super-dsh 0.1.4 → 0.1.5-a

package/cordis.patch.yml

@@ -4,13 +4,9 @@
 # exports, so every row below is individually toggleable on the plugin page
 # (cordis hmr; docs/06 §二.5 — insert rows = the "Components" lines).
 #
-#   - super-dsh/hub            the hub host library (selector + roster +
-#                              per-world mount carrier + V5 gateway
-#                              delegation) — ships for the adapters' relative
-#                              imports (world spawn/mount/carrier/web-trust);
-#                              the ctx0 control-plane row and ui client half
-#                              were stripped in 0.1.4 (archival final state
-#                              of the multi-webui path)
+#   - super-dsh/hub            the hub: selector + roster + per-world mount
+#                              carrier + V5 gateway delegation (wraps the live
+#                              typertGateway; upstream dispatch untouched)
 #   - super-dsh/agents/<label>  one world plugin per adapter (activation IS
 #                              roster membership, S2) — each spawns its own
 #                              zero-port sibling root, mounted under /<label>
@@ -29,8 +25,26 @@
 # Profile-layer values (webserver port/host, settings path) stay in the USER's
 # profile patch layer, never here.
 - insert:
+    # BARE package row: subpath rows (…/agents/omp) are permanently not client
+    # rows in client-modules' scan (exactPackageSpecifier), so THIS row is
+    # what registers the package's client half — the sidebar selector.
+    - id: superd-hub
+      name: 'super-dsh'
     - id: superd-web-trust
       name: 'super-dsh/web-trust'
+    # Native UI fusion transport (plan Task 3): the ctx0 page-level state atom
+    # + five call-time patches. Composing this row IS the switch — there is no
+    # environment variable in the decision (2026-09-27 user ruling: a release
+    # gate living in an env var is deployment state no patch layer can see).
+    # ROW ORDER IS LOAD ORDER and the row MUST stay after superd-web-trust:
+    # the trust script's non-merging `if(!window.__DSH_TRANSPORT__)` verdict
+    # must be evaluated before the fusion script could own that global
+    # (spec §3.4, hard; precedent world-web-server.ts renderIndex).
+    # To turn the fused surface off: restate this row (same id, same name) with
+    # `config: {enabled: false}` or `disabled: true`, or drop it from the
+    # composition. Off = the component registers nothing: no script, no global.
+    - id: superd-fusion-transport
+      name: 'super-dsh/fusion-transport'
     - id: agent-omp
       name: 'super-dsh/agents/omp'
     - id: agent-codex

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "super-dsh",
-  "version": "0.1.4",
-  "description": "Super D for the DeepSeek Harness (DSH) — one dsh plugin that mounts the superd hub (roster, per-runtime agents) and joins local foreign-agent runtimes (OMP, Codex, Claude, Pi, Hermes, Antigravity) into the DSH Web UI. Each runtime keeps its native home and session store; the hub only bridges.",
+  "version": "0.1.5-a",
+  "description": "Super D for the DeepSeek Harness (DSH) — one dsh plugin that mounts the superd hub (runtime selector, roster, per-runtime agents) and joins local foreign-agent runtimes (OMP, Codex, Claude, Pi, Hermes, Antigravity) into the DSH Web UI. Each runtime keeps its native home and session store; the hub only bridges.",
   "type": "module",
   "license": "MIT",
   "repository": {
@@ -18,14 +18,18 @@
     "./agents/pi": "./agent-pi/dist/world-plugin.js",
     "./agents/hermes": "./agent-hermes/dist/world-plugin.js",
     "./agents/agy": "./agent-agy/dist/world-plugin.js",
+    "./client": "./client/index.js",
     "./cordis.patch.yml": "./cordis.patch.yml",
     "./package.json": "./package.json",
-    "./web-trust": "./superd-hub/dist/web-trust.js"
+    "./web-trust": "./superd-hub/dist/web-trust.js",
+    "./fusion-transport": "./superd-hub/dist/fusion-transport.js"
   },
   "files": [
     "cordis.patch.yml",
+    "client",
     "README.md",
     "superd-hub/dist",
+    "superd-hub/lib",
     "superd-hub/package.json",
     "superd-hub/cordis.patch.yml",
     "agent-omp/dist",
@@ -52,6 +56,12 @@
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-slots"
+      ],
+      "platform": "web"
     }
   },
   "dependencies": {

package/superd-hub/dist/agent-roster.d.ts

@@ -12,7 +12,7 @@
  *   /codex/    → the Codex world's mount
  */
 import type { IndexInjection } from '@deepseek-ai/dsh-host-webserver';
-/** One selectable runtime: its key, its label, and the path that addresses it. */
+/** One selectable runtime: its key, its label, the path that addresses it, its machine. */
 export interface AgentLink {
     /** `native` for ctx0, otherwise the adapter's runtime key. */
     key: string;
@@ -20,6 +20,8 @@ export interface AgentLink {
     label: string;
     /** Mount root, always trailing-slashed except the native `/`. */
     path: string;
+    /** Machine the runtime runs on — the Hub UI's grouping key. */
+    machine: string;
 }
 /** The global this module publishes the roster under. */
 export declare const AGENT_ROSTER_GLOBAL = "__DSH_AGENT_ROSTER__";

package/superd-hub/dist/agent-roster.js

@@ -1,7 +1,9 @@
 import { listAgents } from './roster.js';
 import { takeHostMount } from './world-host.js';
+/** Machine of every roster row today — the local constant; the extension point a multi-machine registry replaces. */
+const LOCAL_MACHINE = 'local';
 /** The native runtime's synthetic entry (no adapter plugin backs it). */
-const NATIVE = { key: 'native', label: 'DSH', path: '/' };
+const NATIVE = { key: 'native', label: 'DSH', path: '/', machine: LOCAL_MACHINE };
 /** The global this module publishes the roster under. */
 export const AGENT_ROSTER_GLOBAL = '__DSH_AGENT_ROSTER__';
 /**
@@ -17,7 +19,7 @@ export function agentLinks() {
         if (mount === undefined)
             continue;
         const path = mount.labelPath.endsWith('/') ? mount.labelPath : `${mount.labelPath}/`;
-        links.push({ key: agent.key, label: agent.label, path });
+        links.push({ key: agent.key, label: agent.label, path, machine: LOCAL_MACHINE });
     }
     return links;
 }

package/superd-hub/dist/carrier.d.ts

@@ -1,5 +1,5 @@
-import { type RealWebServerFace } from './world-web-server.js';
-import { type MuxFailure } from './world-mux.js';
+import { type WorldRequest, type WorldResponse } from './world-web-server.js';
+import { WorldMuxServer, type MuxFailure } from './world-mux.js';
 /** The three-method face of a world's typertGateway service instance. */
 export interface CarrierGatewayFace {
     dispatchRpc(endpoint: string, payload: unknown, signal: AbortSignal): Promise<unknown>;
@@ -12,38 +12,51 @@ export interface CarrierGatewayFace {
      */
     openWireStream(endpoint: string, payload: unknown, uplink: AsyncIterable<unknown>, peer: undefined, signal: AbortSignal, control: AbortController): Promise<AsyncIterable<unknown>> | AsyncIterable<unknown>;
 }
-/** Options for mounting one world. */
-export interface MountWorldOptions {
-    /** The ctx0 webServer the translated routes register on. */
-    real: RealWebServerFace;
-    /** Runtime key: the mount label (`omp` → `/omp`). */
-    label: string;
+export declare function writeJson(res: WorldResponse, status: number, body: string): void;
+/** Deps the forwarding kernel needs to answer for one world's traffic. */
+export interface ForwardOptions {
     /** The addressed world's gateway instance. */
     gateway: CarrierGatewayFace;
+    /** World key addressing the world's published `/api` fetch handler. */
+    label: string;
+    /** URL prefix this carrier strips before the world sees the request (`/omp`, `/hub`). */
+    mountPath: string;
     /** ctx0's browser-trust fence: returns an HTTP status to reject with. */
     requestRejection?(req: unknown): number | undefined;
     /** Max request body bytes (mirrors the connection default). */
     maxBodyBytes?: number;
-    /** Mux ping interval (upstream default 30s). */
-    heartbeatIntervalMs?: number;
-    /** Error → wire failure mapper for the world's streams. */
-    failure?(error: unknown): MuxFailure;
-}
-/** The live mount handle. */
-export interface MountedWorld {
-    /** Mount root (`/omp`). */
-    readonly labelPath: string;
-    /** Unary channel root (`/omp/api`). */
-    readonly apiPath: string;
-    /** Mux websocket path (`/omp/api/remote.mux`). */
-    readonly muxPath: string;
-    /** Unregister everything this mount installed. */
-    dispose(): void;
 }
 /**
- * Mount one world on the shared ctx0 webServer.
- * @param options - see {@link MountWorldOptions}.
- * @returns the live mount handle.
+ * Forward one non-envelope GET/HEAD request into the owning world's shared
+ * `/api` fetch handler (exact Fetch routes first, then the gateway's RPC
+ * interceptor, then 404 — the upstream composition). The caller has already
+ * answered the ctx0 fence by the time we get here; the world's own
+ * browser-auth gate is never consulted (a different tree, a different secret).
+ */
+export declare function forwardWorldFetch(options: {
+    label: string;
+    mountPath: string;
+}, req: WorldRequest, res: WorldResponse): Promise<void>;
+/**
+ * The reusable forwarding kernel (envelope dispatch + world fetch bridge):
+ * decode the connection envelope and dispatch into the ADDRESSED world's
+ * gateway instance; non-envelope GET/HEAD traffic forwards into the world's
+ * own registered fetch routes. Parameterized by (gateway, label, mountPath)
+ * so the `/hub` route family shares this exact behavior — the demux key is
+ * the caller's business, the wire semantics live here.
+ */
+export declare function forwardApiCall(options: ForwardOptions, req: WorldRequest, res: WorldResponse): Promise<void>;
+/** One WorldMuxServer bound to `gateway` — the canonical openWireStream wiring in one place. */
+export declare function worldMuxOf(gateway: CarrierGatewayFace, options?: {
+    heartbeatIntervalMs?: number;
+    failure?: (error: unknown) => MuxFailure;
+}): WorldMuxServer;
+/**
+ * RETIRED with T-D (2026-09-26): the T-C `mountWorld` no-op — which itself
+ * used to register `/<label>/api`, `/<label>/open-in-app` and
+ * `/<label>/api/remote.mux` on the real webServer — is GONE from the module.
+ * The adapter world-plugins' spawn-time call sites were updated in the same
+ * round (the registerHostMount record needs no webServer and no fence; the
+ * `/hub` family reaches each world's gateway through the foreign-target
+ * table). Git history keeps the function.
  */
-export declare function mountWorld(options: MountWorldOptions): MountedWorld;
-export { rewriteIndexHtml } from './index-pass.js';

package/superd-hub/dist/carrier.js

@@ -1,23 +1,27 @@
 /**
- * ctx0 WebCarrier (AW-B DL1/DL5): mounts one world's traffic under `/<label>`.
+ * The carrier forwarding kernel (AW-B DL1/DL5 → native UI fusion Task 2 →
+ * path-separation T-C): the wire semantics every foreign-agent entry shares.
  *
- * Responsibilities (grow per AW-B task):
- *  - Task 4: unary RPC — `/<label>/api/<endpoint>` decodes the connection
- *    envelope and dispatches into the ADDRESSED world's gateway instance.
- *  - Task 6: mux — `/<label>/api/remote.mux` upgrade bridged to the same
- *    instance (no shared selection anywhere). Wire protocol is dsh 0.1.7's
- *    stream protocol incl. the client uplink (`item`/`end` frames).
- *  - 2026-09-17 (H1): non-envelope GET/HEAD on `/<label>/api` forwards into
- *    the owning world's registered exact Fetch routes — the world connection's
- *    shared `/api` handler, published from `world-entry` via `world-host` —
- *    still behind ctx0's fence, so `HEAD /<label>/api/session.export?...`
- *    reaches the world's session-log-download route.
- *  - 2026-09-24: `/<label>/open-in-app/*` GETs bridge the same way — the
- *    world page's open-in-app feature polls its host routes relative to the
- *    mount base (`/omp/open-in-app/apps`), which live on the WORLD's
- *    connection, not ctx0's.
+ * History and the T-C/T-D cuts:
+ *  - The kernel — envelope dispatch ({@link forwardApiCall}), the world fetch
+ *    bridge ({@link forwardWorldFetch}) and the mux construction
+ *    ({@link worldMuxOf}) — is parameterized by (gateway, label, mountPath).
+ *  - It used to be mounted twice: the per-label page family
+ *    (`/<label>/api`, `/<label>/api/remote.mux`, `/<label>/open-in-app` —
+ *    registered by the now-deleted `mountWorld`) and, since 2026-09-26, the
+ *    hub-owned `/hub` family (`hub-route.ts`, demuxed by `?agent=`).
+ *  - T-C (2026-09-26, user ruling "strip off the per agent url path … no need
+ *    the url path fallback (we have git history)"): the per-label family is
+ *    RETIRED — `/hub` is the sole foreign entry and the only remaining
+ *    consumer of this kernel. The world DATA planes are untouched: the same
+ *    gateway faces (dispatchRpc/openWireStream), the same WorldMuxServer, the
+ *    same envelope, the same worldFetchHandlerOf lane, all reached through
+ *    `/hub`.
+ *  - T-D (2026-09-26, "disable their webui build"): the retired `mountWorld`
+ *    no-op and the mount HTML pass re-export left the module; the carrier is
+ *    the forwarding kernel alone.
  *
- * The addressed world is the request's path. Nothing here reads a global.
+ * Nothing here reads a global: the addressed world travels with the request.
  */
 import { EnvelopeError, parseClientRequest, serverError, serverResult, wireErrorOf, } from './envelope.js';
 import { stripLabelFromUrl } from './world-web-server.js';
@@ -55,19 +59,7 @@ async function readBody(req, limit) {
         carrier.on?.('error', (error) => reject(error instanceof Error ? error : new Error(String(error))));
     });
 }
-/** Reject an upgrade on the raw socket (no ws ownership transfer). */
-function rejectUpgrade(socket, status) {
-    const reason = status === 401 ? 'Unauthorized' : 'Forbidden';
-    const body = reason.toLowerCase();
-    const writable = socket;
-    writable.write?.(`HTTP/1.1 ${status} ${reason}\r\n`
-        + 'Connection: close\r\n'
-        + 'Content-Type: text/plain; charset=utf-8\r\n'
-        + `Content-Length: ${String(Buffer.byteLength(body, 'utf8'))}\r\n\r\n`
-        + body);
-    writable.destroy?.();
-}
-function writeJson(res, status, body) {
+export function writeJson(res, status, body) {
     const carrier = res;
     carrier.writeHead?.(status, { 'content-type': 'application/json' });
     res.end(body);
@@ -78,190 +70,144 @@ function writeText(res, status, body) {
     carrier.writeHead?.(status, { 'content-type': 'text/plain; charset=utf-8' });
     res.end(body);
 }
+const forwardsFetchMethod = (req) => {
+    const method = req.method;
+    return method === 'GET' || method === 'HEAD';
+};
 /**
- * Mount one world on the shared ctx0 webServer.
- * @param options - see {@link MountWorldOptions}.
- * @returns the live mount handle.
+ * Forward one non-envelope GET/HEAD request into the owning world's shared
+ * `/api` fetch handler (exact Fetch routes first, then the gateway's RPC
+ * interceptor, then 404 — the upstream composition). The caller has already
+ * answered the ctx0 fence by the time we get here; the world's own
+ * browser-auth gate is never consulted (a different tree, a different secret).
  */
-export function mountWorld(options) {
-    const labelPath = `/${options.label}`;
-    const apiPath = `${labelPath}/api`;
-    const muxPath = `${apiPath}/remote.mux`;
-    const maxBody = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
-    const disposers = [];
-    const forwardsFetchMethod = (req) => {
-        const method = req.method;
-        return method === 'GET' || method === 'HEAD';
+export async function forwardWorldFetch(options, req, res) {
+    const worldFetch = worldFetchHandlerOf(options.label);
+    if (worldFetch === undefined) {
+        writeText(res, 404, 'not found');
+        return;
+    }
+    const method = (req.method ?? 'GET');
+    const resCarrier = res;
+    // Client-disconnect detection rides the response (same reason as the
+    // upstream node:http bridge: the request 'close' fires as soon as a
+    // bodyless GET is consumed).
+    const abort = new AbortController();
+    const onClose = () => {
+        if (resCarrier.writableEnded !== true)
+            abort.abort();
     };
-    /**
-     * Forward one non-envelope GET/HEAD request into the owning world's shared
-     * `/api` fetch handler (exact Fetch routes first, then the gateway's RPC
-     * interceptor, then 404 — the upstream composition). The ctx0 fence has
-     * already answered by the time we get here; the world's own browser-auth
-     * gate is never consulted (a different tree, a different secret).
-     */
-    const bridgeWorldFetch = async (req, res) => {
-        const worldFetch = worldFetchHandlerOf(options.label);
-        if (worldFetch === undefined) {
-            writeText(res, 404, 'not found');
-            return;
+    resCarrier.once?.('close', onClose);
+    let headersSent = false;
+    try {
+        const headers = {};
+        for (const [name, value] of Object.entries(req.headers ?? {})) {
+            if (typeof value === 'string')
+                headers[name.toLowerCase()] = value;
         }
-        const method = (req.method ?? 'GET');
-        const resCarrier = res;
-        // Client-disconnect detection rides the response (same reason as the
-        // upstream node:http bridge: the request 'close' fires as soon as a
-        // bodyless GET is consumed).
-        const abort = new AbortController();
-        const onClose = () => {
-            if (resCarrier.writableEnded !== true)
-                abort.abort();
-        };
-        resCarrier.once?.('close', onClose);
-        let headersSent = false;
-        try {
-            const headers = {};
-            for (const [name, value] of Object.entries(req.headers ?? {})) {
-                if (typeof value === 'string')
-                    headers[name.toLowerCase()] = value;
-            }
-            // The world route owns the world-relative URL: strip the mount label,
-            // keep the query (the session-export route reads it from searchParams).
-            const request = new Request(new URL(stripLabelFromUrl(req.url, labelPath), 'http://dsh.internal'), { method, headers, signal: abort.signal });
-            const response = await worldFetch.fetch(request);
-            res.writeHead(response.status, Object.fromEntries(response.headers.entries()));
-            headersSent = true;
-            if (response.body === null) {
-                res.end();
-                return;
-            }
-            for await (const chunk of response.body) {
-                // Backpressure: wait for drain instead of buffering unboundedly; a
-                // socket close resolves the wait and the aborted signal ends the stream.
-                if (resCarrier.write?.(chunk) === false && typeof resCarrier.once === 'function') {
-                    await new Promise((resolve) => {
-                        const done = () => {
-                            resCarrier.off?.('drain', done);
-                            resCarrier.off?.('close', done);
-                            resolve();
-                        };
-                        resCarrier.once?.('drain', done);
-                        resCarrier.once?.('close', done);
-                    });
-                }
-            }
+        // The world route owns the world-relative URL: strip the mount prefix,
+        // keep the query (the session-export route reads it from searchParams).
+        const request = new Request(new URL(stripLabelFromUrl(req.url, options.mountPath), 'http://dsh.internal'), { method, headers, signal: abort.signal });
+        const response = await worldFetch.fetch(request);
+        res.writeHead(response.status, Object.fromEntries(response.headers.entries()));
+        headersSent = true;
+        if (response.body === null) {
             res.end();
-        }
-        catch {
-            // The world route owns its statuses; only carrier-level faults land here.
-            if (!headersSent)
-                writeText(res, 500, 'carrier fetch bridge failure');
-            else
-                resCarrier.destroy?.();
-        }
-        finally {
-            resCarrier.off?.('close', onClose);
-        }
-    };
-    const handleUnary = async (req, res) => {
-        const rejection = options.requestRejection?.(req);
-        if (rejection !== undefined) {
-            writeJson(res, rejection, JSON.stringify({ error: rejection === 401 ? 'unauthorized' : 'forbidden' }));
             return;
         }
-        let rpcId = 'invalid-request';
-        try {
-            const text = await readBody(req, maxBody);
-            let envelope;
-            try {
-                envelope = parseClientRequest(text);
-            }
-            catch (error) {
-                // Non-envelope GET/HEAD traffic on the shared mount prefix belongs to
-                // the world's own registered fetch routes; envelopes (and every other
-                // method) keep the transport-level 400 below.
-                if (error instanceof EnvelopeError && forwardsFetchMethod(req)) {
-                    await bridgeWorldFetch(req, res);
-                    return;
-                }
-                throw error;
+        for await (const chunk of response.body) {
+            // Backpressure: wait for drain instead of buffering unboundedly; a
+            // socket close resolves the wait and the aborted signal ends the stream.
+            if (resCarrier.write?.(chunk) === false && typeof resCarrier.once === 'function') {
+                await new Promise((resolve) => {
+                    const done = () => {
+                        resCarrier.off?.('drain', done);
+                        resCarrier.off?.('close', done);
+                        resolve();
+                    };
+                    resCarrier.once?.('drain', done);
+                    resCarrier.once?.('close', done);
+                });
             }
-            rpcId = envelope.rpcId;
-            const controller = new AbortController();
-            const result = await options.gateway.dispatchRpc(envelope.method, envelope.payload, controller.signal);
-            // The gateway already returns a Result (`{ok:true,value}` | `{ok:false,error}`),
-            // which is exactly the server-response's `result` field.
-            writeJson(res, 200, serverResult(rpcId, result));
+        }
+        res.end();
+    }
+    catch {
+        // The world route owns its statuses; only carrier-level faults land here.
+        if (!headersSent)
+            writeText(res, 500, 'carrier fetch bridge failure');
+        else
+            resCarrier.destroy?.();
+    }
+    finally {
+        resCarrier.off?.('close', onClose);
+    }
+}
+/**
+ * The reusable forwarding kernel (envelope dispatch + world fetch bridge):
+ * decode the connection envelope and dispatch into the ADDRESSED world's
+ * gateway instance; non-envelope GET/HEAD traffic forwards into the world's
+ * own registered fetch routes. Parameterized by (gateway, label, mountPath)
+ * so the `/hub` route family shares this exact behavior — the demux key is
+ * the caller's business, the wire semantics live here.
+ */
+export async function forwardApiCall(options, req, res) {
+    const maxBody = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+    const rejection = options.requestRejection?.(req);
+    if (rejection !== undefined) {
+        writeJson(res, rejection, JSON.stringify({ error: rejection === 401 ? 'unauthorized' : 'forbidden' }));
+        return;
+    }
+    let rpcId = 'invalid-request';
+    try {
+        const text = await readBody(req, maxBody);
+        let envelope;
+        try {
+            envelope = parseClientRequest(text);
         }
         catch (error) {
-            const wire = wireErrorOf(error);
-            // Envelope-level failures are transport-level 400s; dispatch failures are
-            // business results carried inside a 200 server-response (upstream shape).
-            if (error instanceof EnvelopeError) {
-                writeJson(res, 400, serverError(rpcId, wire));
+            // Non-envelope GET/HEAD traffic on the shared mount prefix belongs to
+            // the world's own registered fetch routes; envelopes (and every other
+            // method) keep the transport-level 400 below.
+            if (error instanceof EnvelopeError && forwardsFetchMethod(req)) {
+                await forwardWorldFetch(options, req, res);
                 return;
             }
-            writeJson(res, 200, serverError(rpcId, wire));
+            throw error;
         }
-    };
-    disposers.push(options.real.register({
-        kind: 'prefix',
-        path: apiPath,
-        handler: handleUnary,
-    }));
-    // The world page's open-in-app feature polls its host routes relative to the
-    // mount base (`/omp/open-in-app/apps`); those exact routes live on the
-    // WORLD's connection, so they bridge exactly like the non-envelope `/api`
-    // GETs — behind ctx0's fence, answered by the owning world.
-    const openInAppPath = `${labelPath}/open-in-app`;
-    disposers.push(options.real.register({
-        kind: 'prefix',
-        path: openInAppPath,
-        handler: (async (req, res) => {
-            const rejection = options.requestRejection?.(req);
-            if (rejection !== undefined) {
-                writeText(res, rejection, rejection === 401 ? 'unauthorized' : 'forbidden');
-                return;
-            }
-            await bridgeWorldFetch(req, res);
-        }),
-    }));
-    // Mux: the world's own stream face behind the same mount prefix. The wire
-    // protocol is dsh 0.1.7's stream protocol — including the client uplink —
-    // and the world call uses the gateway's canonical argument order
-    // (endpoint, payload, uplink, peer, signal, control): the mux's controller
-    // supplies both the request signal and the logical-stream control.
-    const mux = new WorldMuxServer((endpoint, payload, uplink, control) => Promise.resolve(options.gateway.openWireStream(endpoint, payload, uplink, undefined, control.signal, control)), {
-        ...(options.heartbeatIntervalMs === undefined ? {} : { heartbeatIntervalMs: options.heartbeatIntervalMs }),
-        ...(options.failure === undefined ? {} : { failure: options.failure }),
+        rpcId = envelope.rpcId;
+        const controller = new AbortController();
+        const result = await options.gateway.dispatchRpc(envelope.method, envelope.payload, controller.signal);
+        // The gateway already returns a Result (`{ok:true,value}` | `{ok:false,error}`),
+        // which is exactly the server-response's `result` field.
+        writeJson(res, 200, serverResult(rpcId, result));
+    }
+    catch (error) {
+        const wire = wireErrorOf(error);
+        // Envelope-level failures are transport-level 400s; dispatch failures are
+        // business results carried inside a 200 server-response (upstream shape).
+        if (error instanceof EnvelopeError) {
+            writeJson(res, 400, serverError(rpcId, wire));
+            return;
+        }
+        writeJson(res, 200, serverError(rpcId, wire));
+    }
+}
+/** One WorldMuxServer bound to `gateway` — the canonical openWireStream wiring in one place. */
+export function worldMuxOf(gateway, options) {
+    return new WorldMuxServer((endpoint, payload, uplink, control) => Promise.resolve(gateway.openWireStream(endpoint, payload, uplink, undefined, control.signal, control)), {
+        ...(options?.heartbeatIntervalMs === undefined ? {} : { heartbeatIntervalMs: options.heartbeatIntervalMs }),
+        ...(options?.failure === undefined ? {} : { failure: options.failure }),
     });
-    disposers.push(options.real.registerUpgrade({
-        path: muxPath,
-        handler: ((req, socket, head) => {
-            const rejection = options.requestRejection?.(req);
-            if (rejection !== undefined) {
-                rejectUpgrade(socket, rejection === 401 ? 401 : 403);
-                return;
-            }
-            return mux.handleUpgrade(req, socket, head);
-        }),
-    }));
-    disposers.push(() => { void mux.close().catch(() => undefined); });
-    return {
-        labelPath,
-        apiPath,
-        muxPath,
-        dispose() {
-            for (const dispose of disposers.splice(0).reverse()) {
-                try {
-                    dispose();
-                }
-                catch {
-                    // teardown must not throw
-                }
-            }
-        },
-    };
 }
-// The mount HTML pass lives in its own module; re-exported here so the carrier
-// remains the single import surface for mount behaviour.
-export { rewriteIndexHtml } from './index-pass.js';
+/**
+ * RETIRED with T-D (2026-09-26): the T-C `mountWorld` no-op — which itself
+ * used to register `/<label>/api`, `/<label>/open-in-app` and
+ * `/<label>/api/remote.mux` on the real webServer — is GONE from the module.
+ * The adapter world-plugins' spawn-time call sites were updated in the same
+ * round (the registerHostMount record needs no webServer and no fence; the
+ * `/hub` family reaches each world's gateway through the foreign-target
+ * table). Git history keeps the function.
+ */
+// The carrier is now purely the forwarding kernel: no mount-time HTML pass,
+// no per-label registration — `/hub` (hub-route.ts) is the sole consumer.