super-dsh 0.1.3 → 0.1.5

package/superd-hub/dist/hub-route.js

@@ -0,0 +1,188 @@
+/**
+ * The hub-owned `/hub` route family (native UI fusion, plan Task 2).
+ *
+ * ONE prefix route + ONE upgrade route on ctx0's webServer (design ratified
+ * 2026-09-26): every FOREIGN-agent request funnels into this family and the
+ * demux key rides the query (`?agent=<label>`) instead of the path. The
+ * native `/api` surface is never touched — this family is the only seam. It
+ * registers unconditionally (authorize-gated, inert until a request carries a
+ * registered foreign label); the fusion feature flag never gates server route
+ * registration.
+ *
+ * Semantics per request:
+ *  - `?agent=<label>` with a registered gateway → the request is consumed and
+ *    forwarded to that world: envelope POST → `dispatchRpc`, non-envelope
+ *    GET/HEAD → the world's published `/api` fetch handler, WS upgrade → a
+ *    `WorldMuxServer` bound to that gateway. The demux key is CONSUMED, so
+ *    the world sees exactly the URL its native page would have sent
+ *    (`/hub/api/x?agent=o&p=1` → world `/api/x?p=1`).
+ *  - no `agent` param or `agent=native` → 404 JSON: the family serves foreign
+ *    traffic only; native belongs to `/api`.
+ *  - unknown / not-yet-spawned label → 404 JSON `{error:'unknown-agent',
+ *    label}` — silent degradation, never a locked page.
+ *
+ * The ctx0 gate is the SAME authorize source the world mounts use
+ * (`connection.authorizeIndex`, the boolean face whose false path already
+ * wrote the answer — 401 or the token→cookie 303); the family then runs the
+ * SAME browser-trust fence the sibling `/<label>/api` mounts run
+ * (`requestRejection`, the connection's `isTrustedApiRequest` face) before it
+ * answers anything — the family is never weaker than the neighbors carrying
+ * identical traffic. Forwarding reuses the carrier kernel
+ * ({@link forwardApiCall} / {@link worldMuxOf}) unchanged: this module only
+ * gates, fences and demuxes.
+ *
+ * Mux lifecycle (review round 1): each accepted upgrade constructs ONE
+ * `WorldMuxServer`, which roots a heartbeat interval and a per-connection
+ * WebSocketServer — resources that would otherwise outlive the client forever
+ * (one 2s no-op timer per reconnect). The mux is therefore CLOSED the moment
+ * its socket dies: close-on-disconnect. The carrier's shared-mux-per-mount
+ * shape does not transfer (the hub rebinds per respawn); close-on-disconnect
+ * does.
+ */
+import { forwardApiCall, worldMuxOf, writeJson } from './carrier.js';
+import { stripLabelFromUrl } from './world-web-server.js';
+/** The mount prefix the family owns. */
+export const HUB_MOUNT_PATH = '/hub';
+/** The WebSocket upgrade path (upstream matches upgrades by pathname, so `?agent=` rides along). */
+export const HUB_MUX_PATH = '/hub/api/remote.mux';
+/** The demux key of one family request; absent or empty means "not foreign-addressed". */
+function agentOf(req) {
+    const url = new URL(req.url ?? '/', 'http://dsh.internal');
+    const value = url.searchParams.get('agent');
+    return value === null || value === '' ? undefined : value;
+}
+/**
+ * The world-relative URL for one family request: the `/hub` mount prefix
+ * stripped (same translation the `/<label>` mounts apply) and the demux key
+ * removed with byte-preserving query surgery — every other parameter keeps
+ * its original order and encoding.
+ */
+function worldUrlOf(url) {
+    const raw = stripLabelFromUrl(url, HUB_MOUNT_PATH);
+    const queryAt = raw.indexOf('?');
+    if (queryAt === -1)
+        return raw;
+    const kept = raw.slice(queryAt + 1).split('&').filter((pair) => {
+        if (pair === '')
+            return false;
+        const eq = pair.indexOf('=');
+        return (eq === -1 ? pair : pair.slice(0, eq)) !== 'agent';
+    });
+    return kept.length === 0 ? raw.slice(0, queryAt) : `${raw.slice(0, queryAt)}?${kept.join('&')}`;
+}
+/** Reason phrases for the raw-socket upgrade rejections this family writes. */
+const REASON_PHRASE = { 401: 'Unauthorized', 403: 'Forbidden', 404: 'Not Found' };
+/** Reject an upgrade on the raw socket (no ws ownership transfer). */
+function rejectUpgrade(socket, status, body, contentType) {
+    const writable = socket;
+    writable.write?.(`HTTP/1.1 ${status} ${REASON_PHRASE[status] ?? 'Rejected'}\r\n`
+        + 'Connection: close\r\n'
+        + `Content-Type: ${contentType}\r\n`
+        + `Content-Length: ${String(Buffer.byteLength(body, 'utf8'))}\r\n\r\n`
+        + body);
+    writable.destroy?.();
+}
+/**
+ * Run the boolean gate against an upgrade: the authorizer's false path writes
+ * to a `res` that does not exist on an upgrade, so the answer is captured and
+ * replayed on the raw socket verbatim. False means the upgrade was answered.
+ */
+function gateUpgrade(options, req, socket) {
+    let status = 401;
+    let body;
+    const admitted = options.authorize(req, {
+        writeHead: (answered) => { status = answered; },
+        end: (chunk) => { if (chunk !== undefined && chunk !== null)
+            body = String(chunk); },
+    });
+    if (admitted)
+        return true;
+    rejectUpgrade(socket, status, body ?? '', 'text/plain; charset=utf-8');
+    return false;
+}
+/** One shared 404 answer shape for family-level demux misses. */
+function answer404(res, body) {
+    writeJson(res, 404, JSON.stringify(body));
+}
+/**
+ * Register the family on ctx0's webServer.
+ * @param options - see {@link HubRouteOptions}.
+ * @returns the disposer unregistering both routes.
+ */
+export function registerHubRoute(options) {
+    const handleRequest = async (req, res) => {
+        // ctx0's gate first (world-mount order): false ⇒ already answered.
+        if (!options.authorize(req, res))
+            return;
+        // Then the SAME browser-trust fence the sibling carrier family runs
+        // (the kernel's first statement there): before ANY family answer — the
+        // demux 404s below are for trusted traffic only.
+        const rejection = options.requestRejection?.(req);
+        if (rejection !== undefined) {
+            writeJson(res, rejection, JSON.stringify({ error: rejection === 401 ? 'unauthorized' : 'forbidden' }));
+            return;
+        }
+        const agent = agentOf(req);
+        if (agent === undefined || agent === 'native') {
+            answer404(res, {
+                error: 'foreign-only',
+                message: 'the /hub family serves ?agent=<label> foreign traffic only; native belongs to /api',
+            });
+            return;
+        }
+        const gateway = options.gatewayOf(agent);
+        if (gateway === undefined) {
+            answer404(res, { error: 'unknown-agent', label: agent });
+            return;
+        }
+        // Consume the family plumbing: the kernel forwards a native-shaped URL
+        // (the kernel carries the same fence face as the carrier's own kernel).
+        req.url = worldUrlOf(req.url);
+        await forwardApiCall({ gateway, label: agent, mountPath: HUB_MOUNT_PATH, requestRejection: options.requestRejection }, req, res);
+    };
+    const handleUpgrade = (req, socket, head) => {
+        if (!gateUpgrade(options, req, socket))
+            return;
+        // Same fence as the sibling carrier's mux: raw 401/403, no ws handover
+        // for untrusted Host/Origin.
+        const rejection = options.requestRejection?.(req);
+        if (rejection !== undefined) {
+            rejectUpgrade(socket, rejection, JSON.stringify({ error: rejection === 401 ? 'unauthorized' : 'forbidden' }), 'application/json');
+            return;
+        }
+        const agent = agentOf(req);
+        if (agent === undefined || agent === 'native') {
+            rejectUpgrade(socket, 404, JSON.stringify({ error: 'foreign-only' }), 'application/json');
+            return;
+        }
+        const gateway = options.gatewayOf(agent);
+        if (gateway === undefined) {
+            rejectUpgrade(socket, 404, JSON.stringify({ error: 'unknown-agent', label: agent }), 'application/json');
+            return;
+        }
+        // One mux per accepted connection: the binding resolves at upgrade time,
+        // so a respawned world is addressed by its CURRENT gateway. The mux roots
+        // a heartbeat interval and a per-connection WebSocketServer; on socket
+        // close it must be CLOSED (world-mux clears the heartbeat only in close),
+        // or every reconnect leaks the timer plus the mux graph forever.
+        const mux = worldMuxOf(gateway);
+        socket.once?.('close', () => {
+            void mux.close().catch(() => undefined);
+        });
+        void mux.handleUpgrade(req, socket, head);
+    };
+    const disposers = [
+        options.real.register({ kind: 'prefix', path: HUB_MOUNT_PATH, handler: handleRequest }),
+        options.real.registerUpgrade({ path: HUB_MUX_PATH, handler: handleUpgrade }),
+    ];
+    return () => {
+        for (const dispose of disposers.splice(0).reverse()) {
+            try {
+                dispose();
+            }
+            catch {
+                // teardown must not throw
+            }
+        }
+    };
+}

package/{agent-hub → superd-hub}/dist/index.d.ts

@@ -1,5 +1,5 @@
 /**
- * @pgmi-builds/agent-hub — host half public surface (Agent Worlds line).
+ * @pgmi-builds/superd-hub — host half public surface (Super D line).
  *
  * The line owns the switch and the gateway (per super-dsh/AGENTS.md):
  * the world inventory control plane + the foreign agent roster + the world
@@ -8,22 +8,30 @@
  * DL7 (2026-09-16): the app-level selector value is GONE. World ownership is
  * per-request: the addressed world is the mount path of the request
  * (`/<label>/...`). `/api/*` stays ctx0/native and untouched.
+ *
+ * Path separation T-D (2026-09-26): the world-page faces left the surface —
+ * the client mount shim, the mount HTML pass (`rewriteIndexHtml`) and the
+ * retired `mountWorld` no-op are gone (git history keeps them), and worlds
+ * compose as pure data planes (no webui rows).
  */
 export { handleAgentRuntime, registerSelectorRpc, AGENT_RUNTIME_RPC_PATH, registryTargets, type RuntimeTargetSource } from './rpc.js';
 export { registerForeignTarget, unregisterForeignTarget, getTarget, listRuntimeKeys, type ForeignTarget, type GatewayFace } from './targets.js';
 export { registerAgent, unregisterAgent, setReady, listAgents, onRosterChanged, type RosterEntry } from './roster.js';
 export { spawnWorld, type SpawnWorldOptions } from './spawn-world.js';
-export { provisionWorldProfile, type ProvisionWorldOptions } from './world-provision.js';
-export { claimLabel, labelOf, releaseLabel, listLabels, type LabelClaim, type ClaimOptions } from './labels.js';
+export { provisionWorldProfile, resolveInstallAnchor, type ProvisionWorldOptions } from './world-provision.js';
 export { WorldWebServer, stripLabelFromUrl, type WorldWebRoute, type WorldWebUpgradeRoute, type RealWebServerFace } from './world-web-server.js';
 export { parseClientRequest, serverResponse, serverError, serverResult, wireErrorOf, EnvelopeError, type ClientRequestEnvelope, type WireError } from './envelope.js';
 export { WorldMuxServer, parseClientMessage, defaultFailure, type MuxOpen, type MuxFailure, type WorldMuxOptions } from './world-mux.js';
-export { mountWorld, rewriteIndexHtml, type CarrierGatewayFace, type MountWorldOptions, type MountedWorld } from './carrier.js';
-export { renderClientShim } from './client-shim.js';
+export { forwardApiCall, forwardWorldFetch, worldMuxOf, writeJson, type CarrierGatewayFace, type ForwardOptions } from './carrier.js';
+export { registerHubRoute, HUB_MOUNT_PATH, HUB_MUX_PATH, type HubRouteOptions } from './hub-route.js';
+export { renderFusionTransport, deriveFusionFlag, FUSION_FLAG_ENV, FUSION_FLAG_GLOBAL, type FusionConfig } from './fusion-transport.js';
+export { createSwitchController, parseLandingTarget, namespacedKey, storageNamespace, seatClickDecision, NATIVE_AGENT, SESSIONS_CURRENT_KEY, SWITCH_FALLBACK_MS, type SwitchHost, type SwitchController, type SwitchOptions, type SeatClickInput, type SeatClickDecision } from './switch-core.js';
 export { agentLinks, agentRosterRow, AGENT_ROSTER_GLOBAL, type AgentLink } from './agent-roster.js';
 export { createOwnershipIndex, type OwnershipIndex, type OwnershipRow } from './ownership.js';
 export { registerHostMount, takeHostMount, listHostMounts, noteWorldServer, worldServerOf, type HostMount } from './world-host.js';
-export { worldMountPatches, WORLD_MOUNT_PLUGIN, WORLD_MOUNT_ROW_ID, type WorldPatchLayer } from './world-mount.js';
+export { worldMountPatches, superdTrustedHosts, WORLD_MOUNT_PLUGIN, WORLD_MOUNT_ROW_ID, WORLD_HUB_PLUGIN, WORLD_HUB_ROW_ID, type WorldPatchLayer, } from './world-mount.js';
+export { buildTrustScript, deriveDefaultPageAuthorities, type BootScriptRow, type TrustConfig, } from './web-trust.js';
+export { withSystemHead, type HeadAwareSessionFace, type HeadPlaceholder, type WithSystemHead } from './system-head.js';
 export { default as worldApply, name as worldPluginName, type Config as WorldEntryConfig } from './world-entry.js';
 export { default as joinApply, name as worldJoinPluginName, type Config as WorldJoinConfig } from './world-join.js';
 export { default } from './gateway.js';

package/{agent-hub → superd-hub}/dist/index.js

@@ -1,5 +1,5 @@
 /**
- * @pgmi-builds/agent-hub — host half public surface (Agent Worlds line).
+ * @pgmi-builds/superd-hub — host half public surface (Super D line).
  *
  * The line owns the switch and the gateway (per super-dsh/AGENTS.md):
  * the world inventory control plane + the foreign agent roster + the world
@@ -8,22 +8,30 @@
  * DL7 (2026-09-16): the app-level selector value is GONE. World ownership is
  * per-request: the addressed world is the mount path of the request
  * (`/<label>/...`). `/api/*` stays ctx0/native and untouched.
+ *
+ * Path separation T-D (2026-09-26): the world-page faces left the surface —
+ * the client mount shim, the mount HTML pass (`rewriteIndexHtml`) and the
+ * retired `mountWorld` no-op are gone (git history keeps them), and worlds
+ * compose as pure data planes (no webui rows).
  */
 export { handleAgentRuntime, registerSelectorRpc, AGENT_RUNTIME_RPC_PATH, registryTargets } from './rpc.js';
 export { registerForeignTarget, unregisterForeignTarget, getTarget, listRuntimeKeys } from './targets.js';
 export { registerAgent, unregisterAgent, setReady, listAgents, onRosterChanged } from './roster.js';
 export { spawnWorld } from './spawn-world.js';
-export { provisionWorldProfile } from './world-provision.js';
-export { claimLabel, labelOf, releaseLabel, listLabels } from './labels.js';
+export { provisionWorldProfile, resolveInstallAnchor } from './world-provision.js';
 export { WorldWebServer, stripLabelFromUrl } from './world-web-server.js';
 export { parseClientRequest, serverResponse, serverError, serverResult, wireErrorOf, EnvelopeError } from './envelope.js';
 export { WorldMuxServer, parseClientMessage, defaultFailure } from './world-mux.js';
-export { mountWorld, rewriteIndexHtml } from './carrier.js';
-export { renderClientShim } from './client-shim.js';
+export { forwardApiCall, forwardWorldFetch, worldMuxOf, writeJson } from './carrier.js';
+export { registerHubRoute, HUB_MOUNT_PATH, HUB_MUX_PATH } from './hub-route.js';
+export { renderFusionTransport, deriveFusionFlag, FUSION_FLAG_ENV, FUSION_FLAG_GLOBAL } from './fusion-transport.js';
+export { createSwitchController, parseLandingTarget, namespacedKey, storageNamespace, seatClickDecision, NATIVE_AGENT, SESSIONS_CURRENT_KEY, SWITCH_FALLBACK_MS } from './switch-core.js';
 export { agentLinks, agentRosterRow, AGENT_ROSTER_GLOBAL } from './agent-roster.js';
 export { createOwnershipIndex } from './ownership.js';
 export { registerHostMount, takeHostMount, listHostMounts, noteWorldServer, worldServerOf } from './world-host.js';
-export { worldMountPatches, WORLD_MOUNT_PLUGIN, WORLD_MOUNT_ROW_ID } from './world-mount.js';
+export { worldMountPatches, superdTrustedHosts, WORLD_MOUNT_PLUGIN, WORLD_MOUNT_ROW_ID, WORLD_HUB_PLUGIN, WORLD_HUB_ROW_ID, } from './world-mount.js';
+export { buildTrustScript, deriveDefaultPageAuthorities, } from './web-trust.js';
+export { withSystemHead } from './system-head.js';
 export { default as worldApply, name as worldPluginName } from './world-entry.js';
 export { default as joinApply, name as worldJoinPluginName } from './world-join.js';
 export { default } from './gateway.js';

package/{agent-hub → superd-hub}/dist/roster.d.ts

@@ -3,8 +3,8 @@
  *
  * No config file: an agent is in the roster exactly while its adapter
  * plugin is loaded and registered. Adapter plugins self-register on
- * activation (key/label/ready) and the RuntimeSeat chip consumes the
- * snapshot. Roster entries are inventory only: they carry NO selection —
+ * activation (key/label/ready) and the Hub UI consumes the snapshot.
+ * Roster entries are inventory only: they carry NO selection —
  * the addressed world is the request's mount path (`DL7`, 2026-09-16).
  * one authority.
  */

package/{agent-hub → superd-hub}/dist/rpc.js

@@ -47,6 +47,6 @@ export function registerSelectorRpc(ctx, source) {
             methods: ['GET', 'POST'],
             requestBody: 'buffered',
             fetch: (request) => handleAgentRuntime(request, source),
-        }), 'agent-hub: /api/agent-runtime route');
+        }), 'superd-hub: /api/agent-runtime route');
     });
 }

package/{agent-hub → superd-hub}/dist/spawn-world.d.ts

@@ -9,12 +9,27 @@
  * test/boot-prepare-ordering.test.mjs. Data detachment at this stage comes
  * from the adapter side (foreign app-home redirection, spec §七).
  *
- * Profile resolution: loadProfile(name, profileName, installAnchor, home)
- * reads profiles under `<home>/profiles/<profileName>` and heals the
- * `@deepseek-ai/*` fallback farm into `<home>/profiles/node_modules` from
- * the install anchor (single instance — same physical installation).
+ * Profile resolution (2026-09-25 upstream alignment —
+ * docs/specs/world-resolution-upstream): loadProfile(name, profileName,
+ * installAnchor, home) reads profiles under `<home>/profiles/<profileName>`
+ * and writes nothing to disk. Before boot imports a single row, spawnWorld
+ * publishes THIS world into the HOST's live resolution table (the successor
+ * contract's sanctioned surface: an added linkedRoot covering the world
+ * tree + added table entries for the world's own `@pgmi-builds` packages +
+ * a generated peerDependencies block in the world profile manifest for
+ * routeLinked's peer gate). The world config's bare row names then resolve
+ * through the same interception the launcher uses; the per-world bare-URL
+ * farms and bareModuleBaseUrl are gone.
  */
 import { boot } from '@deepseek-ai/dsh-app-boot';
+/**
+ * The host (ctx0) surface spawnWorld needs: cordis `ctx.get`, which locates
+ * the launcher's `pluginPackages` table and `profileContext` facts. Structural
+ * on purpose — adapters pass their own minimal host context.
+ */
+export interface WorldHostSurface {
+    get(name: string): unknown;
+}
 export interface SpawnWorldOptions {
     /** App name for the spawned root (also its fiber label). */
     appName: string;
@@ -40,7 +55,13 @@ export interface SpawnWorldOptions {
     dataHome?: string;
     /** Extra patch layers appended after the profile's own (e.g. an adapter's insert row). */
     extraPatches?: Parameters<typeof boot>[2];
-    /** Override the bare-name resolution base (defaults to the install anchor's node_modules). */
-    bareModuleBaseUrl?: string;
+    /**
+     * The host (ctx0) context. When it carries the launcher's `pluginPackages`
+     * table, spawnWorld republishes a widened successor so this world's tree
+     * resolves through the host table exactly like a launcher profile (spec
+     * §2.1). Table-less harnesses (unit tests, embedders) omit it and keep
+     * native resolution.
+     */
+    host?: WorldHostSurface;
 }
 export declare function spawnWorld(opts: SpawnWorldOptions): Promise<import("@deepseek-ai/cordis").Context>;

package/superd-hub/dist/spawn-world.js

@@ -0,0 +1,279 @@
+/**
+ * spawnWorld (S2): spawn a sibling ROOT context for a foreign agent world
+ * from the CTX0 tree — the library form of the PoC (ADR 0008 mechanism,
+ * .scratch/multi-context-poc/spawner2.mjs collapsed into a function).
+ *
+ * AW-A posture: SHARED home (ADR 0008 constraint 2 fallback). The ctxN
+ * `dshHomePath` service override is an AW-C1 item (spec §三/§十一.2) — the
+ * boot() provide/prepare ordering fact is pinned by
+ * test/boot-prepare-ordering.test.mjs. Data detachment at this stage comes
+ * from the adapter side (foreign app-home redirection, spec §七).
+ *
+ * Profile resolution (2026-09-25 upstream alignment —
+ * docs/specs/world-resolution-upstream): loadProfile(name, profileName,
+ * installAnchor, home) reads profiles under `<home>/profiles/<profileName>`
+ * and writes nothing to disk. Before boot imports a single row, spawnWorld
+ * publishes THIS world into the HOST's live resolution table (the successor
+ * contract's sanctioned surface: an added linkedRoot covering the world
+ * tree + added table entries for the world's own `@pgmi-builds` packages +
+ * a generated peerDependencies block in the world profile manifest for
+ * routeLinked's peer gate). The world config's bare row names then resolve
+ * through the same interception the launcher uses; the per-world bare-URL
+ * farms and bareModuleBaseUrl are gone.
+ */
+import { loadProfile, boot, composeEntries, createRuntimeResolution } from '@deepseek-ai/dsh-app-boot';
+import { provideCmdline } from '@deepseek-ai/dsh-cmdline';
+import { dump } from 'js-yaml';
+import { entryListSchema } from '@deepseek-ai/cordis-plugin-include';
+import { existsSync, writeFileSync, readFileSync, readdirSync, realpathSync } from 'node:fs';
+import { join } from 'node:path';
+import { superdTrustedHosts } from './world-mount.js';
+/**
+ * Republish the host's live resolution with THIS world added as a linked
+ * root (spec §2.1, contract-legal form): `profilesDir`/`profileDir` are
+ * frozen per process ("a successor cannot change its profile scope"), so
+ * the world tree joins the table the way the successor contract sanctions —
+ * an added linkedRoot covering `<worldHome>`, added entries for the world's
+ * own `@pgmi-builds` packages (routeLinked resolves names from the table),
+ * and a generated `peerDependencies` block in the world profile manifest
+ * (routeLinked's peer gate reads the importer's ancestor manifests; the
+ * peers are the composed rows' bare names — deterministic, regenerated on
+ * every spawn, so upstream row additions self-heal on the next boot).
+ *
+ * Faithful reconstruction — reload the launcher's profile from
+ * `profileContext` facts and recompute: the service exposes no `current`,
+ * and a plugin add between host boot and now is picked up for free (each
+ * spawn re-publishes; worlds are spawn-time facts and never recompose, so a
+ * later host-side replace can only affect the next spawn).
+ */
+async function publishWorldInHostResolutionTurn(packages, launcher, opts, worldProfileDir, peerNames) {
+    const profile = loadProfile('dsh', launcher.name, launcher.installAnchor, launcher.home);
+    const base = await createRuntimeResolution({ installAnchor: launcher.installAnchor, profile, home: launcher.home });
+    // routeLinked's peer gate: the gate reads ancestor manifests of the
+    // IMPORTER — and ctx.baseUrl is a DIRECTORY URL with a trailing slash, so
+    // the resolver's dirname() lands on `<worldHome>/profiles`, one level
+    // above the profile itself. Peers therefore go into BOTH manifests (the
+    // world profile's own and the profiles-level directory), regenerated
+    // idempotently on every spawn — upstream row additions self-heal next boot.
+    const peers = Object.fromEntries([...peerNames].sort().map((name) => [name, '*']));
+    for (const manifestDir of [worldProfileDir, join(opts.home, 'profiles')]) {
+        const manifestPath = join(manifestDir, 'package.json');
+        const manifest = existsSync(manifestPath)
+            ? JSON.parse(readFileSync(manifestPath, 'utf8'))
+            : { name: `superd-${opts.appName}-profiles`, private: true };
+        manifest.peerDependencies = peers;
+        writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\n');
+    }
+    // The world's own packages become table entries (targets = the realpaths of
+    // the profile-local links provisionWorldProfile wrote). declarer MUST be a
+    // manifest PATH: the ESM interception rewrites the resolve parent to it
+    // (pathToFileURL(route.entry.declarer)).
+    const declarer = join(worldProfileDir, 'package.json');
+    const worldScope = join(worldProfileDir, 'node_modules', '@pgmi-builds');
+    const baseNames = new Set(base.entries.map((entry) => entry.name));
+    for (const name of readdirSync(worldScope, { withFileTypes: true })) {
+        if (!name.isDirectory() && !name.isSymbolicLink())
+            continue;
+        const pkgName = `@pgmi-builds/${name.name}`;
+        // A profile-declared package already covers the name (a consumer who
+        // properly installed our subpackages) — the base entry wins, never assert
+        // a divergent mapping over it.
+        if (baseNames.has(pkgName))
+            continue;
+        const packageDir = realpathSync(join(worldScope, name.name));
+        const pkgManifest = JSON.parse(readFileSync(join(packageDir, 'package.json'), 'utf8'));
+        // FIRST-WRITE-WINS: shared names (every world publishes superd-hub) must
+        // keep the first publisher's declarer — overwriting it with another
+        // world's manifest path trips "replacing X requires a process restart"
+        // (dev3 0.1.3-u evidence). Any manifest path satisfies the ESM redirect;
+        // the peer gate reads the IMPORTER's ancestors, not the declarer.
+        if (!publishedEntries.has(pkgName)) {
+            publishedEntries.set(pkgName, { name: pkgName, packageDir, version: pkgManifest.version, declarer, scope: 'profile' });
+        }
+    }
+    const rootName = `superd-world-${opts.appName}`;
+    if (!publishedRoots.has(rootName)) {
+        publishedRoots.set(rootName, { name: rootName, realPath: opts.home });
+    }
+    packages.replace({
+        ...base,
+        entries: [...base.entries, ...publishedEntries.values()],
+        linkedRoots: [...base.linkedRoots, ...publishedRoots.values()],
+    });
+}
+/** Bare package name of a module specifier (`@scope/pkg/sub` → `@scope/pkg`). */
+function barePackageNameOf(specifier) {
+    if (!specifier || specifier[0] === '.' || specifier[0] === '/' || specifier[0] === '#' || specifier.includes(':'))
+        return undefined;
+    const first = specifier.indexOf('/');
+    if (specifier[0] !== '@')
+        return first < 0 ? specifier : specifier.slice(0, first);
+    if (first < 0)
+        return;
+    const second = specifier.indexOf('/', first + 1);
+    return second < 0 ? specifier : specifier.slice(0, second);
+}
+/**
+ * Cross-spawn accumulation (spec §2.1, dev3 0.1.3-t evidence): the service
+ * exposes no `current`, and every reconstruction starts from a fresh base —
+ * a successor that DROPS a prior world's additions trips the contract
+ * ("replacing X requires a process restart") and every world after the
+ * first falls back to native resolution. Each spawn therefore merges its
+ * additions into this process-wide accumulator, and successors always carry
+ * the union. Values are deterministic per world (stable worldHome and pack
+ * paths), so re-spawns re-assert identical mappings — contract-stable.
+ */
+const publishedEntries = new Map();
+const publishedRoots = new Map();
+/**
+ * Serializes table publishing: the six world spawns run concurrently, and
+ * interleaved reconstruct→replace cycles assert divergent successors against
+ * a mid-flight current (dev3 0.1.3-u evidence). One publish at a time; a
+ * failed turn never blocks the next (the caller's fail-soft handles it).
+ */
+let publishQueue = Promise.resolve();
+async function publishWorldInHostResolution(host, opts, worldProfileDir, peerNames) {
+    const packages = host.get('pluginPackages');
+    const launcher = host.get('profileContext');
+    if (packages === undefined || launcher?.installAnchor === undefined || launcher.home === undefined || launcher.name === undefined)
+        return;
+    const turn = publishQueue.catch(() => { }).then(() => publishWorldInHostResolutionTurn(packages, launcher, opts, worldProfileDir, peerNames));
+    publishQueue = turn;
+    await turn;
+}
+export async function spawnWorld(opts) {
+    const profile = loadProfile(opts.appName, opts.profileName, opts.installAnchor, opts.home);
+    // THE FILE IS THE COMPOSITION (0.1.7 alignment): compose every layer
+    // (bundle patches in profile order + profile patch + spawn extras like
+    // worldMountPatches) ONCE here and write the FINAL row list into the
+    // include file. Boot mounts it with NO patch stream. Rationale: the
+    // include's runtime patch application provably dropped the spawn-time
+    // worldMountPatches in nested boots (webserver re-enabled on 3080, world
+    // rows gone — 2026-09-24 alignment evidence), while the composition itself
+    // is deterministic and dumpable with the loader's own dialect (`!!js`
+    // preserved via entryListSchema).
+    const composed = composeEntries(profile.layers.map((l) => l.patches).concat([profile.patches, ...(opts.extraPatches ?? [])]), () => { });
+    writeFileSync(join(profile.dir, 'cordis.yml'), dump(composed, { schema: entryListSchema, noRefs: true, lineWidth: -1 }) + '\n');
+    const patches = [];
+    if (process.env.SUPERD_TRACE === '1') {
+        // Alignment diagnostics: what the world tree will actually compose.
+        try {
+            const rows = composed;
+            const pick = (id) => rows.find((r) => r.id === id);
+            for (const id of ['webserver', 'hmr', 'web-runtime', 'client-hmr', 'modules', 'superd-world-mount', 'superd-hub', 'agent-preset-registry']) {
+                const row = pick(id);
+                process.stderr.write(`[spawn-world:${opts.appName}] ${id}: ${row === undefined ? 'ABSENT' : JSON.stringify({ disabled: row.disabled, inject: 'inject' in row ? row.inject : undefined, name: row.name })}\n`);
+            }
+            process.stderr.write(`[spawn-world:${opts.appName}] composed rows: ${rows.length}\n`);
+            process.stderr.write(`[spawn-world:${opts.appName}] patches tail: ${JSON.stringify(patches.slice(-3).map((p) => p.id ?? (Array.isArray(p.insert) ? `insert(${p.insert.length})` : '?')))}\n`);
+        }
+        catch (cause) {
+            process.stderr.write(`[spawn-world:${opts.appName}] trace compose failed: ${String(cause)}\n`);
+        }
+    }
+    // Host table first (spec §2.1): publish this world as a linked root of the
+    // live resolution BEFORE boot() mounts the root include — the world config's
+    // bare row names then resolve through the same interception the launcher
+    // uses. Fail-soft: a table-less or hostile host degrades to native
+    // resolution (the world fails loudly on its first missing import, never the
+    // host).
+    if (opts.host !== undefined) {
+        try {
+            const peerNames = new Set();
+            for (const row of composed) {
+                for (const specifier of [
+                    ...(typeof row.name === 'string' ? [row.name] : []),
+                    ...(Array.isArray(row.inject) ? row.inject.filter((s) => typeof s === 'string') : []),
+                ]) {
+                    const bare = barePackageNameOf(specifier);
+                    if (bare !== undefined)
+                        peerNames.add(bare);
+                }
+            }
+            await publishWorldInHostResolution(opts.host, opts, profile.dir, peerNames);
+        }
+        catch (cause) {
+            process.stderr.write(`[spawn-world:${opts.appName}] host table publishing failed (${String(cause)}) — falling back to native resolution\n`);
+        }
+    }
+    // Embedding-host facts via the PUBLIC cmdline API (risk-2 probe: boot owns
+    // dshHomePath, so the prepare slot is for OUR provides — cmdlineArgs is not
+    // boot-provided and upstream documents the empty-args embedding path).
+    // Worlds take no flags and never open a browser; exit = dispose own fiber.
+    // LAN authorities for the world's trust fence (deploy-level, env-driven):
+    // the world webserver must accept the Host the browser actually sends.
+    // (Same derivation worldMountPatches carries into the mount row's neutral
+    // webRuntime facts — one source, `superdTrustedHosts`.)
+    const trusted = superdTrustedHosts(process.env.SUPERD_TRUSTED_HOSTS)
+        .flatMap((h) => ['--trusted-host', h]);
+    let fiber;
+    // Launcher parity (0.1.7): a profileContext-carrying tree runs the profile
+    // HMR row, whose init REQUIRES the appReady service (otherwise "Profile HMR
+    // requires application readiness"). The launcher owns the readiness signal
+    // and commits it after boot settles — worlds do the same inline.
+    let appReadyCommitted = false;
+    const appReadyListeners = new Set();
+    const appReady = {
+        service: {
+            onReady(listener) {
+                if (appReadyCommitted) {
+                    listener();
+                    return () => { };
+                }
+                appReadyListeners.add(listener);
+                return () => { appReadyListeners.delete(listener); };
+            },
+        },
+        commit() {
+            if (appReadyCommitted)
+                return;
+            appReadyCommitted = true;
+            for (const listener of [...appReadyListeners])
+                listener();
+            appReadyListeners.clear();
+        },
+    };
+    const ctxW = await boot(opts.appName, join(profile.dir, 'cordis.yml'), patches, (ctx) => {
+        provideCmdline(ctx, {
+            args: ['--no-open', ...trusted],
+            exit: () => { void fiber?.dispose(); },
+            ready: appReady.service,
+        });
+        // This tree reads its own home from here on: sessions, settings.yaml,
+        // workspace store — all under the world's nested root.
+        //
+        // `set` (not `provide`): boot already registered `dshHomePath` on this
+        // root, and cordis refuses a second `provide` in the same scope
+        // ("service … has been registered at <root>"). `set` is the documented
+        // "overwrite a provided service's value" path for the owning fiber, which
+        // the prepare slot is — and ADR 0008 constraint 2 prescribes exactly this
+        // in-tree override (process.env is a shared resolver and must not change).
+        if (opts.dataHome !== undefined) {
+            const dataHome = opts.dataHome;
+            ctx.set('dshHomePath', (...segments) => join(dataHome, ...segments));
+        }
+        // 0.1.7: profile-mounted services (settings …) inject `profileContext`,
+        // which only runProfile's prepare slot used to provide. Worlds boot
+        // directly, so provide the equivalent here — without it every world's
+        // provider row pends on `waiting for service: settings`. This also arms
+        // the row-admission compatibility preflight inside world trees (it no-ops
+        // without a profileContext, which would leave world rows unjudged).
+        ctx.provide('profileContext', {
+            name: opts.appName,
+            dir: profile.dir,
+            patchPath: profile.patchPath,
+            installAnchor: opts.installAnchor,
+            cwd: process.cwd(),
+            home: opts.home,
+            startedBundles: profile.layers.map((l) => l.packageName),
+            overlays: profile.patches,
+            telemetryDisabledEnv: process.env.DSH_TELEMETRY_DISABLED,
+        });
+    });
+    fiber = ctxW.fiber;
+    // Launcher parity: commit readiness only when the world tree actually
+    // settled with a Loader (runProfile's same condition).
+    if (ctxW.get('loader') !== undefined)
+        appReady.commit();
+    return ctxW;
+}