exactly `cordis-plugin-development`; the maintained filesystem provider still owns parsing, resource bases, watch, invalidation, incomplete observations, and body loading. This prevents unrelated or obsolete sibling Skills from silently enlarging the PTC surface without copying the companion content or switching the current preset. A scope that omits one of those surfaces is not an error: the owner keeps the agent pending, publishes nothing there, and retries on the DSH tools-change signal or the next prompt assembly, because a later registration or provided service can supply the missing member ([ADR 0029](0029-keep-plugin-unavailability-out-of-the-host-agent-lifecycle.md)).
+Add `cordisToolsEnabled: boolean`, default `false`, as a live PTC Plus setting. When enabled, PTC Plus mounts the official `@deepseek-ai/dsh-tool-cordis` plugin and a maintained `@deepseek-ai/dsh-skill-filesystem` provider in each agent scope that exposes every surface the mount publishes through: `run_code`, the `skill` tool, and the public `agentPresets` and `skills` services; disabling it disposes both fibers immediately. The provider resolves the shipped `cordis` preset through the public `agentPresets` service and reads its sibling `skills` root as an immutable bundled Host resource without including default roots or watching the packaged directory. At the public `skills.registerProvider` seam, PTC Plus transparently filters discovery and loading to exactly `cordis-plugin-development`; the maintained filesystem provider still owns parsing, resource bases, incomplete observations, and body loading. This prevents unrelated or obsolete sibling Skills from silently enlarging the PTC surface without copying the companion content or switching the current preset. A scope that omits one of those surfaces is not an error: the owner keeps the agent pending, publishes nothing there, and retries on the DSH tools-change signal or the next prompt assembly, because a later registration or provided service can supply the missing member ([ADR 0029](0029-keep-plugin-unavailability-out-of-the-host-agent-lifecycle.md)).
 
 The Skill provider and official Cordis child fiber form one reversible mount. Both must settle, and the scoped `skills` service must prove that `cordis-plugin-development` resolves from the added provider as model-invocable and loadable, before the first prompt assembly is returned. A prepended public `system-prompt/assemble` waterfall listener is the final race barrier: if collection began before the mount settled, it waits for readiness, discards that stale assembly, and invokes public assembly again so DSH recollects the official providers. It does not synthesize or mutate Cordis schemas or guidance. The Cordis fiber's resolved `inject` declaration is the authoritative required-service list, and its live registrations are the authoritative tool names, schemas, and guidance. A scope whose exposed preset, Skill service/tool, declared service, publication, or child fiber contradicts the DSH contract is a configuration error and rolls back every contribution; an absent surface only defers the mount. An unusable scope reached through the host's own calls — `agent/created` and the prepended waterfall — withdraws and reports one warning instead of failing the host operation that created the scope ([ADR 0029](0029-keep-plugin-unavailability-out-of-the-host-agent-lifecycle.md)).
 
@@ -24,7 +24,7 @@ Cordis tools remain native program bindings under `tools.*`. The PTC code-only d
 
 Cordis definitions and Runs are process-local, while PTC journals replay every settled program binding as a recorded value without redispatch. On the first prompt for an agent or a new Cordis enable generation, PTC Plus derives whether normalized journals contain a Cordis transcript. If they do, it emits the fixed `tools:ptc-plus-cordis-recovery` runtime context: recorded values remain journal data, but the model must perform a live read-only Cordis Inspect before relying on prior IDs, state, approvals, or capability observations. The context remains until a newly settled successful `cordis_inspect*` call appears in the session log. It neither asserts that live state was lost nor reruns a mutating call.
 
-Companion Skill resolution is capability-based. The generations that discover presets from their composition directories publish an absolute composition path for the shipped `cordis` preset, and PTC Plus reads the sibling `skills` root. A generation that declares presets without publishing any composition path publishes no companion Skill root through `agentPresets` at all: PTC Plus reports that missing publication as an unsupported surface, naming the surface and its consequence rather than a shape failure of a healthy host, and keeps the existing rollback or single-warning withdrawal instead of assuming a directory. An unusable preset (`broken`) is reported as unavailable before any path shape is considered.
+Companion Skill resolution is capability-based. A generation that publishes an absolute composition path for the shipped `cordis` preset uses its sibling `skills` root. For a pathless generation, PTC Plus asks the Host's public `pluginPackages.packageOf` service for the active installation's `@deepseek-ai/dsh-agent-preset` or `@deepseek-ai/dsh-agent-presets` resource, then selects that generation's known Skill layout. Older generations that do not publish `pluginPackages` may resolve only the historical plural package from the Host's `ctx.baseUrl`; this compatibility path is disabled whenever the service exists, including when it returns no package. It never uses plugin-anchored ambient Node lookup, because a profile or Desktop installation may contain a stale package from another Host generation. PTC Plus accepts a root only when it contains the exact `cordis-plugin-development/SKILL.md`; it does not infer support from a package name or directory alone. An unusable preset (`broken`) is reported as unavailable before path or package resolution, while an invalid published path remains a host contradiction rather than falling through to a different generation.
 
 ## Alternatives Considered
 

package/docs/adr/0030-serve-both-typert-codec-generations-from-one-codec.md

@@ -12,7 +12,7 @@ PTC Plus publishes its Remote services through DSH's TYPERT registry, and that r
 
 Each generation validates only the member it owns and ignores the other, so one published contract serves whichever shape the installed host implements. Compatibility follows the live acceptance behavior of the registry rather than a release version, and the decoder is published once, so a host that reads both members cannot obtain two different decoders for one wire member.
 
-CI registers the packed contract with the installed host's own registry on both the stable and alpha channels (`scripts/dsh-rpc-contract-smoke.mjs`), so a generation that changes this validation fails the packaging check instead of reaching users.
+CI registers the packed contract with the installed host's own registry from the frozen official `latest` and `next` graphs (`scripts/dsh-rpc-contract-smoke.mjs`), so a generation that changes this validation fails the packaging check instead of reaching users.
 
 ## Alternatives Considered
 
@@ -24,4 +24,4 @@ CI registers the packed contract with the installed host's own registry on both
 
 ## Consequences
 
-One plugin build serves the stable and alpha channels for this surface, and the compatibility rule lives in a single module with the decoder published once. A future generation that requires another member, or that rejects a codec carrying a member it does not know, needs this owner updated; the regression test is CI's registration against the installed registry, which fails on the channel that changed instead of on the user's machine. The decoder keeps the project's maintained schema runtime, so a host that validates payloads itself still evaluates the same semantics the plugin's own tests exercise through both members.
+One plugin build serves the preceding and current public codec generations for this surface, and the compatibility rule lives in a single module with the decoder published once. A future generation that requires another member, or that rejects a codec carrying a member it does not know, needs this owner updated; the regression test is CI's registration against the installed registry, which fails on the frozen Host graph that changed instead of on the user's machine. The decoder keeps the project's maintained schema runtime, so a host that validates payloads itself still evaluates the same semantics the plugin's own tests exercise through both members.

package/docs/architecture.md

@@ -52,7 +52,7 @@ system sections、tool schema 或 tool order，也不假设 Windows、WSL、POSI
 
 ## 设置与启用开关
 
-Host half 通过 DSH 公共 settings 服务接入 `ptc-plus` 命名空间：提供 provider-owned `installSection()` 的代际直接注册，提供根模块 `installSettingsSection()` 的代际经兼容适配注册；两条路径共享同一 fallback、watch、rollback 与 disposal 语义。既不提供 section installer、又由宿主从插件导出的 `Config` 管理设置文档的代际（当前 alpha）被视为 host-owned surface：导出 schema 的全部字段带 volatile 标记，宿主据此提供表单并通过自身 config-editor 把 volatile-only 变更写入 retained handles；插件订阅宿主的 `loader/volatile-update` 事件，从同一 schema 重新解析 live 值并复用既有 reconcile、rollback 与 per-cell 配置代际语义。字段清单、默认值与校验来自 `internal/config-spec.js`。
+Host half 通过 DSH 公共 settings 服务接入 `ptc-plus` 命名空间：提供 provider-owned `installSection()` 的代际直接注册，提供根模块 `installSettingsSection()` 的代际经兼容适配注册；两条路径共享同一 fallback、watch、rollback 与 disposal 语义。既不提供 section installer、又由宿主从插件导出的 `Config` 管理设置文档的代际被视为 host-owned surface：导出 schema 的全部字段带 volatile 标记，宿主据此提供表单并通过自身 config-editor 把 volatile-only 变更写入 retained handles；插件订阅宿主的 `loader/volatile-update` 事件，从同一 schema 重新解析 live 值并复用既有 reconcile、rollback 与 per-cell 配置代际语义。字段清单、默认值与校验来自 `internal/config-spec.js`。
 Client half 在侧栏 **插件 → 已安装 → dsh-ptc-plus** 的插件行配置页呈现全部设置，通过 `plugins.row.config`（keyed，键 `<包名>#<行 id>`）注册；旧宿主的插件设置使用 `settings.plugin.item`（keyed，按 namespace）。`src/client-host-compat.js` 等待对应页面声明槽位，并按 `summary`/`page` 分别渲染一句描述与完整表单，不向通用设置注册。星光菜单在应用内弹窗复用完整表单与写入 owner；包元数据的 `icon` 指向随包发布的 SVG，由宿主显示在插件列表与详情页（[ADR 0019](adr/0019-plugin-settings-and-kill-switch.md)）。`enabled` 是 kill switch：关闭时保留 settings 注册、设置卡片与撤销旧 PTC 声明所需的被动 presentation cleanup；`enhancedToolView` 是默认开启的正文展示开关，关闭时只交还 DSH 原生 `run_code`/`edit_run_code` generic row，
 总开关关闭时不注册 runtime、执行 hook、tool surface 或 system prompt section，也不读取 binding 存储；`ptc` 与兼容 `code` preset 会话在头部单独显示 `PTC Plus` 指示器。设置卡片显示“已启用/已停用”，稳定指引不包含 UI 品牌名。
 `Config` 的字段形态由 `internal/settings-compat.js` 按已安装代际的公共能力决定：仍提供 section installer 的代际保留普通描述字段，由自身文档路径提交校验后的具体默认值；只有自管设置文档的代际才加 volatile 标记，字段构建器不具备该能力的代际保持可加载。版本号不参与该判断。
@@ -63,6 +63,8 @@ Client half 在侧栏 **插件 → 已安装 → dsh-ptc-plus** 的插件行配
 
 `cordisToolsEnabled` 默认关闭且即时生效。Host 只在同时暴露 `run_code`、`skill` 工具与 `agentPresets`/`skills` service 的 agent scope 中挂载官方 `@deepseek-ai/dsh-tool-cordis`，并通过公共 `agentPresets` service 定位 shipped `cordis` preset，再用维护中的 Skill filesystem plugin 把其 companion Skill 目录发布到同一 scope。两个 child fiber、tool guidance 与 `cordis-plugin-development` Skill 是一个 mount；首轮 request 等待完整发布和 scoped Skill load 验证，关闭、agent/runtime 释放或任一激活失败时逆序卸载。缺少其中任一 surface 的 scope 不是错误：owner 保持 pending、不在该 scope 发布内容，并在工具 surface 变化或下一次 prompt assembly 时重试；由宿主自身调用触达的不可用 scope 只从该 scope 撤出并记一条 warning，不使 `agents.create()` 或 prompt assembly 失败（[ADR 0029](adr/0029-keep-plugin-unavailability-out-of-the-host-agent-lifecycle.md)）。工具名、数量、schema 和 guidance 直接来自 official tool fiber，Skill 内容直接来自 shipped preset，Host 均不复制。官方插件同时向 process-global `cordisInspect` 注册 Host provider；owner 将 manifest 相同的 per-agent 注册合并为引用计数 lease，查询委托给当前仍存活的官方 registration，最后一份 lease 释放后才注销 provider。manifest 不一致时启用失败。该开关不切换 preset，也不改变 code-only direct-tool projection。
 
+Skill 根在当前 generation 发布绝对 composition path 时取其 sibling；pathless generation 改由 active Host 的公共 `pluginPackages.packageOf` service 定位该安装的官方单数或复数 preset package resource。完全没有该 service 的旧 generation 仅可从 Host `ctx.baseUrl` 解析历史复数包；service 已存在但返回空或无效结果时不进入兼容路径，因此不会读取插件 profile 周围可能属于另一宿主的 ambient package。只有准确存在 `cordis-plugin-development/SKILL.md` 才进入 mount；已发布但无效的 path 不回退到另一 generation 的 package layout。
+
 ## Global User Bindings
 
 `internal/user-bindings.js` 是条目、文档、请求快照和有界声明的严格规范化 owner。它从命名 value export 的 TypeScript 源码派生 symbols、binding kind、body-free declaration、durability 与 fingerprint，并封闭校验所有衍生字段；调用方不能提交一份与源码不一致的声明或 snapshot。源码声明保留未被遮蔽的环境类型，并收集公开签名引用的本地 interface、type alias 与 class 闭包；各条目使用独立声明 namespace，公开 class shape 包含实例字段与 constructor parameter property。无法形成自足声明的 imported type 在持久化前拒绝，不能静默替换为 `unknown`。`namespace` scope 产生一个条目名对象，`top-level` scope 产生选定导出；保留名称和启用集合中的调用标识符冲突在持久化或请求激活前拒绝。

package/docs/installation.md

@@ -18,20 +18,20 @@ Install the plugin into the profile that actually runs the target DSH surface. D
 
 `danger-full-access` is the primary supported experience. The worker isolates the REPL lifecycle; it is not a malicious-code sandbox. DSH continues to own native-tool scope, policy, approval, cancellation, sandboxing, and scheduling. Narrower profiles expose only their available capabilities; PTC Plus does not simulate missing authority or add another permission system.
 
-The optional `cordisToolsEnabled` integration requires the current DSH installation to provide its shipped `cordis` preset plus the public preset, Skill, Cordis, settings, and tool-runtime packages. PTC Plus declares those host-owned DSH packages as unrestricted required peers instead of installing private runtime copies; runtime capability validation owns compatibility, and CI loads the packed plugin inside complete stable and alpha DSH installations. That load step runs `scripts/dsh-execution-seam-smoke.mjs`, which reads the execution service the installed tool runtime reads and requires the plugin to take it over, and `scripts/dsh-rpc-contract-smoke.mjs`, which registers the packed Remote descriptors with the installed TYPERT registry and evaluates the decoder that generation reads ([ADR 0030](adr/0030-serve-both-typert-codec-generations-from-one-codec.md)); an import alone cannot distinguish a loaded plugin from one whose injection is unsatisfied, because Cordis leaves the latter pending without an error, and it cannot show that the Host accepts a wire contract it validates only at registration. Service packages retain the dependency graph selected by their Host distribution rather than independently selecting each service's release tag. DSH's profile module fallback must resolve the peers from the active installation. Do not copy `SKILL.md` or add the Cordis preset's Skill directory to global roots. If the host surface is incomplete, plugin activation or enabling the setting fails instead of loading a second DSH core.
+The optional `cordisToolsEnabled` integration requires the current DSH installation to provide its shipped `cordis` preset plus the public preset, Skill, Cordis, settings, and tool-runtime services. PTC Plus declares the shared service packages as unrestricted required peers instead of installing private runtime copies. For a pathless preset it asks the Host's `pluginPackages.packageOf` service for the active generation's official preset package and requires the exact `cordis-plugin-development/SKILL.md` before mounting it; an older generation with no package service may resolve only its historical plural preset package relative to the Host's `ctx.baseUrl`. This compatibility path is disabled whenever `pluginPackages` exists, so packages merely reachable from the plugin profile cannot override an active Host result. Runtime capability validation owns compatibility, and CI loads the packed plugin against frozen official `latest` and `next` DSH graphs. That load step mounts the pathless Cordis companion from a separated active-host resource while a resolvable stale package is present beside the packed plugin, runs `scripts/dsh-execution-seam-smoke.mjs` to read and take over the execution service the installed tool runtime uses, and runs `scripts/dsh-rpc-contract-smoke.mjs` to register the packed Remote descriptors with the installed TYPERT registry and evaluate the decoder that generation reads ([ADR 0030](adr/0030-serve-both-typert-codec-generations-from-one-codec.md)); an import alone cannot distinguish a loaded plugin from one whose injection is unsatisfied, because Cordis leaves the latter pending without an error, and it cannot show that the Host accepts a wire contract it validates only at registration. The same suite round-trips argument diagnostics through the selected Host's compressed JSONL Session persistence. Service packages retain the dependency graph selected by their Host distribution rather than independently selecting each service's release tag. DSH's profile module fallback must resolve the peers, while `pluginPackages` identifies the official preset resource from an active installation that publishes the service. Do not copy `SKILL.md` or add the Cordis preset's Skill directory to global roots. If the host surface is incomplete, plugin activation or enabling the setting fails instead of loading a second DSH core.
 
 The plugin attaches to whichever program-execution service the installed DSH registers, and it presents the capabilities of the execution it performs ([ADR 0028](adr/0028-attach-to-the-host-ptc-execution-seam.md)). Cells run in the session kernel under the session's configured budgets, so `run_code` advertises neither a per-call deadline nor a file sandbox, and DSH rejects `timeoutMs` and `sandbox_permissions` with its own message instead of the plugin accepting an input it would then ignore.
 
-Every installation path uses an unmodified official DSH distribution. Local plugin development packages this checkout; it does not build, patch, or substitute the Host. Missing public layout interfaces remain a feature limitation, not an instruction to customize DSH. See [ADR 0017](adr/0017-track-the-latest-dsh-public-surface.md) for distribution and acceptance requirements.
+Supported installations use an unmodified official DSH release. Local plugin development packages this checkout. The release development launcher uses the published Host; the opt-in [upstream source launcher](#upstream-source-development-launcher-windows) builds the unmodified official repository for testing unreleased changes. Neither path patches the Host. Missing public layout interfaces remain a feature limitation, not an instruction to customize DSH. See [ADR 0017](adr/0017-track-the-latest-dsh-public-surface.md) for distribution and acceptance requirements.
 
-The Client root requires `slots`, `locale`, `connection`, and `remote`; it resolves the installed generation's settings transport (`configForms` on the current alpha, `settingsScope` on the preceding RC) through an optional injection. Contributions wait for their public slots and consume the supplied session hooks; the composer action additionally requires `remote.commands`. Neither an unused `ui-session` module nor a renamed conversation registry gates activation. Preset selection prefers `agentPreset` projection evidence, falling back only to the preceding public session summary field when that projection is absent. Binding values and draft capabilities always require their own projections. No private store or raw-log fallback is used. Slot and provider disposal withdraw the contributions they own.
+The Client root requires `slots`, `locale`, `connection`, and `remote`; it resolves whichever public settings transport the installed Host exposes (`configForms` or `settingsScope`) through an optional injection. Contributions wait for their public slots and consume the supplied session hooks; the composer action additionally requires `remote.commands`. Neither an unused `ui-session` module nor a renamed conversation registry gates activation. Preset selection prefers `agentPreset` projection evidence, falling back only to the preceding public session summary field when that projection is absent. Binding values and draft capabilities always require their own projections. No private store or raw-log fallback is used. Slot and provider disposal withdraw the contributions they own.
 
 ## npm Release
 
 Use this form after the selected version is available from the npm registry:
 
 ```sh
-dsh plugin --profile <profile> add dsh-ptc-plus@0.4.3
+dsh plugin --profile <profile> add dsh-ptc-plus@0.4.8
 dsh --profile <profile> --dump-config
 ```
 
@@ -68,7 +68,7 @@ pnpm dsh --profile <profile> --dump-config
 
 ```sh
 npm pack
-dsh plugin --profile <profile> add /absolute/path/to/dsh-ptc-plus-0.4.3.tgz
+dsh plugin --profile <profile> add /absolute/path/to/dsh-ptc-plus-0.4.8.tgz
 dsh --profile <profile> --dump-config
 ```
 
@@ -89,14 +89,32 @@ On Windows, `--browser-channel msedge` can use the existing Edge installation. T
 
 ## Isolated latest-DSH development launcher
 
-To test this checkout in a separate DSH installation, double-click `scripts\run-dev-dsh.cmd`. It resolves the newest published DSH release by semantic version over all published versions, prereleases included, rather than following a dist-tag that a release can leave behind; it installs that exact version only when the cached version changes, creates the shipped `web` profile inside an isolated `DSH_HOME`, installs this checkout, and starts DSH. When no port is supplied, the default Web profile reuses its cached loopback port while that port is available; an invalid cache entry or occupied port is replaced with a free port. This keeps browser authentication stable across ordinary restarts without blocking another DSH on port 3080. The launched Host receives a 64 KiB HTTP request-header limit while retaining existing Node options to accommodate development authentication cookies and the combined Client plugin request during Web boot. The launcher does not modify the repository or your normal DSH home.
+To test this checkout in a separate DSH installation, double-click `scripts\run-dev-dsh.cmd`. It orders all published DSH releases by semantic version, prereleases included, and selects the newest release whose complete dependency cohort npm can install, rather than following a dist-tag that a release can leave behind. If a newly published root package still has missing exact-version dependencies, the launcher warns and tries the preceding release; an explicit `DSH_DEV_VERSION` remains exact and fails instead of falling back. It installs only when the selected cached version changes, creates the shipped `web` profile inside an isolated `DSH_HOME`, installs this checkout, and starts DSH. When no port is supplied, the default Web profile reuses its cached loopback port while that port is available; an invalid cache entry or occupied port is replaced with a free port. This keeps browser authentication stable across ordinary restarts without blocking another DSH on port 3080. The launched Host receives a 64 KiB HTTP request-header limit while retaining existing Node options to accommodate development authentication cookies and the combined Client plugin request during Web boot. The launcher does not modify the repository or your normal DSH home.
 
 The launcher defaults to `https://registry.npmjs.org/` for version queries, npm installs and DSH's pnpm subprocesses, including the `@deepseek-ai` scope. This avoids mirror synchronization gaps where a new DSH package is available before its dependencies. It prints the selected registry and refreshes version metadata online; an unavailable version query can still reuse the previously cached version. Set `DSH_DEV_REGISTRY` to an absolute HTTP(S) registry URL to select another source explicitly. The choice applies only to the launcher process and its children; npm configuration files and persistent environment settings are unchanged. Other explicitly configured package scopes retain their own registries.
 
-The default cache is `%LOCALAPPDATA%\dsh-ptc-plus-dev`. It contains the isolated `DSH_HOME`, DSH installations, immutable plugin snapshots, and a pnpm store. Cleanup aims to retain three DSH versions and plugin snapshots, always including the selected installation and snapshot even when another directory has a newer timestamp. Locked directories warn and remain for a later cleanup attempt; their installation marker is removed before deletion so partially deleted installations cannot be reused. Failed pnpm store pruning also warns and continues startup. Installation errors still stop the launcher. Set `DSH_DEV_CACHE` to move the cache, `DSH_DEV_PROFILE` to change the profile name, `DSH_DEV_VERSION` to pin an npm dist-tag or version instead of the newest published release, `DSH_DEV_PORT` to choose a fixed Web port, or `DSH_DEV_MAX_VERSIONS` to change the retention count (1-10).
+The default cache is `%LOCALAPPDATA%\dsh-ptc-plus-dev`. It contains the isolated `DSH_HOME`, DSH installations, immutable plugin snapshots, and a pnpm store. Cleanup aims to retain three DSH versions and plugin snapshots, always including the selected installation and snapshot even when another directory has a newer timestamp. Locked directories warn and remain for a later cleanup attempt; their installation marker is removed before deletion so partially deleted or failed installations cannot be reused. Failed pnpm store pruning also warns and continues startup. Failure of every published candidate, or of an explicitly selected version, stops the launcher. Set `DSH_DEV_CACHE` to move the cache, `DSH_DEV_PROFILE` to change the profile name, `DSH_DEV_VERSION` to pin an npm dist-tag or version instead of the newest installable published release, `DSH_DEV_PORT` to choose a fixed Web port, or `DSH_DEV_MAX_VERSIONS` to change the retention count (1-10).
 
 The Windows launchers normalize the process, machine, and user `PATH` values in memory, remove duplicate entries, and add the Node/cache directories they need. They do not create drive mappings, junction trees, or persistent environment changes. If a genuinely unique PATH is still too long for `cmd.exe`, the launcher stops before npm or DSH runs and asks you to shorten the relevant PATH value.
 
+### Upstream source development launcher (Windows)
+
+Double-click `scripts\run-upstream-dsh.cmd` to test unreleased official DSH code with this plugin checkout. Git, Node.js and npm must be on the Windows PATH. The launcher fetches the official repository's default-branch HEAD, prints its full commit, installs the exact pnpm declared by that commit, and follows the official `pnpm install --frozen-lockfile`, `pnpm run build`, and `pnpm run dsh` source workflow. It does not patch upstream source. First startup can take several minutes and substantial disk space; upstream build prerequisites and failures remain visible.
+
+The source launcher shares plugin packaging, profile selection and port handling with `run-dev-dsh.cmd`, but uses an `upstream` subdirectory of the development cache. Its DSH home, profiles, authentication, pnpm store and build snapshots are separate from the release launcher and your normal DSH installation. `DSH_DEV_CACHE`, `DSH_DEV_REGISTRY`, `DSH_DEV_PROFILE`, `DSH_DEV_PORT`, and `DSH_DEV_MAX_VERSIONS` apply; `DSH_DEV_VERSION` does not select source commits. For example:
+
+```bat
+scripts\run-upstream-dsh.cmd web --no-open
+```
+
+Each build cache key includes the full commit, Node version/platform/architecture/ABI, upstream pnpm declaration, registry and inherited `DSH_CLIENT_*` / `DSH_BUILD_*` environment. A successful build is marked only after its CLI version check succeeds. Unchanged inputs reuse that build; failed builds have no completion marker and are retried. Tracked changes or a different HEAD in a completed checkout stop startup instead of overwriting edits. An interrupted initial checkout can be recreated on the next run.
+
+A failed fetch warns and uses the last fetched commit if available; it never labels that fallback as current upstream HEAD. A failed install or build stops startup instead of silently launching an older successful revision. The launcher holds an exclusive OS file lock through Host shutdown, so another launch using the same cache fails clearly. The lock releases when the process exits; the remaining `source.lock` file is harmless and should not be removed to bypass a running process.
+
+Cleanup retains the configured number of build snapshots and plugin tarballs (three by default), including the selected ones. Locked cleanup targets warn and are retried later. Git objects, exact pnpm runtimes and the shared pnpm store are retained to speed later revisions; their size is not bounded by the snapshot count. With this source launcher stopped, delete `upstream\builds` to force fresh builds while retaining downloads; remove `upstream\pnpm-store` as well to reclaim the shared download cache. The generated CMD shims use launcher-process environment variables to preserve Unicode paths and are not standalone entry points. Do not delete `upstream\dsh-home` unless you intend to remove this test environment's settings and sessions.
+
+This is an opt-in upstream test environment. Published-release compatibility remains the plugin's supported delivery target.
+
 ## DSH Desktop
 
 On Windows or macOS, choose **Open DSH Terminal** from the Desktop tray. Bare commands in that terminal target the active profile:
@@ -106,7 +124,7 @@ dsh plugin add github:muyuanjin/dsh-ptc-plus#main
 dsh --dump-config
 ```
 
-After an npm release, the package spec may instead be `dsh-ptc-plus@0.4.3`. For a local package, use its absolute tarball path. Restart DSH Desktop after installation. Linux Desktop is not a current DSH Desktop release target; use DSH CLI/Web on Linux.
+After an npm release, the package spec may instead be `dsh-ptc-plus@0.4.8`. For a local package, use its absolute tarball path. Restart DSH Desktop after installation. Linux Desktop is not a current DSH Desktop release target; use DSH CLI/Web on Linux.
 
 ## Upgrades
 

package/docs/publishing.md

@@ -20,7 +20,7 @@
 
 npm 发布遵循 [ADR 0022](adr/0022-stage-npm-releases-with-oidc.md)，使用 `.github/workflows/release.yml` 声明的 Trusted Publisher，不向 GitHub 保存 npm write token。npm package settings 必须把 publisher 精确绑定到 `muyuanjin/dsh-ptc-plus`、workflow filename `release.yml` 和 environment `npm-release`，且只允许 `npm stage publish`。Publishing access 选择页面中最严格且标记为 recommended 的 2FA 选项；npm 文档称其为 `Require two-factor authentication and disallow tokens`，当前 npm 页面也可能显示 `Require two-factor authentication and disallow bypass 2fa tokens (recommended)`。不要从滚动变化的标签推断账户中已不存在传统 token。OIDC 只把经过验证的 tarball 放入 npm staging，维护者仍须在 npm CLI 或 npmjs.com 检查 staged package 并以 2FA approve，包才会进入公开 registry。
 
-普通 `CI` 只响应 `main` push 与 pull request。发布前创建 annotated `v<package.version>` tag，原子推送 release commit 与 tag，等待该 commit 的 `CI` 成功，然后以该 tag 作为 ref 显式运行 `Release` workflow。workflow 不接受另一个 tag input，并会重新证明 dispatch 的 `GITHUB_REF`、`GITHUB_SHA`、annotated tag target、checkout HEAD、manifest 版本和成功 CI 的 SHA 完全一致；release job 使用 GitHub-hosted Node `24.15.0`、npm `12.0.2`、无 package-manager cache 和最小 `id-token: write` 权限，构建一个 tarball、执行 clean-consumer smoke，再对同一文件执行 `npm stage publish`。`package.json#allowScripts` 显式拒绝当前不需要的 `esbuild` install script；`replace-registry-host=always` 让 release install 将 lockfile 中的 registry tarball 路由到显式 npm 官方 registry，而不放宽 npm 12 的 Git/remote dependency 默认拒绝。
+普通 `CI` 只在 `main` push 或 pull request 包含非纯文档变更时运行：只改动 `**.md`、`assets/**` 或 `LICENSE` 的提交不触发矩阵。发布 commit 因包含 `package.json` 与 `package-lock.json` 变更必然产生一次 `main` push run，Release workflow 仍要求该 commit 有成功的 run 才继续。发布前创建 annotated `v<package.version>` tag，原子推送 release commit 与 tag，等待该 commit 的 `CI` 成功，然后以该 tag 作为 ref 显式运行 `Release` workflow。workflow 不接受另一个 tag input，并会重新证明 dispatch 的 `GITHUB_REF`、`GITHUB_SHA`、annotated tag target、checkout HEAD、manifest 版本和成功 CI 的 SHA 完全一致；release job 使用 GitHub-hosted Node `24.15.0`、npm `12.0.2`、无 package-manager cache 和最小 `id-token: write` 权限，构建一个 tarball、执行 clean-consumer smoke，再对同一文件执行 `npm stage publish`。`package.json#allowScripts` 显式拒绝当前不需要的 `esbuild` install script；`replace-registry-host=always` 让 release install 将 lockfile 中的 registry tarball 路由到显式 npm 官方 registry，而不放宽 npm 12 的 Git/remote dependency 默认拒绝。
 
 ```powershell
 git tag -a "v$((Get-Content package.json | ConvertFrom-Json).version)" -m "v$((Get-Content package.json | ConvertFrom-Json).version)"
@@ -42,13 +42,13 @@ npm.cmd stage approve '<stage-id>' --registry=https://registry.npmjs.org/
 
 ## Release checklist
 
-1. 在 Linux Node `22.19.0`、24.x 与 26.x，以及 Windows 与 macOS Node 24.x 上运行 `npm ci`、`npm run build:check` 和 `npm run check`。仓库 CI 定义同一矩阵。
-2. 运行 `npm audit`、`npx publint`、`git diff --check`、Markdown local-link check 和 `npm pack --silent --dry-run --json`。确认 tarball 只包含发布白名单内的运行时代码、文档和展示资产，不含凭据、本地路径、开发脚本或测试夹具，并从 tarball 安装到空目录执行 ESM import smoke。机器读取 `npm pack --json` 时保持 `--silent`，避免 lifecycle 输出混入 JSON stream。
+1. 提交前在稳定工作树上运行完整 `npm run check`，生成 coverage 与 review proof。仓库 CI 在 Linux Node `22.19.0`、24.x、26.x，以及 Windows 与 macOS Node 24.x 的干净安装上运行 `npm run verify:ci`，检查构建、Client 与跨平台关键运行契约；Ubuntu Node 24.x 另运行打包后的 `latest` / `next` Host contracts。CI 不重复收集 coverage 或执行穷尽式后端套件。
+2. 运行 `npm audit --omit=dev`、`npx publint`、`git diff --check`、Markdown local-link check 和 `npm pack --silent --dry-run --json`。audit 检查随包安装的 production 依赖图；宿主 DSH 及其开发依赖不进入插件 tarball，由冻结宿主契约和 CI 单独验证。确认 tarball 只包含发布白名单内的运行时代码、文档和展示资产，不含凭据、本地路径、开发脚本或测试夹具，并从 tarball 安装到空目录执行 ESM import smoke。机器读取 `npm pack --json` 时保持 `--silent`，避免 lifecycle 输出混入 JSON stream。
 3. 更新到最新可用 DSH release 并记录 `dsh --version`。分别从 npm 包、固定 Git commit、源码 checkout 和 tarball 安装到临时 profile，再执行 `dsh --profile <profile> --dump-config`，确认只新增 `ptc-plus` row。每个上游 release 都重新验证公共扩展面、CLI/Web 集成和 profile 装配，不设置版本白名单。
 4. 在 Windows 与 Linux 运行无模型调用的 `npm run test:client:web -- --dsh-entry <latest-installed-dsh/lib/bin.js>`，验证 tarball 安装后的真实 Web Client、设置与对话 surface；浏览器前置条件见 [安装指南](installation.md)。`build:check`、Host ESM import 和 factory smoke 均不能替代浏览器激活验收。macOS 由原生 runner 验证 CLI/Web；Windows 与 macOS Desktop 从托盘打开当前 profile 的 DSH Terminal 安装，重启 Desktop 后做一次 PTC 模式 smoke。Desktop 当前发布平台不包括 Linux。
 5. 只有在明确授权模型消耗后才运行 `npm run test:expensive` 与 `npm run test:ab`。发布结论以结构化测试结果为准，不把一次模型样本推广为普遍保证。
 6. 确认 npm 包名可用、待发布版本高于 registry 版本、README 截图来自真实 DSH 会话，并核对 repository、homepage、bugs、license 与 `dsh-plugin` topic。
-7. 最后检查 `npm pack --silent --json` 的名称、版本、大小与文件列表，创建 annotated release tag，并确认 tag commit 已通过 `CI`。运行 `Release` workflow 将同一源码产生的 tarball送入 npm staging；人工检查并以 2FA approve 后，等待 registry 扫描完成，再创建 GitHub Release。
+7. 最后检查 `npm pack --silent --json` 的名称、版本、大小与文件列表，创建 annotated release tag，并确认 tag commit 已通过 `CI`。运行 `Release` workflow 将同一源码产生的 tarball送入 npm staging；人工检查并以 2FA approve 后，等待 registry 扫描完成，再创建 GitHub Release。Release notes 的内容取舍与风格由 [release-notes.md](release-notes.md) 拥有。
 
 远程仓库、registry、签名凭据、目标平台运行状态和模型额度都属于发布时事实，不能由本地 manifest 推断。
 

package/docs/release-notes.md

@@ -0,0 +1,109 @@
+# GitHub Release Notes
+
+本文件拥有每个 GitHub Release 的**内容取舍与写作风格**。发布流程（tag、CI 身份校验、npm staging、2FA approve）由 [publishing.md](publishing.md) 拥有；包内容由 manifest 与发布白名单拥有；面向用户的长期说明由 [README.md](../README.md) 与 [README.en.md](../README.en.md) 拥有。写 notes 时按本文件执行，不需要回看历史 Release。
+
+## 读者与边界
+
+读者是使用插件的用户。notes 只写他们需要知道的产品事实：能不能装、能不能跑、行为变了什么、坏掉的东西修好了什么、升级要做什么。
+
+不写产物的生成过程：
+
+- 不写写作时间或发行状态（“写作时”“目前”“本文完成于”）；需要指明目标发行时直接写版本号
+- 不写验证与取证过程（谁在哪个客户端上核对过、跑过哪些命令、门禁结果）
+- 不写内部实现与流程术语（内部模块名、实现步骤、评审与 CI 与发布自动化）
+- 不写协商过程与修正记录（“按反馈”“不再使用某说法”）
+
+验证证据留在交付记录里（CI run、发布日志、维护文档），不进入 notes。
+
+## 先按用户视角计算重要性
+
+从 `git log --format='%h %s%n%b' <上一个 tag>..<本次 tag>` 收集全部变更，按用户的遭遇排序后再提炼；提交顺序、提交类型（feat/fix/docs/chore）和改动行数都不参与排序。
+
+1. **还能不能用**：对当前官方 DSH 发布与上一代宿主契约的适配、安装与升级路径、激活与启动。用户最先问的是“装上还能不能跑”，排第一。
+2. **有什么变化**：新增能力、默认值变化、既有行为改变，以及需要用户动手的迁移。
+3. **哪些毛病没了**：用户可观察到的错误、闪烁、失效入口、丢失的数据关系。
+4. **升级要求**：Node 版本、是否需要重启、是否有配置迁移。
+5. **内部交付**默认不出现；只有当它改变用户可见结果时，才用用户能理解的方式提及。
+
+兼容性声明落在公共扩展面上——设置座位、slot、公共 `Menu` 区域、会话投影、能力探测。版本号只用于标明本次适配的目标发行，不构成版本白名单；能力与座位仍以宿主声明的公共扩展面为准（[ADR 0017](adr/0017-track-the-latest-dsh-public-surface.md)）。
+
+## 风格
+
+- 双语且等价：中文在前，`---` 之后是 English；两段不互相省略，小节顺序一致。小节标题用 `<h3>`，中文 anchor 用 `cn-v0XY`，英文用 `en-v0XY`。
+- 一条 bullet 只写一个用户可观察的结果；写清触发条件与边界（何时生效、何时不做、是否自动执行）。
+- 用用户能观察到的对象描述变化：绑定、星光菜单、设置卡片、状态提示、cell 执行。宿主声明的座位键名（如 `plugins.row.config`）保留，内部模块名和实现步骤不写。
+- 不写营销形容词，也不承诺恢复能力、永久记忆等无法保证的结果。
+- 结构稳定，便于读者按标题 diff 两个版本：宿主适配 → 新增 → 修复 → 升级（含安装命令）→ `Full Changelog` compare 链接。
+
+## 模板
+
+````markdown
+[中文](#cn-v0XY) | [English](#en-v0XY)
+
+<h3 id="cn-v0XY">宿主适配</h3>
+
+* 本次适配的目标 DSH 发行与它使用的公共扩展面
+* 不满足该契约的宿主如何继续工作
+
+<h3>新增</h3>
+
+* ……
+
+<h3>修复</h3>
+
+* ……
+
+<h3>升级</h3>
+
+* 需要 Node.js `^22.19.0 || >=24.0.0`；升级插件后请重启 DSH
+* 是否有配置迁移，以及旧配置的表现
+
+```sh
+dsh plugin --profile <profile> add dsh-ptc-plus@<version>
+```
+
+---
+
+<h3 id="en-v0XY">Host Compatibility</h3>
+
+* ……
+
+<h3>New Features</h3>
+
+* ……
+
+<h3>Fixes</h3>
+
+* ……
+
+<h3>Upgrade</h3>
+
+* Requires Node.js `^22.19.0 || >=24.0.0`; restart DSH after upgrading the plugin
+
+```sh
+dsh plugin --profile <profile> add dsh-ptc-plus@<version>
+```
+
+---
+
+Full Changelog: https://github.com/muyuanjin/dsh-ptc-plus/compare/<上一个 tag>...<本次 tag>
+````
+
+## 示例（v0.4.3 的宿主适配小节）
+
+````markdown
+<h3 id="cn-v043">宿主适配</h3>
+
+* 适配 DSH 0.1.7 的公共扩展面：设置卡片注册到宿主的插件配置座位（侧栏 **插件 → 已安装** 的 `plugins.row.config`），星光入口的四个动作进入公共 `Menu` 的 `children` 区域
+* 不渲染 `children` 的宿主同样可用：同一套插件自有动作区由 pinned 区域承载，上一代设置座位 `settings.plugin.item` 继续生效
+* 兼容性由公共能力探测决定：探测只记录一次已挂载观测，支持 `children` 的宿主不会重复渲染
+````
+
+同一版的 `feat(review)`、`chore(release)` 等内部提交不进入 notes；测试夹具修复属于交付记录，不作为用户条目。
+
+## 发布时的用法
+
+1. 取全量变更：`git log --format='%h %s%n%b' <上一个 tag>..<本次 tag>`。
+2. 按用户视角排序，决定每条要不要写、写在哪个小节。
+3. 逐条确认陈述在产品里成立；无法确认的条目删除。
+4. 按模板写完；npm 版本可安装后创建 GitHub Release（流程见 [publishing.md](publishing.md)）。

package/docs/runtime-reference.md

@@ -20,6 +20,8 @@ For PTC mode requests using the code-only direct-tool projection, PTC Plus prese
 
 `edit_run_code` is a real registered tool call. Session history and later model requests retain its original name and delta arguments. The plugin executes the materialized source as a host-derived `run_code`, returns only the edit status, value, and logs to the model, and keeps the complete source plus journal in private replay metadata. It does not rewrite assistant history or emit edit-specific runtime context.
 
+One provider failure has a bounded transport recovery. When the provider reports the exact invalid-tool-JSON `MALFORMED_RESPONSE` as a terminal chunk or stream exception, PTC Plus changes that terminal reason to `tool-calls`; this error cannot terminate the whole turn. DSH already preserves an unparseable argument string and routes it through ordinary validation, tool execution/result recording, and the next model step. A response is trusted for call preservation only when its buffered body consists entirely of tool-call-specific framing plus at most one `usage` event. If such a response contains exactly one internally consistent declared `run_code` or `edit_run_code` block, PTC Plus also tests deletion of one final `}`. It applies that correction only when the resulting value is an object accepted by the live direct-tool schema. The call keeps its index, identity, and name and proceeds through ordinary DSH validation, recording, scheduling, authority, and execution. Without a unique correction, trusted internally consistent complete blocks retain their original identity and argument bytes for the ordinary rejected-tool-result path; PTC Plus re-emits canonical start/delta/end framing so every tolerated provider variant passes DSH's stream invariant. If a tool block is incomplete or inconsistent, none was emitted, multiple usage events appear, or any other event occurs in the buffered body, PTC Plus closes any already visible text or reasoning block from its accumulated content, removes buffered unsafe block material, and emits one deterministic `run_code` call whose argument string cannot parse as a JSON object. DSH rejects it during ordinary schema validation, so no partial model call executes and the model still receives another step. Valid streams and other provider failures retain their original result. This is not a general JSON repair mechanism.
+
 When a live parse error occurs exactly at the cell EOF, PTC Plus checks all 12 suffixes of one or two closing tokens drawn from `}`, `)`, and `]` with the same preparation context. If exactly one correction succeeds, the existing editor can express it from a bounded unique suffix, and the rejected call has a persistent event identity, `PTC-C001` includes a directly callable `edit_run_code({ edits: [...], expected_target_call_seq })` invocation. The guard must match the target captured when the edit call is persisted, so a later editable cell suppresses execution even when the same literal replacement would match it. The plugin does not apply or execute the correction automatically; ambiguous, broader, and unbound repairs keep the ordinary length-adaptive guidance.
 
 Use `return` for an explicit result and the native Node `console` surface for logs. Its formatting methods, including `dir` options, tables, counters, groups, timers, assertions, and traces, retain Node semantics. `process.stdout/stderr.write`, direct fd 1/2 writes and inherited child stdio are also captured. Console entries retain call order and each descriptor pipe retains byte order; the merged log does not claim a total chronology across stdout, stderr and the private control channel. All forms share the cell's aggregate output budget. Native expression completion can also supply a result value:
@@ -61,6 +63,8 @@ The configuration uses `ptc-plus` as the DSH plugin ID and `dsh-ptc-plus` as the
 
 `autoDescribeRunCode` defaults to `true` and appears as “Allow run_code execution without a summary.” When enabled, a call that omits the outer `run_code.description` uses derived arguments for local DSH validation, and the fallback summary enters presentation metadata only. When disabled, DSH validates the original arguments. Both states expose byte-identical model requests with the required `description` declaration; original call arguments, existing summaries, cell source, and nested native-tool JSON remain unchanged.
 
+Missing-description diagnostics append a complete DSH user message to `additionalContexts`, with an identity, text content and a `plugin:ptc-plus` notice source. The diagnostic distinguishes outer transport arguments from nested native-tool arguments and preserves existing additional messages. These notices are ordinary inbox messages, separate from recovery-tip escalation and state snapshots. This prevents new malformed diagnostic records; it does not repair session files already written by older plugin versions.
+
 ```yaml
 - id: ptc-plus
   name: dsh-ptc-plus
@@ -91,7 +95,9 @@ The five legacy binding and module switches remain migration inputs. Complete en
 
 `enabled: false` is the settings-based kill switch: the Host keeps the settings namespace, client card, and passive cleanup that can withdraw old PTC declarations at the next permitted accepted step. It removes execution hooks, prompt sections, and tool surfaces without reading binding storage. Every setting is applied live when its owner can reconcile it. A submitted cell retains one configuration snapshot through preflight, execution, binding calls, completion validation, and diagnostics; an update accepted while it runs applies to cells submitted afterward. Node fixes a worker's V8 old-generation limit at creation, so changing `maxOldGenerationSizeMb` while a session worker is active is rejected and rolled back rather than reported as applied. Other non-`enabled` updates reconfigure existing owners without replacing session-bound bindings. The settings card renders in whichever settings seat the installed DSH declares — the sidebar **Plugins → Installed** page per-bundle configuration (`plugins.row.config`), or the preceding Host's **Settings → Plugin configuration** card (`settings.plugin.item`) ([ADR 0019](adr/0019-plugin-settings-and-kill-switch.md)) — shows “已启用” or “已停用”, and disables every control except `enabled` while the plugin is off. The card does not register in General settings; the sparkle menu opens the same complete form in an application dialog. If a live enable or reconfiguration cannot install a complete runtime, PTC Plus unwinds or restores every owner and persists the last applied settings; a failed compensating settings write is surfaced as an activation diagnostic. The TypeScript language check is deferred until runtime activation, so a non-TypeScript host can load the plugin in disabled mode but cannot enable it.
 
-`cordisToolsEnabled: true` atomically mounts the official `@deepseek-ai/dsh-tool-cordis` plugin and exactly the shipped `cordis-plugin-development` companion Skill in agent scopes that expose the `run_code` and `skill` tools plus the public preset and Skill services. PTC Plus resolves the official `cordis` preset through DSH's public preset service, lets the maintained filesystem provider own its Skill root, and filters that provider at the public registration boundary so sibling Skills are never published to the PTC scope. It does not copy the Skill or switch the agent's preset. The first request waits until the Cordis tool fiber, owner guidance, exact Skill provider, and scoped Skill load are all ready. An agent scope that omits one of those surfaces is left for later: the owner publishes nothing there, reports nothing, and retries when the tool surface changes or the next prompt is assembled. A scope whose exposed preset, Skill/tool service, declared Cordis service, inspect manifest, or activation contradicts the host contract fails the setting change at installation and removes every provisional contribution; reached through the host's own `agent/created` or assemble call it withdraws from that scope with one warning instead, so this plugin's unavailability never fails an agent another plugin created ([ADR 0029](adr/0029-keep-plugin-unavailability-out-of-the-host-agent-lifecycle.md)). Disable and agent/runtime disposal remove both fibers. Native agents inherit neither the resulting `tools.*` members nor the Skill, and the code-only direct-tool projection remains `[run_code, edit_run_code]`. Cordis can evaluate model-written plugins against the live runtime, so enabling it grants shell-equivalent trust.
+`cordisToolsEnabled: true` atomically mounts the official `@deepseek-ai/dsh-tool-cordis` plugin and exactly the shipped `cordis-plugin-development` companion Skill in agent scopes that expose the `run_code` and `skill` tools plus the public preset and Skill services. PTC Plus resolves the official `cordis` preset through DSH's public preset service, lets the maintained filesystem provider read its Skill root as an immutable bundled Host resource, and filters that provider at the public registration boundary so sibling Skills are never published to the PTC scope. It does not copy the Skill or switch the agent's preset. The first request waits until the Cordis tool fiber, owner guidance, exact Skill provider, and scoped Skill load are all ready. An agent scope that omits one of those surfaces is left for later: the owner publishes nothing there, reports nothing, and retries when the tool surface changes or the next prompt is assembled. A scope whose exposed preset, Skill/tool service, declared Cordis service, inspect manifest, or activation contradicts the host contract fails the setting change at installation and removes every provisional contribution; reached through the host's own `agent/created` or assemble call it withdraws from that scope with one warning instead, so this plugin's unavailability never fails an agent another plugin created ([ADR 0029](adr/0029-keep-plugin-unavailability-out-of-the-host-agent-lifecycle.md)). Disable and agent/runtime disposal remove both fibers. Native agents inherit neither the resulting `tools.*` members nor the Skill, and the code-only direct-tool projection remains `[run_code, edit_run_code]`. Cordis can evaluate model-written plugins against the live runtime, so enabling it grants shell-equivalent trust.
+
+The Skill root uses the preset's absolute composition path when that generation publishes one. A pathless generation is resolved through the active Host's public `pluginPackages.packageOf` service, which returns the official singular or plural preset package from that installation rather than an ambient package reachable from the plugin profile. An older generation with no such service may resolve only its historical plural package relative to the Host's `ctx.baseUrl`; the fallback is disabled whenever `pluginPackages` exists. The exact `cordis-plugin-development/SKILL.md` must exist before the mount begins. An invalid published path remains authoritative and fails instead of falling through to another generation's package layout.
 
 Keep large Cordis host or client source in a top-level binding before calling a Cordis tool. If that call rejects while the worker stays live, an initialized binding can be reused in a short continuation. Decide whether to retry from the operation owner's retry/idempotence contract and available execution facts; a thrown call or a smaller cell does not prove that no effect occurred.
 

package/docs/verification.md

@@ -41,6 +41,10 @@ The final verdict uses `dsh-review-verdict/v2`. Pre-commit verifies its plan has
 
 `npm run verify` and `npm run check` validate the ledger, compare generated bundles, check syntax, run Client tests, and run all backend tests with coverage. Backend test files run in separate Node processes. The default process count is half the available CPUs, rounded down and bounded between one and four; each process can also own runtime Workers. Tests within each file retain their existing ordering. Coverage still requires 100% lines and functions and at least 95% branches, including compiler source remapping. The graded merge additionally asserts that the plugin-source closure it claims — `index.js` and every `internal/*.js` owner — appears in the merged report, so a module no instrumented process loads fails the gate instead of silently leaving it. Generated artifacts stay outside that closure: the root `compiler-*.cjs` bundles and the `internal/*.cjs` shims are remapped onto their original `internal/` sources or verified by the bundle checks, and `scripts/migrate-session-log.mjs` is verified by its own migration suite.
 
+Coverage, the exhaustive backend suite, and the review-bound proof belong to the local pre-commit `npm run check`. CI starts from a clean lockfile install and runs `verify:ci` on every supported Node and operating-system entry: frozen-baseline validation, semantic ownership, generated builds, Client tests, and focused runtime contracts covering compiler startup, helper-process lifecycle, plugin takeover, native-call transport, and durable argument diagnostics. Ubuntu Node 24 additionally exercises the packed plugin against both frozen official `latest` and `next` DSH graphs. CI therefore proves portable installation and runtime integration without repeating coverage or the exhaustive semantic suite on hosted runners.
+
+`host:baseline:verify`, which is part of deterministic verification, is offline. It requires the installed root DSH `next` cohort to match `package-lock.json` and validates the tracked `compat/latest` declaration and lock without installing it. CI separately runs `test:host-contract`: the root graph exercises `next`, while a temporary consumer created from `compat/latest/package-lock.json` exercises `latest` against the packed plugin. Registry tag lookup and lock regeneration belong only to `host:baseline:update` and the scheduled baseline-refresh workflow. That workflow publishes a changed frozen candidate as a pull request and explicitly dispatches this CI workflow once because its `GITHUB_TOKEN`-authored events cannot start another run; ordinary gates never install a floating channel.
+
 Use focused coverage while developing or after a full gate identifies a narrow coverage failure. Select every source whose threshold matters and the smallest test set that can distinguish the correction:
 
 ```bash
@@ -73,7 +77,7 @@ Coverage runs additionally set `DSH_PTC_TEST_WORKER_COVERAGE=1` and load `script
 
 `npm run coverage` and `npm run coverage:focus` print their current stage and total elapsed time. Each invocation collects worker coverage in its own temporary directory under `coverage/`, removed after c8 finishes reporting, so simultaneous runs cannot erase or combine each other's evidence. The default report is printed to the terminal. A separate `coverage/run-*.tap` log retains Node's test diagnostics, including process exit codes and signals that the concise terminal reporter can omit. An explicit Node test reporter option replaces these default reporters. Source changes during verification still invalidate a `check` proof; separate coverage directories do not make concurrent source edits safe.
 
-Windows Node 24 and 26 reproductions and stacks identify a cppgc finalizer (`node::contextify::ContextifyScript`, or `ContextifyContext` when coverage was enabled) running after the environment that owned its private realm was gone, which wrote through a dangling `node::Realm` during isolate teardown. The reproduction ended the whole DSH process when an in-host session worker was terminated; macOS runners also observed whole-file aborts under coverage, but the available evidence does not establish that those aborts came from the same Windows stack or that the same cause applies across platforms. The session kernel now runs in a plugin-owned helper process (`internal/kernel-child.js`); `IsolatedWorker` sends a cooperative shutdown and, if the helper does not leave within its bound, kills only that helper. DSH is no longer the worker-teardown target on any supported host, so a wedged kernel is contained as a helper failure rather than a host-native crash. `.github/workflows/ci.yml` sets `DSH_PTC_TEST_CONCURRENCY: 1` and runs `npm run check` once; the former file-level retry wrapper is gone, and any failing test or file-level abort fails that run. This boundary removes the plugin's in-host kill exposure; it neither repairs the upstream Node path nor proves the macOS abort shared the Windows cause.
+Windows Node 24 and 26 reproductions and stacks identify a cppgc finalizer (`node::contextify::ContextifyScript`, or `ContextifyContext` when coverage was enabled) running after the environment that owned its private realm was gone, which wrote through a dangling `node::Realm` during isolate teardown. The reproduction ended the whole DSH process when an in-host session worker was terminated; macOS runners also observed whole-file aborts under coverage, but the available evidence does not establish that those aborts came from the same Windows stack or that the same cause applies across platforms. The session kernel now runs in a plugin-owned helper process (`internal/kernel-child.js`); `IsolatedWorker` sends a cooperative shutdown and, if the helper does not leave within its bound, kills only that helper. DSH is no longer the worker-teardown target on any supported host, so a wedged kernel is contained as a helper failure rather than a host-native crash. The former file-level retry wrapper is gone, and any failing CI smoke or local exhaustive test fails its run. This boundary removes the plugin's in-host kill exposure; it neither repairs the upstream Node path nor proves the macOS abort shared the Windows cause.
 
 Native oracle workers and external Windows command fixtures explicitly disable inherited `NODE_V8_COVERAGE`; they execute no code included by the plugin coverage gate. Subprocesses testing plugin implementations still collect coverage. PowerShell semantic-version observations share one invocation, and Windows registry fixtures read the three effective registry values with one real npm configuration query. Each retains its original inputs and assertions.
 

package/internal/cordis-tools-owner.js

@@ -1,5 +1,7 @@
 import * as CordisTools from '@deepseek-ai/dsh-tool-cordis'
 import * as CordisSkillFilesystem from '@deepseek-ai/dsh-skill-filesystem'
+import { existsSync } from 'node:fs'
+import { createRequire } from 'node:module'
 import { dirname, isAbsolute, join } from 'node:path'
 import { isDeepStrictEqual } from 'node:util'
 import { RUN_CODE } from './runtime-bridge-owner.js'
@@ -8,6 +10,16 @@ const CORDIS_PRESET_ID = 'cordis'
 const CORDIS_SKILL_NAME = 'cordis-plugin-development'
 const CORDIS_SKILL_PROVIDER = 'ptc-plus-cordis'
 const COMPANION_SKILL_TOOL = 'skill'
+const COMPANION_PACKAGE_LAYOUTS = Object.freeze([
+  Object.freeze({
+    name: '@deepseek-ai/dsh-agent-preset',
+    skillRoot: directory => join(directory, 'skills'),
+  }),
+  Object.freeze({
+    name: '@deepseek-ai/dsh-agent-presets',
+    skillRoot: directory => join(directory, 'presets', CORDIS_PRESET_ID, 'skills'),
+  }),
+])
 
 function exactCompanionCandidates(observation) {
   if (Array.isArray(observation)) {
@@ -131,25 +143,51 @@ function requireCompanionServices(agent) {
   return { agentPresets, skills }
 }
 
-async function companionSkillDirectory(agentPresets) {
+function containsCompanionSkill(directory, fileExists) {
+  return fileExists(join(directory, CORDIS_SKILL_NAME, 'SKILL.md'))
+}
+
+/** Resolve the official Cordis companion Skill across DSH preset generations. */
+export async function resolveCompanionSkillDirectory(agentPresets, options = {}) {
+  const fileExists = options.fileExists ?? existsSync
   const preset = await agentPresets.resolve(CORDIS_PRESET_ID)
-  if (typeof preset.broken === 'string' && preset.broken.length > 0) {
+  if (typeof preset?.broken === 'string' && preset.broken.length > 0) {
     throw new Error(`ptc-plus: DSH cordis preset is unavailable: ${preset.broken}`)
   }
-  // The generations that discover presets from their composition directories
-  // publish an absolute path, and the preset's sibling `skills` directory is
-  // then the companion Skill root. A generation that declares presets without
-  // any composition path publishes no root through this surface at all, so the
-  // report names that missing publication instead of claiming a shape failure
-  // on a healthy host. A published path that is not absolute is still a
-  // contract contradiction.
-  if (preset?.path === undefined) {
-    throw new Error('ptc-plus: the installed DSH agentPresets generation publishes no composition path for the "cordis" preset, so it does not publish the companion Skill root that cordisToolsEnabled mounts')
+  if (preset?.path !== undefined) {
+    if (typeof preset.path !== 'string' || !isAbsolute(preset.path)) {
+      throw new Error('ptc-plus: DSH cordis preset did not expose an absolute composition path')
+    }
+    const directory = join(dirname(preset.path), 'skills')
+    if (!containsCompanionSkill(directory, fileExists)) {
+      throw new Error(`ptc-plus: DSH cordis preset does not contain ${CORDIS_SKILL_NAME}/SKILL.md beside its composition`)
+    }
+    return directory
   }
-  if (typeof preset.path !== 'string' || !isAbsolute(preset.path)) {
-    throw new Error('ptc-plus: DSH cordis preset did not expose an absolute composition path')
+
+  for (const layout of COMPANION_PACKAGE_LAYOUTS) {
+    const pkg = options.packageOf?.(layout.name, options.packageBaseUrl)
+    if (pkg === undefined) continue
+    if (pkg?.name !== layout.name || typeof pkg.dir !== 'string' || !isAbsolute(pkg.dir)) {
+      throw new Error(`ptc-plus: DSH pluginPackages returned an invalid ${layout.name} package resource`)
+    }
+    const directory = layout.skillRoot(pkg.dir)
+    if (containsCompanionSkill(directory, fileExists)) return directory
   }
-  return join(dirname(preset.path), 'skills')
+
+  if (options.packageOf === undefined && options.resolveLegacyPackageManifest !== undefined) {
+    let manifest
+    try {
+      manifest = options.resolveLegacyPackageManifest('@deepseek-ai/dsh-agent-presets/package.json')
+    } catch (error) {
+      if (error?.code !== 'MODULE_NOT_FOUND' && error?.code !== 'ERR_PACKAGE_PATH_NOT_EXPORTED') throw error
+    }
+    if (manifest !== undefined) {
+      const directory = join(dirname(manifest), 'presets', CORDIS_PRESET_ID, 'skills')
+      if (containsCompanionSkill(directory, fileExists)) return directory
+    }
+  }
+  throw new Error(`ptc-plus: the active DSH installation does not publish a loadable ${CORDIS_SKILL_NAME} companion Skill through its package-resolution surface`)
 }
 
 async function requireCompanionSkill(agent, skills) {
@@ -270,6 +308,7 @@ export function createCordisToolsOwner(
   ctx,
   cordisPlugin = CordisTools,
   skillFilesystemPlugin = CordisSkillFilesystem,
+  companionResolution = undefined,
 ) {
   if (typeof ctx?.agents?.list !== 'function') {
     throw new Error('ptc-plus: cordisToolsEnabled requires the DSH agents.list API')
@@ -281,6 +320,22 @@ export function createCordisToolsOwner(
   const cordisInspectLeases = createCordisInspectLeases(ctx)
   const scopedCordisPlugin = cordisInspectLeases.plugin(cordisPlugin)
   const scopedSkillPlugin = exactCompanionSkillPlugin(skillFilesystemPlugin)
+  const pluginPackages = ctx.get?.('pluginPackages')
+  const packageBaseUrl = ctx.baseUrl
+  const skillResolution = companionResolution ?? {
+    packageOf: pluginPackages === undefined
+      ? undefined
+      : (name, parentURL) => {
+          if (typeof pluginPackages?.packageOf !== 'function') {
+            throw new Error('ptc-plus: cordisToolsEnabled requires the DSH pluginPackages.packageOf API')
+          }
+          return pluginPackages.packageOf(name, parentURL)
+        },
+    packageBaseUrl,
+    resolveLegacyPackageManifest: pluginPackages === undefined && typeof packageBaseUrl === 'string'
+      ? specifier => createRequire(packageBaseUrl).resolve(specifier)
+      : undefined,
+  }
   let disposed = false
 
   const leafErrors = error => error instanceof AggregateError
@@ -364,13 +419,14 @@ export function createCordisToolsOwner(
     mounts.set(agent, mount)
     mount.activation = Promise.resolve().then(async () => {
       const { agentPresets, skills } = requireCompanionServices(agent)
-      const skillDirectory = await companionSkillDirectory(agentPresets)
+      const skillDirectory = await resolveCompanionSkillDirectory(agentPresets, skillResolution)
       if (mount.disposed) return
 
       const skillFiber = agent.ctx.plugin(scopedSkillPlugin, {
         providerName: CORDIS_SKILL_PROVIDER,
         includeDefaultRoots: false,
-        customSkillDirs: [skillDirectory],
+        bundledSkillDir: skillDirectory,
+        watch: false,
       })
       if (typeof skillFiber?.dispose !== 'function') {
         throw new Error('ptc-plus: DSH Context.plugin did not return a disposable Cordis Skill fiber')

package/internal/direct-surface-owner.js

@@ -1,4 +1,7 @@
 /** Own PTC direct presentation, prompt projection, and stream normalization. */
+import { boundContextSummary, createUserMessage } from '@deepseek-ai/dsh-llm'
+import { validateJsonSchemaValue } from '@deepseek-ai/dsh-tools'
+import { PTC_MESSAGE_SOURCE_KIND } from './message-sources.js'
 import { canonicalizeToolCallStream } from './tool-call-canonicalizer.js'
 import { editRunCodeSchema } from './rejected-cell-editor.js'
 import { sessionRuntimeContexts } from './runtime-contexts.js'
@@ -19,6 +22,12 @@ const RUN_CODE_CODE_DESCRIPTION = 'Code for the next REPL cell, parsed as the bo
 const RUN_CODE_DESCRIPTION_DESCRIPTION = 'Short active-voice summary of what this cell does, 5-10 words (shown in the UI).'
 const CODE_TRANSPORT_INSTRUCTION = '`run_code` and `edit_run_code` are the only tools callable directly. Call every native tool declared by the SDK from inside a program.'
 const PTC_COLLAPSE_SECTION_NAMES = Object.freeze(['tools:ptc-only', 'tools:code-only'])
+const INVALID_TOOL_JSON_FAILURE = Object.freeze({
+  code: 'MALFORMED_RESPONSE',
+  message: 'DeepSeek Messages stream: tool input is invalid JSON',
+})
+const MALFORMED_TOOL_REJECTION_ID = 'dsh-ptc-plus-malformed-tool-json'
+const MALFORMED_TOOL_REJECTION_ARGUMENTS = '{"dsh_ptc_plus_malformed_tool_json":'
 
 function adaptRunCodeSchema(tool) {
   const parameters = tool.parameters
@@ -139,6 +148,314 @@ async function* bindCallPolicies(source, policy, calls) {
   }
 }
 
+function invalidToolJsonFinish(chunk) {
+  const failure = chunk?.reason?.failure
+  return chunk?.type === 'finish'
+    && chunk.reason.kind === 'error'
+    && failure?.code === INVALID_TOOL_JSON_FAILURE.code
+    && failure?.message === INVALID_TOOL_JSON_FAILURE.message
+}
+
+function invalidToolJsonError(error) {
+  const failure = error?.failure ?? error
+  return failure?.code === INVALID_TOOL_JSON_FAILURE.code
+    && failure?.message === INVALID_TOOL_JSON_FAILURE.message
+}
+
+function directToolSchemas(tools) {
+  const schemas = new Map()
+  if (!Array.isArray(tools)) return schemas
+  for (const tool of tools) {
+    if (tool?.name !== RUN_CODE && tool?.name !== EDIT_RUN_CODE) continue
+    if (schemas.has(tool.name) || !isRecord(tool.parameters)) return new Map()
+    schemas.set(tool.name, tool.parameters)
+  }
+  return schemas
+}
+
+function repairableDirectCall(chunks, tools) {
+  const finish = chunks.at(-1)
+  if (!invalidToolJsonFinish(finish)) return undefined
+  const completed = completedToolBlocks(chunks)
+  if (completed?.length !== 1) return undefined
+  const body = chunks.slice(0, -1)
+  const starts = body.filter(chunk => chunk?.type === 'block-start' && chunk.blockType === 'tool-call')
+  const deltas = body.filter(chunk => chunk?.type === 'tool-call-delta')
+  const ends = body.filter(chunk => chunk?.type === 'block-end' && chunk.block?.type === 'tool-call')
+  const usages = body.filter(chunk => chunk?.type === 'usage')
+  if (starts.length !== 1 || deltas.length === 0 || ends.length !== 1
+    || usages.length > 1
+    || body.some(chunk => chunk?.type !== 'usage' && !toolStreamChunk(chunk))) {
+    return undefined
+  }
+  const index = starts[0].index
+  const end = ends[0]
+  const id = end.block.id
+  const name = end.block.name
+  if (!Number.isSafeInteger(index) || index < 0 || typeof id !== 'string' || id.length === 0
+    || (name !== RUN_CODE && name !== EDIT_RUN_CODE)
+    || end.index !== index
+    || typeof end.block.arguments !== 'string'
+    || deltas.some(chunk => chunk.index !== index || chunk.id !== id
+      || (chunk.name !== undefined && chunk.name !== name)
+      || typeof chunk.argumentsDelta !== 'string')) {
+    return undefined
+  }
+  const raw = deltas.map(chunk => chunk.argumentsDelta).join('')
+  if (raw !== end.block.arguments || !raw.endsWith('}')) return undefined
+  const candidate = raw.slice(0, -1)
+  let value
+  try {
+    value = JSON.parse(candidate)
+  } catch {
+    return undefined
+  }
+  const schema = directToolSchemas(tools).get(name)
+  if (!isRecord(value) || schema === undefined
+    || validateJsonSchemaValue(schema, value).length !== 0) return undefined
+  return { index, candidate }
+}
+
+function canonicalToolBlock(index, block) {
+  return [
+    { type: 'block-start', index, blockType: 'tool-call' },
+    {
+      type: 'tool-call-delta', index, id: block.id, name: block.name,
+      argumentsDelta: block.arguments,
+    },
+    { type: 'block-end', index, block },
+  ]
+}
+
+function repairedDirectChunks(chunks, repair, usageAlreadyEmitted) {
+  const end = chunks.find(chunk => chunk?.type === 'block-end'
+    && chunk.index === repair.index && chunk.block?.type === 'tool-call')
+  const block = { ...end.block, arguments: repair.candidate }
+  const usage = usageAlreadyEmitted ? undefined : firstUsageChunk(chunks)
+  return [
+    ...canonicalToolBlock(repair.index, block),
+    ...usage === undefined ? [] : [usage],
+    { type: 'finish', reason: { kind: 'tool-calls' } },
+  ]
+}
+
+function completedToolBlocks(chunks) {
+  const body = chunks.slice(0, -1)
+  if (body.filter(chunk => chunk?.type === 'usage').length > 1
+    || body.some(chunk => chunk?.type !== 'usage' && !toolStreamChunk(chunk))) {
+    return undefined
+  }
+  const calls = new Map()
+  for (const chunk of chunks) {
+    if (chunk?.type === 'block-start' && chunk.blockType === 'tool-call') {
+      if (!Number.isSafeInteger(chunk.index) || chunk.index < 0) return undefined
+      const call = calls.get(chunk.index)
+      if (call?.started === true || call?.block !== undefined) return undefined
+      if (call === undefined) calls.set(chunk.index, {
+        arguments: '', hasDelta: false, started: true,
+      })
+      else call.started = true
+    } else if (chunk?.type === 'tool-call-delta') {
+      if (!Number.isSafeInteger(chunk.index) || chunk.index < 0) return undefined
+      let call = calls.get(chunk.index)
+      if (call === undefined) {
+        call = { arguments: '', hasDelta: false, started: false }
+        calls.set(chunk.index, call)
+      }
+      if (call.block !== undefined
+        || typeof chunk.id !== 'string' || chunk.id.length === 0
+        || (call.id !== undefined && call.id !== chunk.id)
+        || (chunk.name !== undefined && (typeof chunk.name !== 'string' || chunk.name.length === 0
+          || (call.name !== undefined && call.name !== chunk.name)))
+        || typeof chunk.argumentsDelta !== 'string') return undefined
+      call.id ??= chunk.id
+      if (chunk.name !== undefined) call.name ??= chunk.name
+      call.hasDelta = true
+      call.arguments += chunk.argumentsDelta
+    } else if (chunk?.type === 'block-end' && chunk.block?.type === 'tool-call') {
+      if (!Number.isSafeInteger(chunk.index) || chunk.index < 0) return undefined
+      let call = calls.get(chunk.index)
+      if (call === undefined) {
+        call = { arguments: '', hasDelta: false, started: false }
+        calls.set(chunk.index, call)
+      }
+      if (call.block !== undefined
+        || typeof chunk.block.id !== 'string' || chunk.block.id.length === 0
+        || typeof chunk.block.name !== 'string' || chunk.block.name.length === 0
+        || typeof chunk.block.arguments !== 'string'
+        || (call.id !== undefined && call.id !== chunk.block.id)
+        || (call.name !== undefined && call.name !== chunk.block.name)
+        || (call.hasDelta && call.arguments !== chunk.block.arguments)) return undefined
+      call.block = chunk.block
+    }
+  }
+  if (calls.size === 0 || [...calls.values()].some(call => call.block === undefined)) {
+    return undefined
+  }
+  const completed = [...calls].map(([index, call]) => ({ index, block: call.block }))
+  if (new Set(completed.map(call => call.block.id)).size !== completed.length) return undefined
+  return completed
+}
+
+function firstUsageChunk(chunks) {
+  return chunks.find(chunk => chunk?.type === 'usage')
+}
+
+function settleMalformedToolCalls(chunks, priorIndexes, usageAlreadyEmitted) {
+  if (!invalidToolJsonFinish(chunks.at(-1))) return undefined
+  const calls = completedToolBlocks(chunks)
+  if (calls === undefined || calls.some(call => priorIndexes.has(call.index))) return undefined
+  const usage = usageAlreadyEmitted ? undefined : firstUsageChunk(chunks)
+  return [
+    ...calls.flatMap(call => canonicalToolBlock(call.index, call.block)),
+    ...usage === undefined ? [] : [usage],
+    { type: 'finish', reason: { kind: 'tool-calls' } },
+  ]
+}
+
+function toolStreamChunk(chunk) {
+  return chunk?.type === 'tool-call-delta'
+    || (chunk?.type === 'block-start' && chunk.blockType === 'tool-call')
+    || (chunk?.type === 'block-end' && chunk.block?.type === 'tool-call')
+}
+
+function unusedString(base, used) {
+  let value = base
+  for (let suffix = 2; used.has(value); suffix++) value = `${base}-${suffix}`
+  return value
+}
+
+function visibleBlockClosures(openBlocks, chunks) {
+  const closing = new Map([...openBlocks].map(([index, block]) => [index, { ...block }]))
+  for (const chunk of chunks) {
+    const block = closing.get(chunk?.index)
+    if (block === undefined) continue
+    if (chunk.type === `${block.type}-delta` && typeof chunk.text === 'string') {
+      block.text += chunk.text
+    } else if (chunk.type === 'block-end' && chunk.block?.type === block.type) {
+      block.final = chunk.block
+    }
+  }
+  return [...closing].map(([index, block]) => ({
+    type: 'block-end',
+    index,
+    block: block.final ?? { type: block.type, text: block.text },
+  }))
+}
+
+function rejectedMalformedToolStream(
+  chunks,
+  priorIndexes = new Set(),
+  openBlocks = new Map(),
+  usageAlreadyEmitted = false,
+) {
+  const usedIndexes = new Set(priorIndexes)
+  const usedIds = new Set()
+  for (const chunk of chunks) {
+    if (Number.isSafeInteger(chunk?.index) && chunk.index >= 0) usedIndexes.add(chunk.index)
+    if (typeof chunk?.id === 'string') usedIds.add(chunk.id)
+    if (typeof chunk?.block?.id === 'string') usedIds.add(chunk.block.id)
+  }
+  let index = 0
+  while (usedIndexes.has(index)) index++
+  const id = unusedString(MALFORMED_TOOL_REJECTION_ID, usedIds)
+  const usage = usageAlreadyEmitted ? undefined : firstUsageChunk(chunks)
+  return [
+    ...visibleBlockClosures(openBlocks, chunks),
+    { type: 'block-start', index, blockType: 'tool-call' },
+    {
+      type: 'tool-call-delta', index, id, name: RUN_CODE,
+      argumentsDelta: MALFORMED_TOOL_REJECTION_ARGUMENTS,
+    },
+    {
+      type: 'block-end', index,
+      block: {
+        type: 'tool-call', id, name: RUN_CODE,
+        arguments: MALFORMED_TOOL_REJECTION_ARGUMENTS,
+      },
+    },
+    ...usage === undefined ? [] : [usage],
+    { type: 'finish', reason: { kind: 'tool-calls' } },
+  ]
+}
+
+function recoveredMalformedChunks(chunks, tools, priorIndexes, openBlocks, usageAlreadyEmitted) {
+  if (usageAlreadyEmitted && firstUsageChunk(chunks) !== undefined) {
+    return rejectedMalformedToolStream(chunks, priorIndexes, openBlocks, true)
+  }
+  const repair = repairableDirectCall(chunks, tools)
+  const settled = repair !== undefined && !priorIndexes.has(repair.index)
+    ? repairedDirectChunks(chunks, repair, usageAlreadyEmitted)
+    : settleMalformedToolCalls(chunks, priorIndexes, usageAlreadyEmitted)
+  return settled === undefined
+    ? rejectedMalformedToolStream(chunks, priorIndexes, openBlocks, usageAlreadyEmitted)
+    : [...visibleBlockClosures(openBlocks, chunks), ...settled]
+}
+
+function observeVisibleBlock(openBlocks, chunk) {
+  if (chunk?.type === 'block-start'
+    && (chunk.blockType === 'text' || chunk.blockType === 'reasoning')) {
+    openBlocks.set(chunk.index, { type: chunk.blockType, text: '' })
+  } else if (chunk?.type === 'text-delta' || chunk?.type === 'reasoning-delta') {
+    const block = openBlocks.get(chunk.index)
+    const type = chunk.type === 'text-delta' ? 'text' : 'reasoning'
+    if (block?.type === type) block.text += chunk.text
+  } else if (chunk?.type === 'block-end') {
+    openBlocks.delete(chunk.index)
+  }
+}
+
+async function* recoverMalformedToolCallStream(source, tools) {
+  let pending = []
+  const priorIndexes = new Set()
+  const openBlocks = new Map()
+  let usageSeen = false
+  try {
+    for await (const chunk of source) {
+      if (pending.length === 0) {
+        if (toolStreamChunk(chunk)) pending.push(chunk)
+        else if (chunk?.type === 'usage' && usageSeen) pending.push(chunk)
+        else if (invalidToolJsonFinish(chunk)) {
+          yield* rejectedMalformedToolStream([chunk], priorIndexes, openBlocks, usageSeen)
+          openBlocks.clear()
+        } else {
+          if (Number.isSafeInteger(chunk?.index) && chunk.index >= 0) priorIndexes.add(chunk.index)
+          observeVisibleBlock(openBlocks, chunk)
+          if (chunk?.type === 'usage') usageSeen = true
+          yield chunk
+        }
+        continue
+      }
+      pending.push(chunk)
+      if (chunk?.type !== 'finish') continue
+      const output = invalidToolJsonFinish(chunk)
+        ? recoveredMalformedChunks(pending, tools, priorIndexes, openBlocks, usageSeen)
+        : pending
+      for (const outputChunk of output) {
+        if (Number.isSafeInteger(outputChunk?.index) && outputChunk.index >= 0) {
+          priorIndexes.add(outputChunk.index)
+        }
+        if (outputChunk?.type === 'usage') usageSeen = true
+        yield outputChunk
+      }
+      if (invalidToolJsonFinish(chunk)) openBlocks.clear()
+      pending = []
+    }
+  } catch (error) {
+    if (invalidToolJsonError(error)) {
+      yield* recoveredMalformedChunks([
+        ...pending,
+        { type: 'finish', reason: { kind: 'error', failure: INVALID_TOOL_JSON_FAILURE } },
+      ], tools, priorIndexes, openBlocks, usageSeen)
+      return
+    } else {
+      yield* pending
+      throw error
+    }
+  }
+  yield* pending
+}
+
 export function createDirectSurfaceOwner({
   editTransport,
   runtimeConfig,
@@ -383,7 +700,8 @@ export function createDirectSurfaceOwner({
           editToolName: EDIT_RUN_CODE,
         })
         : next()
-      return bindCallPolicies(source, policy, policy.owner.calls)
+      const recovered = recoverMalformedToolCallStream(source, options.tools)
+      return bindCallPolicies(recovered, policy, policy.owner.calls)
     },
     executionRejection(exec) {
       if (exec.name === EDIT_RUN_CODE && exec.parent !== undefined) {
@@ -430,12 +748,18 @@ export function createDirectSurfaceOwner({
       const outer = missingPath === 'description'
         && policy?.autoDescribeRunCode !== true
         && !(isRecord(exec.arguments) && typeof exec.arguments.description === 'string')
-      const context = {
-        name: 'tools:ptc-plus-run-code-arguments',
-        text: outer
-          ? 'The run_code outer transport arguments are invalid at JSON path $.description. Add a sibling string `description` field to run_code; a description nested inside a native-tool argument does not satisfy this outer requirement.'
-          : `A nested native-tool argument is missing required property "${missingPath}". Add a string description at that path in the native-tool arguments; the outer run_code description does not satisfy this nested requirement.`,
-      }
+      const text = outer
+        ? 'The run_code outer transport arguments are invalid at JSON path $.description. Add a sibling string `description` field to run_code; a description nested inside a native-tool argument does not satisfy this outer requirement.'
+        : `A nested native-tool argument is missing required property "${missingPath}". Add a string description at that path in the native-tool arguments; the outer run_code description does not satisfy this nested requirement.`
+      // additionalContexts enter the durable inbox as messages, not prompt sections.
+      const context = createUserMessage({
+        source: {
+          kind: PTC_MESSAGE_SOURCE_KIND,
+          form: 'notice',
+          summary: boundContextSummary('tools:ptc-plus-run-code-arguments'),
+        },
+        content: [{ type: 'text', text }],
+      })
       return {
         ...diagnosed,
         additionalContexts: [...diagnosed.additionalContexts ?? [], context],

package/internal/rejected-cell-editor.js

@@ -252,29 +252,15 @@ function assemble(source, replacements) {
   return changed ? { code: chunks.join('') } : { error: 'edits must change at least one matched fragment' }
 }
 
-function editRunCodeParameterBranch(operation, operationSchema) {
-  return {
-    type: 'object',
-    additionalProperties: false,
-    properties: {
-      [operation]: operationSchema,
-      [EXPECTED_TARGET_CALL_SEQ]: {
-        type: 'integer', minimum: 0,
-        description: 'Optional target precondition copied from a validated diagnostic. The edit is rejected if the captured cell has another call sequence.',
-      },
-    },
-    required: [operation],
-  }
-}
-
 export function editRunCodeSchema() {
   return {
     name: 'edit_run_code',
     description: 'Edit the most recent eligible cell captured at dispatch and run the complete corrected cell. A successful edit becomes the next target. This reruns the entire cell, including prior effects; use it after pre-execution rejection or when repeating those effects is safe under the called API\'s retry rules. Otherwise continue in a new run_code cell using retained values. A diagnostic may supply a localized correction; use it when it matches your intent and preserve its expected_target_call_seq. Send exactly one edits or regex_edits array: edits replaces unique literal fragments; regex_edits replaces a counted set of pattern matches. All ranges must be non-overlapping in the original cell. Regex replacements use JavaScript $1/$<name> captures, not \\1.',
     parameters: {
       type: 'object',
-      oneOf: [
-        editRunCodeParameterBranch('edits', {
+      additionalProperties: false,
+      properties: {
+        edits: {
           type: 'array', minItems: 1, maxItems: EDIT_LIMITS.exactEdits,
           description: 'Atomic exact replacements, all resolved against the original target cell.',
           items: {
@@ -285,8 +271,8 @@ export function editRunCodeSchema() {
             },
             required: ['old_string', 'new_string'],
           },
-        }),
-        editRunCodeParameterBranch('regex_edits', {
+        },
+        regex_edits: {
           type: 'array', minItems: 1, maxItems: EDIT_LIMITS.regexEdits,
           description: 'Atomic regular-expression replacements, all matched against the original target cell with JavaScript pattern and replacement semantics; each replacement is a JavaScript template (see replacement).',
           items: {
@@ -299,8 +285,12 @@ export function editRunCodeSchema() {
             },
             required: ['pattern', 'flags', 'replacement', 'expected_matches'],
           },
-        }),
-      ],
+        },
+        [EXPECTED_TARGET_CALL_SEQ]: {
+          type: 'integer', minimum: 0,
+          description: 'Optional target precondition copied from a validated diagnostic. The edit is rejected if the captured cell has another call sequence.',
+        },
+      },
     },
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-ptc-plus",
-  "version": "0.4.3",
+  "version": "0.4.8",
   "icon": "assets/ptc-plus-icon.svg",
   "description": "A session-bound agent-native REPL for DeepSeek Harness PTC mode.",
   "type": "module",
@@ -92,6 +92,9 @@
     "semantic:check": "node scripts/semantic-obligations.mjs",
     "test:client:web": "node scripts/client-web-smoke.mjs",
     "test:client:layout": "node scripts/client-binding-layout.mjs",
+    "host:baseline:update": "node scripts/dsh-dependency-baseline.mjs update",
+    "host:baseline:verify": "node scripts/dsh-dependency-baseline.mjs verify",
+    "test:host-contract": "node scripts/dsh-host-contract-suite.mjs",
     "prepack": "npm run build:check",
     "hooks:install": "node scripts/review-findings.mjs install-hook",
     "review:new": "node scripts/review-findings.mjs create",
@@ -106,7 +109,9 @@
     "session:migrate": "node scripts/migrate-session-log.mjs",
     "coverage": "node scripts/coverage.mjs",
     "coverage:focus": "node scripts/coverage.mjs --focus",
-    "verify": "npm run review:validate && npm run semantic:check && npm run build:check && node --check index.js && node --check internal/kernel-worker.js && node --check scripts/migrate-session-log.mjs && node --check scripts/expensive-headless-acceptance.mjs && node --check scripts/ab-headless-trajectories.mjs && npm run test:client && npm run coverage",
+    "test:ci:runtime": "node --test --test-concurrency=1 test/package-contract.test.js test/compiler-platform.test.js test/direct-surface-policy.test.js test/isolated-entrance.test.js test/plugin-native-call-transport.test.js",
+    "verify": "npm run review:validate && npm run host:baseline:verify && npm run semantic:check && npm run build:check && node --check index.js && node --check internal/kernel-worker.js && node --check scripts/migrate-session-log.mjs && node --check scripts/expensive-headless-acceptance.mjs && node --check scripts/ab-headless-trajectories.mjs && npm run test:client && npm run coverage",
+    "verify:ci": "npm run review:validate && npm run host:baseline:verify && npm run semantic:check && npm run build:check && node --check index.js && node --check internal/kernel-worker.js && node --check scripts/migrate-session-log.mjs && npm run test:client && npm run test:ci:runtime",
     "check": "node scripts/review-findings.mjs check",
     "test:expensive": "node scripts/expensive-headless-acceptance.mjs",
     "test:ab": "node scripts/ab-headless-trajectories.mjs"
@@ -151,6 +156,7 @@
     }
   },
   "devDependencies": {
+    "@deepseek-ai/dsh": "next",
     "@deepseek-ai/dsh-agent-loop": "next",
     "@deepseek-ai/dsh-api-gateway": "next",
     "@deepseek-ai/dsh-api-remotes": "next",

package/src/client-workbench.js

@@ -484,11 +484,13 @@ export function createUserBindingsWorkbench(React, deps) {
     const content = React.useRef(null)
     const localReturnFocus = React.useRef(null)
     const returnFocus = returnFocusRef ?? localReturnFocus
-    React.useEffect(() => {
+    const attachContent = React.useCallback(element => {
+      content.current = element
+      if (element === null) return
       const previous = document.activeElement
       // A resumed mount may have no focused control; keep the last valid entry.
-      if (!content.current.contains(previous) && canReturnFocus(previous)) returnFocus.current = previous
-      content.current.querySelector('button')?.focus()
+      if (!element.contains(previous) && canReturnFocus(previous)) returnFocus.current = previous
+      element.querySelector('button')?.focus()
     }, [returnFocus])
     const close = () => {
       const target = canReturnFocus(returnFocus.current) ? returnFocus.current : getReturnFocus?.()
@@ -509,7 +511,7 @@ export function createUserBindingsWorkbench(React, deps) {
       }
     }
     return h(Modal, { open: true, onClose: close, title: t('bindings.title'), headless: true, className: 'ptcPlusBindingsModal' },
-      h('div', { className: 'ptcPlusBindingsDialog', ref: content, onKeyDown: trapFocus },
+      h('div', { className: 'ptcPlusBindingsDialog', ref: attachContent, onKeyDown: trapFocus },
         h('div', { className: 'ptcPlusBindingsDialogHead' },
           h('h2', null, t('bindings.title')),
           h('button', { type: 'button', className: 'ptcPlusDialogClose', onClick: close,