super-dsh 0.1.12 → 0.3.0

package/superd-hub/dist/mesh-rpc.d.ts

@@ -13,17 +13,11 @@
  *
  * One exact route, body/method dispatched:
  *   GET    /api/superd/machines            → `{self, machines}` (public row
- *                                           projection — NEVER token/cookie,
- *                                           D1 + Task 2 review's deferred
- *                                           finding: the row carries two
- *                                           secrets and the wire carries
- *                                           none; since mesh P3 5a (I2) a
- *                                           row may also carry
- *                                           `versionWarning` — additive,
- *                                           present only when the peer's
- *                                           superd version differs from
- *                                           ours by more than patch)
- *   POST   /api/superd/machines            → `{op?: 'reprobe', ...}`:
+ *                                           projection — NEVER token/cookie on
+ *                                           a row; the SELF block carries a 10-char
+ *                                           token PREVIEW for the copy affordance,
+ *                                           full token only via op 'tokenUrl')
+ *   POST   /api/superd/machines            → `{op?: 'reprobe' | 'tokenUrl', ...}`:
  *        op:'reprobe' + {id}               → `{probe: ProbeResult}` (the
  *                                           brief's `/machines/reprobe` path
  *                                           variant is FOLDED here because
@@ -31,7 +25,13 @@
  *                                           path — one registration, body
  *                                           dispatch; documented per Task 3
  *                                           controller amendment)
- *        otherwise `{name, label?, tokenUrl}` → pairMachine → 201 `{machine}`;
+ *        op:'tokenUrl' + {origin}          → `{tokenUrl}` — the caller's
+ *                                           origin tokenized with the process's
+ *                                           live launch token via the connection
+ *                                           face's public `authenticatedUrl`
+ *                                           (spec hub-roster-identity §3); the
+ *                                           GET projection still carries no secret
+ *        otherwise `{name, tokenUrl}` → pairMachine → 201 `{machine}`;
  *                                           any failure → 400 `{error}` (the
  *                                           message is mesh-link's own,
  *                                           already token-redacted)
@@ -57,19 +57,23 @@ export declare const MESH_API_BASE = "/api/superd/machines";
 /** Injection seam: the hub home (registry + pairing live under it) and an
  *  optional fetch override for tests. `home` is resolved by the caller
  *  (gateway.ts passes `resolveDshHome()` at registration time); this module
- *  stays free of home-resolution logic. */
+ *  stays free of home-resolution logic. `tokenUrlOf` tokenizes an origin with
+ *  the process's live launch token — built from the connection face's
+ *  `authenticatedUrl` at registration; tests inject a fake (and may omit it
+ *  to pin the missing-face 400). */
 export interface MeshDeps {
     home: string;
     fetchImpl?: typeof fetch;
+    tokenUrlOf?: (origin: string) => string;
 }
 /** The GET/POST row shape as it crosses the wire — the persisted MachineRow
  *  minus its two secrets (`token`, `cookie`), plus the joined status (and,
  *  additively since I2/mesh P3 5a, the version-mismatch warning when the
- *  mesh-link status entry carries one). */
+ *  mesh-link status entry carries one). `name` is the machine's sole display
+ *  identity (spec hub-roster-identity §4). */
 export interface MachinePublicRow {
     id: string;
     name: string;
-    label: string;
     origin: string;
     enabled: boolean;
     addedAt: number;
@@ -78,6 +82,14 @@ export interface MachinePublicRow {
     error?: string;
     versionWarning?: string;
 }
+/**
+ * Truncated launch-token preview for the self row (first 10 chars + ellipsis):
+ * enough for the user to SEE this is a token, never enough to mint a cookie —
+ * the full token rides only the explicit `tokenUrl` op.
+ * @param tokenUrl - a tokenized URL (`…/?token=<value>`), as the mint answers.
+ * @returns the preview, or undefined when the URL carries no token.
+ */
+export declare function tokenPreviewOf(tokenUrl: string): string | undefined;
 /**
  * The mesh-machines handler: GET list / POST pair-or-reprobe / DELETE remove.
  * @param request - the incoming `/api/superd/machines` request.
@@ -85,10 +97,30 @@ export interface MachinePublicRow {
  * @returns the JSON response.
  */
 export declare function handleMeshMachines(request: Request, deps: MeshDeps): Promise<Response>;
+/**
+ * Validate a token-url request origin: an absolute http(s) URL that is ONLY
+ * an origin — no path, query, hash, or credentials. The pairing URL a user
+ * copies must address the server root (`authorizeIndex` answers `/` only),
+ * and anything beyond the origin would smuggle parts the mint would overwrite
+ * or drop anyway.
+ * @param origin - the client-supplied origin (trim before calling).
+ * @returns the normalized origin, or the failure reason.
+ */
+export declare function parsePairingOrigin(origin: string): {
+    ok: true;
+    origin: string;
+} | {
+    ok: false;
+    error: string;
+};
 /**
  * Register the mesh-machines API on the shared `/api` connection channel
  * (behind the standard browser-trust + auth fence). No-op when the
- * `connection` service is absent (e.g. fake-ctx unit tests).
+ * `connection` service is absent (e.g. fake-ctx unit tests). The connection
+ * face also backs the `tokenUrl` op: its public `authenticatedUrl` is the
+ * ONLY sanctioned way to attach the process's live launch token (spec
+ * hub-roster-identity §3 — the token is random per process, never derived
+ * from the stored credential seed).
  */
 export declare function registerMeshRpc(ctx: Context, deps: MeshDeps): void;
 /**

package/superd-hub/dist/mesh-rpc.js

@@ -1,3 +1,4 @@
+import { hostname } from 'node:os';
 import { ensureSelf, listRemotes, removeRemote } from './machines.js';
 import { machineStatus, pairMachine, reprobeMachine, emitMachineRemoved } from './mesh-link.js';
 import { A2A_ENDPOINT_PATH, A2A_OUTBOX_PATH, A2A_WIRE_VERSION, decodeA2aWireFrame } from './a2a-wire.js';
@@ -10,6 +11,24 @@ function json(status, body) {
         headers: { 'content-type': 'application/json' },
     });
 }
+/**
+ * Truncated launch-token preview for the self row (first 10 chars + ellipsis):
+ * enough for the user to SEE this is a token, never enough to mint a cookie —
+ * the full token rides only the explicit `tokenUrl` op.
+ * @param tokenUrl - a tokenized URL (`…/?token=<value>`), as the mint answers.
+ * @returns the preview, or undefined when the URL carries no token.
+ */
+export function tokenPreviewOf(tokenUrl) {
+    const at = tokenUrl.indexOf('token=');
+    if (at === -1)
+        return undefined;
+    const raw = tokenUrl.slice(at + 'token='.length);
+    const amp = raw.indexOf('&');
+    const token = amp === -1 ? raw : raw.slice(0, amp);
+    if (token === '')
+        return undefined;
+    return `${token.slice(0, 10)}…`;
+}
 /** Project one persisted row to its public wire shape (allowlist — never
  *  token, never cookie) and join the mesh-link status entry by id. */
 function publicRow(row) {
@@ -18,8 +37,8 @@ function publicRow(row) {
 function projectRow(row, status) {
     const entry = status.get(row.id);
     if (entry === undefined)
-        return { id: row.id, name: row.name, label: row.label, origin: row.origin, enabled: row.enabled, addedAt: row.addedAt, status: 'pending' };
-    const out = { id: row.id, name: row.name, label: row.label, origin: row.origin, enabled: row.enabled, addedAt: row.addedAt, status: entry.status, lastProbeAt: entry.lastProbeAt };
+        return { id: row.id, name: row.name, origin: row.origin, enabled: row.enabled, addedAt: row.addedAt, status: 'pending' };
+    const out = { id: row.id, name: row.name, origin: row.origin, enabled: row.enabled, addedAt: row.addedAt, status: entry.status, lastProbeAt: entry.lastProbeAt };
     if (entry.error !== undefined)
         out.error = entry.error;
     if (entry.versionWarning !== undefined)
@@ -59,15 +78,103 @@ export async function handleMeshMachines(request, deps) {
     return json(405, { error: `mesh-api: method ${method} is not supported on ${MESH_API_BASE}` });
 }
 /** GET: self (lazily minted on first need, spec §3.1) + every remote row in
- *  its public projection, status joined from the mesh-link table. */
+ *  its public projection, status joined from the mesh-link table. The self
+ *  block carries a truncated token preview (see {@link tokenPreviewOf}) when
+ *  the mint face is available — display aid for the copy affordance, never
+ *  the token itself. */
 function handleList(deps) {
     const self = ensureSelf(deps.home, 'local');
     const status = machineStatus();
     const machines = listRemotes(deps.home).map((row) => projectRow(row, status));
-    return json(200, { self, machines });
+    // Cosmetic leg: a throwing mint face degrades to no preview, never a failed
+    // machines GET.
+    let preview;
+    if (deps.tokenUrlOf !== undefined) {
+        try {
+            preview = tokenPreviewOf(deps.tokenUrlOf('http://localhost/'));
+        }
+        catch { /* degrade */ }
+    }
+    return json(200, {
+        self: preview === undefined ? self : { ...self, tokenPreview: preview },
+        machines,
+    });
+}
+/**
+ * Validate a token-url request origin: an absolute http(s) URL that is ONLY
+ * an origin — no path, query, hash, or credentials. The pairing URL a user
+ * copies must address the server root (`authorizeIndex` answers `/` only),
+ * and anything beyond the origin would smuggle parts the mint would overwrite
+ * or drop anyway.
+ * @param origin - the client-supplied origin (trim before calling).
+ * @returns the normalized origin, or the failure reason.
+ */
+export function parsePairingOrigin(origin) {
+    if (origin === '')
+        return { ok: false, error: 'mesh-api: tokenUrl body must be {op: "tokenUrl", origin} with a non-empty origin' };
+    let url;
+    try {
+        url = new URL(origin);
+    }
+    catch {
+        return { ok: false, error: 'mesh-api: tokenUrl origin is not a parseable absolute URL' };
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        return { ok: false, error: `mesh-api: tokenUrl origin must be http(s), got "${url.protocol}"` };
+    }
+    if (url.username !== '' || url.password !== '')
+        return { ok: false, error: 'mesh-api: tokenUrl origin must not carry credentials' };
+    if (url.pathname !== '/' || url.search !== '' || url.hash !== '') {
+        return { ok: false, error: 'mesh-api: tokenUrl origin must be a bare origin (no path, query or hash)' };
+    }
+    return { ok: true, origin: url.origin };
+}
+/** POST op `tokenUrl`: tokenize the caller's origin with the live launch
+ *  token (spec hub-roster-identity §3). The answer rides a POST the user
+ *  explicitly clicks — the GET projection still carries no secret. */
+function handleTokenUrl(body, deps) {
+    const raw = typeof body.origin === 'string' ? body.origin.trim() : '';
+    const parsed = parsePairingOrigin(raw);
+    if (!parsed.ok)
+        return json(400, { error: parsed.error });
+    if (deps.tokenUrlOf === undefined) {
+        return json(400, { error: 'mesh-api: the host connection face exposes no authenticatedUrl — this hub cannot mint pairing URLs' });
+    }
+    return json(200, { tokenUrl: deps.tokenUrlOf(parsed.origin) });
 }
-/** POST: body-dispatched — `{op: 'reprobe', id}` re-probes, anything else is
- *  a pairing input `{name, label?, tokenUrl}`. */
+/**
+ * The initiator's self-description for the mutual-pairing reverse leg: the
+ * authority the user reached us by (the request's Host header — the
+ * dispatched Request's URL carries only the carrier's internal placeholder
+ * origin, while the headers survive `http-bridge.ts` verbatim), tokenized,
+ * plus this host's name port-qualified so two instances of one machine stay
+ * distinguishable. `x-forwarded-proto` upgrades the scheme behind a TLS
+ * proxy; everything else dials http. Undefined when we cannot self-describe
+ * (no mint face, no Host header) — the peer can then only be paired
+ * manually from its own UI.
+ */
+function buildMutual(request, deps) {
+    if (deps.tokenUrlOf === undefined)
+        return undefined;
+    const host = request.headers.get('host');
+    if (host === null || host === '')
+        return undefined;
+    const proto = request.headers.get('x-forwarded-proto')?.split(',')[0]?.trim() ?? 'http';
+    const origin = `${proto}://${host}`;
+    const port = new URL(origin).port;
+    const name = hostname();
+    return {
+        selfTokenUrl: deps.tokenUrlOf(origin),
+        selfName: port === '' ? name : `${name}:${port}`,
+    };
+}
+/** POST: body-dispatched — `{op: 'reprobe', id}` re-probes, `{op: 'tokenUrl',
+ *  origin}` tokenizes the pairing URL, anything else is
+ *  a pairing input `{name, tokenUrl}`. A user-initiated pair carries the
+ *  mutual-pairing reverse leg (the peer is offered our own pairing input, so
+ *  one action pairs both machines); an offer that arrived WITH
+ *  `mutual: true` pairs WITHOUT its own reverse leg — the recursion stops by
+ *  construction. */
 async function handlePost(request, deps) {
     let body;
     try {
@@ -77,6 +184,8 @@ async function handlePost(request, deps) {
         return json(400, { error: errMsg(err) });
     }
     if (typeof body.op === 'string' && body.op !== '') {
+        if (body.op === 'tokenUrl')
+            return handleTokenUrl(body, deps);
         if (body.op !== 'reprobe')
             return json(400, { error: `mesh-api: unknown op "${body.op}"` });
         const id = typeof body.id === 'string' && body.id !== '' ? body.id : '';
@@ -96,18 +205,23 @@ async function handlePost(request, deps) {
     const name = typeof body.name === 'string' && body.name !== '' ? body.name : '';
     const tokenUrl = typeof body.tokenUrl === 'string' && body.tokenUrl !== '' ? body.tokenUrl : '';
     if (name === '' || tokenUrl === '') {
-        return json(400, { error: 'mesh-api: pair body must be {name, label?, tokenUrl} with non-empty name and tokenUrl' });
+        return json(400, { error: 'mesh-api: pair body must be {name, tokenUrl} with non-empty name and tokenUrl' });
     }
-    const label = typeof body.label === 'string' && body.label !== '' ? body.label : undefined;
+    // The reverse leg rides USER-initiated pairs only: an offer that arrived
+    // with `mutual: true` (the peer's own reverse leg) pairs without one.
+    const mutual = body.mutual === true ? undefined : buildMutual(request, deps);
     let outcome;
     try {
-        outcome = await pairMachine(deps.home, { name, label, tokenUrl }, { fetchImpl: deps.fetchImpl });
+        outcome = await pairMachine(deps.home, { name, tokenUrl, ...(mutual === undefined ? {} : { mutual }) }, { fetchImpl: deps.fetchImpl });
     }
     catch (err) {
         // mesh-link errors are actionable and token-redacted (Task 2 fix round 1).
         return json(400, { error: errMsg(err) });
     }
-    return json(201, { machine: publicRow(outcome.row) });
+    return json(201, {
+        machine: publicRow(outcome.row),
+        ...(outcome.mutual === undefined ? {} : { mutual: outcome.mutual }),
+    });
 }
 /** DELETE: drop one remote row by `?id=`; `{removed: false}` for unknown ids. */
 function handleRemove(request, deps) {
@@ -122,18 +236,29 @@ function handleRemove(request, deps) {
 /**
  * Register the mesh-machines API on the shared `/api` connection channel
  * (behind the standard browser-trust + auth fence). No-op when the
- * `connection` service is absent (e.g. fake-ctx unit tests).
+ * `connection` service is absent (e.g. fake-ctx unit tests). The connection
+ * face also backs the `tokenUrl` op: its public `authenticatedUrl` is the
+ * ONLY sanctioned way to attach the process's live launch token (spec
+ * hub-roster-identity §3 — the token is random per process, never derived
+ * from the stored credential seed).
  */
 export function registerMeshRpc(ctx, deps) {
     ctx.inject(['connection'], (connCtx) => {
-        const fetchFace = Reflect.get(connCtx, 'connection')?.fetch;
-        if (fetchFace === undefined)
+        const connection = Reflect.get(connCtx, 'connection');
+        const fetchFace = connection?.fetch;
+        if (connection === undefined || fetchFace === undefined)
             return; // connection not actually present (test ctx)
+        // Bound method capture: `authenticatedUrl` reads the process's launch
+        // token off `this`, so the closure must keep the face as receiver.
+        const authenticatedUrl = typeof connection.authenticatedUrl === 'function'
+            ? connection.authenticatedUrl.bind(connection)
+            : undefined;
+        const tokenUrlOf = authenticatedUrl === undefined ? undefined : (origin) => authenticatedUrl(origin);
         connCtx.effect(() => fetchFace.register({
             path: MESH_API_BASE,
             methods: [...ROUTE_METHODS],
             requestBody: 'buffered',
-            fetch: (request) => handleMeshMachines(request, deps),
+            fetch: (request) => handleMeshMachines(request, { ...deps, ...(tokenUrlOf === undefined ? {} : { tokenUrlOf }) }),
         }), 'superd-hub: /api/superd/machines route');
     });
 }

package/superd-hub/dist/roster.d.ts

@@ -8,11 +8,31 @@
  * the addressed world is the request's mount path (`DL7`, 2026-09-16).
  * one authority.
  */
+/** The canonical runtime identifier of the NATIVE DSH runtime (not an adapter — no package). */
+export declare const NATIVE_RUNTIME_ID = "native";
+/**
+ * The unified runtime identifier convention: an adapter's roster key MUST be
+ * its package name's `agent-` suffix (`omp` ↔ `agent-omp`, `omp-sdk` ↔
+ * `agent-omp-sdk`), so one derivation IS the cross-machine agreement — the
+ * same ID travels on local rows and on every federated row (spec
+ * hub-roster-identity §1). `native` is the reserved DSH spelling.
+ * @param key - the roster key (`native`, or the adapter's runtime key).
+ * @returns the adapter package identifier (`agent-omp`, …) or `native`.
+ */
+export declare function runtimeIdOf(key: string): string;
 export interface RosterEntry {
     /** Runtime key (`omp`, `codex`, …) — what the selector addresses. */
     key: string;
     /** Human label for the selector chip. */
     label: string;
+    /**
+     * The unified runtime identifier (adapter package name, `runtimeIdOf(key)`).
+     * Optional at registration — adapters registered before this field existed
+     * (and the generic joiner) are materialized at projection time; explicit
+     * values win so a future adapter whose package name drifts from the key
+     * convention can declare its identity.
+     */
+    runtimeId?: string;
     /** True once the adapter's world context is spawned and its target registered. */
     ready: boolean;
     /**

package/superd-hub/dist/roster.js

@@ -1,3 +1,27 @@
+/**
+ * Foreign agent roster (S2: plugin-presence IS the roster).
+ *
+ * No config file: an agent is in the roster exactly while its adapter
+ * plugin is loaded and registered. Adapter plugins self-register on
+ * activation (key/label/ready) and the Hub UI consumes the snapshot.
+ * Roster entries are inventory only: they carry NO selection —
+ * the addressed world is the request's mount path (`DL7`, 2026-09-16).
+ * one authority.
+ */
+/** The canonical runtime identifier of the NATIVE DSH runtime (not an adapter — no package). */
+export const NATIVE_RUNTIME_ID = 'native';
+/**
+ * The unified runtime identifier convention: an adapter's roster key MUST be
+ * its package name's `agent-` suffix (`omp` ↔ `agent-omp`, `omp-sdk` ↔
+ * `agent-omp-sdk`), so one derivation IS the cross-machine agreement — the
+ * same ID travels on local rows and on every federated row (spec
+ * hub-roster-identity §1). `native` is the reserved DSH spelling.
+ * @param key - the roster key (`native`, or the adapter's runtime key).
+ * @returns the adapter package identifier (`agent-omp`, …) or `native`.
+ */
+export function runtimeIdOf(key) {
+    return key === 'native' ? NATIVE_RUNTIME_ID : `agent-${key}`;
+}
 const entries = new Map();
 const listeners = new Set();
 function emit() {

package/superd-hub/dist/switch-core.d.ts

@@ -647,11 +647,12 @@ export declare function decidePreFlight(label: string, row: PreFlightRow | undef
  *  hung hub answer must never swallow the toast). */
 export declare const MACHINE_DOWN_ENRICH_MS = 3000;
 /** The machines-face slice the machine-down feedback reads (the client's
- *  `fetchMachines()` satisfies this structurally). */
+ *  `fetchMachines()` satisfies this structurally). `name` is the machine's
+ *  sole display identity (spec hub-roster-identity §4). */
 export interface MachineDownMachinesFace {
     machines: readonly {
         id: string;
-        label: string;
+        name: string;
         status: string;
     }[];
 }

package/superd-hub/dist/switch-core.js

@@ -754,7 +754,7 @@ export function runMachineDownFeedback(label, row, faces) {
         if (enriched !== undefined) {
             const found = enriched.machines.find((entry) => entry.id === row.machine);
             if (found !== undefined) {
-                machineName = found.label;
+                machineName = found.name;
                 if (found.status === 'unreachable' || found.status === 'auth-expired')
                     status = found.status;
             }

package/superd-hub/dist/world-entry.d.ts

@@ -30,9 +30,12 @@ export declare const name = "superd-world-mount";
 /** Row config: which world this root is. */
 export interface Config {
     key: string;
+    /** Optional activation identity from the owning row's world patch. */
+    ownerId?: string;
 }
 /** Apply the world mount. @param ctx - the WORLD root context. @param config - `{ key }`. */
 export declare function apply(ctx: Context, config?: {
     key?: unknown;
+    ownerId?: unknown;
 }): void;
 export default apply;

package/superd-hub/dist/world-entry.js

@@ -11,6 +11,9 @@ export function apply(ctx, config) {
         return;
     }
     const mount = takeHostMount(key);
+    // A delayed old boot must not adopt its replacement's mount capability.
+    if (typeof config?.ownerId === 'string' && mount?.ownerId !== config.ownerId)
+        return;
     if (mount === undefined) {
         ctx.logger?.warn?.(`superd-world-mount: no host mount registered for key ${JSON.stringify(key)}`);
         return;
@@ -37,7 +40,7 @@ export function apply(ctx, config) {
         if (connection === undefined)
             return;
         if (typeof connection.createSharedFetchHandler === 'function') {
-            dropWorldFetch = publishWorldFetch(key, connection.createSharedFetchHandler('/api'));
+            dropWorldFetch = publishWorldFetch(key, connection.createSharedFetchHandler('/api'), mount);
         }
     });
     ctx.effect(() => () => {

package/superd-hub/dist/world-host.d.ts

@@ -24,6 +24,8 @@ export interface HostMount {
     key: string;
     /** Mount root (`/omp`). */
     labelPath: string;
+    /** Owning activation; carried into its world patch to reject obsolete boots. */
+    ownerId?: string;
 }
 /** Publish the host side of one world mount (idempotent replace). */
 export declare function registerHostMount(mount: HostMount): () => void;
@@ -57,8 +59,9 @@ export interface WorldFetchHandler {
  * can forward non-envelope traffic (`?agent=<label>` GET/HEAD) into the
  * world's registered routes (session-log export and friends). Called from
  * inside the world root (`world-entry`); read from the host root
- * (`carrier`). Idempotent replace.
+ * (`carrier`). Idempotent replace. An optional owner mount prevents delayed
+ * publication after that mount was removed or replaced.
  */
-export declare function publishWorldFetch(key: string, handler: WorldFetchHandler): () => void;
+export declare function publishWorldFetch(key: string, handler: WorldFetchHandler, owner?: HostMount): () => void;
 /** The world's published shared `/api` fetch handler, if its root published one yet. */
 export declare function worldFetchHandlerOf(key: string): WorldFetchHandler | undefined;

package/superd-hub/dist/world-host.js

@@ -50,9 +50,13 @@ const worldFetchHandlers = new Map();
  * can forward non-envelope traffic (`?agent=<label>` GET/HEAD) into the
  * world's registered routes (session-log export and friends). Called from
  * inside the world root (`world-entry`); read from the host root
- * (`carrier`). Idempotent replace.
+ * (`carrier`). Idempotent replace. An optional owner mount prevents delayed
+ * publication after that mount was removed or replaced.
  */
-export function publishWorldFetch(key, handler) {
+export function publishWorldFetch(key, handler, owner) {
+    // A connection may activate after its host row was removed or replaced.
+    if (owner !== undefined && mounts.get(key) !== owner)
+        return () => { };
     worldFetchHandlers.set(key, handler);
     return () => {
         if (worldFetchHandlers.get(key) === handler)

package/superd-hub/dist/world-join.d.ts

@@ -9,7 +9,7 @@ export interface Config {
 interface HostContext {
     provide(name: string, value: unknown): void;
     inject(deps: string[], callback: (ctx: unknown) => void): unknown;
-    effect?(callback: () => () => void, label?: string): unknown;
+    effect(callback: () => () => Promise<void>, label?: string): unknown;
     get(name: string): unknown;
 }
 /** Apply the join. @param ctx - the CTX0 root context. @param config - `{ key, label? }`. */

package/superd-hub/dist/world-join.js

@@ -32,11 +32,10 @@
 import { mkdirSync } from 'node:fs';
 import { resolveDshHome } from '@deepseek-ai/dsh-home-paths';
 import { join } from 'node:path';
-import { registerAgent, setFailed, setReady } from './roster.js';
-import { registerForeignTarget } from './targets.js';
+import { setFailed } from './roster.js';
 import { spawnWorld } from './spawn-world.js';
 import { provisionWorldProfile, resolveInstallAnchor } from './world-provision.js';
-import { registerHostMount } from './world-host.js';
+import { ownWorld } from './world-lifecycle.js';
 import { worldMountPatches } from './world-mount.js';
 /** Stable Cordis plugin name. */
 export const name = 'superd-join';
@@ -48,7 +47,6 @@ export function apply(ctx, config) {
         return;
     }
     const label = typeof config?.label === 'string' && config.label !== '' ? config.label : key;
-    registerAgent({ key, label, ready: false });
     // S7 nested home: the world's whole tree lives under `agents/<key>` (its
     // profiles were provisioned there by the line bootstrap; DSH data lands
     // inside the same root via spawnWorld's dataHome override).
@@ -65,33 +63,18 @@ export function apply(ctx, config) {
         adapterPkg: '@pgmi-builds/agent-claude',
         worldHome,
     });
-    const world = (async () => {
-        // T-D: the mount record is addressability only — no ctx0 listening-stack
-        // wait, no webServer instance, no authorize leg (the /hub family wires
-        // its own gate in ctx0, see gateway.ts).
-        const dropHostMount = registerHostMount({ key, labelPath: `/${key}` });
-        const ctxW = await spawnWorld({
-            appName: `superd-${key}`,
-            profileName: 'web',
-            installAnchor: resolveInstallAnchor(ctx), // lazy: never at module scope — import must stay side-effect-free
-            home: worldHome,
-            dataHome: worldHome,
-            // The host's live table carries this world: spawnWorld republishes a
-            // widened successor before boot imports anything (spec §2.1), and
-            // @pgmi-builds rows resolve from the profile-local links written above.
-            host: ctx,
-            extraPatches: worldMountPatches(key),
-        });
-        const gateway = ctxW.get('typertGateway');
-        registerForeignTarget({ key, gateway });
-        // T-C: no per-label mount anymore — the gateway above is the world's
-        // whole ingress, reached through the /hub family's `?agent=<key>` demux.
-        setReady(key, true);
-        ctx.effect?.(() => () => {
-            dropHostMount();
-        }, `superd-join: ${key} mount`);
-        return ctxW;
-    })().catch((cause) => {
+    const world = ownWorld(ctx, { key, label }, (ownerId) => spawnWorld({
+        appName: `superd-${key}`,
+        profileName: 'web',
+        installAnchor: resolveInstallAnchor(ctx), // lazy: never at module scope — import must stay side-effect-free
+        home: worldHome,
+        dataHome: worldHome,
+        // The host's live table carries this world: spawnWorld republishes a
+        // widened successor before boot imports anything (spec §2.1), and
+        // @pgmi-builds rows resolve from the profile-local links written above.
+        host: ctx,
+        extraPatches: worldMountPatches(key, ownerId),
+    }), (cause) => {
         // A failed world degrades to a FAILED roster row (mount stays for
         // diagnosis; ready stays false); a rejected provided promise would fail
         // the entire host boot (loader entry apply).
@@ -100,7 +83,6 @@ export function apply(ctx, config) {
             setFailed(key, true);
         }
         catch { /* roster row already gone */ }
-        return null;
     });
     ctx.provide(`superd.world.${key}`, world);
 }

package/superd-hub/dist/world-lifecycle.d.ts

@@ -0,0 +1,20 @@
+/** Cordis owns the effect and awaits its disposer when the row unloads. */
+interface WorldOwner {
+    effect(callback: () => () => Promise<void>, label?: string): unknown;
+}
+interface OwnedWorld {
+    get(name: string): unknown;
+    effect(callback: () => () => void, label?: string): unknown;
+    fiber: {
+        dispose(): Promise<void>;
+    };
+}
+/**
+ * One row owns its roster membership, mount, target and sibling world. Install
+ * cleanup before starting boot: completion can arrive after the owner unloads.
+ */
+export declare function ownWorld<T extends OwnedWorld>(ctx: WorldOwner, entry: {
+    key: string;
+    label: string;
+}, spawn: (ownerId: string) => Promise<T>, onFailure: (cause: unknown) => void): Promise<T | null>;
+export {};