dsh-vision-router 2.0.0 → 2.1.0

package/docs/releases/v2.0.1.md

@@ -0,0 +1,17 @@
+# v2.0.1
+
+这是一个针对长任务识图设置与诊断的补丁版本。
+
+## 修复
+
+- 修复 `visionTaskTimeoutMs` 在浏览器设置页与 Host schema 之间的校验漂移：客户端现在会在写入前正确检查范围和步进，避免 Host 拒绝后只留下 `readback-mismatch`。
+- 明确区分“单次识图任务超时”和“首次识图后的整轮时间上限”；整轮限制继续沿用既有 wall-clock 语义。
+- 保持 v2 默认 `visionTurnBudgetMs=0`（不限制）；不会自动迁移或清除用户已有的显式正数配置。
+- 当整轮视觉时间上限耗尽时，guard 与日志会显示实际生效的限制；Diagnostics 与 Doctor 也会显示有效值及其来源，便于定位旧 profile / composition 覆盖。
+- 增加针对设置边界、预算诊断、Doctor 输出和运行时结构不变量的回归测试。
+
+## Compatibility
+
+- No change to #220/#295 lazy activation or wall-clock accounting.
+- No change to the v2 default: `visionTurnBudgetMs=0` remains unlimited.
+- Existing explicit positive whole-turn limits remain honored.

package/docs/releases/v2.1.0-support-window.md

@@ -0,0 +1,29 @@
+# DVR 2.1.0 Host support-window announcement
+
+This file is the historical advance notice published during the DVR 2.0.x train. The announced boundary is fulfilled by DVR 2.1.0. The current normative window is maintained in [`docs/architecture/dsh-support-window.md`](../architecture/dsh-support-window.md).
+
+## 中文
+
+DVR 2.0.x 的公开最低 Host 是 DSH `0.1.0-rc.6`。项目曾提前公告：从 **DVR 2.1.0** 起，最低支持 Host 调整为 DSH `0.1.0-rc.8`。
+
+该边界现已在 v2.1.0 发版线正式激活：
+
+- Minimum Supported Host：`0.1.0-rc.8`
+- Previous Supported Train：`0.1.1-rc.1`
+- Current Supported Train：`0.1.1-rc.2`
+- `0.1.2-alpha.4`：当前 canary / upstream compatibility evidence，不视为正式支持基线
+
+仍在 rc.6 / rc.7 的用户应先升级 DSH，再升级 DVR 2.1.x。兼容代码的删除仍需独立能力证明，不会因为提高公开支持下限而自动发生。
+
+## English
+
+DVR 2.0.x publicly supported DSH `0.1.0-rc.6` as its minimum Host. The project announced in advance that **DVR 2.1.0** would raise the minimum to DSH `0.1.0-rc.8`.
+
+That boundary is now active on the v2.1.0 release line:
+
+- Minimum Supported Host: `0.1.0-rc.8`
+- Previous Supported Train: `0.1.1-rc.1`
+- Current Supported Train: `0.1.1-rc.2`
+- `0.1.2-alpha.4`: current canary/upstream compatibility evidence, not a released support-floor claim
+
+Users still on rc.6 / rc.7 should upgrade DSH before upgrading to DVR 2.1.x. Raising the public floor does not automatically delete historical compatibility seams; each retirement still requires separate capability proof.

package/docs/releases/v2.1.0.md

@@ -0,0 +1,83 @@
+# v2.1.0
+
+这是从 v2.0.1 到当前 2.1 线的一次完整 minor release：把输入框识图、Settings 原生化、运行时双语、能力路由与测评、DSH 新 Host 兼容、资源与取消治理，以及 2.x 架构收敛一起正式交付。
+
+## 升级前先看
+
+**DVR 2.1.x 的最低支持 Host 提升为 DSH `0.1.0-rc.8`。**
+
+- DVR 2.0.x 最低支持：DSH `0.1.0-rc.6`
+- DVR 2.1.x 最低支持：DSH `0.1.0-rc.8`
+- Previous Supported Train：DSH `0.1.1-rc.1`
+- Current Supported Train：DSH `0.1.1-rc.2`
+- DSH `0.1.2-alpha.4` 只作为当前 canary / upstream compatibility evidence
+
+仍在 rc.6 / rc.7 的用户请先升级 DSH，再升级到 DVR 2.1.x。这个最低 Host 调整已在 2.0.x 阶段提前公告；2.1.0 只激活既定边界。rc.6 时代的兼容代码不会因此一次性删除，后续仍按 capability-first + 单独退休审计逐项收敛。
+
+## 输入框识图模式
+
+- 新增显式 Composer「识图 / Vision」开关：普通模型继续由 DSH 原生模型选择器管理，需要看图时再进入对应的内部 Vision Router wrapper。
+- 开关状态直接来自会话真实 ModelDirectory，不维护第二份布尔状态；发送后不会自动复位，手动切换普通模型会退出 wrapper，只修改 reasoning effort 不会退出。
+- 能确认归属时，内部「+ 自动识图」wrapper 从原生 picker 与 `/model` 展示层隐藏；归属不确定时 fail-open，不误藏第三方 route。
+- Host 拒绝模型切换时使用临时错误提示，同时保持 UI 与真实当前模型一致。
+- `👁` 与文本 `✓` 已替换为固定尺寸、`currentColor` 的内联 SVG，Windows / macOS / Linux 不再受系统 emoji / 字体 fallback 影响。
+
+## Settings 与新手引导
+
+- **Settings → Vision Router** 成为唯一正式入口，不再恢复旧 `settings.plugin.item` 隐藏入口。
+- 设置页重构为 5 张 DSH 风格披露卡：常规、识图策略、本地与设备、高级、诊断。
+- 五张卡默认全部折叠，可独立同时展开；卡体和模型数据按需懒加载，减少设置页无关工作和滚动卡顿。
+- 每张可编辑卡拥有独立保存 / 放弃 / 校验边界；无效 staged draft 也会正确计入 dirty，跨卡保存不会吞掉其他未保存修改。
+- Reset、保存 settlement、并发切卡等路径增加竞态保护。
+- 「重新查看新手引导」恢复；最终完成 callout 与 onboarding 持久化恢复，新装用户不再卡死在 step2。
+- capability benchmark 客户端改为观察稳定的 `document`，即使 DSH 启动过程替换完整 `documentElement`，后续懒挂载模型链仍会自动出现测评控件；没有永久 1 秒 DOM 轮询。
+
+## 识图策略、深度与双语
+
+- 运行时 i18n 进入正式路径：设置、引导、深度策略、fallback guidance 等用户可见内容跟随 Host locale，中文 / 英文可切换。
+- Fast / Standard / Deep 明确为识图策略；深看最大调用次数作为独立 opt-in cap，不再把“策略”和“次数限制”混成同一个概念。
+- 1+x structured vision、自由后续工具调用和自定义 guidance 继续可组合使用，并补齐异常/取消/重复执行保护。
+
+## Auto 路由与模型测评
+
+- capability shadow 退役，路由运行时、证据、展示与 benchmark 生命周期进一步拆分，减少双重状态源。
+- Auto 只在已经授权的候选与已有能力证据之间调整顺序；开启 Auto 本身不会启动 benchmark。
+- 后台能力补测继续独立授权，前台真实识图优先；失败、暂缓、停止和凭据域都显式化。
+- benchmark 控件对 DSH Web shell 生命周期自愈，且保持事件驱动，无长期全局 DOM sweep。
+
+## Runtime / 2.x 架构收敛
+
+- 路由 runtime / evidence、execution order、provider transport、session vision index 等从历史大模块中拆出，行为通过 parity/closure gate 固定。
+- artifact I/O 与 vision artifact store 收敛，Host canonical attachment 继续是图像事实来源。
+- fetch 代理可撤销、断路器失败寿命显式化、扫描/队列有界化；AbortSignal、硬超时与取消语义在新 Host 上继续保持。
+- capability shadow 等过时中间层删除，最终 runtime composition、public entry 与 Web presentation ownership 有专门架构闭包测试。
+
+## DSH / 平台兼容
+
+- 2.1.x 正式最低 Host：DSH `0.1.0-rc.8`；当前 release train 为 `0.1.1-rc.2`。
+- DSH `0.1.2-alpha.4` 使用官方 tag `dsh-v0.1.2-alpha.4` 的精确源码提交做 canary contract；Settings 生命周期、附件归一化、client/adapter seam 等均纳入验证，但 alpha 不作为正式最低支持声明。
+- Host capability snapshot 与 Doctor support-window 输出进入正式诊断路径。
+- Windows 混合 DPI 桌面截图路径加固。
+- 原生多模态模型继续遵循 non-intervention：Host 已能原生处理图片时，Vision Router 不强行劫持原生路径。
+
+## 验证
+
+本版本周期已经覆盖：
+
+- Node 22 / Node 24 全量测试；
+- DSH rc.8 最低支持线、0.1.1 released trains 与 0.1.2-alpha.4 canary contract；
+- Ubuntu / macOS / Windows host/runtime lanes；
+- Architecture Closure、P1 Routing Parity、DSH Contract；
+- Native multimodal cold resume；
+- 大图资源压力与取消/超时回归；
+- 真实 Chrome Browser P1 acceptance：DSH shell root replacement 后 benchmark 自愈，以及新手引导完成状态持久化；
+- 版本级真实 DSH 自验收：Settings 五卡、1+x、fallback、视觉工具、大图/多图、本地服务降级、Doctor/product-state、重启冷恢复等。
+
+## 已知限制
+
+以下两项在发版验收中确认存在，但不是 v2.1.0 引入的回归，因此不阻塞本次发布：
+
+- [#360](https://github.com/ysr666/dsh-vision-router/issues/360)：部分视觉后端在非方形图片上返回内部方形坐标帧，`vision_ground` / `vision_detect` 需要增加确定性坐标回映射；方形图片不受该问题影响。
+- [#361](https://github.com/ysr666/dsh-vision-router/issues/361)：Doctor 可能把合法 route/id override 误判成 duplicate mount；运行时实际仍可能只有一个有效实例。
+
+这两项将作为 2.1.x 后续专项处理。

package/entry.js

@@ -1,68 +1,11 @@
 // Public plugin entrypoint.
 //
-// Keep the large implementation in index.js, but normalize the progressive
-// tools switch here before Cordis reads the exported Config. Issue #81 showed
-// that changing the tool schema mid-session can invalidate provider prefix/KV
-// caches for very long conversations, so progressive exposure is now an
-// explicit opt-in rather than the implicit fallback.
+// P3-F keeps this file as the public schema/export boundary. Runtime ownership
+// lives in lib/runtime-composition.js; the mature core remains in index.js.
 
 import z from '@deepseek-ai/schemastery'
 import * as core from './index.js'
-import { installVisionRouterFileLogging } from './lib/file-logger.js'
-import { contextWithDelegatedReplay } from './lib/replay-delegation.js'
-import { contextWithReplayEnvelopeV2Compat } from './lib/replay-envelope-v2-compat.js'
-import { contextWithVisionExecutionPolicy } from './lib/vision-execution-policy.js'
-import { contextWithVisionBackendRuntimePolicy } from './lib/vision-backend-runtime-policy.js'
-import { contextWithNativeImageCoexistence } from './lib/native-image-coexistence.js'
-import { installLegacyCoreVisionPolicyBridge } from './lib/legacy-core-vision-policy-bridge.js'
-import { installPiAiBridgeWireCompat } from './lib/pi-ai-bridge-wire-compat.js'
-import { installLiveModelDiscovery } from './lib/live-model-discovery.js'
-import { installVisionModelRegistry } from './lib/vision-model-registry.js'
-import { installStrictLiveModelClientPrelude } from './lib/strict-live-model-client-prelude.js'
-import { installWrapperScopeClientPrelude } from './lib/wrapper-scope-client-prelude.js'
-import { installClientPresentationBoundary } from './lib/client-presentation-boundary.js'
-import { installGuideVisionToggleHighlight } from './lib/guide-vision-toggle-highlight.js'
-import { installVisionModelVisibilityBoundary } from './lib/vision-model-visibility-boundary.js'
-import { installAdversarialHardening } from './lib/adversarial-hardening.js'
-import { installOllamaColdStartGuard } from './lib/ollama-cold-start.js'
-import { installLocalVisionStabilizer } from './lib/local-vision-stabilizer.js'
-import { installWrapperDirectoryAlias } from './lib/wrapper-directory.js'
-import { installAndroidAttachmentCompat } from './lib/android-attachment-compat.js'
-import { contextWithCoalescedAdapterUpdates } from './lib/adapter-update-coalescer.js'
-import { installTesseractExecFileCompat } from './lib/tesseract-exec-compat.js'
-import { installLocalMutationRouteBoundary } from './lib/web-capability-boundary.js'
-import { installScreenshotSourceBoundary } from './lib/screenshot-source-boundary.js'
-import { installVisionToolRuntimeBoundary } from './lib/vision-tool-runtime-boundary.js'
-import { installVisionRouterRemoteSettingsBridge } from './lib/remote-settings-bridge.js'
-import { installSettingsRc8ClientLifecycle } from './lib/settings-client-rc8-lifecycle.js'
-import { installCapabilityShadowRuntime } from './lib/vision-capability-shadow.js'
-import { createCapabilityProfileStore } from './lib/vision-capability-probe.js'
-import { installCapabilityBenchmarkService } from './lib/vision-capability-benchmark-service.js'
-import { installCapabilityBenchmarkClient } from './lib/vision-capability-benchmark-client.js'
-import { installVisionRoutingSettingsPrelude } from './lib/vision-routing-settings-prelude.js'
-import { resolveVisionRoutingProduct } from './lib/vision-routing-product.js'
-import {
-  normalizeBackgroundMeasurementAuthority,
-  resolveVisionRoutingAuthority,
-} from './lib/vision-routing-authority.js'
-import { withVisionCircuitBreakerObserver } from './lib/vision-breaker-observer.js'
-import { createVisionBreakerShadowHealth } from './lib/vision-breaker-shadow-health.js'
-import { installBackgroundCapabilityProfiling } from './lib/vision-background-benchmark.js'
-import {
-  contextWithVisionRuntimePerformance,
-  createVisionRuntimePerformanceStore,
-} from './lib/vision-runtime-performance.js'
-import {
-  installStructuredFlowHardening,
-  normalizeGuidanceOverrides,
-} from './lib/structured-flow-hardening.js'
-import {
-  attachmentContextForContract,
-  hasBatchAttachmentContract,
-  installHostSettingsCompatibility,
-  installVisionAttachmentAdmissionPolicy,
-  protectHostProviderOwnership,
-} from './lib/dsh-contract-compat.js'
+import { applyVisionRuntimeComposition } from './lib/runtime-composition.js'
 
 // Increment whenever the browser-visible settings contract gains a field whose
 // absence changes write semantics. This revision is also exposed as a resolved
@@ -80,47 +23,32 @@ core.Config.set('progressiveTools', z.boolean().default(false))
 // one visual task (including fallbacks) shares 120s. The whole-turn visual
 // budget is an optional user safety cap rather than an Agent lifetime policy:
 // 0 means unlimited, which is the default for long-running autonomous turns.
-// The runtime policy below still reserves the final quarter of a multi-backend
-// task for fallback, so disabling the aggregate cap does not revive the
-// historical "120s per backend" stall that #117 removed.
 core.Config.set('visionTaskTimeoutMs', z.number().step(1000).min(1000).max(180000).default(120000))
 core.Config.set('visionTurnBudgetMs', z.number().step(1000).min(0).max(600000).default(0))
 
 // Both visible entry points — Settings > Vision Router and the legacy
 // Settings > Plugins compatibility card — edit the same Host-owned namespace.
-// Keep the depth enum and custom cap on this final public contract so either
-// entry serializes exactly the same shape on every supported Host generation.
 core.Config.set('visionDepth', z.union(['fast', 'standard', 'deep', 'custom']).default('standard'))
 core.Config.set('visionDepthMaxCalls', z.number().step(1).min(0).max(100).default(0))
 
-// Product semantics: users choose whether Vision Router may select a backend
-// automatically or must obey the configured order, plus a plain-language
-// routing preference. Ordered remains the safe default; Auto changes execution
+// Product semantics: ordered remains the safe default; Auto changes execution
 // only under explicit live routingMode:auto authority.
 core.Config.set('routingMode', z.union(['ordered', 'auto']).default('ordered'))
 core.Config.set(
   'routingPreference',
   z.union(['balanced', 'quality', 'speed', 'local']).default('balanced'),
 )
-// Background measurement is a separate user authority. Even local/free work
-// consumes resources, so absence never grants it: users explicitly choose
-// local-free or all when they want standing background measurement.
+// Background measurement is separate user authority; absence never grants it.
 core.Config.set(
   'backgroundBenchmarking',
   z.union(['local-free', 'all', 'off']).default('off'),
 )
 
-// Settings surfaces and Host persistence must agree on this field. Keep the
-// permission on the public entry contract as well as index.js so a packaged
-// build cannot expose the new client toggle while registering an older Host
-// schema that silently recovers from the rejected settings.mutate call. This
-// deliberately repeats the default: entry.js is the final schema authority
-// loaded by Cordis and therefore the right place to close client/Host drift.
+// Settings surfaces and Host persistence must agree on this field.
 core.Config.set('allowRemoteSettings', z.boolean().default(false))
 
 // Internal read-only-by-convention handshake. It is not rendered by Vision
-// Router's settings UI and is not in the remote mutable allow-list; its resolved
-// default lets diagnostics prove which schema the running Host actually loaded.
+// Router's settings UI and is not in the remote mutable allow-list.
 core.Config.set(
   'settingsContractRevision',
   z.number().step(1).min(1).max(SETTINGS_CONTRACT_REVISION).default(SETTINGS_CONTRACT_REVISION),
@@ -135,238 +63,16 @@ export {
   installVisionAttachmentAdmissionPolicy,
   protectHostProviderOwnership,
   // Transitional public aliases retained for callers/tests written during the
-  // rc.7 compatibility pass. Runtime code below no longer branches on names.
+  // rc.7 compatibility pass. Production runtime branches on feature seams.
   installRc7SettingsCompatibility,
   isRc7ContractRuntime,
   protectRc7ProviderOwnership,
 } from './lib/dsh-contract-compat.js'
 export const Config = core.Config
 
-// Defense in depth for direct/programmatic callers that invoke apply() without
-// first running the Cordis Config resolver: only an explicit true enables the
-// schema-changing progressive mode. The wrapped context changes logger plus a
-// private llm/tools view used only by Vision Router: wrapper -> delegate calls
-// preserve replay identity, while vision-tool network calls are constrained to
-// the exact backends the user selected in Vision Router.
+// Defense in depth for direct/programmatic callers is implemented by the same
+// production composition used by Cordis. This public entry intentionally owns
+// no runtime installer ordering beyond that single call.
 export function apply(ctx, config = {}) {
-  // DSH's browser WebServer can intentionally bind 0.0.0.0 and carries no
-  // authentication layer of its own. Same-origin headers are only a CSRF
-  // signal, so install a transport-level loopback fence before ANY plugin-owned
-  // route is registered. The wrapper patches only webServer.register and hands
-  // every injection callback the original child context identity unchanged.
-  const localMutationCtx = installLocalMutationRouteBoundary(ctx)
-  // Normalize DSH 0.1.1's prepareCall contract at the deepest private LLM
-  // boundary. Higher Vision Router layers can finish wrapping adapter.stream
-  // before this boundary captures the final Host-visible adapter, so prepareCall
-  // cannot bypass local/runtime/replay stream behavior.
-  const adapterContractCtx = contextWithCoalescedAdapterUpdates(localMutationCtx)
-  const logging = installVisionRouterFileLogging(adapterContractCtx)
-  const capabilityStore = createCapabilityProfileStore({ logger: logging.logger })
-  // Runtime speed is deliberately process-local and short-lived. It is not
-  // persisted beside capability evidence because network/provider performance
-  // is a dynamic runtime fact, not a model capability fact.
-  const runtimePerformanceStore = createVisionRuntimePerformanceStore()
-  const delegatedReplayCtx = contextWithDelegatedReplay(logging.ctx, {
-    wrapperRoute:
-      typeof config.wrapperRoute === 'string' && config.wrapperRoute !== ''
-        ? config.wrapperRoute
-        : 'deepseek-vision',
-    visionConfig: config,
-  })
-  const runtimeCtx = contextWithReplayEnvelopeV2Compat(delegatedReplayCtx)
-  const screenshotSourceCtx = installScreenshotSourceBoundary(runtimeCtx, core)
-  const { ctx: hardenedCtx, config: hardenedConfig } = installAdversarialHardening(
-    screenshotSourceCtx,
-    config,
-    core,
-  )
-  const ollamaColdStartCtx = installOllamaColdStartGuard(hardenedCtx, hardenedConfig, core)
-  const { ctx: stabilizedCtx, bootConfig } = installLocalVisionStabilizer(
-    ollamaColdStartCtx,
-    hardenedConfig,
-    core,
-  )
-  const routingProduct = resolveVisionRoutingProduct(bootConfig)
-  const runtimeConfig = {
-    ...bootConfig,
-    routingMode: routingProduct.mode,
-    routingPreference: routingProduct.preference,
-    backgroundBenchmarking: normalizeBackgroundMeasurementAuthority(bootConfig.backgroundBenchmarking),
-    progressiveTools: hardenedConfig.progressiveTools === true,
-    guidanceOverrides: normalizeGuidanceOverrides(bootConfig.guidanceOverrides ?? hardenedConfig.guidanceOverrides),
-    visionTaskTimeoutMs:
-      Number.isFinite(Number(bootConfig.visionTaskTimeoutMs))
-        ? Number(bootConfig.visionTaskTimeoutMs)
-        : 120000,
-    visionTurnBudgetMs:
-      Number.isFinite(Number(bootConfig.visionTurnBudgetMs))
-        ? Number(bootConfig.visionTurnBudgetMs)
-        : 0,
-  }
-  const batchAttachmentHost = hasBatchAttachmentContract(stabilizedCtx)
-  if (batchAttachmentHost) installVisionAttachmentAdmissionPolicy(stabilizedCtx, logging.logger)
-  installVisionRouterRemoteSettingsBridge(stabilizedCtx, logging.logger)
-  installSettingsRc8ClientLifecycle(stabilizedCtx)
-  const ownershipCtx = batchAttachmentHost ? protectHostProviderOwnership(stabilizedCtx) : stabilizedCtx
-  const settingsCtx = batchAttachmentHost
-    ? installHostSettingsCompatibility(ownershipCtx, { ...runtimeConfig, stealth: false }, {
-        namespace: 'vision-router',
-        Config: core.Config,
-      })
-    : ownershipCtx
-  const attachmentCompatCtx = attachmentContextForContract(settingsCtx, logging.logger, {
-    installAndroidAttachmentCompat,
-  })
-  const toolRuntimeCtx = installVisionToolRuntimeBoundary(attachmentCompatCtx, runtimeConfig)
-  const nativeImageCompat = contextWithNativeImageCoexistence(toolRuntimeCtx, runtimeConfig)
-  // Feed the session-level image-ownership decision into the legacy core's
-  // wrapper/tool gates without reintroducing a global policy guess.
-  const legacyCoreCompat = installLegacyCoreVisionPolicyBridge(
-    nativeImageCompat.ctx,
-    nativeImageCompat.config,
-    { rewriteHistoryImages: core.rewriteHistoryImages },
-  )
-  // Final structured-flow guard sits closest to core.apply so it sees the
-  // actual tool registrations and pre-step listener. It makes bootstrap
-  // one-shot, enforces fast/standard/deep/custom quotas, tracks mixed branches,
-  // rejects empty/non-evidence results, and applies the optional turn deadline
-  // only when the user explicitly configures one.
-  const structuredCtx = installStructuredFlowHardening(legacyCoreCompat.ctx, legacyCoreCompat.config)
-  const backgroundProfiling = installBackgroundCapabilityProfiling(
-    structuredCtx,
-    runtimeConfig,
-    core,
-    capabilityStore,
-    { logger: logging.logger },
-  )
-  const breakerShadowHealth = createVisionBreakerShadowHealth(backgroundProfiling.ctx)
-  const capabilityShadowCtx = installCapabilityShadowRuntime(
-    backgroundProfiling.ctx,
-    runtimeConfig,
-    core,
-    {
-      logger: logging.logger,
-      store: capabilityStore,
-      runtimePerformanceStore,
-      healthForCandidate: breakerShadowHealth.healthForCandidate,
-    },
-  )
-  // prepareCall normalization/reconciliation is already installed at the
-  // deepest private Host registration boundary above. Do not wrap it again
-  // here or a prepared adapter may capture a pre-wrapper stream.
-  const reconciledCtx = capabilityShadowCtx
-  const liveDiscovery = installLiveModelDiscovery(reconciledCtx, {
-    config: runtimeConfig,
-    logger: logging.logger,
-  })
-  installVisionModelRegistry(reconciledCtx, liveDiscovery, { config: runtimeConfig })
-  installClientPresentationBoundary(reconciledCtx)
-  // The same first walkthrough step now teaches the explicit "识图" control
-  // introduced by #284. Widen the existing spotlight to cover that button and
-  // the adjacent model selector as one target instead of leaving the control
-  // under the dimming veil.
-  installGuideVisionToggleHighlight(reconciledCtx)
-  // The Host keeps wrapper routes registered because image admission and the
-  // Vision toggle need their real identity. Hide only confidently owned
-  // wrapper groups from DSH's stock model-selection presentation and project an
-  // active wrapper back to its ordinary source label; uncertain routes stay
-  // visible rather than being guessed away.
-  installVisionModelVisibilityBoundary(reconciledCtx)
-  // Keep endpoint-discovered ids private to Vision Router's settings client,
-  // but make Settings -> Models authoritative when DSH already enumerates a
-  // provider. Live /models data now fills only a still-active provider whose
-  // DSH catalog is empty, so disabled models and removed providers cannot leak
-  // back into the Vision Router picker through stale endpoint discovery.
-  installStrictLiveModelClientPrelude(reconciledCtx)
-  // Surface the existing autoWrapProviders/wrappedProviders contract in the
-  // primary Vision Router settings section. This is presentation-only: the Host
-  // keeps one settings namespace and one wrapper-registration implementation.
-  installWrapperScopeClientPrelude(reconciledCtx)
-  // Capability Benchmark is the single visible and callable per-model
-  // capability-test surface in the release runtime.
-  installVisionRoutingSettingsPrelude(reconciledCtx)
-  installCapabilityBenchmarkClient(reconciledCtx)
-  installPiAiBridgeWireCompat(reconciledCtx, logging.logger)
-  const executionCtx = contextWithVisionExecutionPolicy(reconciledCtx, {
-    isBridgeEvidence: (provider, model) => liveDiscovery.hasModel(provider, model),
-    evidenceSource: (provider, model) => liveDiscovery.evidenceSource?.(provider, model),
-    logger: logging.logger,
-  })
-  // Only real visual-tool adapter streams are timed, and only while live Auto
-  // authority permits future-routing observation. Benchmark/background calls
-  // have no visual-tool scope and cannot contaminate this store.
-  const performanceCtx = contextWithVisionRuntimePerformance(
-    executionCtx,
-    runtimePerformanceStore,
-    {
-      logger: logging.logger,
-      observationAllowed() {
-        try {
-          const settings = executionCtx?.get?.('settings')
-          const current = settings?.get?.('vision-router')
-          if (!current || typeof current !== 'object' || Array.isArray(current)) return false
-          return resolveVisionRoutingAuthority(current).ephemeralRuntimeObservation
-        } catch {
-          return false
-        }
-      },
-    },
-  )
-  // v1.7.7's outer policy covers cases where DSH would otherwise project image
-  // bytes to SHA text before an adapter gets the chance to reject them. Keeping
-  // it outside the runtime-performance observer means native adapter execution
-  // is still timed, while a preflight direct bridge bypasses runtime sampling
-  // and therefore stays incomparable for Balanced/Speed as designed.
-  const backendRuntimeCtx = contextWithVisionBackendRuntimePolicy(performanceCtx, {
-    config: runtimeConfig,
-    core,
-    evidenceSource: (provider, model) => liveDiscovery.evidenceSource?.(provider, model),
-    logger: logging.logger,
-  })
-  installCapabilityBenchmarkService(backendRuntimeCtx, runtimeConfig, core, {
-    logger: logging.logger,
-    store: capabilityStore,
-  })
-  installTesseractExecFileCompat(backendRuntimeCtx)
-
-  try {
-    const c = hardenedConfig && typeof hardenedConfig === 'object' ? hardenedConfig : {}
-    const local = c.localOllama && typeof c.localOllama === 'object' ? c.localOllama : {}
-    const lms = c.localLmStudio && typeof c.localLmStudio === 'object' ? c.localLmStudio : {}
-    logging.logger.info(
-      'vision-router: base config summary — contract=%s instantDescribe=%s localDescribeStyle=%s localOllama=%s localLmStudio=%s',
-      batchAttachmentHost ? 'batch-attachments' : 'single-attachment',
-      c.instantDescribe === true ? 'on' : 'off',
-      c.localDescribeStyle === 'structured' ? 'structured' : 'plain',
-      local.enabled === true ? 'on' : 'off',
-      lms.enabled === true ? 'on' : 'off',
-    )
-  } catch {
-    /* diagnostics must never break apply */
-  }
-  try {
-    const result = withVisionCircuitBreakerObserver(
-      breakerShadowHealth.capture,
-      () => core.apply(backendRuntimeCtx, legacyCoreCompat.config),
-    )
-    legacyCoreCompat.finishSchemaBootstrap()
-    installWrapperDirectoryAlias(attachmentCompatCtx, runtimeConfig, logging.logger)
-    if (result && typeof result.then === 'function') {
-      return result.catch((error) => {
-        logging.logger.error(
-          'vision-router: plugin apply failed: %s',
-          error && error.stack ? error.stack : error && error.message ? error.message : String(error),
-        )
-        throw error
-      })
-    }
-    return result
-  } catch (error) {
-    legacyCoreCompat.finishSchemaBootstrap()
-    logging.logger.error(
-      'vision-router: plugin apply failed: %s',
-      error && error.stack ? error.stack : error && error.message ? error.message : String(error),
-    )
-    throw error
-  }
-}
+  return applyVisionRuntimeComposition(ctx, config, core)
+}