super-dsh 0.1.3 → 0.1.4

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "super-dsh",
-  "version": "0.1.3",
-  "description": "Agent Worlds for the DeepSeek Harness (DSH) — one dsh plugin that mounts the agent hub (runtime selector, roster, per-runtime worlds) and joins local foreign-agent runtimes (OMP, Codex, Claude, Pi, Hermes, Antigravity) into the DSH Web UI. Each runtime keeps its native home and session store; the hub only bridges.",
+  "version": "0.1.4",
+  "description": "Super D for the DeepSeek Harness (DSH) — one dsh plugin that mounts the superd hub (roster, per-runtime agents) and joins local foreign-agent runtimes (OMP, Codex, Claude, Pi, Hermes, Antigravity) into the DSH Web UI. Each runtime keeps its native home and session store; the hub only bridges.",
   "type": "module",
   "license": "MIT",
   "repository": {
@@ -9,27 +9,25 @@
     "url": "git+https://github.com/pgmi-builds/superd.git"
   },
   "exports": {
-    ".": "./agent-hub/dist/index.js",
-    "./hub": "./agent-hub/dist/index.js",
-    "./join": "./agent-hub/dist/world-join.js",
-    "./world/omp": "./agent-omp/dist/world-plugin.js",
-    "./world/codex": "./agent-codex/dist/world-plugin.js",
-    "./world/claude": "./agent-claude/dist/world-plugin.js",
-    "./world/pi": "./agent-pi/dist/world-plugin.js",
-    "./world/hermes": "./agent-hermes/dist/world-plugin.js",
-    "./world/agy": "./agent-agy/dist/world-plugin.js",
-    "./client": "./client/index.js",
+    ".": "./superd-hub/dist/index.js",
+    "./hub": "./superd-hub/dist/index.js",
+    "./join": "./superd-hub/dist/world-join.js",
+    "./agents/omp": "./agent-omp/dist/world-plugin.js",
+    "./agents/codex": "./agent-codex/dist/world-plugin.js",
+    "./agents/claude": "./agent-claude/dist/world-plugin.js",
+    "./agents/pi": "./agent-pi/dist/world-plugin.js",
+    "./agents/hermes": "./agent-hermes/dist/world-plugin.js",
+    "./agents/agy": "./agent-agy/dist/world-plugin.js",
     "./cordis.patch.yml": "./cordis.patch.yml",
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./web-trust": "./superd-hub/dist/web-trust.js"
   },
   "files": [
     "cordis.patch.yml",
-    "client",
     "README.md",
-    "agent-hub/dist",
-    "agent-hub/lib",
-    "agent-hub/package.json",
-    "agent-hub/cordis.patch.yml",
+    "superd-hub/dist",
+    "superd-hub/package.json",
+    "superd-hub/cordis.patch.yml",
     "agent-omp/dist",
     "agent-omp/package.json",
     "agent-omp/cordis.patch.yml",
@@ -54,12 +52,6 @@
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
-    },
-    "client": {
-      "inject": [
-        "@deepseek-ai/dsh-client-ui-slots"
-      ],
-      "platform": "web"
     }
   },
   "dependencies": {
@@ -70,24 +62,24 @@
     "@openai/codex-sdk": "0.154.0",
     "bun": "^1.4.2",
     "ws": "^8.21.0",
-    "zod": "3.25.76",
+    "zod": "4.4.3",
     "@modelcontextprotocol/sdk": "^1.29.0"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-agent": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-agent-presets": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-api-gateway": "*",
-    "@deepseek-ai/dsh-commands": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-home-paths": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-host-webserver": "*",
-    "@deepseek-ai/dsh-llm": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-scope": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-session": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-session-persistence": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-user-approval": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-user-questions": "0.1.5-rc.2"
+    "@deepseek-ai/dsh-agent": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-agent-presets": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-api-gateway": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-commands": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-home-paths": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-host-webserver": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-llm": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-scope": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-session": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-session-persistence": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-typert-protocol": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-user-approval": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-user-questions": ">=0.1.5-0 <0.3.0-0"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/cordis": {

package/{agent-hub → superd-hub}/cordis.patch.yml

@@ -1,4 +1,4 @@
-# Mount the agent-hub host half BESIDE the upstream gateway.
+# Mount the superd-hub host half BESIDE the upstream gateway.
 # The typert-gateway row STAYS ENABLED: disabling it also removed the
 # gateway package's client half from the browser module table (learned
 # 2026-09-10: session-controller's client requires
@@ -8,5 +8,5 @@
 # The /api/agent-runtime selector RPC face rides along (control plane,
 # always CTX0-local).
 - insert:
-    - id: agent-hub
-      name: '@pgmi-builds/agent-hub'
+    - id: superd-hub
+      name: '@pgmi-builds/superd-hub'

package/{agent-hub → superd-hub}/dist/carrier.d.ts

@@ -1,10 +1,16 @@
 import { type RealWebServerFace } from './world-web-server.js';
 import { type MuxFailure } from './world-mux.js';
-/** The two-method face of a world's typertGateway service instance. */
+/** The three-method face of a world's typertGateway service instance. */
 export interface CarrierGatewayFace {
     dispatchRpc(endpoint: string, payload: unknown, signal: AbortSignal): Promise<unknown>;
-    /** Streams return an async iterable (upstream face is synchronous-returning). */
-    openWireStream(endpoint: string, payload: unknown, signal: AbortSignal): Promise<AsyncIterable<unknown>> | AsyncIterable<unknown>;
+    /**
+     * Streams return an async iterable (upstream face is synchronous-returning).
+     * Canonical order: (endpoint, payload, uplink, peer, signal, control) — the
+     * carrier passes no peer (ctx0's fence already authenticated the client),
+     * the mux controller's signal, and the controller itself, exactly as the
+     * native gateway's mux wires its own streams.
+     */
+    openWireStream(endpoint: string, payload: unknown, uplink: AsyncIterable<unknown>, peer: undefined, signal: AbortSignal, control: AbortController): Promise<AsyncIterable<unknown>> | AsyncIterable<unknown>;
 }
 /** Options for mounting one world. */
 export interface MountWorldOptions {

package/{agent-hub → superd-hub}/dist/carrier.js

@@ -5,12 +5,17 @@
  *  - Task 4: unary RPC — `/<label>/api/<endpoint>` decodes the connection
  *    envelope and dispatches into the ADDRESSED world's gateway instance.
  *  - Task 6: mux — `/<label>/api/remote.mux` upgrade bridged to the same
- *    instance (no shared selection anywhere).
+ *    instance (no shared selection anywhere). Wire protocol is dsh 0.1.7's
+ *    stream protocol incl. the client uplink (`item`/`end` frames).
  *  - 2026-09-17 (H1): non-envelope GET/HEAD on `/<label>/api` forwards into
  *    the owning world's registered exact Fetch routes — the world connection's
  *    shared `/api` handler, published from `world-entry` via `world-host` —
  *    still behind ctx0's fence, so `HEAD /<label>/api/session.export?...`
  *    reaches the world's session-log-download route.
+ *  - 2026-09-24: `/<label>/open-in-app/*` GETs bridge the same way — the
+ *    world page's open-in-app feature polls its host routes relative to the
+ *    mount base (`/omp/open-in-app/apps`), which live on the WORLD's
+ *    connection, not ctx0's.
  *
  * The addressed world is the request's path. Nothing here reads a global.
  */
@@ -203,8 +208,29 @@ export function mountWorld(options) {
         path: apiPath,
         handler: handleUnary,
     }));
-    // Mux: the world's own stream face behind the same mount prefix.
-    const mux = new WorldMuxServer((endpoint, payload, signal) => Promise.resolve(options.gateway.openWireStream(endpoint, payload, signal)), {
+    // The world page's open-in-app feature polls its host routes relative to the
+    // mount base (`/omp/open-in-app/apps`); those exact routes live on the
+    // WORLD's connection, so they bridge exactly like the non-envelope `/api`
+    // GETs — behind ctx0's fence, answered by the owning world.
+    const openInAppPath = `${labelPath}/open-in-app`;
+    disposers.push(options.real.register({
+        kind: 'prefix',
+        path: openInAppPath,
+        handler: (async (req, res) => {
+            const rejection = options.requestRejection?.(req);
+            if (rejection !== undefined) {
+                writeText(res, rejection, rejection === 401 ? 'unauthorized' : 'forbidden');
+                return;
+            }
+            await bridgeWorldFetch(req, res);
+        }),
+    }));
+    // Mux: the world's own stream face behind the same mount prefix. The wire
+    // protocol is dsh 0.1.7's stream protocol — including the client uplink —
+    // and the world call uses the gateway's canonical argument order
+    // (endpoint, payload, uplink, peer, signal, control): the mux's controller
+    // supplies both the request signal and the logical-stream control.
+    const mux = new WorldMuxServer((endpoint, payload, uplink, control) => Promise.resolve(options.gateway.openWireStream(endpoint, payload, uplink, undefined, control.signal, control)), {
         ...(options.heartbeatIntervalMs === undefined ? {} : { heartbeatIntervalMs: options.heartbeatIntervalMs }),
         ...(options.failure === undefined ? {} : { failure: options.failure }),
     });

package/{agent-hub → superd-hub}/dist/gateway.d.ts

@@ -1,5 +1,5 @@
 /**
- * @pgmi-builds/agent-hub — plugin entry (host half).
+ * @pgmi-builds/superd-hub — plugin entry (host half).
  *
  * DL7 (2026-09-16): there is NO server-side selected state. The module-level
  * selector and the instance-delegation wrapper that consumed it were removed;
@@ -15,7 +15,7 @@
  */
 import type { Context } from '@deepseek-ai/cordis';
 /** Stable Cordis plugin name. */
-export declare const name = "agent-hub";
+export declare const name = "superd-hub";
 /**
  * The plugin form (row contract): applied when the row mounts.
  *

package/{agent-hub → superd-hub}/dist/gateway.js

@@ -1,7 +1,7 @@
 import { registerSelectorRpc, registryTargets } from './rpc.js';
 import { agentRosterRow } from './agent-roster.js';
 /** Stable Cordis plugin name. */
-export const name = 'agent-hub';
+export const name = 'superd-hub';
 /**
  * The plugin form (row contract): applied when the row mounts.
  *

package/{agent-hub → superd-hub}/dist/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * @pgmi-builds/agent-hub — host half public surface (Agent Worlds line).
+ * @pgmi-builds/superd-hub — host half public surface (Super D line).
  *
  * The line owns the switch and the gateway (per super-dsh/AGENTS.md):
  * the world inventory control plane + the foreign agent roster + the world
@@ -13,7 +13,7 @@ export { handleAgentRuntime, registerSelectorRpc, AGENT_RUNTIME_RPC_PATH, regist
 export { registerForeignTarget, unregisterForeignTarget, getTarget, listRuntimeKeys, type ForeignTarget, type GatewayFace } from './targets.js';
 export { registerAgent, unregisterAgent, setReady, listAgents, onRosterChanged, type RosterEntry } from './roster.js';
 export { spawnWorld, type SpawnWorldOptions } from './spawn-world.js';
-export { provisionWorldProfile, type ProvisionWorldOptions } from './world-provision.js';
+export { provisionWorldProfile, resolveInstallAnchor, type ProvisionWorldOptions } from './world-provision.js';
 export { claimLabel, labelOf, releaseLabel, listLabels, type LabelClaim, type ClaimOptions } from './labels.js';
 export { WorldWebServer, stripLabelFromUrl, type WorldWebRoute, type WorldWebUpgradeRoute, type RealWebServerFace } from './world-web-server.js';
 export { parseClientRequest, serverResponse, serverError, serverResult, wireErrorOf, EnvelopeError, type ClientRequestEnvelope, type WireError } from './envelope.js';
@@ -23,7 +23,9 @@ export { renderClientShim } from './client-shim.js';
 export { agentLinks, agentRosterRow, AGENT_ROSTER_GLOBAL, type AgentLink } from './agent-roster.js';
 export { createOwnershipIndex, type OwnershipIndex, type OwnershipRow } from './ownership.js';
 export { registerHostMount, takeHostMount, listHostMounts, noteWorldServer, worldServerOf, type HostMount } from './world-host.js';
-export { worldMountPatches, WORLD_MOUNT_PLUGIN, WORLD_MOUNT_ROW_ID, type WorldPatchLayer } from './world-mount.js';
+export { worldMountPatches, WORLD_MOUNT_PLUGIN, WORLD_MOUNT_ROW_ID, WORLD_WEB_TRUST_PLUGIN, WORLD_WEB_TRUST_ROW_ID, type WorldPatchLayer, } from './world-mount.js';
+export { buildTrustScript, deriveDefaultPageAuthorities, type BootScriptRow, type TrustConfig, } from './web-trust.js';
+export { withSystemHead, type HeadAwareSessionFace, type HeadPlaceholder, type WithSystemHead } from './system-head.js';
 export { default as worldApply, name as worldPluginName, type Config as WorldEntryConfig } from './world-entry.js';
 export { default as joinApply, name as worldJoinPluginName, type Config as WorldJoinConfig } from './world-join.js';
 export { default } from './gateway.js';

package/{agent-hub → superd-hub}/dist/index.js

@@ -1,5 +1,5 @@
 /**
- * @pgmi-builds/agent-hub — host half public surface (Agent Worlds line).
+ * @pgmi-builds/superd-hub — host half public surface (Super D line).
  *
  * The line owns the switch and the gateway (per super-dsh/AGENTS.md):
  * the world inventory control plane + the foreign agent roster + the world
@@ -13,7 +13,7 @@ export { handleAgentRuntime, registerSelectorRpc, AGENT_RUNTIME_RPC_PATH, regist
 export { registerForeignTarget, unregisterForeignTarget, getTarget, listRuntimeKeys } from './targets.js';
 export { registerAgent, unregisterAgent, setReady, listAgents, onRosterChanged } from './roster.js';
 export { spawnWorld } from './spawn-world.js';
-export { provisionWorldProfile } from './world-provision.js';
+export { provisionWorldProfile, resolveInstallAnchor } from './world-provision.js';
 export { claimLabel, labelOf, releaseLabel, listLabels } from './labels.js';
 export { WorldWebServer, stripLabelFromUrl } from './world-web-server.js';
 export { parseClientRequest, serverResponse, serverError, serverResult, wireErrorOf, EnvelopeError } from './envelope.js';
@@ -23,7 +23,9 @@ export { renderClientShim } from './client-shim.js';
 export { agentLinks, agentRosterRow, AGENT_ROSTER_GLOBAL } from './agent-roster.js';
 export { createOwnershipIndex } from './ownership.js';
 export { registerHostMount, takeHostMount, listHostMounts, noteWorldServer, worldServerOf } from './world-host.js';
-export { worldMountPatches, WORLD_MOUNT_PLUGIN, WORLD_MOUNT_ROW_ID } from './world-mount.js';
+export { worldMountPatches, WORLD_MOUNT_PLUGIN, WORLD_MOUNT_ROW_ID, WORLD_WEB_TRUST_PLUGIN, WORLD_WEB_TRUST_ROW_ID, } from './world-mount.js';
+export { buildTrustScript, deriveDefaultPageAuthorities, } from './web-trust.js';
+export { withSystemHead } from './system-head.js';
 export { default as worldApply, name as worldPluginName } from './world-entry.js';
 export { default as joinApply, name as worldJoinPluginName } from './world-join.js';
 export { default } from './gateway.js';

package/{agent-hub → superd-hub}/dist/roster.d.ts

@@ -3,8 +3,8 @@
  *
  * No config file: an agent is in the roster exactly while its adapter
  * plugin is loaded and registered. Adapter plugins self-register on
- * activation (key/label/ready) and the RuntimeSeat chip consumes the
- * snapshot. Roster entries are inventory only: they carry NO selection —
+ * activation (key/label/ready). Roster entries are inventory only: they
+ * carry NO selection —
  * the addressed world is the request's mount path (`DL7`, 2026-09-16).
  * one authority.
  */

package/{agent-hub → superd-hub}/dist/rpc.js

@@ -47,6 +47,6 @@ export function registerSelectorRpc(ctx, source) {
             methods: ['GET', 'POST'],
             requestBody: 'buffered',
             fetch: (request) => handleAgentRuntime(request, source),
-        }), 'agent-hub: /api/agent-runtime route');
+        }), 'superd-hub: /api/agent-runtime route');
     });
 }

package/{agent-hub → superd-hub}/dist/spawn-world.d.ts

@@ -9,12 +9,27 @@
  * test/boot-prepare-ordering.test.mjs. Data detachment at this stage comes
  * from the adapter side (foreign app-home redirection, spec §七).
  *
- * Profile resolution: loadProfile(name, profileName, installAnchor, home)
- * reads profiles under `<home>/profiles/<profileName>` and heals the
- * `@deepseek-ai/*` fallback farm into `<home>/profiles/node_modules` from
- * the install anchor (single instance — same physical installation).
+ * Profile resolution (2026-09-25 upstream alignment —
+ * docs/specs/world-resolution-upstream): loadProfile(name, profileName,
+ * installAnchor, home) reads profiles under `<home>/profiles/<profileName>`
+ * and writes nothing to disk. Before boot imports a single row, spawnWorld
+ * publishes THIS world into the HOST's live resolution table (the successor
+ * contract's sanctioned surface: an added linkedRoot covering the world
+ * tree + added table entries for the world's own `@pgmi-builds` packages +
+ * a generated peerDependencies block in the world profile manifest for
+ * routeLinked's peer gate). The world config's bare row names then resolve
+ * through the same interception the launcher uses; the per-world bare-URL
+ * farms and bareModuleBaseUrl are gone.
  */
 import { boot } from '@deepseek-ai/dsh-app-boot';
+/**
+ * The host (ctx0) surface spawnWorld needs: cordis `ctx.get`, which locates
+ * the launcher's `pluginPackages` table and `profileContext` facts. Structural
+ * on purpose — adapters pass their own minimal host context.
+ */
+export interface WorldHostSurface {
+    get(name: string): unknown;
+}
 export interface SpawnWorldOptions {
     /** App name for the spawned root (also its fiber label). */
     appName: string;
@@ -40,7 +55,13 @@ export interface SpawnWorldOptions {
     dataHome?: string;
     /** Extra patch layers appended after the profile's own (e.g. an adapter's insert row). */
     extraPatches?: Parameters<typeof boot>[2];
-    /** Override the bare-name resolution base (defaults to the install anchor's node_modules). */
-    bareModuleBaseUrl?: string;
+    /**
+     * The host (ctx0) context. When it carries the launcher's `pluginPackages`
+     * table, spawnWorld republishes a widened successor so this world's tree
+     * resolves through the host table exactly like a launcher profile (spec
+     * §2.1). Table-less harnesses (unit tests, embedders) omit it and keep
+     * native resolution.
+     */
+    host?: WorldHostSurface;
 }
 export declare function spawnWorld(opts: SpawnWorldOptions): Promise<import("@deepseek-ai/cordis").Context>;

package/superd-hub/dist/spawn-world.js

@@ -0,0 +1,277 @@
+/**
+ * spawnWorld (S2): spawn a sibling ROOT context for a foreign agent world
+ * from the CTX0 tree — the library form of the PoC (ADR 0008 mechanism,
+ * .scratch/multi-context-poc/spawner2.mjs collapsed into a function).
+ *
+ * AW-A posture: SHARED home (ADR 0008 constraint 2 fallback). The ctxN
+ * `dshHomePath` service override is an AW-C1 item (spec §三/§十一.2) — the
+ * boot() provide/prepare ordering fact is pinned by
+ * test/boot-prepare-ordering.test.mjs. Data detachment at this stage comes
+ * from the adapter side (foreign app-home redirection, spec §七).
+ *
+ * Profile resolution (2026-09-25 upstream alignment —
+ * docs/specs/world-resolution-upstream): loadProfile(name, profileName,
+ * installAnchor, home) reads profiles under `<home>/profiles/<profileName>`
+ * and writes nothing to disk. Before boot imports a single row, spawnWorld
+ * publishes THIS world into the HOST's live resolution table (the successor
+ * contract's sanctioned surface: an added linkedRoot covering the world
+ * tree + added table entries for the world's own `@pgmi-builds` packages +
+ * a generated peerDependencies block in the world profile manifest for
+ * routeLinked's peer gate). The world config's bare row names then resolve
+ * through the same interception the launcher uses; the per-world bare-URL
+ * farms and bareModuleBaseUrl are gone.
+ */
+import { loadProfile, boot, composeEntries, createRuntimeResolution } from '@deepseek-ai/dsh-app-boot';
+import { provideCmdline } from '@deepseek-ai/dsh-cmdline';
+import { dump } from 'js-yaml';
+import { entryListSchema } from '@deepseek-ai/cordis-plugin-include';
+import { existsSync, writeFileSync, readFileSync, readdirSync, realpathSync } from 'node:fs';
+import { join } from 'node:path';
+/**
+ * Republish the host's live resolution with THIS world added as a linked
+ * root (spec §2.1, contract-legal form): `profilesDir`/`profileDir` are
+ * frozen per process ("a successor cannot change its profile scope"), so
+ * the world tree joins the table the way the successor contract sanctions —
+ * an added linkedRoot covering `<worldHome>`, added entries for the world's
+ * own `@pgmi-builds` packages (routeLinked resolves names from the table),
+ * and a generated `peerDependencies` block in the world profile manifest
+ * (routeLinked's peer gate reads the importer's ancestor manifests; the
+ * peers are the composed rows' bare names — deterministic, regenerated on
+ * every spawn, so upstream row additions self-heal on the next boot).
+ *
+ * Faithful reconstruction — reload the launcher's profile from
+ * `profileContext` facts and recompute: the service exposes no `current`,
+ * and a plugin add between host boot and now is picked up for free (each
+ * spawn re-publishes; worlds are spawn-time facts and never recompose, so a
+ * later host-side replace can only affect the next spawn).
+ */
+async function publishWorldInHostResolutionTurn(packages, launcher, opts, worldProfileDir, peerNames) {
+    const profile = loadProfile('dsh', launcher.name, launcher.installAnchor, launcher.home);
+    const base = await createRuntimeResolution({ installAnchor: launcher.installAnchor, profile, home: launcher.home });
+    // routeLinked's peer gate: the gate reads ancestor manifests of the
+    // IMPORTER — and ctx.baseUrl is a DIRECTORY URL with a trailing slash, so
+    // the resolver's dirname() lands on `<worldHome>/profiles`, one level
+    // above the profile itself. Peers therefore go into BOTH manifests (the
+    // world profile's own and the profiles-level directory), regenerated
+    // idempotently on every spawn — upstream row additions self-heal next boot.
+    const peers = Object.fromEntries([...peerNames].sort().map((name) => [name, '*']));
+    for (const manifestDir of [worldProfileDir, join(opts.home, 'profiles')]) {
+        const manifestPath = join(manifestDir, 'package.json');
+        const manifest = existsSync(manifestPath)
+            ? JSON.parse(readFileSync(manifestPath, 'utf8'))
+            : { name: `superd-${opts.appName}-profiles`, private: true };
+        manifest.peerDependencies = peers;
+        writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\n');
+    }
+    // The world's own packages become table entries (targets = the realpaths of
+    // the profile-local links provisionWorldProfile wrote). declarer MUST be a
+    // manifest PATH: the ESM interception rewrites the resolve parent to it
+    // (pathToFileURL(route.entry.declarer)).
+    const declarer = join(worldProfileDir, 'package.json');
+    const worldScope = join(worldProfileDir, 'node_modules', '@pgmi-builds');
+    const baseNames = new Set(base.entries.map((entry) => entry.name));
+    for (const name of readdirSync(worldScope, { withFileTypes: true })) {
+        if (!name.isDirectory() && !name.isSymbolicLink())
+            continue;
+        const pkgName = `@pgmi-builds/${name.name}`;
+        // A profile-declared package already covers the name (a consumer who
+        // properly installed our subpackages) — the base entry wins, never assert
+        // a divergent mapping over it.
+        if (baseNames.has(pkgName))
+            continue;
+        const packageDir = realpathSync(join(worldScope, name.name));
+        const pkgManifest = JSON.parse(readFileSync(join(packageDir, 'package.json'), 'utf8'));
+        // FIRST-WRITE-WINS: shared names (every world publishes superd-hub) must
+        // keep the first publisher's declarer — overwriting it with another
+        // world's manifest path trips "replacing X requires a process restart"
+        // (dev3 0.1.3-u evidence). Any manifest path satisfies the ESM redirect;
+        // the peer gate reads the IMPORTER's ancestors, not the declarer.
+        if (!publishedEntries.has(pkgName)) {
+            publishedEntries.set(pkgName, { name: pkgName, packageDir, version: pkgManifest.version, declarer, scope: 'profile' });
+        }
+    }
+    const rootName = `superd-world-${opts.appName}`;
+    if (!publishedRoots.has(rootName)) {
+        publishedRoots.set(rootName, { name: rootName, realPath: opts.home });
+    }
+    packages.replace({
+        ...base,
+        entries: [...base.entries, ...publishedEntries.values()],
+        linkedRoots: [...base.linkedRoots, ...publishedRoots.values()],
+    });
+}
+/** Bare package name of a module specifier (`@scope/pkg/sub` → `@scope/pkg`). */
+function barePackageNameOf(specifier) {
+    if (!specifier || specifier[0] === '.' || specifier[0] === '/' || specifier[0] === '#' || specifier.includes(':'))
+        return undefined;
+    const first = specifier.indexOf('/');
+    if (specifier[0] !== '@')
+        return first < 0 ? specifier : specifier.slice(0, first);
+    if (first < 0)
+        return;
+    const second = specifier.indexOf('/', first + 1);
+    return second < 0 ? specifier : specifier.slice(0, second);
+}
+/**
+ * Cross-spawn accumulation (spec §2.1, dev3 0.1.3-t evidence): the service
+ * exposes no `current`, and every reconstruction starts from a fresh base —
+ * a successor that DROPS a prior world's additions trips the contract
+ * ("replacing X requires a process restart") and every world after the
+ * first falls back to native resolution. Each spawn therefore merges its
+ * additions into this process-wide accumulator, and successors always carry
+ * the union. Values are deterministic per world (stable worldHome and pack
+ * paths), so re-spawns re-assert identical mappings — contract-stable.
+ */
+const publishedEntries = new Map();
+const publishedRoots = new Map();
+/**
+ * Serializes table publishing: the six world spawns run concurrently, and
+ * interleaved reconstruct→replace cycles assert divergent successors against
+ * a mid-flight current (dev3 0.1.3-u evidence). One publish at a time; a
+ * failed turn never blocks the next (the caller's fail-soft handles it).
+ */
+let publishQueue = Promise.resolve();
+async function publishWorldInHostResolution(host, opts, worldProfileDir, peerNames) {
+    const packages = host.get('pluginPackages');
+    const launcher = host.get('profileContext');
+    if (packages === undefined || launcher?.installAnchor === undefined || launcher.home === undefined || launcher.name === undefined)
+        return;
+    const turn = publishQueue.catch(() => { }).then(() => publishWorldInHostResolutionTurn(packages, launcher, opts, worldProfileDir, peerNames));
+    publishQueue = turn;
+    await turn;
+}
+export async function spawnWorld(opts) {
+    const profile = loadProfile(opts.appName, opts.profileName, opts.installAnchor, opts.home);
+    // THE FILE IS THE COMPOSITION (0.1.7 alignment): compose every layer
+    // (bundle patches in profile order + profile patch + spawn extras like
+    // worldMountPatches) ONCE here and write the FINAL row list into the
+    // include file. Boot mounts it with NO patch stream. Rationale: the
+    // include's runtime patch application provably dropped the spawn-time
+    // worldMountPatches in nested boots (webserver re-enabled on 3080, world
+    // rows gone — 2026-09-24 alignment evidence), while the composition itself
+    // is deterministic and dumpable with the loader's own dialect (`!!js`
+    // preserved via entryListSchema).
+    const composed = composeEntries(profile.layers.map((l) => l.patches).concat([profile.patches, ...(opts.extraPatches ?? [])]), () => { });
+    writeFileSync(join(profile.dir, 'cordis.yml'), dump(composed, { schema: entryListSchema, noRefs: true, lineWidth: -1 }) + '\n');
+    const patches = [];
+    if (process.env.SUPERD_TRACE === '1') {
+        // Alignment diagnostics: what the world tree will actually compose.
+        try {
+            const rows = composed;
+            const pick = (id) => rows.find((r) => r.id === id);
+            for (const id of ['webserver', 'hmr', 'modules', 'superd-world-mount', 'superd-hub', 'agent-preset-registry']) {
+                const row = pick(id);
+                process.stderr.write(`[spawn-world:${opts.appName}] ${id}: ${row === undefined ? 'ABSENT' : JSON.stringify({ disabled: row.disabled, inject: 'inject' in row ? row.inject : undefined, name: row.name })}\n`);
+            }
+            process.stderr.write(`[spawn-world:${opts.appName}] composed rows: ${rows.length}\n`);
+            process.stderr.write(`[spawn-world:${opts.appName}] patches tail: ${JSON.stringify(patches.slice(-3).map((p) => p.id ?? (Array.isArray(p.insert) ? `insert(${p.insert.length})` : '?')))}\n`);
+        }
+        catch (cause) {
+            process.stderr.write(`[spawn-world:${opts.appName}] trace compose failed: ${String(cause)}\n`);
+        }
+    }
+    // Host table first (spec §2.1): publish this world as a linked root of the
+    // live resolution BEFORE boot() mounts the root include — the world config's
+    // bare row names then resolve through the same interception the launcher
+    // uses. Fail-soft: a table-less or hostile host degrades to native
+    // resolution (the world fails loudly on its first missing import, never the
+    // host).
+    if (opts.host !== undefined) {
+        try {
+            const peerNames = new Set();
+            for (const row of composed) {
+                for (const specifier of [
+                    ...(typeof row.name === 'string' ? [row.name] : []),
+                    ...(Array.isArray(row.inject) ? row.inject.filter((s) => typeof s === 'string') : []),
+                ]) {
+                    const bare = barePackageNameOf(specifier);
+                    if (bare !== undefined)
+                        peerNames.add(bare);
+                }
+            }
+            await publishWorldInHostResolution(opts.host, opts, profile.dir, peerNames);
+        }
+        catch (cause) {
+            process.stderr.write(`[spawn-world:${opts.appName}] host table publishing failed (${String(cause)}) — falling back to native resolution\n`);
+        }
+    }
+    // Embedding-host facts via the PUBLIC cmdline API (risk-2 probe: boot owns
+    // dshHomePath, so the prepare slot is for OUR provides — cmdlineArgs is not
+    // boot-provided and upstream documents the empty-args embedding path).
+    // Worlds take no flags and never open a browser; exit = dispose own fiber.
+    // LAN authorities for the world's trust fence (deploy-level, env-driven):
+    // the world webserver must accept the Host the browser actually sends.
+    const trusted = (process.env.SUPERD_TRUSTED_HOSTS ?? '')
+        .split(/[\s,]+/).filter(Boolean)
+        .flatMap((h) => ['--trusted-host', h]);
+    let fiber;
+    // Launcher parity (0.1.7): a profileContext-carrying tree runs the profile
+    // HMR row, whose init REQUIRES the appReady service (otherwise "Profile HMR
+    // requires application readiness"). The launcher owns the readiness signal
+    // and commits it after boot settles — worlds do the same inline.
+    let appReadyCommitted = false;
+    const appReadyListeners = new Set();
+    const appReady = {
+        service: {
+            onReady(listener) {
+                if (appReadyCommitted) {
+                    listener();
+                    return () => { };
+                }
+                appReadyListeners.add(listener);
+                return () => { appReadyListeners.delete(listener); };
+            },
+        },
+        commit() {
+            if (appReadyCommitted)
+                return;
+            appReadyCommitted = true;
+            for (const listener of [...appReadyListeners])
+                listener();
+            appReadyListeners.clear();
+        },
+    };
+    const ctxW = await boot(opts.appName, join(profile.dir, 'cordis.yml'), patches, (ctx) => {
+        provideCmdline(ctx, {
+            args: ['--no-open', ...trusted],
+            exit: () => { void fiber?.dispose(); },
+            ready: appReady.service,
+        });
+        // This tree reads its own home from here on: sessions, settings.yaml,
+        // workspace store — all under the world's nested root.
+        //
+        // `set` (not `provide`): boot already registered `dshHomePath` on this
+        // root, and cordis refuses a second `provide` in the same scope
+        // ("service … has been registered at <root>"). `set` is the documented
+        // "overwrite a provided service's value" path for the owning fiber, which
+        // the prepare slot is — and ADR 0008 constraint 2 prescribes exactly this
+        // in-tree override (process.env is a shared resolver and must not change).
+        if (opts.dataHome !== undefined) {
+            const dataHome = opts.dataHome;
+            ctx.set('dshHomePath', (...segments) => join(dataHome, ...segments));
+        }
+        // 0.1.7: profile-mounted services (settings …) inject `profileContext`,
+        // which only runProfile's prepare slot used to provide. Worlds boot
+        // directly, so provide the equivalent here — without it every world's
+        // provider row pends on `waiting for service: settings`. This also arms
+        // the row-admission compatibility preflight inside world trees (it no-ops
+        // without a profileContext, which would leave world rows unjudged).
+        ctx.provide('profileContext', {
+            name: opts.appName,
+            dir: profile.dir,
+            patchPath: profile.patchPath,
+            installAnchor: opts.installAnchor,
+            cwd: process.cwd(),
+            home: opts.home,
+            startedBundles: profile.layers.map((l) => l.packageName),
+            overlays: profile.patches,
+            telemetryDisabledEnv: process.env.DSH_TELEMETRY_DISABLED,
+        });
+    });
+    fiber = ctxW.fiber;
+    // Launcher parity: commit readiness only when the world tree actually
+    // settled with a Loader (runProfile's same condition).
+    if (ctxW.get('loader') !== undefined)
+        appReady.commit();
+    return ctxW;
+}